itworksbut 0.5.0 → 0.7.0

package/README.md

@@ -6,7 +6,19 @@ It focuses on common "it works, but..." risks often found in AI-generated or rus
 
 For every finding, ItWorksBut gives you a copy-ready fix prompt you can paste into your coding agent. It does not just say what is wrong; it tells your AI exactly what to inspect, what to change, and what not to leak.
 
-It only reads files and reports findings. It does not call external APIs, does not send telemetry, and does not modify the scanned project unless you explicitly ask it to write `todo.md` with `--todo`.
+It mostly reads files and reports findings. It does not send telemetry. The outdated-package check may invoke your local package manager, and the CLI only writes files when you explicitly ask for `todo.md` with `--todo` or `report.md` with `--report`.
+
+## Table of Contents
+
+- [Installation](#installation)
+- [Quick Start](#quick-start)
+- [Options](#options)
+- [Terminal Experience](#terminal-experience)
+- [GitHub Actions](#github-actions)
+- [Configuration](#configuration)
+- [Example Output](#example-output)
+- [What It Detects](#what-it-detects)
+- [What It Does Not Guarantee](#what-it-does-not-guarantee)
 
 ## Installation
 
@@ -37,10 +49,13 @@ Common commands:
 
 ```sh
 itworksbut scan --path .
+itworksbut deps
+itworksbut stress
 itworksbut scan --fail-on high
 itworksbut scan --json
 itworksbut scan --sarif > itworksbut.sarif
 itworksbut scan --todo
+itworksbut scan --report
 itworksbut scan --config itworksbut.config.json
 itworksbut scan --verbose
 itworksbut --version
@@ -50,14 +65,24 @@ itworksbut --version
 
 ```text
 itworksbut scan [options]
+itworksbut deps [options]
+itworksbut stress [options]
 ```
 
+- `deps`: Run only dependency checks, including lockfile hygiene, install-script risk, audit script availability, and outdated packages.
+- `stress`: Discover API endpoints and run a controlled Artillery load test against local or explicitly authorized targets.
 - `--path <path>`: Scan a specific project directory. Defaults to the current directory.
 - `--config <path>`: Use a custom config file. Defaults to `itworksbut.config.json` when present.
 - `--fail-on <severity>`: Exit with code `1` when a finding at or above the severity exists. Levels: `critical`, `high`, `medium`, `low`, `info`. Default: `low`.
+- `--target <url>`: Stress-test target. Defaults to `http://localhost:3000`. External targets require `--i-own-this`.
+- `--duration <seconds>`: Stress-test duration. Default `30`, maximum `300`.
+- `--arrival-rate <number>`: Arrival rate in requests per second. Default `5`, maximum `50`.
+- `--max-vusers <number>`: Virtual user cap. Default `50`, maximum `100`.
+- `--i-own-this`: Required for non-local stress-test targets.
 - `--json`: Print machine-readable JSON only. No banner, colors, spinner, table, or extra text.
 - `--sarif`: Print SARIF JSON for GitHub Code Scanning. No banner, colors, spinner, table, or extra text.
 - `--todo`: Write an AI-ready `todo.md` into the scanned project with prioritized findings, fix prompts, and acceptance criteria.
+- `--report`: Write a Markdown `report.md` into the current working directory.
 - `--verbose`: Include scanner warnings and extra metadata in console output.
 - `--quiet`: Print only the summary.
 - `--no-color`: Disable colored output.
@@ -97,6 +122,24 @@ itworksbut scan --todo
 
 This writes `todo.md` to the scanned project. The file is ordered by severity and includes agent rules, exact fix prompts, locations, recommendations, and final verification checkboxes.
 
+To create a Markdown scan report:
+
+```sh
+itworksbut scan --report
+```
+
+This writes `report.md` to the current working directory with check statuses, summaries, details, and recommendations.
+
+To run a controlled API stress test:
+
+```sh
+itworksbut stress
+itworksbut stress --target https://my-own-api.example --i-own-this
+itworksbut stress --report
+```
+
+`stress` only tests local targets by default. For external hosts, pass `--i-own-this` to confirm that you own the target or have explicit authorization. Mutating endpoints such as `POST`, `PUT`, `PATCH`, and `DELETE` are discovered but skipped automatically.
+
 ## GitHub Actions
 
 ```yaml
@@ -166,38 +209,10 @@ release/**
 ## Example Output
 
 ![screenshot of an example output](/assets/medium_problems.webp)
-✖ CRITICAL It works, but your .env is tracked.
-✔ Check: env.env-file-tracked
-📁 File: .env
-🤔 Why: .env appears to be tracked by git. Secrets may be exposed.
-🤖 prompt: You are a senior security engineer working in this repository. Fix the ItWorksBut finding env.env-file-tracked at .env. Treat this as a concrete finding. Problem: .env appears to be tracked by git. Secrets may be exposed. Required change: Remove tracked env files from git, add safe examples such as .env.example, and make sure any exposed credentials are treated as compromised. Do not print, log, or preserve raw secret values; use placeholders only. Keep existing behavior intact where possible, add or update focused tests when useful, and do not silence the check unless the underlying risk is actually fixed.
-
-▲ HIGH It works, but your SQL query is one template string away from pain.
-✔ Check: database.raw-sql-interpolation
-📁 File: src/db.js:12
-🤔 Why: Possible SQL injection risk: raw SQL appears to be built with template string interpolation.
-🤖 prompt: You are a senior security engineer working in this repository. Fix the ItWorksBut finding database.raw-sql-interpolation at src/db.js:12. This finding is heuristic, so inspect the code first and only change behavior when the risk is real. Problem: Possible SQL injection risk: raw SQL appears to be built with template string interpolation. Required change: Replace SQL string interpolation or concatenation with parameterized queries, prepared statements, or a safe ORM query builder. Keep existing behavior intact where possible, add or update focused tests when useful, and do not silence the check unless the underlying risk is actually fixed.
-
-SUMMARY
-
-- ship status: DO NOT SHIP
-- Fix the red stuff before production.
-- total findings: 2
-- critical: 1
-- high: 1
-- medium: 0
-- low: 0
-- info: 0
-- fail-on: high
-- exit decision: 1
-
-```
-
-Secret-like findings never print the full secret value. Findings report the file, line, and secret type where possible.
 
 ## What It Detects
 
-The baseline includes 50 modular checks:
+The baseline includes 51 modular checks:
 
 - `git.gitignore-missing`
 - `git.gitignore-incomplete`
@@ -211,6 +226,7 @@ The baseline includes 50 modular checks:
 - `dependencies.multiple-lockfiles`
 - `dependencies.install-scripts-risk`
 - `dependencies.audit-script-missing`
+- `dependencies.outdated-packages`
 - `package.scripts-missing`
 - `ci.no-ci-config`
 - `ci.npm-install-instead-of-npm-ci`
@@ -257,4 +273,3 @@ Each check is a plain ESM module with an `id`, metadata, and async `run(context)
 ItWorksBut is a static heuristic scanner, not a pentest, SAST replacement, dependency vulnerability database, or runtime security monitor. Findings intentionally use wording such as "possible", "potential", and "appears to" when a check is heuristic.
 
 Use it as a CI guardrail for common project hygiene and security mistakes. For production systems, combine it with code review, tests, dependency scanning, secrets scanning, threat modeling, and focused security assessment.
-```

package/bin/itworksbut.js

@@ -10,6 +10,8 @@ import { reportConsole } from '../src/reporters/consoleReporter.js';
 import { reportJson } from '../src/reporters/jsonReporter.js';
 import { reportSarif } from '../src/reporters/sarifReporter.js';
 import { writeTodoReport } from '../src/reporters/todoReporter.js';
+import { writeMarkdownReport } from '../src/reporters/markdownReport.js';
+import { runStressCommand } from '../src/commands/stress.js';
 
 async function main() {
     const args = parseArgs(process.argv.slice(2));
@@ -24,7 +26,11 @@ async function main() {
         return 0;
     }
 
-    if (args.command !== 'scan') {
+    if (args.command === 'stress') {
+        return await runStressCommand(args);
+    }
+
+    if (!['scan', 'deps'].includes(args.command)) {
         printUsage();
         return 2;
     }
@@ -41,6 +47,7 @@ async function main() {
             configPath: args.config,
             failOn: args.failOn,
             verbose: args.verbose,
+            categories: args.command === 'deps' ? ['dependencies'] : undefined,
         });
         if (spinner) spinner.succeed('Scan complete. Now the receipts.');
     } catch (error) {
@@ -59,6 +66,14 @@ async function main() {
         reportConsole(result, args);
     }
 
+    if (args.report) {
+        const report = await writeMarkdownReport(result);
+        if (!args.json && !args.sarif) {
+            const verb = report.overwritten ? 'Overwrote' : 'Wrote';
+            process.stdout.write(`${verb} scan report: ${report.filePath}\n`);
+        }
+    }
+
     return getExitCode(result.findings, result.config.failOn);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "itworksbut",
-    "version": "0.5.0",
+    "version": "0.7.0",
     "description": "Static CI checks for common security, repo, dependency, build, and deployment risks in JavaScript vibe coding projects.",
     "type": "module",
     "bin": {
@@ -36,6 +36,7 @@
     ],
     "license": "MIT",
     "dependencies": {
+        "artillery": "^2.0.30",
         "boxen": "^8.0.1",
         "chalk": "^5.6.2",
         "cli-table3": "^0.6.5",

package/src/checks/dependencies/outdated-packages.js

@@ -0,0 +1,297 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { detectOutdatedPackageManager, getOutdatedCommand } from "../../utils/packageManager.js";
+
+const execFileAsync = promisify(execFile);
+const CHECK_ID = "dependencies.outdated-packages";
+const CHECK_TITLE = "Outdated packages";
+const COMMAND_TIMEOUT_MS = 30_000;
+const COMMAND_MAX_BUFFER = 10 * 1024 * 1024;
+
+export default {
+  id: CHECK_ID,
+  title: CHECK_TITLE,
+  category: "dependencies",
+  severity: "info",
+  tags: ["dependencies", "maintenance"],
+  run: async (context) => {
+    const result = await runOutdatedPackagesCheck(context);
+    return { findings: [], result };
+  }
+};
+
+export async function runOutdatedPackagesCheck(context, options = {}) {
+  const detected = detectOutdatedPackageManager({
+    packageJson: context.packageJson,
+    files: context.allFiles
+  });
+
+  if (detected.status === "skip") {
+    return checkResult({
+      status: "skip",
+      summary: detected.summary,
+      metadata: { reason: "missing-package-json" }
+    });
+  }
+
+  const commandResult = await runOutdatedCommand(detected.manager, context.rootPath, options);
+  if (isMissingCommand(commandResult)) {
+    return checkResult({
+      status: "fail",
+      summary: `${detected.manager} is not installed or could not be found.`,
+      details: [
+        {
+          message: `${detected.manager} is not installed or could not be found.`,
+          command: renderCommand(commandResult),
+          exitCode: commandResult.exitCode
+        }
+      ],
+      metadata: { packageManager: detected.manager }
+    });
+  }
+
+  const parsed = parseOutdatedOutput(detected.manager, commandResult.stdout, context.packageJson);
+  if (!parsed.ok) {
+    if (!hasCommandFailure(commandResult) && isEmptyOutput(commandResult.stdout)) {
+      return checkResult({
+        status: "pass",
+        summary: "all dependencies are up to date",
+        details: [],
+        metadata: { packageManager: detected.manager }
+      });
+    }
+
+    return checkResult({
+      status: "fail",
+      summary: `${detected.manager} outdated returned output that could not be parsed.`,
+      details: [
+        {
+          message: parsed.error,
+          command: renderCommand(commandResult),
+          exitCode: commandResult.exitCode,
+          stderr: trimText(commandResult.stderr)
+        }
+      ],
+      metadata: { packageManager: detected.manager }
+    });
+  }
+
+  if ((hasCommandFailure(commandResult) || hasEmptyExitOneFailure(commandResult)) && parsed.packages.length === 0) {
+    return checkResult({
+      status: "fail",
+      summary: `${detected.manager} outdated failed.`,
+      details: [
+        {
+          message: trimText(commandResult.stderr) || "Command exited with code " + commandResult.exitCode + ".",
+          command: renderCommand(commandResult),
+          exitCode: commandResult.exitCode
+        }
+      ],
+      metadata: { packageManager: detected.manager }
+    });
+  }
+
+  if (parsed.packages.length === 0) {
+    return checkResult({
+      status: "pass",
+      summary: "all dependencies are up to date",
+      details: [],
+      metadata: { packageManager: detected.manager }
+    });
+  }
+
+  return checkResult({
+    status: "warn",
+    summary: `${parsed.packages.length} ${parsed.packages.length === 1 ? "package" : "packages"} outdated`,
+    details: parsed.packages,
+    metadata: { packageManager: detected.manager }
+  });
+}
+
+export async function runOutdatedCommand(manager, rootPath, options = {}) {
+  const runCommand = options.runCommand || execCommand;
+  const { command, args } = getOutdatedCommand(manager);
+  return await runCommand(command, args, { cwd: rootPath });
+}
+
+export function parseOutdatedOutput(manager, stdout, packageJson = {}) {
+  const output = String(stdout || "").trim();
+  if (!output) return { ok: true, packages: [] };
+
+  try {
+    if (manager === "yarn") {
+      return { ok: true, packages: parseYarnOutput(output, packageJson) };
+    }
+
+    const parsed = JSON.parse(output);
+    return { ok: true, packages: normalizeOutdatedData(parsed, packageJson) };
+  } catch (error) {
+    return {
+      ok: false,
+      packages: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+export function normalizeOutdatedData(data, packageJson = {}) {
+  if (!data || typeof data !== "object") return [];
+
+  if (Array.isArray(data)) {
+    return data
+      .map((entry) => normalizePackageEntry(entry.name || entry.package, entry, packageJson))
+      .filter(Boolean);
+  }
+
+  return Object.entries(data)
+    .map(([name, entry]) => normalizePackageEntry(name, entry, packageJson))
+    .filter(Boolean);
+}
+
+async function execCommand(command, args, options) {
+  try {
+    const result = await execFileAsync(command, args, {
+      cwd: options.cwd,
+      timeout: COMMAND_TIMEOUT_MS,
+      maxBuffer: COMMAND_MAX_BUFFER
+    });
+    return {
+      command,
+      args,
+      stdout: result.stdout || "",
+      stderr: result.stderr || "",
+      exitCode: 0
+    };
+  } catch (error) {
+    return {
+      command,
+      args,
+      stdout: error?.stdout || "",
+      stderr: error?.stderr || error?.message || "",
+      exitCode: error?.code ?? null,
+      signal: error?.signal,
+      error
+    };
+  }
+}
+
+function parseYarnOutput(output, packageJson) {
+  const directJson = tryJson(output);
+  if (directJson.ok) {
+    if (directJson.value?.type === "table") return parseYarnTable(directJson.value.data, packageJson);
+    return normalizeOutdatedData(directJson.value, packageJson);
+  }
+
+  const records = output
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => tryJson(line))
+    .filter((record) => record.ok)
+    .map((record) => record.value);
+
+  const tableRecord = records.find((record) => record?.type === "table" && record.data);
+  if (tableRecord) return parseYarnTable(tableRecord.data, packageJson);
+
+  const packageRecords = records
+    .filter((record) => record?.data && typeof record.data === "object")
+    .map((record) => record.data);
+  if (packageRecords.length > 0) return normalizeOutdatedData(packageRecords, packageJson);
+
+  throw new Error("No parseable Yarn outdated JSON records were found.");
+}
+
+function parseYarnTable(data, packageJson) {
+  const head = Array.isArray(data?.head) ? data.head.map((value) => String(value).toLowerCase()) : [];
+  const body = Array.isArray(data?.body) ? data.body : [];
+
+  return body.map((row) => {
+    const entry = {
+      name: row[indexOf(head, "package", 0)],
+      current: row[indexOf(head, "current", 1)],
+      wanted: row[indexOf(head, "wanted", 2)],
+      latest: row[indexOf(head, "latest", 3)],
+      type: row[indexOf(head, "package type", 4)]
+    };
+    return normalizePackageEntry(entry.name, entry, packageJson);
+  }).filter(Boolean);
+}
+
+function normalizePackageEntry(name, entry, packageJson) {
+  if (!name || !entry || typeof entry !== "object") return null;
+
+  const current = stringValue(entry.current ?? entry.installed ?? entry.version);
+  const wanted = stringValue(entry.wanted ?? entry.latest);
+  const latest = stringValue(entry.latest ?? entry.wanted);
+
+  if (!current && !wanted && !latest) return null;
+
+  return {
+    name: String(name),
+    current: current || "unknown",
+    wanted: wanted || "unknown",
+    latest: latest || "unknown",
+    type: stringValue(entry.type ?? entry.dependencyType ?? entry.packageType) || inferDependencyType(name, packageJson)
+  };
+}
+
+function inferDependencyType(name, packageJson = {}) {
+  if (Object.hasOwn(packageJson.dependencies || {}, name)) return "dependencies";
+  if (Object.hasOwn(packageJson.devDependencies || {}, name)) return "devDependencies";
+  if (Object.hasOwn(packageJson.peerDependencies || {}, name)) return "peerDependencies";
+  if (Object.hasOwn(packageJson.optionalDependencies || {}, name)) return "optionalDependencies";
+  return "dependencies";
+}
+
+function checkResult(result) {
+  return {
+    id: CHECK_ID,
+    title: CHECK_TITLE,
+    category: "dependencies",
+    details: [],
+    ...result
+  };
+}
+
+function hasCommandFailure(result) {
+  return result.exitCode !== 0 && result.exitCode !== 1;
+}
+
+function hasEmptyExitOneFailure(result) {
+  return result.exitCode === 1 && isEmptyOutput(result.stdout) && !isEmptyOutput(result.stderr);
+}
+
+function isMissingCommand(result) {
+  return result.exitCode === "ENOENT" || result.error?.code === "ENOENT";
+}
+
+function isEmptyOutput(value) {
+  return String(value || "").trim() === "";
+}
+
+function renderCommand(result) {
+  return [result.command, ...(result.args || [])].filter(Boolean).join(" ");
+}
+
+function trimText(value) {
+  const normalized = String(value || "").trim();
+  return normalized.length > 1000 ? `${normalized.slice(0, 1000)}...` : normalized;
+}
+
+function tryJson(value) {
+  try {
+    return { ok: true, value: JSON.parse(value) };
+  } catch {
+    return { ok: false, value: null };
+  }
+}
+
+function indexOf(head, name, fallback) {
+  const index = head.indexOf(name);
+  return index === -1 ? fallback : index;
+}
+
+function stringValue(value) {
+  if (value === undefined || value === null || value === "") return "";
+  return String(value);
+}

package/src/checks/index.js

@@ -10,6 +10,7 @@ import lockfileMissing from "./dependencies/lockfile-missing.js";
 import multipleLockfiles from "./dependencies/multiple-lockfiles.js";
 import installScriptsRisk from "./dependencies/install-scripts-risk.js";
 import auditScriptMissing from "./dependencies/audit-script-missing.js";
+import outdatedPackages from "./dependencies/outdated-packages.js";
 import packageScriptsMissing from "./package/scripts-missing.js";
 import noCiConfig from "./ci/no-ci-config.js";
 import npmInstallInsteadOfNpmCi from "./ci/npm-install-instead-of-npm-ci.js";
@@ -62,6 +63,7 @@ export default [
   multipleLockfiles,
   installScriptsRisk,
   auditScriptMissing,
+  outdatedPackages,
   packageScriptsMissing,
   noCiConfig,
   npmInstallInsteadOfNpmCi,

package/src/cli/output.js

@@ -5,15 +5,23 @@ export function printUsage() {
 
 Usage:
   itworksbut scan [options]
+  itworksbut deps [options]
+  itworksbut stress [options]
 
 Options:
   --path <path>       Project path to scan. Defaults to current directory.
   --config <path>     Optional itworksbut.config.json path.
   --fail-on <level>   Exit 1 when findings meet or exceed this severity.
                      Levels: critical, high, medium, low, info. Default: low.
+  --target <url>      Stress-test target. Defaults to http://localhost:3000.
+  --duration <sec>    Stress-test duration. Default: 30, max: 300.
+  --arrival-rate <n>  Stress-test arrival rate. Default: 5, max: 50.
+  --max-vusers <n>    Stress-test virtual user cap. Default: 50, max: 100.
+  --i-own-this        Required to stress-test non-local targets.
   --json              Print machine-readable JSON.
   --sarif             Print SARIF for GitHub Code Scanning.
   --todo              Write an AI-ready todo.md to the scanned project.
+  --report            Write a Markdown scan report.md to the current directory.
   --no-color          Disable color styling.
   --no-banner         Disable the intro banner.
   --quiet             Print only the summary.

package/src/cli/parseArgs.js

@@ -1,5 +1,5 @@
-const FLAG_WITH_VALUE = new Set(["--fail-on", "--config", "--path"]);
-const BOOLEAN_FLAGS = new Set(["--json", "--sarif", "--todo", "--verbose", "--help", "-h", "--version", "-v", "--no-color", "--no-banner", "--quiet"]);
+const FLAG_WITH_VALUE = new Set(["--fail-on", "--config", "--path", "--target", "--duration", "--arrival-rate", "--max-vusers"]);
+const BOOLEAN_FLAGS = new Set(["--json", "--sarif", "--todo", "--report", "--i-own-this", "--verbose", "--help", "-h", "--version", "-v", "--no-color", "--no-banner", "--quiet"]);
 
 export function parseArgs(argv) {
   const args = {
@@ -10,6 +10,12 @@ export function parseArgs(argv) {
     json: false,
     sarif: false,
     todo: false,
+    report: false,
+    target: undefined,
+    duration: undefined,
+    arrivalRate: undefined,
+    maxVusers: undefined,
+    iOwnThis: false,
     verbose: false,
     noColor: false,
     noBanner: false,
@@ -48,6 +54,8 @@ export function parseArgs(argv) {
       if (token === "--json") args.json = true;
       if (token === "--sarif") args.sarif = true;
       if (token === "--todo") args.todo = true;
+      if (token === "--report") args.report = true;
+      if (token === "--i-own-this") args.iOwnThis = true;
       if (token === "--verbose") args.verbose = true;
       if (token === "--no-color") args.noColor = true;
       if (token === "--no-banner") args.noBanner = true;
@@ -69,5 +77,9 @@ function assignValue(args, flag, value) {
   if (flag === "--fail-on") args.failOn = value;
   else if (flag === "--config") args.config = value;
   else if (flag === "--path") args.path = value;
+  else if (flag === "--target") args.target = value;
+  else if (flag === "--duration") args.duration = value;
+  else if (flag === "--arrival-rate") args.arrivalRate = value;
+  else if (flag === "--max-vusers") args.maxVusers = value;
   else throw new Error(`Unknown argument: ${flag}`);
 }

package/src/commands/stress.js

@@ -0,0 +1,114 @@
+import path from "node:path";
+import { validateStressOptions } from "../utils/targetSafety.js";
+import { discoverEndpoints } from "../stress/discoverEndpoints.js";
+import { createArtilleryConfig } from "../stress/stressConfig.js";
+import { runArtillery } from "../stress/artilleryRunner.js";
+import { parseArtilleryResult } from "../stress/stressResultParser.js";
+import { reportStressConsole } from "../stress/stressRenderer.js";
+import { writeStressMarkdownReport } from "../reporters/stressMarkdownReport.js";
+
+export async function runStressCommand(args, options = {}) {
+  if (args.todo || args.sarif) {
+    throw new Error("The stress command supports console output, --json, and --report.");
+  }
+
+  const result = await runStress({
+    rootPath: path.resolve(args.path || "."),
+    ...validateStressOptions(args)
+  }, options);
+
+  if (args.json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+  } else {
+    reportStressConsole(result, args);
+  }
+
+  if (args.report) {
+    const report = await writeStressMarkdownReport(result);
+    if (!args.json && !args.quiet) {
+      const verb = report.overwritten ? "Overwrote" : "Wrote";
+      process.stdout.write(`${verb} stress report: ${report.filePath}\n`);
+    }
+  }
+
+  return result.status === "fail" ? 1 : 0;
+}
+
+export async function runStress(options, runnerOptions = {}) {
+  const startedAt = new Date();
+  const discovery = await discoverEndpoints(options.rootPath);
+  const baseDetails = {
+    target: options.target,
+    duration: options.duration,
+    arrivalRate: options.arrivalRate,
+    maxVusers: options.maxVusers,
+    endpointsFound: discovery.endpoints.length,
+    safeEndpoints: discovery.safeEndpoints.length,
+    skippedEndpoints: discovery.skippedEndpoints,
+    startedAt: startedAt.toISOString()
+  };
+
+  if (discovery.endpoints.length === 0) {
+    return stressResult({
+      status: "skip",
+      summary: "No API endpoints found.",
+      details: {
+        ...baseDetails,
+        testedEndpoints: [],
+        warnings: 0,
+        failed: 0,
+        completedAt: new Date().toISOString()
+      }
+    });
+  }
+
+  if (discovery.safeEndpoints.length === 0) {
+    return stressResult({
+      status: "fail",
+      summary: "No safe GET/HEAD endpoints can be tested automatically.",
+      details: {
+        ...baseDetails,
+        testedEndpoints: [],
+        warnings: 0,
+        failed: 1,
+        completedAt: new Date().toISOString()
+      }
+    });
+  }
+
+  const config = createArtilleryConfig({
+    target: options.target,
+    duration: options.duration,
+    arrivalRate: options.arrivalRate,
+    maxVusers: options.maxVusers,
+    endpoints: discovery.safeEndpoints
+  });
+
+  const artillery = await runArtillery(config, {
+    rootPath: options.rootPath,
+    duration: options.duration,
+    ...runnerOptions
+  });
+  const parsed = parseArtilleryResult(artillery, discovery.safeEndpoints);
+
+  return stressResult({
+    status: parsed.status,
+    summary: parsed.summary,
+    details: {
+      ...baseDetails,
+      testedEndpoints: parsed.testedEndpoints,
+      warnings: parsed.warnings,
+      failed: parsed.failed,
+      artilleryError: parsed.error,
+      completedAt: new Date().toISOString()
+    }
+  });
+}
+
+function stressResult(result) {
+  return {
+    id: "stress-test",
+    title: "API stress test",
+    ...result
+  };
+}