opmsec 0.1.52 → 0.1.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opmsec",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "private": false,
   "bin": {
     "opm": "packages/cli/src/index.tsx"
@@ -23,18 +23,19 @@
     "chalk": "^5.4.0",
     "ethers": "^6.13.0",
     "ink": "^5.2.1",
-    "react": "^18.3.1",
-    "react-devtools-core": "^7.0.1",
-    "terminal-image": "^4.2.0",
-    "viem": "^2.47.4"
+    "react": "18.3.1",
+    "react-devtools-core": "6.0.1",
+    "terminal-image": "3.1.1",
+    "viem": "2.21.0"
   },
   "devDependencies": {
-    "bun-types": "latest"
+    "bun-types": "latest",
+    "react-server-dom-parcel": "19.1.5"
   },
   "opm": {
-    "signature": "0xa1c1b29e1b878ba3cee4cd14d75e79e5a7e683bbd57ef7cc2917c2693f2310400aaae5dccfb655498cb26e2e6ced586fd3d987ca484f82b8721e480836e88fa61b",
+    "signature": "0xf4f66329d698148bffd4693ec17c1b79288a626e2b933f899364f6dbd8f9318d10588c1cd8b34a2b91882345da8b91db4cdbe7ed643ef67e8bd8cbce98ccf95f1b",
     "author": "0x2a3942EbDd8c5ea3E66D3fC4301F56d0F15d4bE2",
     "ensName": "djpaiethg.eth",
-    "checksum": "0x0ce8eaad637d74e4172c3b9de6af85ec600bb0726dd53bc3d1520615542daa64"
+    "checksum": "0x1d8c7331a20b9b3541e95af0a90f6ce99b2278b8afd1b57a310bca1f664a1302"
   }
 }

package/packages/cli/src/commands/check.tsx

@@ -10,6 +10,7 @@ import { resolveAndScanDepGraph } from '../services/dep-graph';
 import { queryOSV, getOSVSeverity, getFixedVersion } from '../services/osv';
 import { getPackageInfo } from '../services/contract';
 import { detectTyposquatBatch } from '../services/typosquat';
+import { isENSVersion, resolveVersion } from '../services/version';
 import { callLLMRaw, getAgentConfigs, uploadCheckReportToFileverse } from '@opm/scanner';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -20,6 +21,8 @@ export function CheckCommand() {
   const [phase, setPhase] = useState<Phase>('graph');
   const [graphStatus, setGraphStatus] = useState('Resolving...');
   const [graph, setGraph] = useState<DepGraphResult | null>(null);
+  const [scanDetail, setScanDetail] = useState('');
+  const [agentLogs, setAgentLogs] = useState<string[]>([]);
   const [report, setReport] = useState<CheckReport | null>(null);
   const [reportLink, setReportLink] = useState<string | null>(null);
   const [uploadError, setUploadError] = useState<string | null>(null);
@@ -47,10 +50,32 @@ export function CheckCommand() {
     }
 
     setPhase('scanning');
-    const allEntries = [
-      ...deps.map(([n, v]) => ({ n, v: clean(v) })),
-      ...devDeps.map(([n, v]) => ({ n, v: clean(v) })),
+    const rawEntries = [
+      ...deps.map(([n, v]) => ({ n, v: String(v) })),
+      ...devDeps.map(([n, v]) => ({ n, v: String(v) })),
     ];
+
+    const ensEntries = rawEntries.filter(e => isENSVersion(e.v));
+    if (ensEntries.length > 0) {
+      setScanDetail(`Resolving ${ensEntries.length} ENS version(s)...`);
+    }
+
+    const allEntries: { n: string; v: string }[] = [];
+    for (const entry of rawEntries) {
+      if (isENSVersion(entry.v)) {
+        try {
+          setScanDetail(`ENS: ${entry.v} → ${entry.n}...`);
+          const resolved = await resolveVersion(entry.n, entry.v);
+          allEntries.push({ n: entry.n, v: resolved.version });
+        } catch {
+          allEntries.push({ n: entry.n, v: clean(entry.v) });
+        }
+      } else {
+        allEntries.push({ n: entry.n, v: clean(entry.v) });
+      }
+    }
+
+    setScanDetail('Batch querying typosquats + CVEs + on-chain...');
     const allNames = allEntries.map((e) => e.n);
 
     const [typosquatResults, ...parallelResults] = await Promise.all([
@@ -98,18 +123,21 @@ export function CheckCommand() {
     let agentResults: CheckAgentResult[] = [];
     try {
       const configs = getAgentConfigs();
+      setAgentLogs([`Dispatching ${configs.length} agents...`]);
       const depE: DepEntry[] = deps.map(([n, v]) => ({ name: n, version: clean(v) }));
       const devE: DepEntry[] = devDeps.map(([n, v]) => ({ name: n, version: clean(v) }));
       const prompt = buildCheckPrompt(depE, devE);
 
       const runs = await Promise.allSettled(
         configs.map(async (cfg) => {
+          setAgentLogs(prev => [...prev, `[${cfg.agentId}] Calling ${cfg.model}...`]);
           const { intelligence, coding } = await getModelRankingFor(cfg.model);
           const res = await callLLMRaw<{
             findings: CheckAgentResult['findings'];
             overall_assessment: string;
             risk_score: number;
           }>(cfg.model, CHECK_SYSTEM_PROMPT, prompt);
+          setAgentLogs(prev => [...prev, `[${cfg.agentId}] ✓ ${(res.findings || []).length} findings (score: ${res.risk_score || 0})`]);
           return {
             agentId: cfg.agentId, model: cfg.model,
             intelligence, coding,
@@ -122,6 +150,13 @@ export function CheckCommand() {
       agentResults = runs.filter((r): r is PromiseFulfilledResult<CheckAgentResult> =>
         r.status === 'fulfilled',
       ).map((r) => r.value);
+
+      for (const r of runs) {
+        if (r.status === 'rejected') {
+          const msg = String(r.reason?.message || r.reason).slice(0, 80);
+          setAgentLogs(prev => [...prev, `Agent failed: ${msg}`]);
+        }
+      }
     } catch { /* no LLM keys — skip */ }
 
     const checkReport: CheckReport = {
@@ -174,13 +209,21 @@ export function CheckCommand() {
       {phase !== 'graph' && (
         <StatusLine label={`Scanning ${report?.totalDeps || '...'} direct dependencies`}
           status={phase === 'scanning' ? 'running' : 'done'}
-          detail={phase === 'scanning' ? 'typosquats + CVEs + on-chain' : `${report?.totalDeps} checked`} />
+          detail={phase === 'scanning' ? scanDetail : `${report?.totalDeps} checked`} />
       )}
 
       {phase !== 'graph' && phase !== 'scanning' && (
         <StatusLine label="AI agents analyzing dependency tree"
           status={phase === 'agents' ? 'running' : 'done'}
-          detail={report?.agents.length ? `${report.agents.length} agents` : undefined} />
+          detail={phase === 'agents' && agentLogs.length > 0 ? agentLogs[agentLogs.length - 1] : report?.agents.length ? `${report.agents.length} agents` : undefined} />
+      )}
+
+      {phase === 'agents' && agentLogs.length > 0 && (
+        <Box flexDirection="column" marginLeft={4}>
+          {agentLogs.slice(-5).map((log, i) => (
+            <Text key={i} color="gray">{log}</Text>
+          ))}
+        </Box>
       )}
 
       {process.env.FILEVERSE_API_KEY && (phase === 'upload' || phase === 'done') && (

package/packages/cli/src/commands/fix.tsx

@@ -7,6 +7,7 @@ import { StatusLine } from '../components/StatusLine';
 import { Hyperlink } from '../components/Hyperlink';
 import { queryOSV, getOSVSeverity, getFixedVersion } from '../services/osv';
 import { detectTyposquatBatch } from '../services/typosquat';
+import { isENSVersion, resolveVersion } from '../services/version';
 import { callLLMRaw, getAgentConfigs, uploadCheckReportToFileverse } from '@opm/scanner';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -20,12 +21,16 @@ interface FixAction {
   reason: string;
 }
 
-type Phase = 'scan' | 'agents' | 'apply' | 'upload' | 'done';
+type Phase = 'ens' | 'scan' | 'agents' | 'apply' | 'upload' | 'done';
 
 export function FixCommand() {
-  const [phase, setPhase] = useState<Phase>('scan');
+  const [phase, setPhase] = useState<Phase>('ens');
   const [fixes, setFixes] = useState<FixAction[]>([]);
   const [total, setTotal] = useState(0);
+  const [ensCount, setEnsCount] = useState(0);
+  const [ensResolved, setEnsResolved] = useState(0);
+  const [scanDetail, setScanDetail] = useState('');
+  const [agentLogs, setAgentLogs] = useState<string[]>([]);
   const [applied, setApplied] = useState(false);
   const [reportLink, setReportLink] = useState<string | null>(null);
   const [uploadError, setUploadError] = useState<string | null>(null);
@@ -44,18 +49,41 @@ export function FixCommand() {
     const projectName = pkgJson.name || path.basename(process.cwd());
     const deps = Object.entries(pkgJson.dependencies || {}) as [string, string][];
     const devDeps = Object.entries(pkgJson.devDependencies || {}) as [string, string][];
-    const allEntries = [
-      ...deps.map(([n, v]) => ({ n, v: clean(v) })),
-      ...devDeps.map(([n, v]) => ({ n, v: clean(v) })),
+    const rawEntries = [
+      ...deps.map(([n, v]) => ({ n, v: String(v) })),
+      ...devDeps.map(([n, v]) => ({ n, v: String(v) })),
     ];
-    setTotal(allEntries.length);
+    setTotal(rawEntries.length);
+
+    const ensEntries = rawEntries.filter(e => isENSVersion(e.v));
+    setEnsCount(ensEntries.length);
+
+    const allEntries: { n: string; v: string; ensResolved?: string }[] = [];
+    for (const entry of rawEntries) {
+      if (isENSVersion(entry.v)) {
+        try {
+          setScanDetail(`Resolving ${entry.v} for ${entry.n}...`);
+          const resolved = await resolveVersion(entry.n, entry.v);
+          allEntries.push({ n: entry.n, v: resolved.version, ensResolved: entry.v });
+          setEnsResolved(c => c + 1);
+        } catch {
+          allEntries.push({ n: entry.n, v: clean(entry.v) });
+          setEnsResolved(c => c + 1);
+        }
+      } else {
+        allEntries.push({ n: entry.n, v: clean(entry.v) });
+      }
+    }
 
+    setPhase('scan');
+    setScanDetail('Batch querying typosquats + CVEs...');
     const allNames = allEntries.map((e) => e.n);
     const [typosquatResults, ...parallelResults] = await Promise.all([
       detectTyposquatBatch(allNames),
       ...allEntries.map(({ n, v }) => queryOSV(n, v).catch(() => [])),
     ]);
 
+    setScanDetail('Analyzing results...');
     const actions: FixAction[] = [];
     const depResults: CheckDepResult[] = [];
 
@@ -107,18 +135,21 @@ export function FixCommand() {
     let agentResults: CheckAgentResult[] = [];
     try {
       const configs = getAgentConfigs();
+      setAgentLogs([`Dispatching ${configs.length} agents...`]);
       const depE: DepEntry[] = deps.map(([n, v]) => ({ name: n, version: clean(v) }));
       const devE: DepEntry[] = devDeps.map(([n, v]) => ({ name: n, version: clean(v) }));
       const prompt = buildCheckPrompt(depE, devE);
 
       const runs = await Promise.allSettled(
         configs.map(async (cfg) => {
+          setAgentLogs(prev => [...prev, `[${cfg.agentId}] Calling ${cfg.model}...`]);
           const { intelligence, coding } = await getModelRankingFor(cfg.model);
           const res = await callLLMRaw<{
             findings: CheckAgentResult['findings'];
             overall_assessment: string;
             risk_score: number;
           }>(cfg.model, CHECK_SYSTEM_PROMPT, prompt);
+          setAgentLogs(prev => [...prev, `[${cfg.agentId}] Done — ${(res.findings || []).length} findings`]);
           return {
             agentId: cfg.agentId, model: cfg.model,
             intelligence, coding,
@@ -132,6 +163,13 @@ export function FixCommand() {
         .filter((r): r is PromiseFulfilledResult<CheckAgentResult> => r.status === 'fulfilled')
         .map((r) => r.value);
 
+      for (const r of runs) {
+        if (r.status === 'rejected') {
+          const msg = String(r.reason?.message || r.reason).slice(0, 80);
+          setAgentLogs(prev => [...prev, `Agent failed: ${msg}`]);
+        }
+      }
+
       const flagCounts = new Map<string, { count: number; replacement: string | null; version: string | null; reason: string }>();
       for (const agent of agentResults) {
         for (const f of agent.findings) {
@@ -155,7 +193,7 @@ export function FixCommand() {
         actions.push({
           name: pkg, version: entry.v, kind: 'ai',
           newName: validName, newVersion: validVersion,
-          reason: `${count}/3 agents flagged: ${reason.slice(0, 80)}`,
+          reason: `${count}/${configs.length} agents flagged: ${reason.slice(0, 80)}`,
         });
       }
     } catch { /* no LLM keys — skip */ }
@@ -182,17 +220,15 @@ export function FixCommand() {
       setApplied(true);
     }
 
-    setPhase('upload');
-    const checkReport: CheckReport = {
-      project: projectName,
-      timestamp: new Date().toISOString(),
-      totalDeps: allEntries.length,
-      deps: depResults,
-      agents: agentResults,
-    };
-    if (!process.env.FILEVERSE_API_KEY) {
-      setUploadError('FILEVERSE_API_KEY not set');
-    } else {
+    if (process.env.FILEVERSE_API_KEY) {
+      setPhase('upload');
+      const checkReport: CheckReport = {
+        project: projectName,
+        timestamp: new Date().toISOString(),
+        totalDeps: allEntries.length,
+        deps: depResults,
+        agents: agentResults,
+      };
       try {
         const uploadResult = await uploadCheckReportToFileverse(checkReport);
         setReportLink(uploadResult.link);
@@ -209,21 +245,36 @@ export function FixCommand() {
     setPhase('done');
   }
 
+  const hasEns = ensCount > 0;
+
   return (
     <Box flexDirection="column">
       <Header subtitle="fix" />
       <Text> </Text>
 
-      <StatusLine label={`Scanning ${total || '...'} dependencies`}
-        status={phase === 'scan' ? 'running' : 'done'}
-        detail={phase === 'scan' ? 'parallel batch' : `${total} scanned`} />
+      {hasEns && (
+        <StatusLine label={`Resolving ${ensCount} ENS version${ensCount > 1 ? 's' : ''}`}
+          status={phase === 'ens' ? 'running' : 'done'}
+          detail={phase === 'ens' ? `${ensResolved}/${ensCount} resolved` : `${ensCount} resolved`} />
+      )}
+
+      <StatusLine label={`Scanning ${total} dependencies`}
+        status={phase === 'ens' ? 'pending' : phase === 'scan' ? 'running' : 'done'}
+        detail={phase === 'scan' ? scanDetail : phase !== 'ens' ? `${total} scanned` : undefined} />
 
-      {phase !== 'scan' && (
-        <StatusLine label="AI agents analyzing dependency tree"
-          status={phase === 'agents' ? 'running' : 'done'} />
+      <StatusLine label="AI agents analyzing dependency tree"
+        status={phase === 'ens' || phase === 'scan' ? 'pending' : phase === 'agents' ? 'running' : 'done'}
+        detail={phase === 'agents' ? `${agentLogs.length > 0 ? agentLogs[agentLogs.length - 1] : 'starting...'}` : undefined} />
+
+      {phase === 'agents' && agentLogs.length > 0 && (
+        <Box flexDirection="column" marginLeft={4}>
+          {agentLogs.slice(-4).map((log, i) => (
+            <Text key={i} color="gray">{log}</Text>
+          ))}
+        </Box>
       )}
 
-      {(phase === 'upload' || phase === 'done') && (
+      {process.env.FILEVERSE_API_KEY && (phase === 'upload' || phase === 'done') && (
         <StatusLine label="Upload report to Fileverse"
           status={phase === 'upload' ? 'running' : reportLink ? 'done' : 'skip'}
           detail={uploadError || undefined} />