cc-env-checker 0.1.0

package/src/checks/network.js

@@ -0,0 +1,443 @@
+import {
+  createCheckResult,
+  fetchJson as defaultFetchJson,
+  fetchText as defaultFetchText,
+  proxyEnvSnapshot as defaultProxyEnvSnapshot,
+  resolveHost as defaultResolveHost,
+} from './helpers.js';
+
+const CONNECTIVITY_URL = 'https://api.ipify.org?format=json';
+const GEO_URL = 'https://ipapi.co/json/';
+const EXTERNAL_IP_SIGNAL_URL = 'https://ping0.cc/geo';
+const TARGET_HOSTS = ['api.anthropic.com', 'console.anthropic.com'];
+
+function createRemoteDisabledCheck(id, title, suggestion) {
+  return createCheckResult({
+    id,
+    titleKey: title,
+    status: 'skip',
+    riskLevel: 'unknown',
+    evidenceType: 'unknown',
+    source: 'remote',
+    summaryKey: 'check.network.remoteDisabled',
+    suggestionKey: suggestion,
+  });
+}
+
+async function checkConnectivity(context, fetchJson) {
+  if (!context.remote) {
+    return createRemoteDisabledCheck(
+      'network.connectivity',
+      'check.network.connectivity.title',
+      'check.network.connectivity.suggestion.disabled',
+    );
+  }
+
+  const ipResult = await fetchJson(CONNECTIVITY_URL, context.timeoutMs);
+  if (!ipResult.ok || !ipResult.data?.ip) {
+    return createCheckResult({
+      id: 'network.connectivity',
+      titleKey: 'check.network.connectivity.title',
+      status: 'fail',
+      riskLevel: 'high',
+      evidenceType: 'observed',
+      source: 'remote',
+      summaryKey: 'check.network.connectivity.summary.fail',
+      details: [ipResult.error ?? `status=${ipResult.status}`],
+      suggestionKey: 'check.network.connectivity.suggestion.fail',
+    });
+  }
+
+  return createCheckResult({
+    id: 'network.connectivity',
+    titleKey: 'check.network.connectivity.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'remote',
+    summaryKey: 'check.network.connectivity.summary.pass',
+    details: [`ip=${ipResult.data.ip}`],
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+async function checkEgressProfile(context, fetchJson) {
+  if (!context.remote) {
+    return createRemoteDisabledCheck(
+      'network.egress-profile',
+      'check.network.egress.title',
+      'check.network.egress.suggestion.disabled',
+    );
+  }
+
+  const ipResult = await fetchJson(CONNECTIVITY_URL, context.timeoutMs);
+  if (!ipResult.ok || !ipResult.data?.ip) {
+    return createCheckResult({
+      id: 'network.egress-profile',
+      titleKey: 'check.network.egress.title',
+      status: 'warn',
+      riskLevel: 'medium',
+      evidenceType: 'observed',
+      source: 'remote',
+      summaryKey: 'check.network.egress.summary.fail',
+      details: [ipResult.error ?? `status=${ipResult.status}`],
+      suggestionKey: 'check.network.egress.suggestion.fail',
+    });
+  }
+
+  const geoResult = await fetchJson(GEO_URL, context.timeoutMs);
+  const details = [`ip=${ipResult.data.ip}`];
+
+  if (geoResult.ok && geoResult.data) {
+    details.push(`country=${geoResult.data.country_name ?? 'unknown'}`);
+    details.push(`region=${geoResult.data.region ?? 'unknown'}`);
+    details.push(`city=${geoResult.data.city ?? 'unknown'}`);
+    details.push(`asn=${geoResult.data.asn ?? 'unknown'}`);
+    details.push(`org=${geoResult.data.org ?? 'unknown'}`);
+  } else {
+    return createCheckResult({
+      id: 'network.egress-profile',
+      titleKey: 'check.network.egress.title',
+      status: 'warn',
+      riskLevel: 'medium',
+      evidenceType: 'observed',
+      source: 'remote',
+      summaryKey: 'check.network.egress.summary.partial',
+      details,
+      suggestionKey: 'check.network.egress.suggestion.partial',
+    });
+  }
+
+  return createCheckResult({
+    id: 'network.egress-profile',
+    titleKey: 'check.network.egress.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'remote',
+    summaryKey: 'check.network.egress.summary.pass',
+    details,
+    suggestionKey: 'check.network.egress.suggestion.pass',
+  });
+}
+
+function inferExternalIpRisk(signal) {
+  const normalizedRisk = String(signal.risk ?? signal.risk_level ?? '').toLowerCase();
+  const numericRiskScore = Number(signal.risk_score);
+  const strongFlags = [
+    Boolean(signal.is_proxy),
+    Boolean(signal.is_vpn),
+    Boolean(signal.is_datacenter),
+  ].filter(Boolean).length;
+
+  if (normalizedRisk === 'high' || Number.isFinite(numericRiskScore) && numericRiskScore >= 80 || strongFlags >= 2) {
+    return 'high';
+  }
+
+  if (
+    normalizedRisk === 'medium' ||
+    Number.isFinite(numericRiskScore) && numericRiskScore >= 40 ||
+    strongFlags === 1
+  ) {
+    return 'medium';
+  }
+
+  if (
+    normalizedRisk === 'low' ||
+    Number.isFinite(numericRiskScore) ||
+    signal.ip_type ||
+    signal.asn ||
+    signal.org
+  ) {
+    return 'low';
+  }
+
+  return 'unknown';
+}
+
+function parsePing0GeoText(text) {
+  const lines = String(text)
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+
+  if (lines.length < 4) {
+    return null;
+  }
+
+  return {
+    ip: lines[0],
+    location: lines[1],
+    asn: lines[2],
+    org: lines[3],
+  };
+}
+
+async function checkExternalIpSignal(context, fetchJson, fetchText) {
+  if (!context.remote) {
+    return createRemoteDisabledCheck(
+      'network.external-ip-signal',
+      'check.network.externalIpSignal.title',
+      'check.network.externalIpSignal.suggestion.disabled',
+    );
+  }
+
+  const textResult = await fetchText(EXTERNAL_IP_SIGNAL_URL, context.timeoutMs);
+  if (textResult.ok) {
+    const parsed = parsePing0GeoText(textResult.text);
+    if (parsed) {
+      return createCheckResult({
+        id: 'network.external-ip-signal',
+        titleKey: 'check.network.externalIpSignal.title',
+        status: 'pass',
+        riskLevel: 'low',
+        evidenceType: 'observed',
+        source: 'remote',
+        summaryKey: 'check.network.externalIpSignal.summary.low',
+        details: [
+          `ip=${parsed.ip}`,
+          `location=${parsed.location}`,
+          `asn=${parsed.asn}`,
+          `org=${parsed.org}`,
+        ],
+        suggestionKey: 'check.network.externalIpSignal.suggestion.low',
+      });
+    }
+  }
+
+  const result = await fetchJson(EXTERNAL_IP_SIGNAL_URL, context.timeoutMs);
+  if (!result.ok || !result.data) {
+    return createCheckResult({
+      id: 'network.external-ip-signal',
+      titleKey: 'check.network.externalIpSignal.title',
+      status: 'warn',
+      riskLevel: 'unknown',
+      evidenceType: 'unknown',
+      source: 'remote',
+      summaryKey: 'check.network.externalIpSignal.summary.unavailable',
+      details: [
+        textResult.ok ? 'ping0 text format was incomplete' : (textResult.error ?? `status=${textResult.status}`),
+        result.error ?? `status=${result.status}`,
+      ],
+      suggestionKey: 'check.network.externalIpSignal.suggestion.unavailable',
+    });
+  }
+
+  const details = [];
+  for (const [key, value] of Object.entries({
+    risk: result.data.risk,
+    risk_score: result.data.risk_score,
+    is_proxy: result.data.is_proxy,
+    is_vpn: result.data.is_vpn,
+    is_datacenter: result.data.is_datacenter,
+    ip_type: result.data.ip_type,
+    asn: result.data.asn,
+    org: result.data.org,
+  })) {
+    if (value !== undefined && value !== null && value !== '') {
+      details.push(`${key}=${value}`);
+    }
+  }
+
+  const inferredRisk = inferExternalIpRisk(result.data);
+  const status = inferredRisk === 'low' ? 'pass' : 'warn';
+  const summaryKeyByRisk = {
+    low: 'check.network.externalIpSignal.summary.low',
+    medium: 'check.network.externalIpSignal.summary.medium',
+    high: 'check.network.externalIpSignal.summary.high',
+    unknown: 'check.network.externalIpSignal.summary.unavailable',
+  };
+
+  return createCheckResult({
+    id: 'network.external-ip-signal',
+    titleKey: 'check.network.externalIpSignal.title',
+    status,
+    riskLevel: inferredRisk,
+    evidenceType: inferredRisk === 'unknown' ? 'unknown' : 'inferred',
+    source: 'remote',
+    summaryKey: summaryKeyByRisk[inferredRisk],
+    details,
+    suggestionKey:
+      inferredRisk === 'low'
+        ? 'check.network.externalIpSignal.suggestion.low'
+        : 'check.network.externalIpSignal.suggestion.review',
+  });
+}
+
+async function checkDnsBaseline(resolveHost) {
+  const resolutions = await Promise.all(TARGET_HOSTS.map((hostname) => resolveHost(hostname)));
+  const details = [];
+  let hasFailure = false;
+
+  resolutions.forEach((resolution, index) => {
+    const hostname = TARGET_HOSTS[index];
+    if (!resolution.ok || (!resolution.v4.length && !resolution.v6.length)) {
+      hasFailure = true;
+      details.push(`${hostname}=unresolved`);
+      return;
+    }
+
+    details.push(`${hostname}.ipv4=${resolution.v4.length}`);
+    details.push(`${hostname}.ipv6=${resolution.v6.length}`);
+  });
+
+  if (hasFailure) {
+    return createCheckResult({
+      id: 'network.dns-baseline',
+      titleKey: 'check.network.dnsBaseline.title',
+      status: 'fail',
+      riskLevel: 'high',
+      evidenceType: 'observed',
+      source: 'mixed',
+      summaryKey: 'check.network.dnsBaseline.summary.fail',
+      details,
+      suggestionKey: 'check.network.dnsBaseline.suggestion.fail',
+    });
+  }
+
+  return createCheckResult({
+    id: 'network.dns-baseline',
+    titleKey: 'check.network.dnsBaseline.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'mixed',
+    summaryKey: 'check.network.dnsBaseline.summary.pass',
+    details,
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+async function checkDnsFamily(resolveHost) {
+  const resolutions = await Promise.all(TARGET_HOSTS.map((hostname) => resolveHost(hostname)));
+  const details = [];
+  let partial = false;
+  let knownHostCount = 0;
+
+  resolutions.forEach((resolution, index) => {
+    const hostname = TARGET_HOSTS[index];
+    if (!resolution.ok || (!resolution.v4.length && !resolution.v6.length)) {
+      details.push(`${hostname}=unknown`);
+      return;
+    }
+
+    knownHostCount += 1;
+    if (!resolution.v4.length || !resolution.v6.length) {
+      partial = true;
+    }
+
+    details.push(`${hostname}.ipv4=${resolution.v4.length}`);
+    details.push(`${hostname}.ipv6=${resolution.v6.length}`);
+  });
+
+  if (knownHostCount === 0) {
+    return createCheckResult({
+      id: 'network.dns-family',
+      titleKey: 'check.network.dnsFamily.title',
+      status: 'skip',
+      riskLevel: 'unknown',
+      evidenceType: 'unknown',
+      source: 'mixed',
+      summaryKey: 'check.network.dnsFamily.summary.skip',
+      details,
+      suggestionKey: 'check.network.dnsFamily.suggestion.skip',
+    });
+  }
+
+  if (partial) {
+    return createCheckResult({
+      id: 'network.dns-family',
+      titleKey: 'check.network.dnsFamily.title',
+      status: 'warn',
+      riskLevel: 'medium',
+      evidenceType: 'observed',
+      source: 'mixed',
+      summaryKey: 'check.network.dnsFamily.summary.warn',
+      details,
+      suggestionKey: 'check.network.dnsFamily.suggestion.warn',
+    });
+  }
+
+  return createCheckResult({
+    id: 'network.dns-family',
+    titleKey: 'check.network.dnsFamily.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'mixed',
+    summaryKey: 'check.network.dnsFamily.summary.pass',
+    details,
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+function checkProxyConsistency(proxyEnvSnapshot) {
+  const details = proxyEnvSnapshot();
+
+  if (!details.length) {
+    return createCheckResult({
+      id: 'network.proxy-env',
+      titleKey: 'check.network.proxy.title',
+      status: 'pass',
+      riskLevel: 'low',
+      evidenceType: 'observed',
+      source: 'local',
+      summaryKey: 'check.network.proxy.summary.unset',
+      details: ['proxy=unset'],
+      suggestionKey: 'check.network.proxy.suggestion.unset',
+    });
+  }
+
+  const hasHttp = details.some((entry) => entry.startsWith('HTTP_PROXY='));
+  const hasHttps = details.some((entry) => entry.startsWith('HTTPS_PROXY='));
+
+  if (hasHttp !== hasHttps) {
+    return createCheckResult({
+      id: 'network.proxy-env',
+      titleKey: 'check.network.proxy.title',
+      status: 'warn',
+      riskLevel: 'medium',
+      evidenceType: 'observed',
+      source: 'local',
+      summaryKey: 'check.network.proxy.summary.warn',
+      details,
+      suggestionKey: 'check.network.proxy.suggestion.warn',
+    });
+  }
+
+  return createCheckResult({
+    id: 'network.proxy-env',
+    titleKey: 'check.network.proxy.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'local',
+    summaryKey: 'check.network.proxy.summary.pass',
+    details,
+    suggestionKey: 'check.network.proxy.suggestion.pass',
+  });
+}
+
+export function createNetworkModule({
+  fetchJson = defaultFetchJson,
+  fetchText = defaultFetchText,
+  resolveHost = defaultResolveHost,
+  proxyEnvSnapshot = defaultProxyEnvSnapshot,
+} = {}) {
+  return {
+    id: 'network',
+    titleKey: 'module.network',
+    async run(context) {
+      return [
+        await checkConnectivity(context, fetchJson),
+        await checkEgressProfile(context, fetchJson),
+        await checkExternalIpSignal(context, fetchJson, fetchText),
+        await checkDnsBaseline(resolveHost),
+        await checkDnsFamily(resolveHost),
+        checkProxyConsistency(proxyEnvSnapshot),
+      ];
+    },
+  };
+}
+
+export const networkModule = createNetworkModule();

package/src/checks/runtime.js

@@ -0,0 +1,106 @@
+import { createCheckResult, runtimeSnapshot, tryExec } from './helpers.js';
+
+async function checkNodeRuntime() {
+  const major = Number(process.versions.node.split('.')[0]);
+  const details = runtimeSnapshot();
+
+  if (major < 20) {
+    return createCheckResult({
+      id: 'runtime.node',
+      titleKey: 'check.runtime.node.title',
+      status: 'fail',
+      riskLevel: 'high',
+      evidenceType: 'observed',
+      source: 'local',
+      summaryKey: 'check.runtime.node.summary.fail',
+      details,
+      suggestionKey: 'check.runtime.node.suggestion.fail',
+    });
+  }
+
+  return createCheckResult({
+    id: 'runtime.node',
+    titleKey: 'check.runtime.node.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'local',
+    summaryKey: 'check.runtime.node.summary.pass',
+    details,
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+async function checkNpmAvailability() {
+  const result = await tryExec('npm', ['-v']);
+
+  if (!result.ok) {
+    return createCheckResult({
+      id: 'runtime.npm',
+      titleKey: 'check.runtime.npm.title',
+      status: 'fail',
+      riskLevel: 'high',
+      evidenceType: 'observed',
+      source: 'local',
+      summaryKey: 'check.runtime.npm.summary.fail',
+      details: [result.message],
+      suggestionKey: 'check.runtime.npm.suggestion.fail',
+    });
+  }
+
+  return createCheckResult({
+    id: 'runtime.npm',
+    titleKey: 'check.runtime.npm.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'local',
+    summaryKey: 'check.runtime.npm.summary.pass',
+    details: [`npm=${result.stdout}`],
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+async function checkPathHealth() {
+  const pathValue = process.env.PATH ?? '';
+  const segments = pathValue.split(':').filter(Boolean);
+  const duplicates = segments.filter((segment, index) => segments.indexOf(segment) !== index);
+
+  if (duplicates.length) {
+    return createCheckResult({
+      id: 'runtime.path',
+      titleKey: 'check.runtime.path.title',
+      status: 'warn',
+      riskLevel: 'medium',
+      evidenceType: 'observed',
+      source: 'local',
+      summaryKey: 'check.runtime.path.summary.warn',
+      details: duplicates.map((entry) => `duplicate=${entry}`),
+      suggestionKey: 'check.runtime.path.suggestion.warn',
+    });
+  }
+
+  return createCheckResult({
+    id: 'runtime.path',
+    titleKey: 'check.runtime.path.title',
+    status: 'pass',
+    riskLevel: 'low',
+    evidenceType: 'observed',
+    source: 'local',
+    summaryKey: 'check.runtime.path.summary.pass',
+    details: [`segments=${segments.length}`],
+    suggestionKey: 'check.common.noAction',
+  });
+}
+
+export const runtimeModule = {
+  id: 'runtime',
+  titleKey: 'module.runtime',
+  async run() {
+    return [
+      await checkNodeRuntime(),
+      await checkNpmAvailability(),
+      await checkPathHealth(),
+    ];
+  },
+};