diff --git a/src/security/audit-extra.ts b/src/security/audit-extra.ts index 0943196da..3a92a30a8 100644 --- a/src/security/audit-extra.ts +++ b/src/security/audit-extra.ts @@ -280,7 +280,10 @@ function isClaudeModel(id: string): boolean { } function isClaude45OrHigher(id: string): boolean { - return /\bclaude-[^\s/]*?(?:-4-5\b|4\.5\b)/i.test(id); + // Match claude-*-4-5, claude-*-45, claude-*4.5, or opus-4-5/opus-45 variants + // Examples that should match: + // claude-opus-4-5, claude-opus-45, claude-4.5, venice/claude-opus-45 + return /\bclaude-[^\s/]*?(?:-4-?5\b|4\.5\b)/i.test(id); } export function collectModelHygieneFindings(cfg: MoltbotConfig): SecurityAuditFinding[] { diff --git a/src/security/audit.test.ts b/src/security/audit.test.ts index 4bbfd21e3..40124d39a 100644 --- a/src/security/audit.test.ts +++ b/src/security/audit.test.ts @@ -730,6 +730,23 @@ describe("security audit", () => { ); }); + it("does not warn on Venice-style opus-45 model names", async () => { + // Venice uses "claude-opus-45" format (no dash between 4 and 5) + const cfg: ClawdbotConfig = { + agents: { defaults: { model: { primary: "venice/claude-opus-45" } } }, + }; + + const res = await runSecurityAudit({ + config: cfg, + includeFilesystem: false, + includeChannelSecurity: false, + }); + + // Should NOT contain weak_tier warning for opus-45 + const weakTierFinding = res.findings.find((f) => f.checkId === "models.weak_tier"); + expect(weakTierFinding).toBeUndefined(); + }); + it("warns when hooks token looks short", async () => { const cfg: MoltbotConfig = { hooks: { enabled: true, token: "short" },