Update README: install methods, remove private tools (#5)

* Update README: add install methods, remove private tools, fix npx refs

- Add npm global install and Homebrew install options alongside npx
- Remove HMA Researcher and Hunter from adapter table and architecture
- Fix npx commands from opena2a to opena2a-cli (matches npm package name)

* Add npm README for opena2a-cli package

Creates packages/cli/README.md so the npm page shows proper
documentation. Mirrors the root README but removes GIF image
references that won't resolve on npmjs.com and adds an npm
version badge.

* Sync package-lock.json with opena2a-cli package name

The lock file still referenced the old package name "opena2a"
instead of "opena2a-cli", causing npm ci to fail in CI with
"Missing: opena2a-cli@0.1.0 from lock file".

* Fix PR review workflow: use file-based JSON, add error handling

- Use jq --rawfile instead of shell variable expansion to avoid
  escaping issues with large diffs
- Write request payload to file and use curl -d @file
- Capture HTTP status code and handle non-200 responses gracefully
- Skip review if ANTHROPIC_API_KEY is not configured
- Also set ANTHROPIC_API_KEY secret in repo (was missing)

* Do not auto-approve PRs when review API is unavailable

On API failure or missing key, post a comment instead of
auto-approving. This prevents a security bypass where causing
API errors could skip review.

Author: thebenignhacker

.github/workflows/pr-review.yml

@@ -32,19 +32,37 @@ jobs:
         env:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
         run: |
-          DIFF=$(cat /tmp/pr-diff.txt)
-          RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
+          if [ -z "$ANTHROPIC_API_KEY" ]; then
+            echo "ANTHROPIC_API_KEY not set"
+            echo "verdict=SKIP" >> "$GITHUB_OUTPUT"
+            echo "Review skipped: ANTHROPIC_API_KEY not configured. Set the secret to enable automated reviews." > /tmp/review.txt
+            exit 0
+          fi
+
+          # Build JSON payload from file to avoid shell escaping issues
+          jq -n --rawfile diff /tmp/pr-diff.txt '{
+            model: "claude-sonnet-4-5-20250929",
+            max_tokens: 4096,
+            system: "You are a security-focused code reviewer for the OpenA2A platform (TypeScript monorepo, npm workspaces, Turborepo). Review for: 1) Security vulnerabilities (OWASP Top 10, credential exposure, injection) 2) TypeScript best practices 3) Architecture consistency 4) Test coverage. End with VERDICT: APPROVE or REQUEST_CHANGES.",
+            messages: [{role: "user", content: ("Review this PR diff:\n\n" + $diff)}]
+          }' > /tmp/request.json
+
+          HTTP_CODE=$(curl -s -o /tmp/response.json -w '%{http_code}' \
+            https://api.anthropic.com/v1/messages \
             -H "x-api-key: $ANTHROPIC_API_KEY" \
             -H "anthropic-version: 2023-06-01" \
             -H "content-type: application/json" \
-            -d "$(jq -n --arg diff "$DIFF" '{
-              model: "claude-sonnet-4-5-20250929",
-              max_tokens: 4096,
-              system: "You are a security-focused code reviewer for the OpenA2A platform (TypeScript monorepo, npm workspaces, Turborepo). Review for: 1) Security vulnerabilities (OWASP Top 10, credential exposure, injection) 2) TypeScript best practices 3) Architecture consistency 4) Test coverage. End with VERDICT: APPROVE or REQUEST_CHANGES.",
-              messages: [{role: "user", content: ("Review this PR diff:\n\n" + $diff)}]
-            }')")
+            -d @/tmp/request.json)
+
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "API returned HTTP $HTTP_CODE"
+            cat /tmp/response.json
+            echo "verdict=SKIP" >> "$GITHUB_OUTPUT"
+            echo "Review could not be completed: API error (HTTP $HTTP_CODE). A manual review is required." > /tmp/review.txt
+            exit 0
+          fi
 
-          REVIEW_TEXT=$(echo "$RESPONSE" | jq -r '.content[0].text // "Review failed"')
+          REVIEW_TEXT=$(jq -r '.content[0].text // "Review failed"' /tmp/response.json)
           echo "$REVIEW_TEXT" > /tmp/review.txt
 
           if echo "$REVIEW_TEXT" | grep -q "VERDICT: APPROVE"; then
@@ -60,7 +78,9 @@ jobs:
           REVIEW_BODY=$(cat /tmp/review.txt)
           VERDICT="${{ steps.review.outputs.verdict }}"
 
-          if [ "$VERDICT" = "APPROVE" ]; then
+          if [ "$VERDICT" = "SKIP" ]; then
+            gh pr comment ${{ github.event.pull_request.number }} --body "$REVIEW_BODY"
+          elif [ "$VERDICT" = "APPROVE" ]; then
             gh pr review ${{ github.event.pull_request.number }} --approve --body "$REVIEW_BODY" || \
               gh pr comment ${{ github.event.pull_request.number }} --body "$REVIEW_BODY"
           else

README.md

@@ -18,7 +18,14 @@ Credential detection, scope drift analysis, config integrity, runtime monitoring
 ## Install
 
 ```bash
-npx opena2a init
+# Try without installing
+npx opena2a-cli init
+
+# Install globally
+npm install -g opena2a-cli
+
+# Homebrew (macOS/Linux)
+brew tap opena2a-org/tap && brew install opena2a
 ```
 
 No configuration required. Works with Node.js, Python, Go, and MCP server projects.
@@ -201,8 +208,6 @@ The CLI orchestrates these specialized tools through a unified interface:
 | `opena2a secrets` | [Secretless AI](https://github.com/opena2a-org/secretless-ai) | Credential management for AI coding tools |
 | `opena2a benchmark` | [OASB](https://github.com/opena2a-org/oasb) | 222 attack scenarios, compliance scoring |
 | `opena2a registry` | [AI Trust](https://github.com/opena2a-org/ai-trust) | Trust Registry queries, package verification |
-| `opena2a research` | [HMA Researcher](https://github.com/opena2a-org/hma-researcher) | Autonomous security research agent |
-| `opena2a hunt` | [HMA Hunter](https://github.com/opena2a-org/hma-hunter) | Multi-turn attack decomposition |
 | `opena2a train` | [DVAA](https://github.com/opena2a-org/damn-vulnerable-ai-agent) | Vulnerable AI agent for training |
 | `opena2a crypto` | [CryptoServe](https://github.com/ecolibria/crypto-serve) | Cryptographic inventory, PQC readiness |
 | `opena2a identity` | [AIM](https://github.com/opena2a-org/agent-identity-management) | Agent identity management |
@@ -218,16 +223,16 @@ All commands support `--format json` and `--ci` flags for pipeline integration:
 ```yaml
 # GitHub Actions example
 - name: Security assessment
-  run: npx opena2a init --ci --format json > security-report.json
+  run: npx opena2a-cli init --ci --format json > security-report.json
 
 - name: Credential check
   run: |
-    npx opena2a protect --dry-run --ci --format json > cred-report.json
+    npx opena2a-cli protect --dry-run --ci --format json > cred-report.json
     # Fail if credentials found
     jq -e '.totalFound == 0' cred-report.json
 
 - name: Config integrity
-  run: npx opena2a guard verify --ci
+  run: npx opena2a-cli guard verify --ci
 ```
 
 ## Output Formats
@@ -256,8 +261,6 @@ opena2a CLI
        +-- secrets   -> secretless-ai
        +-- benchmark -> @opena2a/oasb
        +-- registry  -> ai-trust
-       +-- research  -> hma-researcher
-       +-- hunt      -> hma-hunter
        +-- train     -> opena2a/dvaa (Docker)
        +-- crypto    -> cryptoserve (Python)
        +-- identity  -> aim