easyvibegate 0.4.4 → 0.6.2

package/dist/engine/checkers/backend/supabase.js

@@ -1,7 +1,11 @@
 import { decodeJwtPayload } from '../../util/text.js';
-import { isErr, request, sleep, unreliable } from '../../net/http.js';
+import { classifyBody, isErr, request, sleep } from '../../net/http.js';
 const URL_ASSIGN = /(?:NEXT_PUBLIC_|VITE_|PUBLIC_)?SUPABASE(?:_PUBLIC)?_URL\s*[:=]\s*["'`]?(https?:\/\/[^"'`\s]+)/i;
 const ANON_ASSIGN = /(?:NEXT_PUBLIC_|VITE_|PUBLIC_)?SUPABASE_(?:ANON|PUBLISHABLE)_KEY\s*[:=]\s*["'`]?([A-Za-z0-9._-]{20,})/i;
+// Docs and templates hold example values, not the running config.
+const NOT_CONFIG = /\.(md|mdx|txt|rst)$|\.(example|sample|template|dist)$/i;
+// Next.js load order for a production build — the most specific file wins.
+const ENV_ORDER = ['.env.production.local', '.env.local', '.env.production', '.env'];
 export function classifyKey(key) {
     if (key.startsWith('sb_publishable_'))
         return 'publishable';
@@ -17,58 +21,62 @@ export function classifyKey(key) {
         return 'jwt-service';
     return 'unknown';
 }
-/** Find a Supabase URL + a *public* key (anon JWT or publishable) in the project. */
+// Bounded for the same reason as the shared `DNS_LABEL` in util/text.ts (a
+// quadratic-time regex on raw file content) — but a Supabase project ref is
+// its own format (no hyphens, {16,63} not {1,63}), so this stays a literal
+// rather than reusing that constant.
+const BARE_URL = /https:\/\/[a-z0-9]{16,63}\.supabase\.co/;
+const BARE_PUBLISHABLE = /\bsb_publishable_[A-Za-z0-9_-]{10,}\b/;
+const BARE_JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
+function isPublicKey(key) {
+    const kind = classifyKey(key);
+    return kind === 'jwt-anon' || kind === 'publishable';
+}
+/**
+ * The URL and *public* key ONE file declares — an explicit assignment first, a
+ * bare literal as fallback. Never an authenticated/service key.
+ */
+function credsInFile(content) {
+    const url = content.match(URL_ASSIGN)?.[1] ?? content.match(BARE_URL)?.[0];
+    let key = content.match(ANON_ASSIGN)?.[1];
+    if (key && !isPublicKey(key))
+        key = undefined;
+    key ??= content.match(BARE_PUBLISHABLE)?.[0]
+        ?? [...content.matchAll(BARE_JWT)].map((m) => m[0]).find((k) => classifyKey(k) === 'jwt-anon');
+    return { url, key };
+}
+function envRank(rel) {
+    const i = ENV_ORDER.indexOf(rel.split('/').pop() ?? rel);
+    return i === -1 ? ENV_ORDER.length : i;
+}
+/**
+ * Find a Supabase URL + a *public* key (anon JWT or publishable) in the project.
+ * URL and key are paired by provenance: a file holding both wins (env files in
+ * load order first). Only when no single file has both do we fall back to a
+ * URL from one file and a key from another — flagged `ambiguous`, because the
+ * two may belong to different environments and must never be presented as one
+ * discovered config.
+ */
 export function discoverSupabase(files) {
-    // Skip docs when discovering credentials so we don't mix an example URL with a real key.
-    const scannable = files.filter((f) => !f.rel.endsWith('.md') && !f.rel.endsWith('.txt'));
-    let url;
-    let anonKey;
-    let source;
-    for (const f of scannable) {
-        const u = f.content.match(URL_ASSIGN)?.[1];
-        if (u && !url) {
-            url = u;
-            source = f.rel;
-        }
-        const k = f.content.match(ANON_ASSIGN)?.[1];
-        if (k && !anonKey && ['publishable', 'jwt-anon'].includes(classifyKey(k)))
-            anonKey = k;
-        if (url && anonKey)
-            break;
-    }
-    if (!url) {
-        for (const f of scannable) {
-            const m = f.content.match(/https:\/\/[a-z0-9]{16,}\.supabase\.co/);
-            if (m) {
-                url = m[0];
-                source ??= f.rel;
-                break;
-            }
-        }
-    }
-    if (!anonKey) {
-        // Only a genuine anon key or publishable key — never authenticated/service.
-        outer: for (const f of scannable) {
-            for (const m of f.content.matchAll(/\bsb_publishable_[A-Za-z0-9_-]{10,}\b/g)) {
-                anonKey = m[0];
-                break outer;
-            }
-            for (const m of f.content.matchAll(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g)) {
-                if (classifyKey(m[0]) === 'jwt-anon') {
-                    anonKey = m[0];
-                    break outer;
-                }
-            }
-        }
-    }
-    if (!url || !anonKey)
-        return null;
-    return {
+    const scannable = files
+        .filter((f) => !NOT_CONFIG.test(f.rel))
+        .map((f) => ({ rel: f.rel, ...credsInFile(f.content) }))
+        .sort((a, b) => envRank(a.rel) - envRank(b.rel)); // stable: ties keep scan order
+    const make = (url, anonKey, source, ambiguous) => ({
         url: url.replace(/\/+$/, ''),
         anonKey,
         keyKind: classifyKey(anonKey) === 'publishable' ? 'publishable' : 'jwt-anon',
         source,
-    };
+        ...(ambiguous ? { ambiguous } : {}),
+    });
+    const paired = scannable.find((f) => f.url && f.key);
+    if (paired?.url && paired.key)
+        return make(paired.url, paired.key, paired.rel);
+    const urlFile = scannable.find((f) => f.url);
+    const keyFile = scannable.find((f) => f.key);
+    if (!urlFile?.url || !keyFile?.key)
+        return null;
+    return make(urlFile.url, keyFile.key, `${urlFile.rel} (URL) + ${keyFile.rel} (key)`, true);
 }
 // Word-ish matching on the table name: "postcards" must not match "card",
 // "authors" must not match "auth", but "api_keys" and "ssn_records" must hit.
@@ -103,21 +111,33 @@ function parseCount(headers) {
     const n = parseInt(total, 10);
     return Number.isNaN(n) ? null : n;
 }
+function isPlainObject(v) {
+    return !!v && typeof v === 'object' && !Array.isArray(v);
+}
+/**
+ * PostgREST answers /rest/v1/ with an OpenAPI 2/3 document. Any other JSON
+ * (`{"error":…}` from a gateway, a maintenance page's payload) is NOT an empty
+ * schema — treating it as one would turn an outage into "zero tables exposed".
+ */
+function asOpenApi(v) {
+    if (!isPlainObject(v))
+        return null;
+    const schemas = isPlainObject(v['components']) ? v['components']['schemas'] : undefined;
+    if (!isPlainObject(v['definitions']) && !isPlainObject(schemas) && !isPlainObject(v['paths']))
+        return null;
+    return v;
+}
 async function enumerate(creds) {
     const res = await request(`${creds.url}/rest/v1/`, { headers: authHeaders(creds.anonKey) });
-    if (isErr(res))
-        return { error: res.error };
-    if (res.status === 401 || res.status === 403)
-        return { error: `anon key rejected (HTTP ${res.status})` };
-    if (res.status >= 400)
-        return { error: `PostgREST returned HTTP ${res.status}` };
-    let spec;
-    try {
-        spec = JSON.parse(res.body);
-    }
-    catch {
-        return { error: 'PostgREST did not return an OpenAPI document' };
-    }
+    const verdict = classifyBody(res, 'json');
+    if (verdict.kind === 'denied')
+        return { error: `anon key rejected (${verdict.reason})` };
+    // Redirect, 5xx, truncated body, HTML, error envelope, empty JSON: the schema was not enumerated.
+    if (verdict.kind !== 'data')
+        return { error: `could not enumerate the PostgREST schema (${verdict.reason})` };
+    const spec = asOpenApi(verdict.json);
+    if (!spec)
+        return { error: 'PostgREST did not return an OpenAPI document — schema enumeration failed' };
     const schemas = { ...(spec.definitions ?? {}), ...(spec.components?.schemas ?? {}) };
     let tables = Object.keys(schemas);
     const paths = Object.keys(spec.paths ?? {});
@@ -163,7 +183,7 @@ export async function probeSupabase(opts) {
     }
     const { tables, rpc } = enumerated;
     log(`Supabase: ${tables.length} table(s), ${rpc.length} rpc function(s) exposed to PostgREST`);
-    let errored = 0;
+    const lost = []; // sub-checks that produced no verdict, for the note
     for (const table of tables) {
         await sleep(rl);
         // HEAD + count=exact returns only the row count in a header — no data pulled.
@@ -172,14 +192,18 @@ export async function probeSupabase(opts) {
             headers: { ...authHeaders(creds.anonKey), Prefer: 'count=exact', Range: '0-0', 'Range-Unit': 'items' },
         });
         // 5xx/429/timeout AND 3xx (a login redirect) mean we learned nothing here.
-        if (isErr(res) || res.status === 429 || res.status >= 500 || (res.status >= 300 && res.status < 400)) {
-            errored++;
+        if (isErr(res)) {
+            lost.push(`${table} (${res.error})`);
+            continue;
+        }
+        if (res.status === 429 || res.status >= 500 || (res.status >= 300 && res.status < 400)) {
+            lost.push(`${table} (HTTP ${res.status})`);
             continue;
         }
         if (res.status === 200 || res.status === 206) {
             const count = parseCount(res.headers);
             if (count === null) {
-                errored++;
+                lost.push(`${table} (no content-range)`);
                 continue;
             } // no usable count → inconclusive, not proof
             if (count > 0) {
@@ -204,31 +228,31 @@ export async function probeSupabase(opts) {
     // Storage buckets listable by anon.
     await sleep(rl);
     const buckets = await request(`${creds.url}/storage/v1/bucket`, { headers: authHeaders(creds.anonKey) });
-    let storageErrored = unreliable(buckets);
-    if (!isErr(buckets) && buckets.status === 200) {
-        try {
-            const parsed = JSON.parse(buckets.body);
-            const list = (Array.isArray(parsed) ? parsed : parsed?.buckets);
-            if (!Array.isArray(list))
-                throw new Error('unrecognized bucket listing');
-            if (list.length > 0) {
-                const objs = list.map((b) => (typeof b === 'string' ? { name: b } : b));
-                const publicOnes = objs.filter((b) => b.public).map((b) => b.name ?? b.id ?? '(unnamed)').join(', ');
-                findings.push({
-                    id: 'supabase_bucket_listing',
-                    severity: publicOnes ? 'critical' : 'warning',
-                    title: 'Storage buckets are listable by anyone',
-                    detail: `The public key can list ${list.length} storage bucket(s)${publicOnes ? `; public: ${publicOnes}` : ''}.`,
-                    fix: 'Restrict bucket listing and mark buckets private unless public access is intentional; add storage RLS policies.',
-                    checker: 'supabase-probe',
-                    level: 2,
-                    endpoint: 'GET /storage/v1/bucket',
-                });
-            }
+    // One classifier for every probe: a redirect, a truncated or non-JSON 200, an
+    // error envelope — none of them says "no buckets". 401/403/404 and `[]` do.
+    const bv = classifyBody(buckets, 'json');
+    if (bv.kind === 'unknown')
+        lost.push(`storage (${bv.reason})`);
+    if (bv.kind === 'data') {
+        const parsed = bv.json;
+        const list = (Array.isArray(parsed) ? parsed : parsed?.buckets);
+        if (!Array.isArray(list)) {
+            lost.push('storage (unrecognized bucket listing)'); // a 200 we cannot read is a lost sub-check
+        }
+        else if (list.length > 0) {
+            const objs = list.map((b) => (typeof b === 'string' ? { name: b } : b));
+            const publicOnes = objs.filter((b) => b.public).map((b) => b.name ?? b.id ?? '(unnamed)').join(', ');
+            findings.push({
+                id: 'supabase_bucket_listing',
+                severity: publicOnes ? 'critical' : 'warning',
+                title: 'Storage buckets are listable by anyone',
+                detail: `The public key can list ${list.length} storage bucket(s)${publicOnes ? `; public: ${publicOnes}` : ''}.`,
+                fix: 'Restrict bucket listing and mark buckets private unless public access is intentional; add storage RLS policies.',
+                checker: 'supabase-probe',
+                level: 2,
+                endpoint: 'GET /storage/v1/bucket',
+            });
         }
-        catch {
-            storageErrored = true;
-        } // a 200 we cannot parse is a lost sub-check
     }
     if (rpc.length > 0) {
         findings.push({
@@ -242,8 +266,10 @@ export async function probeSupabase(opts) {
         });
     }
     const attempted = tables.length + 1; // tables + storage
-    const totalErr = errored + (storageErrored ? 1 : 0);
+    const totalErr = lost.length;
     const status = totalErr === 0 ? 'completed' : totalErr < attempted ? 'partial' : 'failed';
-    const note = totalErr > 0 ? `${totalErr}/${attempted} probe requests errored (5xx/429/timeout)` : undefined;
+    const note = totalErr > 0
+        ? `${totalErr}/${attempted} probe(s) not verified: ${lost.slice(0, 5).join(', ')}${totalErr > 5 ? ', …' : ''}`
+        : undefined;
     return { findings, run: { id: 'supabase-probe', level: 2, status, note } };
 }

package/dist/engine/checkers/deep/deps.js

@@ -1,61 +1,120 @@
 import { execFile } from 'node:child_process';
+const MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
 function run(cmd, args, cwd, timeoutMs) {
     return new Promise((resolve) => {
         execFile(cmd, args, { cwd, timeout: timeoutMs, maxBuffer: 20 * 1024 * 1024 }, (err, stdout) => {
             // audit tools exit non-zero when vulnerabilities are found; keep stdout.
             const e = err;
             const failedToSpawn = !!e && (e.code === 'ENOENT' || e.killed === true);
-            const code = e && typeof e.code === 'number' ? e.code : e ? 1 : 0;
+            const code = e ? (typeof e.code === 'number' ? e.code : null) : 0;
             resolve({ stdout: stdout || '', code, failedToSpawn });
         });
     });
 }
+/**
+ * Exit codes that mean "the audit ran and found something", per tool docs:
+ * npm/pnpm exit 1 when vulnerabilities exist; yarn v1 exits with a bitmask of
+ * the severities found (1 info … 16 critical, max 31). Anything else is a tool
+ * or registry error — a fake pnpm exiting 7 with an empty report once counted
+ * as a clean `completed` run.
+ */
+function isVulnsFoundExit(pm, code) {
+    if (pm === 'yarn')
+        return code >= 1 && code <= 31;
+    return code === 1;
+}
+const SEVERITY_FIELDS = ['info', 'low', 'moderate', 'high', 'critical'];
+/**
+ * Accept only a report whose severity counters are all present and numeric,
+ * with `total` (when present) equal to their sum. `{}` or a missing field is
+ * an unparseable report, never "0 vulnerabilities".
+ */
+function validCounts(v) {
+    if (typeof v !== 'object' || v === null)
+        return null;
+    const o = v;
+    const out = {};
+    for (const k of SEVERITY_FIELDS) {
+        const n = o[k];
+        if (typeof n !== 'number' || !Number.isInteger(n) || n < 0)
+            return null;
+        out[k] = n;
+    }
+    const sum = SEVERITY_FIELDS.reduce((a, k) => a + (out[k] ?? 0), 0);
+    if (o['total'] !== undefined) {
+        if (typeof o['total'] !== 'number' || o['total'] !== sum)
+            return null;
+        out['total'] = o['total'];
+    }
+    return out;
+}
 /**
  * Level 1: dependency vulnerability audit via the project's package manager.
  * Returns a status so an audit that could not run (offline, missing tool,
- * registry error) is never reported as "no vulnerabilities".
+ * registry error, garbage output) is never reported as "no vulnerabilities".
+ *
+ * `packageManagers` comes from detect(): the declared `packageManager` field
+ * first, then lockfile-detected managers in preference order — so [0] decides.
  */
 export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
-    const pm = packageManagers.includes('pnpm')
-        ? 'pnpm'
-        : packageManagers.includes('yarn')
-            ? 'yarn'
-            : packageManagers.includes('bun')
-                ? 'bun'
-                : 'npm';
+    const known = packageManagers.filter((m) => MANAGERS.has(m));
+    const pm = known[0] ?? 'npm';
+    const others = [...new Set(known.slice(1))];
     if (pm === 'bun') {
         return {
             findings: [],
             run: { id: 'deps', level: 1, status: 'unsupported', note: 'bun audit is not yet supported — run `bun audit` manually' },
         };
     }
+    // Several managers detected (a stale lockfile beside `packageManager`, or
+    // two lockfiles): the audit only covers the one we ran. Say so, visibly but
+    // not fatally — the audit itself did complete.
+    const conflict = others.length
+        ? `audited with ${pm}; ${others.join(', ')} lockfile(s)/declaration also present — remove the stale one so the audit covers what is actually installed`
+        : undefined;
+    const conflictFindings = conflict
+        ? [{
+                id: 'deps_manager_conflict',
+                severity: 'advisory',
+                title: 'Several package managers detected',
+                detail: `Dependency audit ran with ${pm}, but ${others.join(', ')} is also detected (lockfile or packageManager field).`,
+                fix: `Keep one package manager: delete the stale lockfile(s) or fix the \`packageManager\` field, so \`${pm} audit\` reflects the real dependency tree.`,
+                checker: 'deps',
+                level: 1,
+            }]
+        : [];
+    const withNote = (r) => (conflict ? { ...r, note: r.note ? `${r.note}; ${conflict}` : conflict } : r);
     const failed = (note) => ({
-        findings: [],
-        run: { id: 'deps', level: 1, status: 'failed', note },
+        findings: conflictFindings,
+        run: withNote({ id: 'deps', level: 1, status: 'failed', note }),
     });
     const res = await run(pm, ['audit', '--json'], root, timeoutMs);
     if (res.failedToSpawn)
         return failed(`${pm} not found or timed out`);
+    if (res.code === null)
+        return failed(`${pm} audit was terminated by a signal`);
+    // A non-zero exit that is not the documented "vulnerabilities found" code is
+    // a tool error, whatever stdout says.
+    if (res.code !== 0 && !isVulnsFoundExit(pm, res.code))
+        return failed(`${pm} audit exited with code ${res.code}`);
     if (!res.stdout.trim())
         return failed(`${pm} audit produced no output (offline or no lockfile?)`);
-    let counts;
+    let counts = null;
     let vulnMap = {};
     if (pm === 'yarn') {
-        let summary;
         for (const line of res.stdout.split('\n')) {
             const s = line.trim();
             if (!s.startsWith('{'))
                 continue;
             try {
                 const obj = JSON.parse(s);
-                if (obj.type === 'auditSummary' && obj.data?.vulnerabilities)
-                    summary = obj.data.vulnerabilities;
+                if (obj.type === 'auditSummary')
+                    counts = validCounts(obj.data?.vulnerabilities);
             }
             catch { /* skip */ }
         }
-        if (!summary)
-            return failed('could not parse yarn audit output');
-        counts = summary;
+        if (!counts)
+            return failed('unparseable audit output (no valid yarn auditSummary)');
     }
     else {
         let parsed;
@@ -68,22 +127,21 @@ export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
                 parsed = JSON.parse(line);
             }
             catch {
-                return failed('could not parse audit output');
+                return failed('unparseable audit output (not JSON)');
             }
         }
         // A valid JSON error envelope (e.g. registry unavailable) is NOT "clean".
-        if (parsed.error !== undefined || !parsed.metadata?.vulnerabilities) {
-            return failed('audit returned an error or an unrecognized shape');
+        if (typeof parsed !== 'object' || parsed === null || parsed.error !== undefined) {
+            return failed('audit returned an error envelope');
         }
-        counts = parsed.metadata.vulnerabilities;
+        counts = validCounts(parsed.metadata?.vulnerabilities);
+        if (!counts)
+            return failed('unparseable audit output (metadata.vulnerabilities missing or malformed)');
         vulnMap = parsed.vulnerabilities ?? {};
     }
-    const critical = counts.critical ?? 0;
-    const high = counts.high ?? 0;
-    const moderate = counts.moderate ?? 0;
-    const low = counts.low ?? 0;
-    const total = counts.total ?? critical + high + moderate + low;
-    const findings = [];
+    const { critical, high, moderate, low } = counts;
+    const total = counts.total ?? critical + high + moderate + low + counts.info;
+    const findings = [...conflictFindings];
     if (total > 0) {
         const severity = critical + high > 0 ? 'critical' : moderate > 0 ? 'warning' : 'info';
         findings.push({
@@ -114,5 +172,5 @@ export async function auditDeps(root, packageManagers, timeoutMs = 60000) {
     }
     // "completed" with zero findings means genuinely no known vulns — the status,
     // not an info finding, records that the check ran cleanly.
-    return { findings, run: { id: 'deps', level: 1, status: 'completed' } };
+    return { findings, run: withNote({ id: 'deps', level: 1, status: 'completed' }) };
 }

package/dist/engine/checkers/live/endpoint-probe.js

@@ -1,30 +1,15 @@
 import { concretePath } from '../../endpoints.js';
-import { isErr, request, sleep } from '../../net/http.js';
-/** Real, non-empty JSON payload — `[]`, `{}` and `{"error":...}` are not data. */
-function looksLikeData(body) {
-    const t = body.trim();
-    if (t.length < 2 || !(t.startsWith('{') || t.startsWith('[')))
-        return false;
-    try {
-        const v = JSON.parse(t);
-        if (Array.isArray(v))
-            return v.length > 0;
-        if (v && typeof v === 'object') {
-            const o = v;
-            if ('error' in o || 'errors' in o)
-                return false;
-            return Object.keys(o).length > 0;
-        }
-        return false;
-    }
-    catch {
-        return false;
-    }
-}
+import { classifyBody, request, sleep } from '../../net/http.js';
 /**
- * Hit each GET-able endpoint with no authentication. A 200 with JSON data is a
+ * Hit each GET-able endpoint with no authentication. A 2xx with JSON data is a
  * candidate "no access control" hole — reported as a warning to confirm, since
  * some endpoints are legitimately public.
+ *
+ * Every response is classified (see classifyBody): only data / empty / denied
+ * count as a checked endpoint. A 404 (the inventory guessed the id or the
+ * prefix), an HTML page where JSON was expected, a redirect, a truncated or
+ * unparseable body all mean the endpoint was NOT verified — the run is
+ * `partial` and the note says which ones.
  */
 export async function probeEndpointsUnauth(appUrl, endpoints, rateLimitMs = 100) {
     const base = appUrl.replace(/\/$/, '');
@@ -36,18 +21,27 @@ export async function probeEndpointsUnauth(appUrl, endpoints, rateLimitMs = 100)
     if (targets.length === 0) {
         return { findings, run: { id: 'endpoint-probe', level: 2, status: 'skipped', note: 'no GET endpoints discovered' } };
     }
-    let errors = 0;
+    let verified = 0;
+    const unverified = []; // "GET /path (reason)"
     for (const e of targets) {
-        await sleep(rateLimitMs);
         const path = concretePath(e.path).replace(/^\/?/, '/');
-        const res = await request(base + path, { headers: { accept: 'application/json' } });
-        if (isErr(res) || res.status === 429 || res.status >= 500 || (res.status >= 300 && res.status < 400)) {
-            errors++;
+        // A route whose mount prefix is unknown would be probed at a wrong URL, and
+        // a 404 there says nothing about the real one.
+        if (e.unresolved) {
+            unverified.push(`GET ${path} (${e.note ?? 'unresolved route prefix'})`);
             continue;
         }
-        if (res.status !== 200)
+        await sleep(rateLimitMs);
+        const res = await request(base + path, { headers: { accept: 'application/json' } });
+        const verdict = classifyBody(res, 'json');
+        // `absent` is lumped with unknown on purpose: the id/prefix was guessed, so a
+        // 404 does not prove the real resource is protected.
+        if (verdict.kind === 'unknown' || verdict.kind === 'absent') {
+            unverified.push(`GET ${path} (${verdict.reason})`);
             continue;
-        if (!looksLikeData(res.body))
+        }
+        verified++;
+        if (verdict.kind !== 'data')
             continue;
         findings.push({
             id: 'endpoint_no_auth',
@@ -61,10 +55,12 @@ export async function probeEndpointsUnauth(appUrl, endpoints, rateLimitMs = 100)
             evidence: `curl '${base}${path}'`,
         });
     }
-    const status = errors >= targets.length ? 'failed' : errors > 0 || dropped > 0 ? 'partial' : 'completed';
+    const status = verified === 0 ? 'failed' : unverified.length > 0 || dropped > 0 ? 'partial' : 'completed';
     const notes = [];
-    if (errors > 0)
-        notes.push(`${errors}/${targets.length} endpoint requests errored`);
+    if (unverified.length > 0) {
+        const shown = unverified.slice(0, 5).join(', ');
+        notes.push(`${unverified.length}/${targets.length} endpoint(s) not verified: ${shown}${unverified.length > 5 ? ', …' : ''}`);
+    }
     if (dropped > 0)
         notes.push(`only ${MAX}/${candidates.length} endpoints probed (cap)`);
     const note = notes.length ? notes.join('; ') : undefined;

package/dist/engine/checkers/live/http-checks.js

@@ -1,4 +1,4 @@
-import { isErr, request, requestFollow, unreliable } from '../../net/http.js';
+import { classifyBody, isErr, looksLikeHtml, requestFollow, unreliable } from '../../net/http.js';
 const EXPOSED = [
     { path: '.env', signature: /^[A-Z0-9_]+=.+/m, title: '.env file served publicly', severity: 'critical' },
     { path: '.env.local', signature: /^[A-Z0-9_]+=.+/m, title: '.env.local served publicly', severity: 'critical' },
@@ -14,27 +14,34 @@ const SECURITY_HEADERS = [
     { header: 'x-frame-options', id: 'missing_xfo', title: 'Missing X-Frame-Options' },
     { header: 'x-content-type-options', id: 'missing_xcto', title: 'Missing X-Content-Type-Options' },
 ];
-function looksLikeHtml(body) {
-    return /<!doctype html|<html[\s>]/i.test(body.slice(0, 400));
-}
 /** Passive live checks on a deployed URL: exposed files + security headers. */
 export async function checkLiveSite(appUrl) {
     const base = appUrl.replace(/\/$/, '');
     const findings = [];
-    // Track every file probe: a timeout/5xx/429 there is a lost sub-check, not "file absent".
-    let fileErrors = 0;
+    // Track every file probe: a lost sub-check (timeout/5xx/429, a redirect we could
+    // not follow, a truncated body) is NOT "file absent" — it goes in the note.
+    const fileUnverified = [];
     for (const probe of EXPOSED) {
-        const res = await request(`${base}/${probe.path}`);
-        if (isErr(res) || res.status === 429 || res.status >= 500) {
-            fileErrors++;
+        // A GET of a static file is safe to follow: the file may sit behind a same-origin
+        // hop (e.g. `/.env` → `/files/.env`). A hop off the origin is refused and lands
+        // below as unknown, so a redirect is never taken as evidence of absence.
+        const res = await requestFollow(`${base}/${probe.path}`);
+        const verdict = classifyBody(res, 'any');
+        // 4xx (absent/denied) and an empty 2xx are real answers: no file content was handed out.
+        if (verdict.kind === 'absent' || verdict.kind === 'denied' || verdict.kind === 'empty')
             continue;
-        }
-        if (res.status !== 200)
-            continue; // 404 etc. = that file is simply not served
-        if (looksLikeHtml(res.body))
+        const twoXx = !isErr(res) && res.status >= 200 && res.status < 300;
+        if (twoXx && looksLikeHtml(res.body))
             continue; // SPA catch-all, not the real file
-        if (!probe.signature.test(res.body))
+        // A 2xx body carrying the signature is positive evidence even when truncated —
+        // the cap does not make a leaked file un-leaked.
+        const served = twoXx && probe.signature.test(res.body);
+        if (!served) {
+            // Truncated without a signature, a redirect off the origin, a 5xx…: not verified.
+            if (verdict.kind === 'unknown')
+                fileUnverified.push(`/${probe.path} (${verdict.reason})`);
             continue;
+        }
         findings.push({
             id: `exposed_${probe.path.replace(/[^a-z0-9]/gi, '_')}`,
             severity: probe.severity,
@@ -103,12 +110,13 @@ export async function checkLiveSite(appUrl) {
     // losing all of them = failed.
     const rootBad = unreliable(root) || (!isErr(root) && (root.status < 200 || root.status >= 300));
     const truncated = !isErr(root) && root.truncated === true;
+    const fileErrors = fileUnverified.length;
     const status = rootBad && fileErrors === EXPOSED.length ? 'failed' : rootBad || fileErrors > 0 || truncated ? 'partial' : 'completed';
     const notes = [];
     if (rootBad)
         notes.push(isErr(root) ? `could not reach ${base}/: ${root.error}` : `no usable 2xx page (HTTP ${root.status}) at ${base}/`);
     if (fileErrors > 0)
-        notes.push(`${fileErrors}/${EXPOSED.length} exposed-file probes errored`);
+        notes.push(`${fileErrors}/${EXPOSED.length} exposed-file probes not verified: ${fileUnverified.slice(0, 4).join(', ')}${fileErrors > 4 ? ', …' : ''}`);
     if (!isErr(root) && root.truncated)
         notes.push('response body hit the 2 MB cap — content past it was not inspected');
     return { findings, run: { id: 'live-site', level: 2, status, note: notes.length ? notes.join('; ') : undefined } };