OpenJarvis 1.0.4.dev981__tar.gz → 1.0.4.dev982__tar.gz

{openjarvis-1.0.4.dev981 → openjarvis-1.0.4.dev982}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: OpenJarvis
-Version: 1.0.4.dev981
+Version: 1.0.4.dev982
 Summary: OpenJarvis — modular AI assistant backend with composable intelligence primitives
 Project-URL: Homepage, https://github.com/open-jarvis/OpenJarvis
 Project-URL: Documentation, https://open-jarvis.github.io/OpenJarvis/

openjarvis-1.0.4.dev982/docs/user-guide/data-boundary-scan.md

@@ -0,0 +1,174 @@
+# Data-boundary scan
+
+`jarvis scan --data-boundaries` reports application-level data boundaries in the
+current OpenJarvis configuration. It complements the existing host/environment
+scan, which checks OS posture such as disk encryption, cloud-sync agents, remote
+access tools, and exposed engine ports.
+
+The data-boundary scan is a configuration diagnostic. It is not a vulnerability
+scanner, a legal privacy assessment, a network monitor, or an OAuth-scope audit.
+
+## Run the scan
+
+```bash
+jarvis scan --data-boundaries
+jarvis scan --data-boundaries --json
+jarvis scan --data-boundaries --json --show-paths
+jarvis scan --data-boundaries --strict
+```
+
+`--strict` exits with status code `1` when the report contains either a `fail`
+or a `warn` finding. Use it when CI or pre-demo checks need to enforce a
+conservative local-only posture.
+
+Without `--strict`, the command always exits `0` even when fail or warn findings
+are present. This is useful for exploratory review.
+
+On a fresh `jarvis init` configuration, common warn findings include
+`server.host = "0.0.0.0"` and `telemetry.enabled = true`. Running
+`jarvis scan --data-boundaries --strict` after init therefore exits `1` until
+those defaults are tightened.
+
+Absolute paths and connector file basenames are redacted by default so JSON
+reports can be pasted into issues without revealing local usernames, mount
+points, or account labels. Use `--show-paths` only for local debugging.
+
+## What it checks
+
+The scan inspects configuration values, environment-variable presence, and the
+existence of known local runtime files. It does not read private content from
+memory databases, trace databases, connector credentials, prompt files, logs, or
+OAuth token files.
+
+The current checks cover:
+
+- cloud-capable model provider, engine, and default model settings
+- local memory context injection combined with cloud-capable inference
+- traces, telemetry, learning, training, and spec-search settings
+- automatic memory service (`tools.storage.enabled` / `[memory].enabled`)
+- deep research engine and model settings
+- security bypass flags when cloud inference is configured
+- unset `security.profile` (informational)
+- web search, browser, local file, shell, code, knowledge chunk scanning, and MCP tool surfaces
+- local knowledge.db composition with cloud-capable Deep Research targets
+- server binding and unauthenticated A2A exposure
+- channel enablement, channel credential fields, and channel credential env vars
+- skills, skill auto-sync, digest sources, and cloud speech/TTS backends such as Cartesia
+- local stores such as `knowledge.db`, `credentials.toml`, `memory.db`, `traces.db`,
+  `telemetry.db`, `scheduler.db`, embeddings, skill index, `.vault_key`, and memory files
+- connector credential files under `connectors/*.json`, without reading them
+- API-key and other runtime credential environment variables (presence only)
+- a scope note for frontend credential storage when cloud/API-key surfaces exist
+
+Configured database paths (for example `traces.db_path` or `memory.db_path`)
+are resolved from config when set, not only the default locations under the
+OpenJarvis home directory.
+
+Static Deep Research targeting uses configuration only (no request overrides):
+`deep_research.engine` or `engine.default`, and `deep_research.model` or
+`server.model` or `intelligence.default_model`.
+
+Model identifiers that contain vendor names (for example `deepseek-r1` or
+`openai/gpt-oss`) are not treated as cloud-bound when their effective engine is
+explicitly local, such as Ollama.
+
+## Status levels
+
+| Status | Meaning |
+| --- | --- |
+| `fail` | A configuration composition is likely incompatible with strict local-only use. |
+| `warn` | A configured surface may send data outside the local runtime or persist sensitive data. |
+| `info` | A relevant setting or local store exists, with no immediate fail or warn condition. |
+
+The command reports potential data paths. It does not prove that a path has been
+used during a specific run.
+
+JSON output includes `"schema_version": 1` for stable downstream parsing.
+
+## Strict local-only checklist
+
+For a conservative local-only setup, review these settings:
+
+```toml
+[analytics]
+enabled = false
+
+[traces]
+enabled = false
+
+[telemetry]
+enabled = false
+
+[agent]
+context_from_memory = false
+
+[intelligence]
+provider = ""
+preferred_engine = ""
+default_model = ""  # local model name only
+
+[engine]
+default = "ollama"  # or another local engine
+
+[tools]
+enabled = ""
+
+[tools.storage]
+enabled = false
+
+[tools.mcp]
+enabled = false
+servers = ""
+
+[channel]
+enabled = false
+
+[learning]
+enabled = false
+auto_update = false
+training_enabled = false
+
+[learning.spec_search]
+enabled = false
+
+[server]
+host = "127.0.0.1"
+
+[security]
+profile = "personal"
+
+[a2a]
+enabled = false
+```
+
+Also unset cloud and channel credentials from the process environment when they
+are not needed.
+
+## Scope and non-goals
+
+The scan intentionally avoids reading private data. In particular, it does not:
+
+- read connector JSON contents or OAuth scopes
+- inspect browser `localStorage` or Tauri secure storage
+- inspect frontend credential storage directly
+- inspect installed skill source code
+- intercept runtime network traffic
+- classify provider retention or training policies
+- prove that a configured path was used at runtime
+
+Frontend credential storage is tracked separately from this CLI diagnostic. If a
+cloud/API-key surface is present, the scan emits an informational scope note so
+users know that browser/Tauri credential storage must be reviewed separately.
+
+## Configuration resolution
+
+The scan follows the same explicit configuration override used by the runtime:
+if `OPENJARVIS_CONFIG` is set, that file is audited. Otherwise the scan uses
+the default OpenJarvis config path under the resolved OpenJarvis home. If the
+home directory cannot be resolved, the command reports a `config-root-error`
+finding instead of crashing.
+
+## See also
+
+- [Security](security.md) — three-layer security model (host scan, config scan, BoundaryGuard)
+- [Configuration](../getting-started/configuration.md) — full config reference

{openjarvis-1.0.4.dev981 → openjarvis-1.0.4.dev982}/docs/user-guide/security.md

@@ -2,6 +2,20 @@
 
 OpenJarvis includes a security layer that scans prompts and model outputs for secrets, personally identifiable information (PII), and sensitive file paths. The system is designed to be composable: scanners run as a pipeline, and the `GuardrailsEngine` wrapper drops in front of any inference backend without changing how the rest of your code works.
 
+## Three layers of security review
+
+OpenJarvis separates host posture, application data boundaries, and runtime prompt guardrails:
+
+| Layer | Command / component | What it checks |
+| --- | --- | --- |
+| Host scan | `jarvis scan` | Disk encryption, cloud-sync agents, exposed engine ports, remote-access tools |
+| Data-boundary scan | `jarvis scan --data-boundaries` | Configured inference, memory, traces, channels, tools, and local stores |
+| Runtime guardrails | `GuardrailsEngine` / BoundaryGuard | Secrets, PII, and file-policy violations in live prompts and outputs |
+
+Use the host scan before storing sensitive data on the machine. Use the data-boundary scan to verify whether your `config.toml` is local-only, cloud-capable, or mixed. Use BoundaryGuard during inference when you need live redaction or blocking.
+
+See [Data Boundary Scan](data-boundary-scan.md) for the application config diagnostic and [BoundaryGuard](#guardrailsengine) below for runtime scanning.
+
 ---
 
 ## Overview
@@ -446,8 +460,15 @@ guarded = GuardrailsEngine(
 
 ---
 
+## Data boundary scan
+
+See [Data Boundary Scan](data-boundary-scan.md) for the application config diagnostic (`jarvis scan --data-boundaries`).
+
+---
+
 ## See Also
 
+- [Data Boundary Scan](data-boundary-scan.md) — application config and local-store diagnostic (`jarvis scan --data-boundaries`)
 - [Architecture: Security](../architecture/security.md) — pipeline design, event flow, and file policy integration
 - [API Reference: Security](../api-reference/openjarvis/security/index.md) — full class and function signatures
 - [Tools](tools.md) — how `FileReadTool` uses file policy

{openjarvis-1.0.4.dev981 → openjarvis-1.0.4.dev982}/mkdocs.yml

@@ -198,6 +198,7 @@ nav:
       - Benchmarks: user-guide/benchmarks.md
       - System Access: user-guide/system-access.md
       - Security: user-guide/security.md
+      - Data Boundary Scan: user-guide/data-boundary-scan.md
       - LLM-guided spec search: user-guide/llm-guided-spec-search.md
   - Leaderboard: leaderboard.md
   - Roadmap: development/roadmap.md

openjarvis-1.0.4.dev982/src/openjarvis/__init__.py

@@ -0,0 +1,35 @@
+"""OpenJarvis — modular AI assistant backend with composable intelligence primitives."""
+
+from __future__ import annotations
+
+from importlib.metadata import PackageNotFoundError
+from importlib.metadata import version as _pkg_version
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from openjarvis.sdk import Jarvis, JarvisSystem, MemoryHandle, SystemBuilder
+
+try:
+    __version__ = _pkg_version("openjarvis")
+except PackageNotFoundError:  # pragma: no cover — uninstalled source tree
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["Jarvis", "JarvisSystem", "MemoryHandle", "SystemBuilder", "__version__"]
+
+_SDK_EXPORTS = {"Jarvis", "JarvisSystem", "MemoryHandle", "SystemBuilder"}
+
+
+def __getattr__(name: str) -> Any:
+    """Load SDK exports lazily so lightweight CLI diagnostics can start safely."""
+    if name not in _SDK_EXPORTS:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+
+    from openjarvis import sdk
+
+    value = getattr(sdk, name)
+    globals()[name] = value
+    return value
+
+
+def __dir__() -> list[str]:
+    return sorted(set(globals()) | _SDK_EXPORTS)

openjarvis-1.0.4.dev982/src/openjarvis/cli/__init__.py

@@ -0,0 +1,208 @@
+"""Command-line interface for OpenJarvis (Click-based)."""
+
+from __future__ import annotations
+
+import sys
+
+import click
+
+import openjarvis
+from openjarvis.cli.scan_cmd import scan
+
+
+def _invoked_command(argv: list[str]) -> str:
+    """Return the first positional CLI token after global flags."""
+    for arg in argv:
+        if arg.startswith("-"):
+            continue
+        return arg
+    return ""
+
+
+# A data-boundary scan must be able to diagnose an invalid OPENJARVIS_HOME.
+# Importing the rest of the CLI eagerly would import core.config and resolve that
+# path before the scan can turn the failure into a finding.
+_DATA_BOUNDARY_BOOTSTRAP = (
+    _invoked_command(sys.argv[1:]) == "scan" and "--data-boundaries" in sys.argv[1:]
+)
+
+
+def _should_skip_update_check(ctx: click.Context, argv: list[str]) -> bool:
+    """Return true for commands whose diagnostics should remain local-only."""
+    if "--research" in argv:
+        return True
+    return ctx.invoked_subcommand == "scan" and "--data-boundaries" in argv
+
+
+@click.group(
+    help="OpenJarvis — modular AI assistant backend",
+    invoke_without_command=True,
+)
+@click.version_option(version=openjarvis.__version__, prog_name="jarvis")
+@click.option("--verbose", is_flag=True, default=False, help="Enable debug logging")
+@click.option("--quiet", is_flag=True, default=False, help="Suppress non-error output")
+@click.pass_context
+def cli(ctx: click.Context, verbose: bool, quiet: bool) -> None:
+    """Top-level CLI group."""
+    from openjarvis.cli.log_config import setup_logging
+
+    ctx.ensure_object(dict)
+    ctx.obj["verbose"] = verbose
+    ctx.obj["quiet"] = quiet
+    setup_logging(verbose=verbose, quiet=quiet)
+
+    # Check for updates on interactive commands. The banner is noise in
+    # demo recordings of ``jarvis ask --research``, so skip it whenever
+    # the research flag is in argv (cheap argv sniff — Click hasn't
+    # parsed the subcommand's args yet at this point). Also skip
+    # ``jarvis scan --data-boundaries`` because it is intended to be a
+    # local application-data diagnostic with no outbound calls.
+    import sys
+
+    skip_update_check = _should_skip_update_check(ctx, sys.argv[1:])
+    if not quiet and ctx.invoked_subcommand and not skip_update_check:
+        import threading
+
+        from openjarvis.cli._version_check import check_for_updates
+
+        # Run the PyPI version poll off the hot path: on a cache miss it does
+        # a blocking urlopen (up to 3s) that otherwise delays every command,
+        # notably `jarvis serve` startup (#263). It's best-effort and never
+        # raises, and the nudge prints to stderr, so a daemon thread is safe —
+        # for long-lived commands (serve) it finishes; for short commands that
+        # exit first, the check is simply skipped this run (same as a miss).
+        threading.Thread(
+            target=check_for_updates,
+            args=(ctx.invoked_subcommand,),
+            daemon=True,
+        ).start()
+
+    # First-run guard — routes bare `jarvis` to chat or init.
+    if ctx.invoked_subcommand is None:
+        from openjarvis.cli._first_run import check_and_route
+
+        check_and_route(ctx)
+
+
+cli.add_command(scan, "scan")
+if not _DATA_BOUNDARY_BOOTSTRAP:
+    from openjarvis.cli._bootstrap import bootstrap_cmd
+    from openjarvis.cli.add_cmd import add
+    from openjarvis.cli.agent_cmd import agent
+    from openjarvis.cli.ask import ask
+    from openjarvis.cli.bench_cmd import bench
+    from openjarvis.cli.channel_cmd import channel
+    from openjarvis.cli.channels_cmd import channels
+    from openjarvis.cli.chat_cmd import chat
+    from openjarvis.cli.compose_cmd import compose
+    from openjarvis.cli.config_cmd import config
+    from openjarvis.cli.connect_cmd import connect
+    from openjarvis.cli.daemon_cmd import restart, start, status, stop
+    from openjarvis.cli.digest_cmd import digest
+    from openjarvis.cli.doctor_cmd import doctor
+    from openjarvis.cli.eval_cmd import eval_group
+    from openjarvis.cli.feedback_cmd import feedback_group
+    from openjarvis.cli.gateway_cmd import gateway
+    from openjarvis.cli.host_cmd import host
+    from openjarvis.cli.init_cmd import init
+    from openjarvis.cli.memory_cmd import memory
+    from openjarvis.cli.mine_cmd import mine
+    from openjarvis.cli.model import model
+    from openjarvis.cli.operators_cmd import operators
+    from openjarvis.cli.optimize_cmd import optimize_group
+    from openjarvis.cli.pearl_cmd import pearl
+    from openjarvis.cli.quickstart_cmd import quickstart
+    from openjarvis.cli.registry_cmd import registry
+    from openjarvis.cli.scheduler_cmd import scheduler
+    from openjarvis.cli.self_update_cmd import self_update
+    from openjarvis.cli.serve import serve
+    from openjarvis.cli.skill_cmd import skill
+    from openjarvis.cli.telemetry_cmd import telemetry
+    from openjarvis.cli.tool_cmd import tool
+    from openjarvis.cli.vault_cmd import vault
+    from openjarvis.cli.workflow_cmd import workflow
+
+    cli.add_command(init, "init")
+    cli.add_command(ask, "ask")
+    cli.add_command(chat, "chat")
+    cli.add_command(serve, "serve")
+    cli.add_command(model, "model")
+    cli.add_command(memory, "memory")
+    cli.add_command(mine, "mine")
+    cli.add_command(pearl, "pearl")
+    cli.add_command(telemetry, "telemetry")
+    cli.add_command(bench, "bench")
+    cli.add_command(channel, "channel")
+    cli.add_command(channels, "channels")
+    cli.add_command(scheduler, "scheduler")
+    cli.add_command(doctor, "doctor")
+    cli.add_command(agent, "agents")
+    cli.add_command(workflow, "workflow")
+    cli.add_command(skill, "skill")
+    cli.add_command(start, "start")
+    cli.add_command(stop, "stop")
+    cli.add_command(restart, "restart")
+    cli.add_command(status, "status")
+    cli.add_command(vault, "vault")
+    cli.add_command(add, "add")
+    cli.add_command(operators, "operators")
+    cli.add_command(eval_group, "eval")
+    cli.add_command(host, "host")
+    cli.add_command(quickstart, "quickstart")
+    cli.add_command(optimize_group, "optimize")
+    cli.add_command(feedback_group, "feedback")
+    cli.add_command(compose, "compose")
+    cli.add_command(gateway, "gateway")
+    cli.add_command(tool, "tool")
+    cli.add_command(registry, "registry")
+    cli.add_command(config, "config")
+    cli.add_command(connect, "connect")
+    cli.add_command(digest, "digest")
+
+    # Deep Research setup pulls the ingestion pipeline (embeddings/numpy). Guard
+    # it so an import-time dependency failure cannot take down the whole CLI.
+    try:
+        from openjarvis.cli.deep_research_setup_cmd import deep_research_setup
+
+        cli.add_command(deep_research_setup, "deep-research-setup")
+        cli.add_command(deep_research_setup, "research")
+    except Exception as _dr_exc:
+        import logging as _logging
+
+        _logging.getLogger(__name__).debug(
+            "deep-research command unavailable: %s", _dr_exc
+        )
+    cli.add_command(self_update, "self-update")
+    cli.add_command(bootstrap_cmd, "_bootstrap")
+
+    # Gateway CLI commands (lazy import to avoid pulling starlette)
+    try:
+        from openjarvis.cli.auth_cmd import auth
+
+        cli.add_command(auth, "auth")
+    except ImportError:
+        pass
+
+    try:
+        from openjarvis.cli.tunnel_cmd import tunnel
+
+        cli.add_command(tunnel, "tunnel")
+    except ImportError:
+        pass
+
+
+def main() -> None:
+    """Entry point registered as ``jarvis`` console script."""
+    import sys
+
+    if sys.platform == "win32":
+        for _stream in (sys.stdout, sys.stderr):
+            if hasattr(_stream, "reconfigure"):
+                try:
+                    _stream.reconfigure(encoding="utf-8", errors="replace")
+                except (AttributeError, OSError):
+                    pass
+    cli()
+
+
+__all__ = ["cli", "main"]

{openjarvis-1.0.4.dev981 → openjarvis-1.0.4.dev982}/src/openjarvis/cli/scan_cmd.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 from dataclasses import dataclass
@@ -11,7 +12,11 @@ from typing import Callable, List
 
 import click
 
-from openjarvis.core.paths import get_config_dir
+from openjarvis.core.paths import get_config_dir, get_config_path
+from openjarvis.security.data_boundary_audit import (
+    DataBoundaryReport,
+    build_data_boundary_report,
+)
 
 # Engine ports that should only be listening on localhost.
 _ENGINE_PORTS = {11434, 8080, 8000, 30000, 1234, 52415, 18181}
@@ -441,10 +446,45 @@ _RICH_ICONS = {
     "ok": "[green]\u2713[/green]",
     "warn": "[yellow]![/yellow]",
     "fail": "[red]\u2717[/red]",
+    "info": "[blue]i[/blue]",
     "skip": "[dim]-[/dim]",
 }
 
 
+def _resolve_data_boundary_config_path() -> Path:
+    env_config = os.environ.get("OPENJARVIS_CONFIG")
+    if env_config:
+        return Path(env_config).expanduser().resolve()
+    return get_config_path()
+
+
+def _load_data_boundary_config():
+    """Load config without treating missing config as active."""
+    root = None
+    root_error = ""
+    try:
+        root = get_config_dir()
+        config_path = _resolve_data_boundary_config_path()
+    except Exception as exc:
+        config_path = None
+        root_error = f"{type(exc).__name__}: {exc}"
+
+    if root_error:
+        return None, root, False, "", root_error
+
+    try:
+        from openjarvis.core.config import JarvisConfig, load_config
+    except Exception as exc:
+        return None, root, False, f"{type(exc).__name__}: {exc}", ""
+
+    if config_path is None or not config_path.exists():
+        return JarvisConfig(), root, False, "", root_error
+    try:
+        return load_config(config_path), root, True, "", root_error
+    except Exception as exc:
+        return JarvisConfig(), root, False, f"{type(exc).__name__}: {exc}", root_error
+
+
 def _render_results(results: List[ScanResult]) -> None:
     """Render scan results as a Rich table."""
     from rich.console import Console
@@ -494,17 +534,123 @@ def _render_results(results: List[ScanResult]) -> None:
         console.print()
 
 
+def _render_data_boundary_report(
+    report: DataBoundaryReport,
+    *,
+    show_paths: bool,
+) -> None:
+    """Render application data-boundary findings as a Rich table."""
+    from rich.console import Console
+    from rich.table import Table
+
+    console = Console()
+    console.print()
+    console.print("[bold]OpenJarvis Data-Boundary Scan[/bold]")
+    console.print(f"Verdict: [bold]{report.verdict}[/bold]")
+    console.print()
+
+    table = Table(show_header=True, header_style="bold", show_lines=True)
+    table.add_column("", width=3, justify="center")
+    table.add_column("Finding")
+    table.add_column("Recommendation")
+
+    for finding in report.findings:
+        icon = _RICH_ICONS.get(finding.status, "?")
+        style = {"fail": "red", "warn": "yellow", "info": "blue"}.get(
+            finding.status,
+            "white",
+        )
+        details = [f"[{style}]{finding.title}[/{style}]"]
+        details.append(f"[dim]{finding.potential_data_path}[/dim]")
+        if finding.location:
+            location = finding.absolute_location if show_paths else finding.location
+            details.append(f"[dim]Location: {location}[/dim]")
+        table.add_row(icon, "\n".join(details), finding.recommendation)
+
+    console.print(table)
+    summary = report.summary()
+    console.print()
+    console.print(
+        f"  [red]{summary['fail']} fail[/red], "
+        f"[yellow]{summary['warn']} warning(s)[/yellow], "
+        f"[blue]{summary['info']} info[/blue]"
+    )
+    if not show_paths:
+        console.print(
+            "  [dim]Absolute paths and connector basenames are redacted by default. "
+            "Use --show-paths for local debugging.[/dim]"
+        )
+    console.print()
+
+
+def _emit_data_boundary_json(
+    report: DataBoundaryReport,
+    *,
+    show_paths: bool,
+) -> None:
+    click.echo(json.dumps(report.to_dict(show_paths=show_paths), indent=2))
+
+
 @click.command()
 @click.option("--quick", is_flag=True, default=False, help="Run only critical checks.")
 @click.option("--json", "as_json", is_flag=True, default=False, help="Output as JSON.")
-def scan(quick: bool, as_json: bool) -> None:
+@click.option(
+    "--data-boundaries",
+    is_flag=True,
+    default=False,
+    help="Run application data-boundary checks instead of host checks.",
+)
+@click.option(
+    "--strict",
+    is_flag=True,
+    default=False,
+    help="Exit non-zero if data-boundary fail or warn findings are present.",
+)
+@click.option(
+    "--show-paths",
+    is_flag=True,
+    default=False,
+    help="Show absolute paths in data-boundary output.",
+)
+def scan(
+    quick: bool,
+    as_json: bool,
+    data_boundaries: bool,
+    strict: bool,
+    show_paths: bool,
+) -> None:
     """Audit your environment for privacy and security risks."""
+    if data_boundaries:
+        if quick:
+            raise click.UsageError("--quick cannot be combined with --data-boundaries.")
+        config, root, config_loaded, config_error, root_error = (
+            _load_data_boundary_config()
+        )
+        report = build_data_boundary_report(
+            config,
+            root,
+            config_loaded=config_loaded,
+            config_error=config_error,
+            root_error=root_error,
+        )
+        if as_json:
+            _emit_data_boundary_json(report, show_paths=show_paths)
+        else:
+            _render_data_boundary_report(report, show_paths=show_paths)
+        summary = report.summary()
+        if strict and (summary["fail"] or summary["warn"]):
+            raise click.exceptions.Exit(1)
+        return
+
+    if strict or show_paths:
+        raise click.UsageError(
+            "--strict and --show-paths are only supported with --data-boundaries."
+        )
+
     scanner = PrivacyScanner()
     results: List[ScanResult] = scanner.run_quick() if quick else scanner.run_all()
 
     if as_json:
-        import json as json_mod
-
         output = [
             {
                 "name": r.name,
@@ -514,7 +660,7 @@ def scan(quick: bool, as_json: bool) -> None:
             }
             for r in results
         ]
-        click.echo(json_mod.dumps(output, indent=2))
+        click.echo(json.dumps(output, indent=2))
         return
 
     if not results: