Summary
`opena2a scan ` Next Steps block cites two commands that don't exist in opena2a-cli:
```
Auto-fix all issues: opena2a secure --fix
AI analysis: opena2a check --nanomind (attack vectors + targeted remediation)
```
User runs the cited command:
```
$ opena2a secure --fix
error: unknown command 'secure' (Did you mean one of secrets, setup?)
$ opena2a check express --nanomind
error: too many arguments for 'check'. Expected 1 argument but got 2.
```
CISO Rule 11 / Phase 4f violation: every cited command in tool output must parse via the tool's CLI parser.
Root cause
Text is emitted by HackMyAgent's Next Steps generator. opena2a-cli sets `HMA_CLI_PREFIX=opena2a` env var; HMA respects it and substitutes `hackmyagent` → `opena2a` in the prefix but assumes the wrapping CLI has the same verbs HMA does (`secure`, `check --nanomind`). opena2a-cli has neither — `scan` is the analog of `secure`, and `--nanomind` was deliberately removed (see CHANGELOG 0.10.0 audit B17).
Reproduce
```
opena2a scan ~/.opena2a/corpus/repo/malicious/kitchen-sink --ci 2>&1 | grep -E 'secure|nanomind'
opena2a secure --fix # error: unknown command
opena2a check express --nanomind # error: too many arguments
```
Severity
P1 per release-test Phase 4f. Pre-existing in 0.10.0 (verified via fresh `npm install opena2a-cli@0.10.0` + scan against the same fixture); not introduced by 0.10.1. Surfaced by the 0.10.1 release-test fresh-user subagent.
Fix direction
Three options:
- A. Add `secure` as a Commander alias of `scan` AND register `--nanomind` as a passthrough flag on `check`. Surgical; preserves muscle memory for users who type `opena2a secure`.
- B. opena2a-cli post-processes HMA stdout to translate dead verbs (`secure --fix` → `scan --fix`, strip `--nanomind`). Brittle; couples to HMA text format.
- C. HMA-side fix: HMA accepts a verb-mapping env var (`HMA_VERB_MAP="secure=scan"`) so the wrapping CLI can declare its translation table. Cleanest contract; cross-repo coordination required.
Recommend C with A as a fallback if HMA doesn't ship a verb-mapping in the next release.
Related
- Audit doc: `todo/2026-04-29-opena2a-cli-ux-audit.md` (W3 follow-up class)
- Found by: 0.10.1 `/release-test` fresh-user subagent (2026-04-29)
- Pre-existing precedent: HMA 0.22.0 `scan-soul --explain` dead-end (release-test Phase 4f trigger)
Summary
`opena2a scan ` Next Steps block cites two commands that don't exist in opena2a-cli:
```
Auto-fix all issues: opena2a secure --fix
AI analysis: opena2a check --nanomind (attack vectors + targeted remediation)
```
User runs the cited command:
```
$ opena2a secure --fix
error: unknown command 'secure' (Did you mean one of secrets, setup?)
$ opena2a check express --nanomind
error: too many arguments for 'check'. Expected 1 argument but got 2.
```
CISO Rule 11 / Phase 4f violation: every cited command in tool output must parse via the tool's CLI parser.
Root cause
Text is emitted by HackMyAgent's Next Steps generator. opena2a-cli sets `HMA_CLI_PREFIX=opena2a` env var; HMA respects it and substitutes `hackmyagent` → `opena2a` in the prefix but assumes the wrapping CLI has the same verbs HMA does (`secure`, `check --nanomind`). opena2a-cli has neither — `scan` is the analog of `secure`, and `--nanomind` was deliberately removed (see CHANGELOG 0.10.0 audit B17).
Reproduce
```
opena2a scan ~/.opena2a/corpus/repo/malicious/kitchen-sink --ci 2>&1 | grep -E 'secure|nanomind'
opena2a secure --fix # error: unknown command
opena2a check express --nanomind # error: too many arguments
```
Severity
P1 per release-test Phase 4f. Pre-existing in 0.10.0 (verified via fresh `npm install opena2a-cli@0.10.0` + scan against the same fixture); not introduced by 0.10.1. Surfaced by the 0.10.1 release-test fresh-user subagent.
Fix direction
Three options:
Recommend C with A as a fallback if HMA doesn't ship a verb-mapping in the next release.
Related