openhacker 0.1.1 → 0.1.3

package/README.md

@@ -5,9 +5,8 @@ Scaffold a self-hosted OpenHacker security agent.
 ## Create an instance
 
 ```bash
-npx openhacker my-instance
-cd my-instance
-pnpm install
+npx openhacker
+cd openhacker
 pnpm dev
 ```
 

package/bin/openhacker

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { run } from "../src/cli.js";
+import { run } from "../src/index.js";
 
 await run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openhacker",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Scaffold a self-hosted OpenHacker security agent",
   "license": "UNLICENSED",
   "type": "module",
@@ -11,7 +11,7 @@
     ".": "./src/index.js"
   },
   "main": "./src/index.js",
-  "types": "./src/index.ts",
+  "types": "./src/index.d.ts",
   "files": [
     "bin",
     "scripts",
@@ -26,7 +26,7 @@
     "typescript": "6.0.2"
   },
   "scripts": {
-    "build": "tsc --noEmit && node --check ./bin/openhacker && node --check ./src/cli.js && node --check ./scripts/sync-template.js && node --check ./scripts/clean-template.js",
+    "build": "tsc --noEmit && node --check ./bin/openhacker && node --check ./src/index.js && node --check ./scripts/sync-template.js && node --check ./scripts/clean-template.js",
     "sync-template": "node ./scripts/sync-template.js"
   }
 }

package/src/index.d.ts

@@ -0,0 +1 @@
+export function run(args?: string[]): Promise<void>;

package/src/index.js

@@ -1 +1,305 @@
-export const MESSAGE = "OpenHacker";
+import { spawnSync } from "node:child_process";
+import { cp, readFile, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ORANGE = "\x1b[38;5;214m";
+const MUTED = "\x1b[0;2m";
+const RED = "\x1b[0;31m";
+const NC = "\x1b[0m";
+
+const EXCLUDE = new Set([
+  ".env",
+  ".env.local",
+  "node_modules",
+  ".eve",
+  ".next",
+  ".output",
+  ".git",
+  ".vercel",
+  ".turbo",
+]);
+
+// Written into scaffolded projects directly rather than shipped as a template
+// file, because npm renames a packaged `.gitignore` to `.npmignore` on publish.
+const GITIGNORE = `# dependencies
+node_modules
+
+# next.js
+.next
+next-env.d.ts
+
+# eve build artifacts
+.eve
+.output
+
+# vercel / turbo
+.vercel
+.turbo
+
+# typescript
+tsconfig.tsbuildinfo
+
+# env files (keep the example)
+.env
+.env.*
+!.env.example
+
+# misc
+.DS_Store
+*.log
+`;
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+async function exists(p) {
+  try {
+    await stat(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function resolveTemplateDir() {
+  const candidates = [];
+
+  if (process.env.OPENHACKER_TEMPLATE_DIR) {
+    candidates.push(path.resolve(process.env.OPENHACKER_TEMPLATE_DIR));
+  }
+
+  candidates.push(
+    // npm package layout: packages/openhacker/src -> packages/openhacker/templates/agent
+    path.resolve(here, "../templates/agent"),
+    // monorepo layout: packages/openhacker/src -> repo root -> apps/agent
+    path.resolve(here, "../../../apps/agent"),
+  );
+
+  for (const candidate of candidates) {
+    if (await exists(path.join(candidate, "agent", "agent.ts"))) {
+      return candidate;
+    }
+  }
+
+  return candidates[0];
+}
+
+function packageNameFor(dest) {
+  return (
+    path
+      .basename(dest)
+      .replace(/[^a-z0-9-]+/gi, "-")
+      .toLowerCase() || "openhacker"
+  );
+}
+
+function shouldCopyTemplatePath(src, root) {
+  const relative = path.relative(root, src);
+  const segments = relative.split(path.sep);
+
+  return (
+    !segments.some((seg) => EXCLUDE.has(seg)) &&
+    !relative.endsWith("next-env.d.ts") &&
+    !relative.endsWith("tsconfig.tsbuildinfo")
+  );
+}
+
+function runStep(command, args, cwd, { quiet = false } = {}) {
+  const result = spawnSync(command, args, {
+    cwd,
+    stdio: quiet ? "ignore" : "inherit",
+    shell: process.platform === "win32",
+  });
+
+  return !result.error && result.status === 0;
+}
+
+function hasCommand(command) {
+  const probe = process.platform === "win32" ? "where" : "which";
+  const result = spawnSync(probe, [command], {
+    stdio: "ignore",
+    shell: process.platform === "win32",
+  });
+  return !result.error && result.status === 0;
+}
+
+function isInsideGitRepo(cwd) {
+  const result = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+    cwd,
+    stdio: "ignore",
+    shell: process.platform === "win32",
+  });
+  return !result.error && result.status === 0;
+}
+
+async function installDependencies(dest) {
+  if (!hasCommand("pnpm")) {
+    console.log(
+      `${MUTED}pnpm not found — skipping install. Run \`pnpm install\` manually.${NC}`,
+    );
+    return false;
+  }
+
+  console.log(`\n${MUTED}Installing dependencies with pnpm…${NC}`);
+  // --ignore-workspace keeps the install self-contained: without it, pnpm walks
+  // up to a parent pnpm-workspace.yaml (e.g. when scaffolding inside a monorepo)
+  // and installs that workspace instead of the new project's node_modules.
+  const ok = runStep("pnpm", ["install", "--ignore-workspace"], dest);
+  if (!ok) {
+    console.log(
+      `${RED}pnpm install failed.${NC} ${MUTED}You can re-run it inside the project.${NC}`,
+    );
+  }
+  return ok;
+}
+
+async function initGitRepo(dest) {
+  if (!hasCommand("git")) {
+    console.log(`${MUTED}git not found — skipping repository init.${NC}`);
+    return false;
+  }
+
+  if (isInsideGitRepo(dest)) {
+    console.log(
+      `${MUTED}Already inside a git repository — skipping git init.${NC}`,
+    );
+    return false;
+  }
+
+  const initialized =
+    runStep("git", ["init"], dest, { quiet: true }) &&
+    runStep("git", ["add", "-A"], dest, { quiet: true }) &&
+    runStep("git", ["commit", "-m", "Initial commit from OpenHacker"], dest, {
+      quiet: true,
+    });
+
+  if (initialized) {
+    console.log(`${MUTED}Initialized a git repository.${NC}`);
+  } else {
+    console.log(
+      `${MUTED}Could not create the initial git commit — you can do it manually.${NC}`,
+    );
+  }
+  return initialized;
+}
+
+async function init(targetArg, { skipInstall = false, skipGit = false } = {}) {
+  const template = await resolveTemplateDir();
+  if (!(await exists(path.join(template, "agent", "agent.ts")))) {
+    console.error(
+      `${RED}Could not find the instance template at ${template}.${NC}`,
+    );
+    console.error(
+      `${MUTED}Set OPENHACKER_TEMPLATE_DIR to the template directory.${NC}`,
+    );
+    process.exit(1);
+  }
+
+  const dest = path.resolve(process.cwd(), targetArg ?? "openhacker");
+  if (await exists(dest)) {
+    console.error(`${RED}Destination already exists: ${dest}${NC}`);
+    process.exit(1);
+  }
+
+  console.log(`\n${MUTED}Creating OpenHacker instance in ${NC}${dest}`);
+  await cp(template, dest, {
+    recursive: true,
+    filter: (src) => shouldCopyTemplatePath(src, template),
+  });
+
+  const pkgPath = path.join(dest, "package.json");
+  const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
+  pkg.name = packageNameFor(dest);
+  pkg.private = true;
+  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+
+  // Write before git init so the initial commit doesn't include node_modules/.env.
+  if (!(await exists(path.join(dest, ".gitignore")))) {
+    await writeFile(path.join(dest, ".gitignore"), GITIGNORE);
+  }
+
+  const installed = skipInstall ? false : await installDependencies(dest);
+  if (!skipGit) {
+    await initGitRepo(dest);
+  }
+
+  console.log(`\n${ORANGE}✓${NC} OpenHacker instance ready.\n`);
+  console.log("Next steps:\n");
+  console.log(`  cd ${path.relative(process.cwd(), dest) || "."}`);
+  if (skipInstall || !installed) {
+    console.log("  pnpm install");
+  }
+  console.log("  pnpm dlx vercel link    # link a Vercel project for AI/LLM access");
+  console.log("  pnpm dev                 # run locally\n");
+  console.log(
+    `${MUTED}Deploy: push to a git repo and import it into Vercel (deploys as one project).`,
+  );
+  console.log(`${MUTED}See README.md for local model configuration.${NC}\n`);
+}
+
+function usage() {
+  console.log("OpenHacker\n");
+  console.log("Usage:");
+  console.log(
+    "  openhacker [dir]        Scaffold a deployable OpenHacker instance",
+  );
+  console.log("  openhacker init [dir]   Same as above");
+  console.log("  openhacker --help       Show help");
+  console.log("  openhacker --version    Show version\n");
+  console.log("Options:");
+  console.log("  --skip-install          Don't run pnpm install");
+  console.log("  --skip-git              Don't create a git repository\n");
+}
+
+async function version() {
+  const pkg = JSON.parse(
+    await readFile(path.resolve(here, "../package.json"), "utf8"),
+  );
+  console.log(pkg.version);
+}
+
+export async function run(args = process.argv.slice(2)) {
+  const options = { skipInstall: false, skipGit: false };
+  const positionals = [];
+
+  for (const arg of args) {
+    switch (arg) {
+      case "--skip-install":
+        options.skipInstall = true;
+        break;
+      case "--skip-git":
+        options.skipGit = true;
+        break;
+      case "-h":
+      case "--help":
+        usage();
+        return;
+      case "-v":
+      case "--version":
+        await version();
+        return;
+      default:
+        if (arg.startsWith("-")) {
+          console.error(`${RED}Unknown option: ${arg}${NC}\n`);
+          usage();
+          process.exit(1);
+        }
+        positionals.push(arg);
+    }
+  }
+
+  const [command, target, ...rest] = positionals;
+
+  if (rest.length > 0) {
+    console.error(`${RED}Too many arguments.${NC}\n`);
+    usage();
+    process.exit(1);
+  }
+
+  if (command === "init") {
+    await init(target, options);
+    return;
+  }
+
+  await init(command, options);
+}

package/templates/agent/agent/instructions.md

@@ -4,7 +4,6 @@ You are OpenHacker, an application security agent.
 
 The user gives you a GitHub repository (as `owner/name` or a github.com URL). Analyze it for security vulnerabilities and report your findings.
 
-- Briefly narrate what you are checking as you go (dependencies, auth, input handling, secrets, etc.).
 - Use the shell to clone and explore the repo. Use `ls`/`find` to list directories; only use `read_file` on actual file paths, never on a directory.
 - Call out concrete risks with severity and, where possible, how to fix them.
 - If you cannot access the repository, say so plainly.

package/templates/agent/app/globals.css

@@ -95,13 +95,35 @@ h1 span {
   margin-bottom: 0;
 }
 .reply .reasoning {
-  white-space: pre-wrap;
-  color: var(--muted);
-  font-size: 13px;
   margin: 0 0 12px;
   padding-left: 12px;
   border-left: 2px solid var(--border);
 }
+.reply .reasoning > summary {
+  cursor: pointer;
+  color: var(--muted);
+  font-size: 12px;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  list-style: none;
+  user-select: none;
+}
+.reply .reasoning > summary::-webkit-details-marker {
+  display: none;
+}
+.reply .reasoning > summary::before {
+  content: "› ";
+  display: inline-block;
+}
+.reply .reasoning[open] > summary::before {
+  content: "⌄ ";
+}
+.reply .reasoning > p {
+  white-space: pre-wrap;
+  color: var(--muted);
+  font-size: 13px;
+  margin: 8px 0 0;
+}
 
 .tool {
   display: flex;
@@ -123,6 +145,33 @@ h1 span {
   padding: 0 8px;
 }
 
+.hacking {
+  color: var(--muted);
+  font-size: 13px;
+  margin: 0;
+}
+.reply .text + .hacking {
+  margin-top: 12px;
+}
+.dots::after {
+  content: "";
+  animation: dots 1.2s steps(4, end) infinite;
+}
+@keyframes dots {
+  0% {
+    content: "";
+  }
+  25% {
+    content: ".";
+  }
+  50% {
+    content: "..";
+  }
+  75% {
+    content: "...";
+  }
+}
+
 .cursor {
   display: inline-block;
   width: 8px;

package/templates/agent/app/page.tsx

@@ -15,7 +15,7 @@ export default function Home() {
     if (!value || busy) return;
     agent.reset();
     agent.send({
-      message: `Analyze the GitHub repository "${value}" for security vulnerabilities. Walk through what you check and report what you find.`,
+      message: `Analyze the GitHub repository "${value}" for security vulnerabilities. Reply with only the final report.`,
     });
   }
 
@@ -23,6 +23,20 @@ export default function Home() {
     .reverse()
     .find((m) => m.role === "assistant");
 
+  const parts = reply?.parts ?? [];
+  const lastStep = parts.reduce<number | undefined>((max, p) => {
+    const idx = "stepIndex" in p ? p.stepIndex : undefined;
+    if (typeof idx !== "number") return max;
+    return max === undefined ? idx : Math.max(max, idx);
+  }, undefined);
+
+  let result = "";
+  for (const p of parts) {
+    if (p.type !== "text") continue;
+    if (lastStep !== undefined && p.stepIndex !== lastStep) continue;
+    result += p.text;
+  }
+
   return (
     <main className="container">
       <h1>
@@ -45,41 +59,16 @@ export default function Home() {
         </button>
       </form>
 
-      {reply ? (
+      {reply || busy ? (
         <section className="reply">
-          {reply.parts.map((part, i) => {
-            if (part.type === "reasoning") {
-              return (
-                <p key={i} className="reasoning">
-                  {part.text}
-                </p>
-              );
-            }
-            if (part.type === "text") {
-              return (
-                <p key={i} className="text">
-                  {part.text}
-                </p>
-              );
-            }
-            if (part.type === "dynamic-tool") {
-              return (
-                <div key={i} className="tool">
-                  <span className="tool-name">{part.toolName}</span>
-                  <span className="tool-state">{part.state}</span>
-                </div>
-              );
-            }
-            return null;
-          })}
-          {agent.status === "streaming" ? (
-            <span className="cursor" aria-hidden />
+          {result ? <p className="text">{result}</p> : null}
+          {busy && !result ? (
+            <p className="hacking">
+              hacking
+              <span className="dots" aria-hidden />
+            </p>
           ) : null}
         </section>
-      ) : busy ? (
-        <section className="reply">
-          <span className="cursor" aria-hidden />
-        </section>
       ) : null}
 
       {agent.status === "error" ? (

package/src/cli.js

@@ -1,276 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { cp, readFile, stat, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ORANGE = "\x1b[38;5;214m";
-const MUTED = "\x1b[0;2m";
-const RED = "\x1b[0;31m";
-const NC = "\x1b[0m";
-
-const EXCLUDE = new Set([
-  ".env",
-  ".env.local",
-  "node_modules",
-  ".eve",
-  ".next",
-  ".output",
-  ".git",
-  ".vercel",
-  ".turbo",
-]);
-
-// Written into scaffolded projects directly rather than shipped as a template
-// file, because npm renames a packaged `.gitignore` to `.npmignore` on publish.
-const GITIGNORE = `# dependencies
-node_modules
-
-# next.js
-.next
-next-env.d.ts
-
-# eve build artifacts
-.eve
-.output
-
-# vercel / turbo
-.vercel
-.turbo
-
-# typescript
-tsconfig.tsbuildinfo
-
-# env files (keep the example)
-.env
-.env.*
-!.env.example
-
-# misc
-.DS_Store
-*.log
-`;
-
-const here = path.dirname(fileURLToPath(import.meta.url));
-
-async function exists(p) {
-  try {
-    await stat(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function resolveTemplateDir() {
-  const candidates = [];
-
-  if (process.env.OPENHACKER_TEMPLATE_DIR) {
-    candidates.push(path.resolve(process.env.OPENHACKER_TEMPLATE_DIR));
-  }
-
-  candidates.push(
-    // npm package layout: packages/openhacker/src -> packages/openhacker/templates/agent
-    path.resolve(here, "../templates/agent"),
-    // monorepo layout: packages/openhacker/src -> repo root -> apps/agent
-    path.resolve(here, "../../../apps/agent"),
-  );
-
-  for (const candidate of candidates) {
-    if (await exists(path.join(candidate, "agent", "agent.ts"))) {
-      return candidate;
-    }
-  }
-
-  return candidates[0];
-}
-
-function packageNameFor(dest) {
-  return path.basename(dest).replace(/[^a-z0-9-]+/gi, "-").toLowerCase() || "openhacker";
-}
-
-function shouldCopyTemplatePath(src, root) {
-  const relative = path.relative(root, src);
-  const segments = relative.split(path.sep);
-
-  return (
-    !segments.some((seg) => EXCLUDE.has(seg)) &&
-    !relative.endsWith("next-env.d.ts") &&
-    !relative.endsWith("tsconfig.tsbuildinfo")
-  );
-}
-
-function runStep(command, args, cwd, { quiet = false } = {}) {
-  const result = spawnSync(command, args, {
-    cwd,
-    stdio: quiet ? "ignore" : "inherit",
-    shell: process.platform === "win32",
-  });
-
-  return !result.error && result.status === 0;
-}
-
-function hasCommand(command) {
-  const probe = process.platform === "win32" ? "where" : "which";
-  const result = spawnSync(probe, [command], { stdio: "ignore", shell: process.platform === "win32" });
-  return !result.error && result.status === 0;
-}
-
-function isInsideGitRepo(cwd) {
-  const result = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
-    cwd,
-    stdio: "ignore",
-    shell: process.platform === "win32",
-  });
-  return !result.error && result.status === 0;
-}
-
-async function installDependencies(dest) {
-  if (!hasCommand("pnpm")) {
-    console.log(`${MUTED}pnpm not found \u2014 skipping install. Run \`pnpm install\` manually.${NC}`);
-    return false;
-  }
-
-  console.log(`\n${MUTED}Installing dependencies with pnpm\u2026${NC}`);
-  // --ignore-workspace keeps the install self-contained: without it, pnpm walks
-  // up to a parent pnpm-workspace.yaml (e.g. when scaffolding inside a monorepo)
-  // and installs that workspace instead of the new project's node_modules.
-  const ok = runStep("pnpm", ["install", "--ignore-workspace"], dest);
-  if (!ok) {
-    console.log(`${RED}pnpm install failed.${NC} ${MUTED}You can re-run it inside the project.${NC}`);
-  }
-  return ok;
-}
-
-async function initGitRepo(dest) {
-  if (!hasCommand("git")) {
-    console.log(`${MUTED}git not found \u2014 skipping repository init.${NC}`);
-    return false;
-  }
-
-  if (isInsideGitRepo(dest)) {
-    console.log(`${MUTED}Already inside a git repository \u2014 skipping git init.${NC}`);
-    return false;
-  }
-
-  const initialized =
-    runStep("git", ["init"], dest, { quiet: true }) &&
-    runStep("git", ["add", "-A"], dest, { quiet: true }) &&
-    runStep("git", ["commit", "-m", "Initial commit from OpenHacker"], dest, { quiet: true });
-
-  if (initialized) {
-    console.log(`${MUTED}Initialized a git repository.${NC}`);
-  } else {
-    console.log(`${MUTED}Could not create the initial git commit \u2014 you can do it manually.${NC}`);
-  }
-  return initialized;
-}
-
-async function init(targetArg, { skipInstall = false, skipGit = false } = {}) {
-  const template = await resolveTemplateDir();
-  if (!(await exists(path.join(template, "agent", "agent.ts")))) {
-    console.error(`${RED}Could not find the instance template at ${template}.${NC}`);
-    console.error(`${MUTED}Set OPENHACKER_TEMPLATE_DIR to the template directory.${NC}`);
-    process.exit(1);
-  }
-
-  const dest = path.resolve(process.cwd(), targetArg ?? "openhacker");
-  if (await exists(dest)) {
-    console.error(`${RED}Destination already exists: ${dest}${NC}`);
-    process.exit(1);
-  }
-
-  console.log(`\n${MUTED}Creating OpenHacker instance in ${NC}${dest}`);
-  await cp(template, dest, {
-    recursive: true,
-    filter: (src) => shouldCopyTemplatePath(src, template),
-  });
-
-  const pkgPath = path.join(dest, "package.json");
-  const pkg = JSON.parse(await readFile(pkgPath, "utf8"));
-  pkg.name = packageNameFor(dest);
-  pkg.private = true;
-  await writeFile(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
-
-  // Write before git init so the initial commit doesn't include node_modules/.env.
-  if (!(await exists(path.join(dest, ".gitignore")))) {
-    await writeFile(path.join(dest, ".gitignore"), GITIGNORE);
-  }
-
-  const installed = skipInstall ? false : await installDependencies(dest);
-  if (!skipGit) {
-    await initGitRepo(dest);
-  }
-
-  console.log(`\n${ORANGE}\u2713${NC} OpenHacker instance ready.\n`);
-  console.log("Next steps:\n");
-  console.log(`  cd ${path.relative(process.cwd(), dest) || "."}`);
-  if (skipInstall || !installed) {
-    console.log("  pnpm install");
-  }
-  console.log("  pnpm dev                 # run locally\n");
-  console.log(`${MUTED}Deploy: push to a git repo and import it into Vercel (deploys as one project).`);
-  console.log(`Add a Vercel KV / Upstash Redis integration to persist findings. See README.md.${NC}\n`);
-}
-
-function usage() {
-  console.log("OpenHacker\n");
-  console.log("Usage:");
-  console.log("  openhacker [dir]        Scaffold a deployable OpenHacker instance");
-  console.log("  openhacker init [dir]   Same as above");
-  console.log("  openhacker --help       Show help");
-  console.log("  openhacker --version    Show version\n");
-  console.log("Options:");
-  console.log("  --skip-install          Don't run pnpm install");
-  console.log("  --skip-git              Don't create a git repository\n");
-}
-
-async function version() {
-  const pkg = JSON.parse(await readFile(path.resolve(here, "../package.json"), "utf8"));
-  console.log(pkg.version);
-}
-
-export async function run(args = process.argv.slice(2)) {
-  const options = { skipInstall: false, skipGit: false };
-  const positionals = [];
-
-  for (const arg of args) {
-    switch (arg) {
-      case "--skip-install":
-        options.skipInstall = true;
-        break;
-      case "--skip-git":
-        options.skipGit = true;
-        break;
-      case "-h":
-      case "--help":
-        usage();
-        return;
-      case "-v":
-      case "--version":
-        await version();
-        return;
-      default:
-        if (arg.startsWith("-")) {
-          console.error(`${RED}Unknown option: ${arg}${NC}\n`);
-          usage();
-          process.exit(1);
-        }
-        positionals.push(arg);
-    }
-  }
-
-  const [command, target, ...rest] = positionals;
-
-  if (rest.length > 0) {
-    console.error(`${RED}Too many arguments.${NC}\n`);
-    usage();
-    process.exit(1);
-  }
-
-  if (command === "init") {
-    await init(target, options);
-    return;
-  }
-
-  await init(command, options);
-}

package/src/index.ts

@@ -1 +0,0 @@
-export const MESSAGE = "OpenHacker";