Add init, guard, runtime, advisory intelligence, and contribution prompting (#2)

* Add init, guard, runtime commands and enhance verify with trust queries

- opena2a init: Security posture assessment with trust score, credential
  scan, hygiene checks, and prioritized next steps (protect flow)
- opena2a guard: ConfigGuard MVP with sign/verify/status subcommands
  for config file integrity via SHA-256 hash pinning
- opena2a runtime: ARP wrapper with start/status/tail/init subcommands
  for agent runtime protection
- verify: Enhanced with trust profile and oracle verdict queries from
  registry, showing trust score, verdict, and dependency risks
- Extract credential patterns to shared module for init/protect reuse
- Remove guard/runtime from adapter registry (now direct commands)
- 22 new tests (init: 8, guard: 8, runtime: 6)

* Add advisory intelligence feed and scan report submission

- Advisory check: init command fetches advisories from registry and
  warns about flagged tools in the project's dependencies
- Advisory cache: 5-minute local cache to avoid repeated fetches
- Package detection: Scans package.json, go.mod, requirements.txt
  for dependency names to match against advisories
- Scan report submission: Utility for sharing detailed scan findings
  with registry when contribute mode is enabled (opt-in)
- 7 new tests for advisory matching, caching, and error handling

* Fix shared package test script to pass with no test files

* Fix intent-map regex to allow modifier words between possessive and target

* Add delayed contribution prompting and GitHub star CTA

- Track scan count in user config, only prompt to share reports after 3+ scans
- Add shouldPromptContribute/dismissContributePrompt to shared config
- Add open source link to init report footer and HTML security report
- 5 new telemetry config tests

Author: thebenignhacker

packages/cli/__tests__/adapters/routing.test.ts

@@ -53,8 +53,9 @@ describe('input classifier', () => {
 
 describe('adapter registry', () => {
   it('has all expected adapters', () => {
-    const expected = ['scan', 'secrets', 'runtime', 'benchmark', 'registry',
-      'research', 'hunt', 'train', 'crypto', 'identity', 'guard', 'broker', 'dlp'];
+    // guard and runtime are now handled directly (not adapter-based)
+    const expected = ['scan', 'secrets', 'benchmark', 'registry',
+      'research', 'hunt', 'train', 'crypto', 'identity', 'broker', 'dlp'];
     for (const name of expected) {
       expect(ADAPTER_REGISTRY[name]).toBeDefined();
     }

packages/cli/__tests__/commands/guard.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { guard } from '../../src/commands/guard.js';
+
+function captureStdout(fn: () => Promise<number>): Promise<{ exitCode: number; output: string }> {
+  const chunks: string[] = [];
+  const origWrite = process.stdout.write;
+  process.stdout.write = ((chunk: any) => {
+    chunks.push(String(chunk));
+    return true;
+  }) as any;
+
+  return fn().then(exitCode => {
+    process.stdout.write = origWrite;
+    return { exitCode, output: chunks.join('') };
+  }).catch(err => {
+    process.stdout.write = origWrite;
+    throw err;
+  });
+}
+
+describe('guard', () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'opena2a-guard-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('sign creates signature store', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{"name":"test"}');
+    fs.writeFileSync(path.join(tempDir, 'tsconfig.json'), '{"compilerOptions":{}}');
+
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'sign',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const result = JSON.parse(output);
+    expect(result.signed).toBe(2);
+
+    // Verify store file exists
+    const storePath = path.join(tempDir, '.opena2a/guard/signatures.json');
+    expect(fs.existsSync(storePath)).toBe(true);
+    const store = JSON.parse(fs.readFileSync(storePath, 'utf-8'));
+    expect(store.version).toBe(1);
+    expect(store.signatures).toHaveLength(2);
+  });
+
+  it('verify detects tampering', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{"name":"original"}');
+
+    // Sign
+    await guard({ subcommand: 'sign', targetDir: tempDir, format: 'json' });
+
+    // Tamper with the file
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{"name":"tampered"}');
+
+    // Verify
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'verify',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(1);
+    const report = JSON.parse(output);
+    expect(report.tampered).toBe(1);
+    const tamperedFile = report.results.find((r: any) => r.status === 'tampered');
+    expect(tamperedFile).toBeDefined();
+    expect(tamperedFile.filePath).toBe('package.json');
+  });
+
+  it('verify passes for clean files', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{"name":"clean"}');
+
+    // Sign
+    await guard({ subcommand: 'sign', targetDir: tempDir, format: 'json' });
+
+    // Verify without modification
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'verify',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const report = JSON.parse(output);
+    expect(report.passed).toBe(1);
+    expect(report.tampered).toBe(0);
+  });
+
+  it('status shows correct counts', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{"name":"test"}');
+    fs.writeFileSync(path.join(tempDir, 'tsconfig.json'), '{}');
+    fs.writeFileSync(path.join(tempDir, 'Dockerfile'), 'FROM node');
+
+    // Sign only package.json
+    await guard({ subcommand: 'sign', targetDir: tempDir, files: ['package.json'], format: 'json' });
+
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'status',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const status = JSON.parse(output);
+    expect(status.signed).toBe(1);
+    expect(status.unsigned).toBe(2); // tsconfig.json and Dockerfile
+    expect(status.tampered).toBe(0);
+  });
+
+  it('sign with custom --files only signs specified files', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{}');
+    fs.writeFileSync(path.join(tempDir, 'tsconfig.json'), '{}');
+
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'sign',
+      targetDir: tempDir,
+      files: ['tsconfig.json'],
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const result = JSON.parse(output);
+    expect(result.signed).toBe(1);
+    expect(result.files).toContain('tsconfig.json');
+    expect(result.files).not.toContain('package.json');
+  });
+
+  it('reports unsigned config files', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{}');
+    // Create an empty store (no signatures)
+    const storeDir = path.join(tempDir, '.opena2a/guard');
+    fs.mkdirSync(storeDir, { recursive: true });
+    fs.writeFileSync(path.join(storeDir, 'signatures.json'), JSON.stringify({
+      version: 1, signatures: [], updatedAt: new Date().toISOString(),
+    }));
+
+    const { output } = await captureStdout(() => guard({
+      subcommand: 'verify',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    const report = JSON.parse(output);
+    expect(report.unsigned).toBeGreaterThan(0);
+  });
+
+  it('returns 1 when no store exists for verify', async () => {
+    const { exitCode } = await captureStdout(() => guard({
+      subcommand: 'verify',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(1);
+  });
+
+  it('handles missing signed files', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), '{}');
+    await guard({ subcommand: 'sign', targetDir: tempDir, format: 'json' });
+
+    // Delete the signed file
+    fs.unlinkSync(path.join(tempDir, 'package.json'));
+
+    const { exitCode, output } = await captureStdout(() => guard({
+      subcommand: 'verify',
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    const report = JSON.parse(output);
+    expect(report.missing).toBe(1);
+  });
+});

packages/cli/__tests__/commands/init.test.ts

@@ -0,0 +1,170 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { init } from '../../src/commands/init.js';
+
+function captureStdout(fn: () => Promise<number>): Promise<{ exitCode: number; output: string }> {
+  const chunks: string[] = [];
+  const origWrite = process.stdout.write;
+  process.stdout.write = ((chunk: any) => {
+    chunks.push(String(chunk));
+    return true;
+  }) as any;
+
+  return fn().then(exitCode => {
+    process.stdout.write = origWrite;
+    return { exitCode, output: chunks.join('') };
+  }).catch(err => {
+    process.stdout.write = origWrite;
+    throw err;
+  });
+}
+
+describe('init', () => {
+  let tempDir: string;
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'opena2a-init-test-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  it('returns 0 for a clean project', async () => {
+    // Create a clean Node project
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'test-project', version: '1.0.0' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), '.env\nnode_modules\n');
+    fs.writeFileSync(path.join(tempDir, 'package-lock.json'), '{}');
+    fs.mkdirSync(path.join(tempDir, '.git'));
+
+    const { exitCode, output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const report = JSON.parse(output);
+    expect(report.projectType).toContain('Node.js');
+    expect(report.credentialFindings).toBe(0);
+    expect(report.trustScore).toBeGreaterThanOrEqual(90);
+    expect(report.grade).toBe('A');
+  });
+
+  it('detects hardcoded credentials', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'test-project' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), 'node_modules\n');
+    // Simulate a file with a hardcoded key
+    const fakeKey = 'sk-ant-api03-' + 'A'.repeat(85);
+    fs.writeFileSync(path.join(tempDir, 'config.ts'), `const key = "${fakeKey}";`);
+
+    const { exitCode, output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const report = JSON.parse(output);
+    expect(report.credentialFindings).toBeGreaterThan(0);
+    expect(report.trustScore).toBeLessThan(90);
+  });
+
+  it('detects MCP config', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'mcp-server' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), '.env\n');
+    fs.writeFileSync(path.join(tempDir, 'mcp.json'), '{}');
+
+    const { exitCode, output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const report = JSON.parse(output);
+    expect(report.projectType).toContain('MCP');
+  });
+
+  it('warns about missing .gitignore', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'test' }));
+
+    const { exitCode, output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    expect(exitCode).toBe(0);
+    const report = JSON.parse(output);
+    const gitignoreCheck = report.hygieneChecks.find((c: any) => c.label === '.gitignore');
+    expect(gitignoreCheck.status).toBe('warn');
+    expect(report.trustScore).toBeLessThan(90);
+  });
+
+  it('generates JSON output with all expected fields', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'test', version: '2.0.0' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), '.env\n');
+
+    const { output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    const report = JSON.parse(output);
+    expect(report).toHaveProperty('projectName');
+    expect(report).toHaveProperty('projectType');
+    expect(report).toHaveProperty('directory');
+    expect(report).toHaveProperty('credentialFindings');
+    expect(report).toHaveProperty('hygieneChecks');
+    expect(report).toHaveProperty('trustScore');
+    expect(report).toHaveProperty('grade');
+    expect(report).toHaveProperty('nextSteps');
+  });
+
+  it('includes protect in next steps when credentials found', async () => {
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'test' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), '.env\n');
+    const fakeKey = 'sk-ant-api03-' + 'B'.repeat(85);
+    fs.writeFileSync(path.join(tempDir, 'app.js'), `const k = "${fakeKey}";`);
+
+    const { output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    const report = JSON.parse(output);
+    const protectStep = report.nextSteps.find((s: any) => s.command === 'opena2a protect');
+    expect(protectStep).toBeDefined();
+    expect(protectStep.severity).toBe('critical');
+  });
+
+  it('calculates correct grade boundaries', async () => {
+    // Clean project should get A
+    fs.writeFileSync(path.join(tempDir, 'package.json'), JSON.stringify({ name: 'clean' }));
+    fs.writeFileSync(path.join(tempDir, '.gitignore'), '.env\nnode_modules\n');
+    fs.writeFileSync(path.join(tempDir, 'package-lock.json'), '{}');
+
+    const { output } = await captureStdout(() => init({
+      targetDir: tempDir,
+      format: 'json',
+    }));
+
+    const report = JSON.parse(output);
+    expect(report.grade).toMatch(/^[A-F]$/);
+    expect(report.trustScore).toBeGreaterThanOrEqual(0);
+    expect(report.trustScore).toBeLessThanOrEqual(100);
+  });
+
+  it('returns 1 for nonexistent directory', async () => {
+    const stderrChunks: string[] = [];
+    const origStderr = process.stderr.write;
+    process.stderr.write = ((chunk: any) => {
+      stderrChunks.push(String(chunk));
+      return true;
+    }) as any;
+
+    const exitCode = await init({ targetDir: '/nonexistent/path/xyz' });
+    process.stderr.write = origStderr;
+
+    expect(exitCode).toBe(1);
+  });
+});