@glintbase/scanner-core 3.5.0 → 3.5.1

package/README.md

@@ -7,7 +7,7 @@ policy (SSRF guards) and the MCP live prober. The [Glintbase CLI](https://github
 
 - ESM only, Node.js 20+, no runtime dependencies (uses the global `fetch`).
 - Type declarations included.
-- Every scorecard carries `version` (`ars-3.3.0`): never compare scores across score versions.
+- Every scorecard carries `version` (`ars-3.3.1`): never compare scores across score versions.
 
 ## Install
 
@@ -24,7 +24,7 @@ const policy = validateScanUrl('example.com', { allowHttp: false });
 if (!policy.ok) throw new Error(policy.message);
 
 const scorecard = await runArs3Probes(policy.url!);
-console.log(scorecard.score, scorecard.grade, scorecard.version); // e.g. 78 'B' 'ars-3.3.0'
+console.log(scorecard.score, scorecard.grade, scorecard.version); // e.g. 78 'B' 'ars-3.3.1'
 console.log(`${scorecard.evidence?.checksEvaluated}/${getAllChecks().length} checks measured`);
 ```
 

package/dist/index.d.ts

@@ -4,9 +4,9 @@
  * rule sets are never compared as if they were equivalent.
  */
 /** Product version shared by the web app, CLI and MCP packages. */
-declare const GLINTBASE_VERSION = "3.5.0";
+declare const GLINTBASE_VERSION = "3.5.1";
 /** Scoring model version stamped on every scan result (score_version). */
-declare const ARS_SCORE_VERSION: "ars-3.3.0";
+declare const ARS_SCORE_VERSION: "ars-3.3.1";
 /** Human-readable name of the current scoring model. */
 declare const ARS_LABEL = "ARS 3.3";
 declare function isCurrentArsVersion(version?: string | null): boolean;

package/dist/index.js

@@ -7362,8 +7362,8 @@ var require_dist = __commonJS({
 });
 
 // ../src/lib/scanner/version.ts
-var GLINTBASE_VERSION = "3.5.0";
-var ARS_SCORE_VERSION = "ars-3.3.0";
+var GLINTBASE_VERSION = "3.5.1";
+var ARS_SCORE_VERSION = "ars-3.3.1";
 var ARS_LABEL = "ARS 3.3";
 function isCurrentArsVersion(version) {
   return version === ARS_SCORE_VERSION;
@@ -7560,6 +7560,9 @@ function classifyArchetype(input) {
   };
 }
 
+// ../src/lib/scanner/v2/fetchResource.ts
+import { AsyncLocalStorage } from "async_hooks";
+
 // ../src/lib/scanner/v2/urlPolicy.ts
 var BLOCKED_HOSTNAMES = /* @__PURE__ */ new Set([
   "localhost",
@@ -7737,7 +7740,15 @@ function policyToErrorCode(code) {
 }
 
 // ../src/lib/scanner/v2/fetchResource.ts
-var DEFAULT_UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36";
+var SCANNER_USER_AGENTS = {
+  agent: "Mozilla/5.0 (compatible; GlintbaseScanner/3.5; +https://glintbase.dev/research/bot)",
+  browser: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
+};
+var DEFAULT_SCANNER_IDENTITY = "agent";
+var uaStore = new AsyncLocalStorage();
+function currentScannerUserAgent() {
+  return uaStore.getStore() || SCANNER_USER_AGENTS[DEFAULT_SCANNER_IDENTITY];
+}
 var DEFAULT_TIMEOUT = 8e3;
 var DEFAULT_MAX_BYTES = 2e6;
 function looksLikeSoft404(body, httpStatus) {
@@ -7853,7 +7864,7 @@ async function fetchResource(url, options = {}) {
         signal: controller.signal,
         redirect: "manual",
         headers: {
-          "User-Agent": DEFAULT_UA,
+          "User-Agent": currentScannerUserAgent(),
           Accept: "*/*",
           ...options.headers
         },
@@ -10380,6 +10391,11 @@ function parseOpenApiDocument(body) {
     return void 0;
   }
 }
+function markdownTwinUrl(pageUrl) {
+  const u = new URL(pageUrl);
+  const path = u.pathname.replace(/\/+$/, "");
+  return `${u.origin}${path ? `${path}.md` : "/index.md"}`;
+}
 function parseLinkHeader(value) {
   if (!value) return [];
   const out = [];
@@ -10672,7 +10688,7 @@ async function probeAccess(targetUrl, localContext) {
     }
   }
   if (!markdownSupported && !localContext?.isLocalCodebase) {
-    const twinUrl = targetUrl.endsWith("/") ? `${targetUrl.slice(0, -1)}.md` : `${targetUrl}.md`;
+    const twinUrl = markdownTwinUrl(targetUrl);
     const twinRes = await fetchResource(twinUrl, { timeoutMs: 3e3 });
     if (twinRes.ok && twinRes.body && !twinRes.body.includes("<html")) {
       markdownSupported = true;