vanguard-cli 3.1.16 → 3.1.18

package/bin/vanguard.js

@@ -18,7 +18,7 @@ const program = new Command();
 async function handleAction(actionName, logicFn) {
     const isConfigured =
         (config.get('AI_PROVIDER') === 'gemini' && config.get('GEMINI_KEY')) ||
-        (config.get('AI_PROVIDER') === 'ollama');
+        (config.get('AI_PROVIDER') === 'ollama' && config.get('OLLAMA_MODEL'));
 
     if (!isConfigured) {
         // showBanner();
@@ -45,7 +45,38 @@ async function handleAction(actionName, logicFn) {
     ]);
 
     if (!proceed) {
-        console.log('⚠️  Skipping protection. Proceeding at your own risk.');
+        console.log(chalk.yellow('⚠️  Skipping protection. Proceeding at your own risk.'));
+
+        // If the user skips Vanguard, we must execute the original git command
+        if (actionName === 'CLONE') {
+            // Reconstruct arguments
+            const args = process.argv.slice(3); // Remove node, bin, clone
+            // This is a simplified fallback. In a real integration, we'd want to execSync/spawn 
+            // "git clone ..." but since we are inside a node process wrapping git, 
+            // we can suggest the user run usage logic or attempt spawn.
+
+            // However, for the 'integrate' shell function, if 'vanguard' exits with 0 and no output,
+            // the shell function expects to be done.
+            // The Shell Integration logic:
+            // if [ "$1" = "clone" ] ... vanguard clone ... else git clone ...
+
+            // If we return here, Vanguard finishes. The shell wrapper won't run `git clone` because 
+            // it delegated the job to `vanguard clone`.
+
+            // SO: We must actually perform the git clone ourselves now, or exit with a specific code 
+            // that tells the shell wrapper to fallback (complex).
+
+            // Easiest path: Spawn 'git' directly here.
+            const { spawn } = await import('child_process');
+            const gitArgs = [actionName.toLowerCase(), ...process.argv.slice(3)];
+
+            const child = spawn('git', gitArgs, { stdio: 'inherit', shell: true });
+            child.on('close', (code) => {
+                process.exit(code);
+            });
+            // We return promise to await exit
+            return new Promise(() => { });
+        }
         return;
     }
 
@@ -105,7 +136,7 @@ program.parse(process.argv);
 if (!process.argv.slice(2).length) {
     const isConfigured =
         (config.get('AI_PROVIDER') === 'gemini' && config.get('GEMINI_KEY')) ||
-        (config.get('AI_PROVIDER') === 'ollama');
+        (config.get('AI_PROVIDER') === 'ollama' && config.get('OLLAMA_MODEL'));
 
     if (!isConfigured) {
         // showBanner();

package/lib/commands/scan.js

@@ -41,6 +41,9 @@ export async function handlePull(cmdOptions, programOptions) {
     try {
         analysis = await scanner.scan('git_diff', diff, spinner);
     } catch (err) {
+        if (err.message === 'CRITICAL_AUTH_FAILURE') {
+            process.exit(1);
+        }
         let msg = err.message;
         if (msg.includes('[GoogleGenerativeAI Error]')) {
             msg = msg.split('[')[0].trim();
@@ -131,6 +134,10 @@ export async function handleClone(url, directory, programOptions) {
                 CacheManager.save(file, content, 'SAFE');
             }
         } catch (err) {
+            if (err.message === 'CRITICAL_AUTH_FAILURE') {
+                await cleanupSandbox(tempPath);
+                process.exit(1);
+            }
             let msg = err.message;
             // Clean up Google's noisy JSON error if it slipped through
             if (msg.includes('[GoogleGenerativeAI Error]')) {

package/lib/services/scanner.js

@@ -122,7 +122,9 @@ RESPONSE FORMAT (JSON ONLY):
         console.log(chalk.red('\n❌ Critical: Gemini API Key is invalid, expired, or missing permissions.'));
         console.log(chalk.yellow('👉 Run "vanguard config" to update your credentials.'));
         // We fail closed - do not allow the scan to proceed or return 'safe'
-        process.exit(1);
+        // process.exit(1) can cause UV_HANDLE_CLOSING assertion on Windows if async ops are pending.
+        // Instead, throw a specific error that the caller can catch and exit cleanly.
+        throw new Error('CRITICAL_AUTH_FAILURE');
       }
 
       if (isServerErr && attempt === 1) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vanguard-cli",
-  "version": "3.1.16",
+  "version": "3.1.18",
   "description": "AI-Powered Supply Chain Firewall for Git",
   "type": "module",
   "bin": {

package/vanguard-malware-lab/core.js

@@ -1,12 +0,0 @@
-/**
- * 🚨 THREAT VECTOR: PROJECT_OMEGA (MOCK)
- * This file contains the mock threat signature we added to lib/threats.json.
- */
-
-function initializeSystem() {
-    console.log("System initializing...");
-}
-
-// ALERT: PROJECT_OMEGA sequence initiated
-const secretKey = "SG0uLi4uIHRoaXMgaXMgYSBzZWNyZXQ=";
-initializeSystem();

package/vanguard-malware-lab/package.json

@@ -1,11 +0,0 @@
-{
-    "name": "vanguard-malware-lab",
-    "version": "1.0.0",
-    "description": "Educational test repository for supply chain security auditing.",
-    "scripts": {
-        "postinstall": "node ./scripts/postinstall.js"
-    },
-    "dependencies": {
-        "axios": "^1.6.0"
-    }
-}