@avi770/testteam 3.0.0 → 3.2.0

package/dist/agents/96-cookie-security-auditor.js

@@ -0,0 +1,339 @@
+/**
+ * Cookie Security Auditor — static scan for cookie-setting code that
+ * forgets the security attributes. Pairs with #88 (which exercises the
+ * runtime auth flow) to cover the configuration side: even a correct
+ * login flow leaks the session if the cookie is set without `httpOnly`,
+ * `secure`, or `sameSite`.
+ *
+ * Detected patterns:
+ *   - Express / NestJS / Hono / Elysia:  res.cookie('name', value, opts?)
+ *   - Next.js cookies() API:             cookies().set('name', value, opts?)
+ *                                        cookies().set({ name, value, ... })
+ *   - Raw header:                        setHeader('Set-Cookie', 'session=...; Path=/; ...')
+ *
+ * Findings:
+ *   - 96-missing-httponly  high    code-bug-security   no httpOnly attribute
+ *   - 96-missing-secure    medium  code-bug-security   no secure attribute
+ *   - 96-missing-samesite  medium  code-bug-security   no sameSite attribute
+ *   - 96-samesite-none-without-secure  high  code-bug-security
+ *     SameSite=None requires Secure (browsers reject otherwise; also a
+ *     CSRF risk).
+ *   - 96-summary           info    infra-issue
+ *
+ * Severity rationale: httpOnly absence is high because it directly enables
+ * cookie theft via XSS. secure / sameSite absence is medium — devs often
+ * develop over HTTP and rely on the framework's prod-only defaults, so
+ * we flag but don't escalate.
+ *
+ * Persists `evidence/cookie-audit.json`. Read-only, parallel-safe.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+import { maskNonCode, isTestPath } from './lib/source-scan.js';
+const SRC_EXTENSIONS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']);
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', '.next', '.nuxt', 'coverage', 'reports', 'baselines', 'evidence',
+]);
+function walk(dir, results = []) {
+    if (!fs.existsSync(dir))
+        return results;
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return results;
+    }
+    for (const entry of entries) {
+        if (SKIP_DIRS.has(entry.name))
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, results);
+        }
+        else if (entry.isFile() && SRC_EXTENSIONS.has(path.extname(entry.name))) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+function relativise(absPath, root) {
+    return path.relative(root, absPath).split(path.sep).join('/');
+}
+/**
+ * Slice from `openIdx` (positioned at the opening `(`) through the matching
+ * closing `)`. Tracks nesting depth and skips characters inside string
+ * literals. Returns the entire `(...)` slice including parens, or null
+ * if the call is unterminated.
+ */
+function readBalancedParens(content, openIdx) {
+    if (content[openIdx] !== '(')
+        return null;
+    let depth = 0;
+    let inString = null;
+    let escape = false;
+    for (let i = openIdx; i < content.length; i++) {
+        const ch = content[i];
+        if (escape) {
+            escape = false;
+            continue;
+        }
+        if (inString) {
+            if (ch === '\\') {
+                escape = true;
+            }
+            else if (ch === inString) {
+                inString = null;
+            }
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === '`') {
+            inString = ch;
+            continue;
+        }
+        if (ch === '(') {
+            depth++;
+        }
+        else if (ch === ')') {
+            depth--;
+            if (depth === 0) {
+                return { text: content.slice(openIdx, i + 1), endIdx: i };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Find every cookie-setting call expression in a source file. Returns the
+ * full call slice so attribute presence can be checked structurally.
+ */
+export function findCookieCalls(content) {
+    const out = [];
+    // Strip comments so `res.cookie(...)`-style doc examples aren't read as real
+    // calls. Strings are kept — cookie attribute values (`sameSite: 'none'`) are
+    // part of the signal. Line numbers come from the original.
+    const masked = maskNonCode(content, { maskStrings: false });
+    const patterns = [
+        // res.cookie(...), ctx.cookie(...), reply.cookie(...) — anything ending in .cookie(
+        { regex: /\b[A-Za-z_$][\w$]*\.cookie\s*\(/g, pattern: 'res.cookie' },
+        // cookies().set(...)
+        { regex: /\bcookies\s*\(\s*\)\s*\.\s*set\s*\(/g, pattern: 'cookies().set' },
+        // setHeader('Set-Cookie', ...) or .setHeader('Set-Cookie', ...)
+        { regex: /\.?\bsetHeader\s*\(\s*['"`]Set-Cookie['"`]\s*,/gi, pattern: 'setHeader(Set-Cookie)' },
+    ];
+    for (const { regex, pattern } of patterns) {
+        const re = new RegExp(regex.source, regex.flags);
+        let m;
+        while ((m = re.exec(masked)) !== null) {
+            // Find the '(' that opens this call. For res.cookie / cookies().set the
+            // regex already consumed up to and including '('; rewind one char.
+            let openParenIdx = m.index + m[0].length - 1;
+            if (masked[openParenIdx] !== '(') {
+                // setHeader pattern matched through ',' — find the most recent '(' before the comma
+                openParenIdx = masked.lastIndexOf('(', openParenIdx);
+                if (openParenIdx < m.index)
+                    continue;
+            }
+            const balanced = readBalancedParens(masked, openParenIdx);
+            if (!balanced)
+                continue;
+            const callText = balanced.text;
+            const lineNum = content.slice(0, m.index).split('\n').length;
+            const attrs = inspectCookieAttributes(callText);
+            out.push({ pattern, text: callText, line: lineNum, ...attrs });
+        }
+    }
+    return out;
+}
+/**
+ * Inspect a cookie call's args text for the security attributes. Recognises
+ * both options-object form (`httpOnly: true`) and Set-Cookie string form
+ * (`HttpOnly`). The matching is structural enough to catch the common
+ * cases without parsing JavaScript.
+ */
+export function inspectCookieAttributes(args) {
+    const lower = args.toLowerCase();
+    const hasHttpOnly = /\bhttp[\s_-]?only\b/i.test(args);
+    // Treat `secure: false` as missing — bug, not protection.
+    const hasSecure = /\bsecure\s*:\s*true\b/i.test(args) ||
+        /;\s*secure\s*(?:;|$|[\r\n])/i.test(args) ||
+        /\bsecure\s*=\s*true\b/i.test(args);
+    const sameSiteMatch = args.match(/\bsame[\s_-]?site\s*[:=]\s*['"`]?(strict|lax|none)['"`]?/i);
+    const hasSameSite = sameSiteMatch !== null || /;\s*samesite\s*=/i.test(lower);
+    let sameSiteValueIsNone = false;
+    if (sameSiteMatch && sameSiteMatch[1].toLowerCase() === 'none') {
+        sameSiteValueIsNone = true;
+    }
+    else {
+        const headerMatch = lower.match(/;\s*samesite\s*=\s*(strict|lax|none)/);
+        if (headerMatch && headerMatch[1] === 'none')
+            sameSiteValueIsNone = true;
+    }
+    return { hasHttpOnly, hasSecure, hasSameSite, sameSiteValueIsNone };
+}
+export class CookieSecurityAuditorAgent extends BaseAgent {
+    agentId = 96;
+    agentName = 'Cookie Security Auditor';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        // Prefer #87's connection-map for the source-file index; fall back to a fresh walk.
+        const sourceFiles = new Set();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        try {
+            const map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+            for (const f of map.files) {
+                if (!f.isTest)
+                    sourceFiles.add(path.join(projectRoot, f.path));
+            }
+        }
+        catch {
+            for (const f of walk(projectRoot))
+                sourceFiles.add(f);
+        }
+        const calls = [];
+        for (const file of sourceFiles) {
+            // Test files carry deliberate insecure-cookie fixtures — skip them, as
+            // the other static scanners do (the map path filters them too).
+            if (isTestPath(file, projectRoot))
+                continue;
+            let content;
+            try {
+                content = fs.readFileSync(file, 'utf-8');
+            }
+            catch {
+                continue;
+            }
+            const rel = relativise(file, projectRoot);
+            for (const call of findCookieCalls(content)) {
+                calls.push({ ...call, file: rel });
+            }
+        }
+        if (calls.length === 0) {
+            findings.push({
+                id: `${this.agentId}-no-cookies`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'cookie-security-auditor',
+                description: 'No cookie-setting code found — nothing to audit.',
+            });
+            this.persistAudit(projectRoot, calls);
+            return findings;
+        }
+        let missingHttpOnly = 0;
+        let missingSecure = 0;
+        let missingSameSite = 0;
+        let sameSiteNoneWithoutSecure = 0;
+        for (const call of calls) {
+            if (!call.hasHttpOnly) {
+                missingHttpOnly++;
+                findings.push({
+                    id: `${this.agentId}-missing-httponly-${call.file.replace(/[^\w]/g, '_')}-${call.line}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    agentId: this.agentId,
+                    module: 'cookie-security-auditor',
+                    description: `Cookie set via ${call.pattern} at ${call.file}:${call.line} without httpOnly — JS on the page can read it, exposing it to XSS.`,
+                    file: call.file,
+                    line: call.line,
+                });
+            }
+            if (!call.hasSecure) {
+                missingSecure++;
+                findings.push({
+                    id: `${this.agentId}-missing-secure-${call.file.replace(/[^\w]/g, '_')}-${call.line}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    agentId: this.agentId,
+                    module: 'cookie-security-auditor',
+                    description: `Cookie set via ${call.pattern} at ${call.file}:${call.line} without secure — the cookie will travel over plain HTTP in any non-HTTPS context.`,
+                    file: call.file,
+                    line: call.line,
+                });
+            }
+            if (!call.hasSameSite) {
+                missingSameSite++;
+                findings.push({
+                    id: `${this.agentId}-missing-samesite-${call.file.replace(/[^\w]/g, '_')}-${call.line}`,
+                    type: 'code-bug-security',
+                    severity: 'medium',
+                    agentId: this.agentId,
+                    module: 'cookie-security-auditor',
+                    description: `Cookie set via ${call.pattern} at ${call.file}:${call.line} without sameSite — CSRF protection is opt-in; modern browsers default to Lax but older ones do not.`,
+                    file: call.file,
+                    line: call.line,
+                });
+            }
+            if (call.sameSiteValueIsNone && !call.hasSecure) {
+                sameSiteNoneWithoutSecure++;
+                findings.push({
+                    id: `${this.agentId}-samesite-none-without-secure-${call.file.replace(/[^\w]/g, '_')}-${call.line}`,
+                    type: 'code-bug-security',
+                    severity: 'high',
+                    agentId: this.agentId,
+                    module: 'cookie-security-auditor',
+                    description: `Cookie at ${call.file}:${call.line} sets SameSite=None without Secure — modern browsers will refuse to send the cookie at all (browser will silently drop it). Add { secure: true }.`,
+                    file: call.file,
+                    line: call.line,
+                });
+            }
+        }
+        this.persistAudit(projectRoot, calls);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'cookie-security-auditor',
+            description: `Cookie audit: ${calls.length} call site(s). Missing httpOnly: ${missingHttpOnly}; missing secure: ${missingSecure}; missing sameSite: ${missingSameSite}; SameSite=None without Secure: ${sameSiteNoneWithoutSecure}.`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, calls) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            calls: calls.map((c) => ({
+                pattern: c.pattern,
+                file: c.file,
+                line: c.line,
+                missing: [
+                    ...(c.hasHttpOnly ? [] : ['httpOnly']),
+                    ...(c.hasSecure ? [] : ['secure']),
+                    ...(c.hasSameSite ? [] : ['sameSite']),
+                    ...(c.sameSiteValueIsNone && !c.hasSecure ? ['SameSite=None-without-Secure'] : []),
+                ],
+            })),
+            totals: {
+                callsFound: calls.length,
+                missingHttpOnly: calls.filter((c) => !c.hasHttpOnly).length,
+                missingSecure: calls.filter((c) => !c.hasSecure).length,
+                missingSameSite: calls.filter((c) => !c.hasSameSite).length,
+                sameSiteNoneWithoutSecure: calls.filter((c) => c.sameSiteValueIsNone && !c.hasSecure).length,
+            },
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'cookie-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/cookie-audit.json',
+                description: `Cookie audit: ${calls.length} call(s), ${audit.totals.missingHttpOnly} missing httpOnly`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=96-cookie-security-auditor.js.map

package/dist/agents/96-cookie-security-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"96-cookie-security-auditor.js","sourceRoot":"","sources":["../../agents/96-cookie-security-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC7C,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU;CAC1G,CAAC,CAAC;AA8BH,SAAS,IAAI,CAAC,GAAW,EAAE,UAAoB,EAAE;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,IAAI,OAAoB,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,OAAe;IAC1D,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAA2B,IAAI,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,GAAG,KAAK,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,QAAQ,GAAG,EAAE,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAoC,EAAE,CAAC;IAChD,6EAA6E;IAC7E,6EAA6E;IAC7E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAqD;QACjE,oFAAoF;QACpF,EAAE,KAAK,EAAE,kCAAkC,EAAE,OAAO,EAAE,YAAY,EAAE;QACpE,qBAAqB;QACrB,EAAE,KAAK,EAAE,sCAAsC,EAAE,OAAO,EAAE,eAAe,EAAE;QAC3E,gEAAgE;QAChE,EAAE,KAAK,EAAE,kDAAkD,EAAE,OAAO,EAAE,uBAAuB,EAAE;KAChG,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,YAAY,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;gBACjC,oFAAoF;gBACpF,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACrD,IAAI,YAAY,GAAG,CAAC,CAAC,KAAK;oBAAE,SAAS;YACvC,CAAC;YACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7D,MAAM,KAAK,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAMlD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,0DAA0D;IAC1D,MAAM,SAAS,GACb,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QACzC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC9F,MAAM,WAAW,GACf,aAAa,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,aAAa,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QAC/D,mBAAmB,GAAG,IAAI,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACxE,IAAI,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,0BAA2B,SAAQ,SAAS;IAC9C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,yBAAyB,CAAC;IAErC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,oFAAoF;QACpF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;YAC3E,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,CAAC,MAAM;oBAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,uEAAuE;YACvE,gEAAgE;YAChE,IAAI,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,OAAe,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,aAAa;gBAChC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,yBAAyB;gBACjC,WAAW,EAAE,kDAAkD;aAChE,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,yBAAyB,GAAG,CAAC,CAAC;QAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,eAAe,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;oBACvF,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,kBAAkB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,qEAAqE;oBAC7I,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,aAAa,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;oBACrF,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,kBAAkB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,oFAAoF;oBAC5J,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACtB,eAAe,EAAE,CAAC;gBAClB,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,qBAAqB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;oBACvF,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,kBAAkB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,sGAAsG;oBAC9K,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChD,yBAAyB,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,iCAAiC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE;oBACnG,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,yBAAyB;oBACjC,WAAW,EAAE,aAAa,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,mJAAmJ;oBACnM,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAEtC,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,yBAAyB;YACjC,WAAW,EAAE,iBAAiB,KAAK,CAAC,MAAM,oCAAoC,eAAe,qBAAqB,aAAa,uBAAuB,eAAe,mCAAmC,yBAAyB,GAAG;SACrO,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAAC,WAAmB,EAAE,KAAmB;QAC3D,MAAM,KAAK,GAAgB;YACzB,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE;oBACP,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;oBAClC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBACtC,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF;aACF,CAAC,CAAC;YACH,MAAM,EAAE;gBACN,UAAU,EAAE,KAAK,CAAC,MAAM;gBACxB,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM;gBAC3D,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;gBACvD,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM;gBAC3D,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM;aAC7F;SACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACvD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,4BAA4B;gBAClC,WAAW,EAAE,iBAAiB,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,MAAM,CAAC,eAAe,mBAAmB;aACvG,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/agents/97-healthcheck-validator.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Health-check Endpoint Validator — verifies the target project exposes
+ * the liveness / readiness routes that Kubernetes, Docker, ECS, Fly.io,
+ * Render and similar platforms expect. A deploy that's missing these
+ * silently fails its probes: the orchestrator keeps restarting the
+ * container or refuses to mark it ready, and the symptom is usually a
+ * confused "but my app works locally" debugging session.
+ *
+ * Detection sources: #87's connection-map (the route inventory). No
+ * runtime probing — purely static check of which routes the code wires
+ * up.
+ *
+ * Findings:
+ *   - 97-missing-liveness   high    infra-issue
+ *     No /live, /liveness, /livez, /health, /healthz, /ping route. K8s
+ *     liveness probe will fail; pod will be restart-looped.
+ *   - 97-missing-readiness  medium  infra-issue
+ *     No /ready, /readiness, /readyz route. K8s won't gate traffic on
+ *     readiness; pod gets requests during cold start.
+ *   - 97-no-routes          info    infra-issue
+ *     connection-map has no routes — frontend-only project.
+ *   - 97-summary            info    infra-issue
+ *
+ * Persists `evidence/healthcheck-audit.json`. Read-only, parallel-safe.
+ */
+import type { Finding } from '../core/types.js';
+import { BaseAgent } from './base-agent.js';
+/**
+ * Route paths that satisfy a Kubernetes / Docker liveness probe. If any
+ * of these exist as a GET, the app reports "I am running".
+ */
+export declare const LIVENESS_PATTERNS: ReadonlyArray<RegExp>;
+/**
+ * Route paths that satisfy a Kubernetes readiness probe — "I am ready
+ * to serve traffic". Distinct from liveness because an app might be
+ * alive but still warming up (loading config, opening DB pool, etc.).
+ */
+export declare const READINESS_PATTERNS: ReadonlyArray<RegExp>;
+export interface HealthcheckMatch {
+    kind: 'liveness' | 'readiness';
+    path: string;
+    method: string;
+    file: string;
+    line: number;
+}
+export interface HealthcheckAudit {
+    version: 1;
+    generatedAt: string;
+    projectRoot: string;
+    livenessRoutes: HealthcheckMatch[];
+    readinessRoutes: HealthcheckMatch[];
+    hasLiveness: boolean;
+    hasReadiness: boolean;
+}
+export declare class HealthcheckValidatorAgent extends BaseAgent {
+    readonly agentId = 97;
+    readonly agentName = "Healthcheck Validator";
+    protected preFlight(): Promise<void>;
+    protected execute(): Promise<Finding[]>;
+    private persistAudit;
+}
+//# sourceMappingURL=97-healthcheck-validator.d.ts.map

package/dist/agents/97-healthcheck-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"97-healthcheck-validator.d.ts","sourceRoot":"","sources":["../../agents/97-healthcheck-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA0BzC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAUnD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC,MAAM,CAMpD,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,gBAAgB,EAAE,CAAC;IACnC,eAAe,EAAE,gBAAgB,EAAE,CAAC;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;CACvB;AAMD,qBAAa,yBAA0B,SAAQ,SAAS;IACtD,QAAQ,CAAC,OAAO,MAAM;IACtB,QAAQ,CAAC,SAAS,2BAA2B;cAE7B,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;cAO1B,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAkG7C,OAAO,CAAC,YAAY;CA+BrB"}

package/dist/agents/97-healthcheck-validator.js

@@ -0,0 +1,204 @@
+/**
+ * Health-check Endpoint Validator — verifies the target project exposes
+ * the liveness / readiness routes that Kubernetes, Docker, ECS, Fly.io,
+ * Render and similar platforms expect. A deploy that's missing these
+ * silently fails its probes: the orchestrator keeps restarting the
+ * container or refuses to mark it ready, and the symptom is usually a
+ * confused "but my app works locally" debugging session.
+ *
+ * Detection sources: #87's connection-map (the route inventory). No
+ * runtime probing — purely static check of which routes the code wires
+ * up.
+ *
+ * Findings:
+ *   - 97-missing-liveness   high    infra-issue
+ *     No /live, /liveness, /livez, /health, /healthz, /ping route. K8s
+ *     liveness probe will fail; pod will be restart-looped.
+ *   - 97-missing-readiness  medium  infra-issue
+ *     No /ready, /readiness, /readyz route. K8s won't gate traffic on
+ *     readiness; pod gets requests during cold start.
+ *   - 97-no-routes          info    infra-issue
+ *     connection-map has no routes — frontend-only project.
+ *   - 97-summary            info    infra-issue
+ *
+ * Persists `evidence/healthcheck-audit.json`. Read-only, parallel-safe.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { BaseAgent } from './base-agent.js';
+/**
+ * True when the project deploys as a container / orchestrated workload (where a
+ * missing liveness route really does cause restart loops). Serverless apps
+ * (Vercel/Netlify Next, no Dockerfile) have no pods to probe, so the finding is
+ * advisory there. Checks projectRoot + two parents (monorepo Dockerfile at root).
+ */
+function isContainerOrchestrated(root) {
+    const signals = [
+        'Dockerfile', 'docker-compose.yml', 'docker-compose.yaml', 'compose.yml',
+        'fly.toml', 'Procfile', 'k8s', 'kubernetes', 'helm', 'Chart.yaml', 'app.yaml',
+    ];
+    let dir = root;
+    for (let i = 0; i < 3; i++) {
+        for (const s of signals) {
+            if (fs.existsSync(path.join(dir, s)))
+                return true;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return false;
+}
+/**
+ * Route paths that satisfy a Kubernetes / Docker liveness probe. If any
+ * of these exist as a GET, the app reports "I am running".
+ */
+export const LIVENESS_PATTERNS = [
+    /^\/health\/?$/i,
+    /^\/healthz\/?$/i,
+    /^\/api\/health\/?$/i,
+    /^\/live\/?$/i,
+    /^\/liveness\/?$/i,
+    /^\/livez\/?$/i,
+    /^\/api\/live\/?$/i,
+    /^\/ping\/?$/i,
+    /^\/api\/ping\/?$/i,
+];
+/**
+ * Route paths that satisfy a Kubernetes readiness probe — "I am ready
+ * to serve traffic". Distinct from liveness because an app might be
+ * alive but still warming up (loading config, opening DB pool, etc.).
+ */
+export const READINESS_PATTERNS = [
+    /^\/ready\/?$/i,
+    /^\/readiness\/?$/i,
+    /^\/readyz\/?$/i,
+    /^\/api\/ready\/?$/i,
+    /^\/api\/readiness\/?$/i,
+];
+function matches(patterns, routePath) {
+    return patterns.some((p) => p.test(routePath));
+}
+export class HealthcheckValidatorAgent extends BaseAgent {
+    agentId = 97;
+    agentName = 'Healthcheck Validator';
+    async preFlight() {
+        const root = this.config.projectRoot ?? process.cwd();
+        if (!fs.existsSync(root)) {
+            throw new Error(`projectRoot does not exist: ${root}`);
+        }
+    }
+    async execute() {
+        const findings = [];
+        const projectRoot = this.config.projectRoot ?? process.cwd();
+        const mapPath = path.join(this.runDir, 'evidence', 'connection-map.json');
+        let map = null;
+        try {
+            map = JSON.parse(fs.readFileSync(mapPath, 'utf-8'));
+        }
+        catch {
+            // map missing — caller failed to run #87. Stay silent on info level.
+        }
+        if (!map) {
+            findings.push({
+                id: `${this.agentId}-no-map`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'healthcheck-validator',
+                description: 'connection-map.json not found — Agent #87 must run first for the healthcheck audit.',
+            });
+            return findings;
+        }
+        const allRoutes = map.routes.filter((r) => r.framework !== 'unknown');
+        if (allRoutes.length === 0) {
+            findings.push({
+                id: `${this.agentId}-no-routes`,
+                type: 'infra-issue',
+                severity: 'info',
+                agentId: this.agentId,
+                module: 'healthcheck-validator',
+                description: 'No HTTP routes in connection-map — frontend-only project, nothing to probe.',
+            });
+            this.persistAudit(projectRoot, [], []);
+            return findings;
+        }
+        // GET / HEAD / ALL are valid health-probe methods. POST etc. don't count
+        // — K8s probes only fire GETs by default.
+        const probeMethods = new Set(['GET', 'HEAD', 'ALL']);
+        const livenessRoutes = [];
+        const readinessRoutes = [];
+        for (const r of allRoutes) {
+            if (!probeMethods.has(r.method))
+                continue;
+            if (matches(LIVENESS_PATTERNS, r.path)) {
+                livenessRoutes.push({ kind: 'liveness', path: r.path, method: r.method, file: r.file, line: r.line });
+            }
+            if (matches(READINESS_PATTERNS, r.path)) {
+                readinessRoutes.push({ kind: 'readiness', path: r.path, method: r.method, file: r.file, line: r.line });
+            }
+        }
+        const containerized = isContainerOrchestrated(projectRoot);
+        if (livenessRoutes.length === 0) {
+            findings.push({
+                id: `${this.agentId}-missing-liveness`,
+                type: 'infra-issue',
+                severity: containerized ? 'high' : 'low',
+                agentId: this.agentId,
+                module: 'healthcheck-validator',
+                description: containerized
+                    ? 'No liveness route (/health, /healthz, /live, /liveness, /livez, /ping) exposed via GET/HEAD. ' +
+                        'Kubernetes liveness probes will fail and the pod will be restart-looped. Add a GET /health that returns 200 fast.'
+                    : 'No liveness route exposed. No container/orchestration manifest (Dockerfile, k8s, fly.toml…) was found, so this looks like a serverless/managed deploy where the platform handles availability — add a /health route only if you containerize.',
+            });
+        }
+        if (readinessRoutes.length === 0) {
+            findings.push({
+                id: `${this.agentId}-missing-readiness`,
+                type: 'infra-issue',
+                severity: containerized ? 'medium' : 'low',
+                agentId: this.agentId,
+                module: 'healthcheck-validator',
+                description: 'No readiness route (/ready, /readiness, /readyz) exposed via GET/HEAD. ' +
+                    "Kubernetes won't gate traffic on readiness — your pod will receive requests during cold start (DB pool warming, migrations, etc.). " +
+                    'Add a GET /ready that returns 200 only once dependencies are reachable.',
+            });
+        }
+        this.persistAudit(projectRoot, livenessRoutes, readinessRoutes);
+        findings.push({
+            id: `${this.agentId}-summary`,
+            type: 'infra-issue',
+            severity: 'info',
+            agentId: this.agentId,
+            module: 'healthcheck-validator',
+            description: `Healthcheck audit: ${livenessRoutes.length} liveness route(s), ${readinessRoutes.length} readiness route(s) across ${allRoutes.length} total routes.`,
+        });
+        return findings;
+    }
+    persistAudit(projectRoot, livenessRoutes, readinessRoutes) {
+        const audit = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            projectRoot,
+            livenessRoutes,
+            readinessRoutes,
+            hasLiveness: livenessRoutes.length > 0,
+            hasReadiness: readinessRoutes.length > 0,
+        };
+        try {
+            const evidenceDir = path.join(this.runDir, 'evidence');
+            fs.mkdirSync(evidenceDir, { recursive: true });
+            fs.writeFileSync(path.join(evidenceDir, 'healthcheck-audit.json'), JSON.stringify(audit, null, 2), 'utf-8');
+            this.addEvidence({
+                type: 'report',
+                path: 'evidence/healthcheck-audit.json',
+                description: `Healthcheck: ${livenessRoutes.length} liveness, ${readinessRoutes.length} readiness`,
+            });
+        }
+        catch {
+            // non-fatal
+        }
+    }
+}
+//# sourceMappingURL=97-healthcheck-validator.js.map

package/dist/agents/97-healthcheck-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"97-healthcheck-validator.js","sourceRoot":"","sources":["../../agents/97-healthcheck-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC;;;;;GAKG;AACH,SAAS,uBAAuB,CAAC,IAAY;IAC3C,MAAM,OAAO,GAAG;QACd,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,aAAa;QACxE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU;KAC9E,CAAC;IACF,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACpD,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B;IACtD,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,mBAAmB;IACnB,cAAc;IACd,mBAAmB;CACpB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA0B;IACvD,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,oBAAoB;IACpB,wBAAwB;CACzB,CAAC;AAoBF,SAAS,OAAO,CAAC,QAA+B,EAAE,SAAiB;IACjE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,SAAS;IAC7C,OAAO,GAAG,EAAE,CAAC;IACb,SAAS,GAAG,uBAAuB,CAAC;IAEnC,KAAK,CAAC,SAAS;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAES,KAAK,CAAC,OAAO;QACrB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC1E,IAAI,GAAG,GAAyB,IAAI,CAAC;QACrC,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAkB,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS;gBAC5B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,qFAAqF;aACnG,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY;gBAC/B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,6EAA6E;aAC3F,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,yEAAyE;QACzE,0CAA0C;QAC1C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QACrD,MAAM,cAAc,GAAuB,EAAE,CAAC;QAC9C,MAAM,eAAe,GAAuB,EAAE,CAAC;QAE/C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC1C,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1G,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,uBAAuB,CAAC,WAAW,CAAC,CAAC;QAE3D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB;gBACtC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;gBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EAAE,aAAa;oBACxB,CAAC,CAAC,+FAA+F;wBAC/F,mHAAmH;oBACrH,CAAC,CAAC,+OAA+O;aACpP,CAAC,CAAC;QACL,CAAC;QAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB;gBACvC,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;gBAC1C,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EACT,yEAAyE;oBACzE,qIAAqI;oBACrI,yEAAyE;aAC5E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;QAEhE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU;YAC7B,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,uBAAuB;YAC/B,WAAW,EAAE,sBAAsB,cAAc,CAAC,MAAM,uBAAuB,eAAe,CAAC,MAAM,8BAA8B,SAAS,CAAC,MAAM,gBAAgB;SACpK,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,YAAY,CAClB,WAAmB,EACnB,cAAkC,EAClC,eAAmC;QAEnC,MAAM,KAAK,GAAqB;YAC9B,OAAO,EAAE,CAAC;YACV,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,WAAW;YACX,cAAc;YACd,eAAe;YACf,WAAW,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC;YACtC,YAAY,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;SACzC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAG,CAAC;YACzD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAChD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAC9B,OAAO,CACR,CAAC;YACF,IAAI,CAAC,WAAW,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,iCAAiC;gBACvC,WAAW,EAAE,gBAAgB,cAAc,CAAC,MAAM,cAAc,eAAe,CAAC,MAAM,YAAY;aACnG,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;CACF"}