kubeagent 0.1.35 → 0.1.36

package/dist/detector/image-parser.test.js

@@ -0,0 +1,87 @@
+import { describe, it, expect } from "vitest";
+import { parseImage, normalizeVersion, majorMinor, major } from "./image-parser.js";
+describe("parseImage", () => {
+    it("parses a bare image name", () => {
+        expect(parseImage("nginx")).toEqual({
+            registry: "docker.io",
+            repository: "library/nginx",
+            name: "nginx",
+            tag: "latest",
+            digest: undefined,
+        });
+    });
+    it("parses a bare image with a tag", () => {
+        expect(parseImage("nginx:1.24.0")).toMatchObject({
+            registry: "docker.io",
+            repository: "library/nginx",
+            name: "nginx",
+            tag: "1.24.0",
+        });
+    });
+    it("parses a docker hub user/repo image", () => {
+        expect(parseImage("bitnami/postgresql:15")).toMatchObject({
+            registry: "docker.io",
+            repository: "bitnami/postgresql",
+            name: "postgresql",
+            tag: "15",
+        });
+    });
+    it("parses a custom registry", () => {
+        expect(parseImage("quay.io/prometheus/prometheus:v2.45.0")).toMatchObject({
+            registry: "quay.io",
+            repository: "prometheus/prometheus",
+            name: "prometheus",
+            tag: "v2.45.0",
+        });
+    });
+    it("parses registry.k8s.io single-segment paths without forcing library/", () => {
+        expect(parseImage("registry.k8s.io/etcd:3.5.9-0")).toMatchObject({
+            registry: "registry.k8s.io",
+            repository: "etcd",
+            name: "etcd",
+            tag: "3.5.9-0",
+        });
+    });
+    it("parses a registry with a port", () => {
+        expect(parseImage("localhost:5000/mything:1.0")).toMatchObject({
+            registry: "localhost:5000",
+            repository: "mything",
+            name: "mything",
+            tag: "1.0",
+        });
+    });
+    it("parses a digest-only reference", () => {
+        const p = parseImage("nginx@sha256:abcdef");
+        expect(p.repository).toBe("library/nginx");
+        expect(p.tag).toBe("");
+        expect(p.digest).toBe("sha256:abcdef");
+    });
+    it("parses tag + digest", () => {
+        const p = parseImage("nginx:1.24@sha256:abcdef");
+        expect(p.tag).toBe("1.24");
+        expect(p.digest).toBe("sha256:abcdef");
+    });
+});
+describe("normalizeVersion", () => {
+    it("strips a leading v", () => {
+        expect(normalizeVersion("v1.2.3")).toBe("1.2.3");
+    });
+    it("strips suffixes like -alpine", () => {
+        expect(normalizeVersion("15.2-alpine")).toBe("15.2");
+    });
+    it("returns empty for placeholder tags", () => {
+        expect(normalizeVersion("latest")).toBe("");
+        expect(normalizeVersion("stable")).toBe("");
+        expect(normalizeVersion("")).toBe("");
+    });
+});
+describe("major/majorMinor", () => {
+    it("extracts major", () => {
+        expect(major("15.2.1")).toBe("15");
+        expect(major("11")).toBe("11");
+    });
+    it("extracts major.minor", () => {
+        expect(majorMinor("15.2.1")).toBe("15.2");
+        expect(majorMinor("11")).toBe("11");
+    });
+});

package/dist/detector/index.d.ts

@@ -0,0 +1,33 @@
+import type { KubectlOptions } from "../kubectl.js";
+import { type Candidate, type WorkloadRef } from "./sources.js";
+import { type CveFinding } from "./osv.js";
+import { type EolStatus } from "./eol.js";
+export interface DetectedApp {
+    canonical: string;
+    display: string;
+    version: string;
+    sources: Array<Candidate["source"]>;
+    workloads: WorkloadRef[];
+    cves: CveFinding[];
+    eol: EolStatus | null;
+    catalogMatch: boolean;
+}
+export interface UnknownApp {
+    name: string;
+    version: string;
+    workloads: WorkloadRef[];
+}
+export interface DetectionResult {
+    apps: DetectedApp[];
+    unknowns: UnknownApp[];
+    scanned: {
+        workloads: number;
+        helmReleases: number;
+    };
+}
+export interface DetectOptions extends KubectlOptions {
+    noCache?: boolean;
+    onProgress?: (step: string) => void;
+}
+export declare function detectApplications(opts?: DetectOptions): Promise<DetectionResult>;
+export declare function formatApplicationsMarkdown(result: DetectionResult): string;

package/dist/detector/index.js

@@ -0,0 +1,217 @@
+import { fetchWorkloadCandidates, fetchHelmCandidates, fetchIngressHostMap, workloadKey, } from "./sources.js";
+import { parseImage, normalizeVersion } from "./image-parser.js";
+import { lookupCatalog, lookupChart } from "./catalog.js";
+import { queryOsv } from "./osv.js";
+import { queryEol } from "./eol.js";
+function recordWorkload(map, ref, hostsByWorkload) {
+    const key = workloadKey(ref);
+    if (!map.has(key)) {
+        const hosts = hostsByWorkload?.get(key);
+        map.set(key, hosts && hosts.length > 0 ? { ...ref, hosts } : ref);
+    }
+}
+function helmWorkloadRef(c) {
+    return { kind: "Deployment", namespace: c.namespace, name: c.releaseName };
+}
+export async function detectApplications(opts = {}) {
+    const { onProgress, noCache } = opts;
+    const kubectlOpts = {
+        context: opts.context,
+        namespace: opts.namespace,
+        timeout: opts.timeout,
+    };
+    onProgress?.("workloads");
+    const [workloadCandidates, ingressMap] = await Promise.all([
+        fetchWorkloadCandidates(kubectlOpts),
+        fetchIngressHostMap(kubectlOpts).catch(() => new Map()),
+    ]);
+    onProgress?.("helm");
+    const helmCandidates = await fetchHelmCandidates(kubectlOpts);
+    const known = new Map();
+    const unknowns = new Map();
+    for (const c of workloadCandidates) {
+        if (c.source === "image") {
+            const parsed = parseImage(c.image);
+            const version = normalizeVersion(parsed.tag);
+            const match = lookupCatalog(parsed.repository, parsed.name);
+            if (match && version) {
+                const key = `${match.canonical}@${version}`;
+                let det = known.get(key);
+                if (!det) {
+                    det = {
+                        canonical: match.canonical,
+                        display: match.entry.display,
+                        version,
+                        entry: match.entry,
+                        sources: new Set(),
+                        workloads: new Map(),
+                    };
+                    known.set(key, det);
+                }
+                det.sources.add("image");
+                recordWorkload(det.workloads, c.workload, ingressMap);
+            }
+            else if (version) {
+                const key = `${parsed.name}@${version}`;
+                let u = unknowns.get(key);
+                if (!u) {
+                    u = { name: parsed.name, version, workloads: [] };
+                    unknowns.set(key, u);
+                }
+                if (!u.workloads.some((w) => w.kind === c.workload.kind && w.namespace === c.workload.namespace && w.name === c.workload.name)) {
+                    const hosts = ingressMap.get(workloadKey(c.workload));
+                    u.workloads.push(hosts && hosts.length > 0 ? { ...c.workload, hosts } : c.workload);
+                }
+            }
+        }
+        else if (c.source === "label") {
+            const match = lookupCatalog(c.appName, c.appName);
+            const version = normalizeVersion(c.appVersion);
+            if (match && version) {
+                const key = `${match.canonical}@${version}`;
+                let det = known.get(key);
+                if (!det) {
+                    det = {
+                        canonical: match.canonical,
+                        display: match.entry.display,
+                        version,
+                        entry: match.entry,
+                        sources: new Set(),
+                        workloads: new Map(),
+                    };
+                    known.set(key, det);
+                }
+                det.sources.add("label");
+                recordWorkload(det.workloads, c.workload, ingressMap);
+            }
+        }
+    }
+    for (const c of helmCandidates) {
+        const match = lookupChart(c.chart);
+        const version = normalizeVersion(c.appVersion ?? c.chartVersion);
+        if (match && version) {
+            const key = `${match.canonical}@${version}`;
+            let det = known.get(key);
+            if (!det) {
+                det = {
+                    canonical: match.canonical,
+                    display: match.entry.display,
+                    version,
+                    entry: match.entry,
+                    sources: new Set(),
+                    workloads: new Map(),
+                };
+                known.set(key, det);
+            }
+            det.sources.add("helm");
+            recordWorkload(det.workloads, helmWorkloadRef(c), ingressMap);
+        }
+    }
+    onProgress?.("cve");
+    const apps = [];
+    for (const det of known.values()) {
+        const cves = det.entry.osv
+            ? await queryOsv(det.entry.osv, det.version, { noCache })
+            : [];
+        const eol = det.entry.eolProduct
+            ? await queryEol(det.entry.eolProduct, det.version, { noCache })
+            : null;
+        apps.push({
+            canonical: det.canonical,
+            display: det.display,
+            version: det.version,
+            sources: [...det.sources],
+            workloads: [...det.workloads.values()],
+            cves,
+            eol,
+            catalogMatch: true,
+        });
+    }
+    apps.sort((a, b) => {
+        const sev = (x) => {
+            if (x.eol?.eol)
+                return 0;
+            if (x.cves.length > 0)
+                return 1;
+            return 2;
+        };
+        const s = sev(a) - sev(b);
+        return s !== 0 ? s : a.display.localeCompare(b.display);
+    });
+    return {
+        apps,
+        unknowns: [...unknowns.values()].sort((a, b) => a.name.localeCompare(b.name)),
+        scanned: {
+            workloads: workloadCandidates.length,
+            helmReleases: helmCandidates.length,
+        },
+    };
+}
+function workloadLabel(w) {
+    const base = `${w.kind}/${w.namespace}/${w.name}`;
+    return w.hosts && w.hosts.length > 0 ? `${base} (${w.hosts.join(", ")})` : base;
+}
+function escapeMd(s) {
+    return s.replace(/\|/g, "\\|");
+}
+export function formatApplicationsMarkdown(result) {
+    const lines = [];
+    lines.push("# Detected Open-Source Applications", "");
+    lines.push(`_Scanned ${result.scanned.workloads} workload container(s) and ${result.scanned.helmReleases} Helm release(s)._`, "");
+    const eolApps = result.apps.filter((a) => a.eol?.eol);
+    const cveApps = result.apps.filter((a) => !a.eol?.eol && a.cves.length > 0);
+    const healthy = result.apps.filter((a) => !a.eol?.eol && a.cves.length === 0);
+    if (eolApps.length > 0) {
+        lines.push("## End-of-Life", "");
+        lines.push("| App | Version | EOL since | Latest in cycle | Workloads |");
+        lines.push("|-----|---------|-----------|-----------------|-----------|");
+        for (const a of eolApps) {
+            const eolStr = a.eol?.eolDate ?? "yes";
+            const latest = a.eol?.latest ?? "—";
+            const wls = a.workloads.map(workloadLabel).join(", ");
+            lines.push(`| ${escapeMd(a.display)} | \`${a.version}\` | ${eolStr} | \`${latest}\` | ${escapeMd(wls)} |`);
+        }
+        lines.push("");
+    }
+    if (cveApps.length > 0) {
+        lines.push("## Known Vulnerabilities", "");
+        for (const a of cveApps) {
+            lines.push(`### ${a.display} \`${a.version}\``);
+            lines.push(`Workloads: ${a.workloads.map(workloadLabel).join(", ")}`);
+            lines.push("");
+            lines.push("| CVE | Severity | Fixed in | Summary |");
+            lines.push("|-----|----------|----------|---------|");
+            for (const c of a.cves.slice(0, 20)) {
+                const ref = c.reference ? `[${c.id}](${c.reference})` : c.id;
+                const fixed = c.fixed ? `\`${c.fixed}\`` : "—";
+                const sev = c.severity ?? "—";
+                lines.push(`| ${ref} | ${sev} | ${fixed} | ${escapeMd(c.summary || "")} |`);
+            }
+            if (a.cves.length > 20) {
+                lines.push(`| _… and ${a.cves.length - 20} more_ | | | |`);
+            }
+            lines.push("");
+        }
+    }
+    if (healthy.length > 0) {
+        lines.push("## Up-to-date", "");
+        lines.push("| App | Version | Workloads |");
+        lines.push("|-----|---------|-----------|");
+        for (const a of healthy) {
+            const wls = a.workloads.map(workloadLabel).join(", ");
+            lines.push(`| ${escapeMd(a.display)} | \`${a.version}\` | ${escapeMd(wls)} |`);
+        }
+        lines.push("");
+    }
+    if (result.unknowns.length > 0) {
+        lines.push("## Other / not in catalog", "");
+        lines.push("Images that look like OSS apps but aren't in the CVE/EOL catalog yet:");
+        lines.push("");
+        for (const u of result.unknowns) {
+            const wls = u.workloads.map(workloadLabel).join(", ");
+            lines.push(`- \`${u.name}:${u.version}\` — ${wls}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}

package/dist/detector/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/index.test.js

@@ -0,0 +1,210 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("./sources.js", () => ({
+    fetchWorkloadCandidates: vi.fn(),
+    fetchHelmCandidates: vi.fn(),
+    fetchIngressHostMap: vi.fn(),
+    workloadKey: (ref) => `${ref.kind}/${ref.namespace}/${ref.name}`,
+}));
+vi.mock("./osv.js", () => ({
+    queryOsv: vi.fn(),
+}));
+vi.mock("./eol.js", () => ({
+    queryEol: vi.fn(),
+}));
+import { fetchWorkloadCandidates, fetchHelmCandidates, fetchIngressHostMap } from "./sources.js";
+import { queryOsv } from "./osv.js";
+import { queryEol } from "./eol.js";
+import { detectApplications, formatApplicationsMarkdown } from "./index.js";
+const fetchWorkloads = vi.mocked(fetchWorkloadCandidates);
+const fetchHelm = vi.mocked(fetchHelmCandidates);
+const fetchIngress = vi.mocked(fetchIngressHostMap);
+const osv = vi.mocked(queryOsv);
+const eol = vi.mocked(queryEol);
+describe("detectApplications", () => {
+    beforeEach(() => {
+        fetchWorkloads.mockReset();
+        fetchHelm.mockReset();
+        fetchIngress.mockReset();
+        osv.mockReset();
+        eol.mockReset();
+        fetchIngress.mockResolvedValue(new Map());
+        osv.mockResolvedValue([]);
+        eol.mockResolvedValue(null);
+    });
+    it("merges image and label candidates pointing at the same app/version", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "postgres:15.2",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+            {
+                source: "label",
+                appName: "postgres",
+                appVersion: "15.2",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(1);
+        expect(result.apps[0].canonical).toBe("postgres");
+        expect(result.apps[0].version).toBe("15.2");
+        expect(result.apps[0].sources.sort()).toEqual(["image", "label"]);
+        expect(result.apps[0].workloads).toHaveLength(1);
+    });
+    it("tracks images not in the catalog as unknowns", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "acme/internal-app:1.2.3",
+                container: "app",
+                workload: { kind: "Deployment", namespace: "team-x", name: "foo" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(0);
+        expect(result.unknowns).toHaveLength(1);
+        expect(result.unknowns[0]).toMatchObject({ name: "internal-app", version: "1.2.3" });
+    });
+    it("flags EOL apps via the eol lookup", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "postgres:11.18",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        eol.mockResolvedValue({
+            product: "postgres",
+            cycle: "11",
+            eol: true,
+            eolDate: "2023-11-09",
+            latest: "11.22",
+            lts: false,
+        });
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps[0].eol?.eol).toBe(true);
+        expect(result.apps[0].eol?.eolDate).toBe("2023-11-09");
+    });
+    it("attaches CVE findings from OSV", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "redis:7.0.5",
+                container: "cache",
+                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        osv.mockResolvedValue([
+            { id: "CVE-2023-9999", summary: "Boom.", severity: "high", fixed: "7.0.12" },
+        ]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps[0].cves).toHaveLength(1);
+        expect(result.apps[0].cves[0].id).toBe("CVE-2023-9999");
+    });
+    it("orders apps by severity (EOL → CVEs → healthy)", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "nginx:1.25.3",
+                container: "web",
+                workload: { kind: "Deployment", namespace: "edge", name: "nginx" },
+            },
+            {
+                source: "image",
+                image: "postgres:11.18",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+            {
+                source: "image",
+                image: "redis:7.0.5",
+                container: "cache",
+                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        eol.mockImplementation(async (product) => product === "postgres"
+            ? { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", lts: false }
+            : null);
+        osv.mockImplementation(async (lookup) => lookup.name === "redis"
+            ? [{ id: "CVE-2023-1", summary: "x", severity: "medium" }]
+            : []);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps.map((a) => a.canonical)).toEqual(["postgres", "redis", "nginx"]);
+    });
+    it("uses Helm chart appVersion when available", async () => {
+        fetchWorkloads.mockResolvedValue([]);
+        fetchHelm.mockResolvedValue([
+            {
+                source: "helm",
+                chart: "postgresql",
+                chartVersion: "12.0.0",
+                appVersion: "15.2.0",
+                namespace: "data",
+                releaseName: "primary",
+            },
+        ]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(1);
+        expect(result.apps[0].canonical).toBe("postgres");
+        expect(result.apps[0].version).toBe("15.2.0");
+        expect(result.apps[0].sources).toContain("helm");
+    });
+});
+describe("formatApplicationsMarkdown", () => {
+    it("produces sections for EOL, CVEs, healthy, and unknowns", () => {
+        const md = formatApplicationsMarkdown({
+            apps: [
+                {
+                    canonical: "postgres",
+                    display: "PostgreSQL",
+                    version: "11.18",
+                    sources: ["image"],
+                    workloads: [{ kind: "StatefulSet", namespace: "prod", name: "db" }],
+                    cves: [],
+                    eol: { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", latest: "11.22", lts: false },
+                    catalogMatch: true,
+                },
+                {
+                    canonical: "redis",
+                    display: "Redis",
+                    version: "7.0.5",
+                    sources: ["image"],
+                    workloads: [{ kind: "Deployment", namespace: "infra", name: "redis" }],
+                    cves: [{ id: "CVE-2023-1", summary: "boom", severity: "high", fixed: "7.0.12" }],
+                    eol: null,
+                    catalogMatch: true,
+                },
+                {
+                    canonical: "nginx",
+                    display: "nginx",
+                    version: "1.25.3",
+                    sources: ["image"],
+                    workloads: [{ kind: "Deployment", namespace: "edge", name: "nginx" }],
+                    cves: [],
+                    eol: null,
+                    catalogMatch: true,
+                },
+            ],
+            unknowns: [
+                { name: "internal-app", version: "1.2.3", workloads: [{ kind: "Deployment", namespace: "team-x", name: "foo" }] },
+            ],
+            scanned: { workloads: 4, helmReleases: 0 },
+        });
+        expect(md).toContain("## End-of-Life");
+        expect(md).toContain("PostgreSQL");
+        expect(md).toContain("## Known Vulnerabilities");
+        expect(md).toContain("CVE-2023-1");
+        expect(md).toContain("## Up-to-date");
+        expect(md).toContain("nginx");
+        expect(md).toContain("## Other / not in catalog");
+        expect(md).toContain("internal-app");
+    });
+});

package/dist/detector/osv.d.ts

@@ -0,0 +1,12 @@
+import type { OsvLookup } from "./catalog.js";
+export interface CveFinding {
+    id: string;
+    summary: string;
+    severity?: string;
+    fixed?: string;
+    reference?: string;
+}
+export declare function queryOsv(lookup: OsvLookup, version: string, opts?: {
+    noCache?: boolean;
+    timeoutMs?: number;
+}): Promise<CveFinding[]>;

package/dist/detector/osv.js

@@ -0,0 +1,50 @@
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+const OSV_URL = "https://api.osv.dev/v1/query";
+function summarize(v) {
+    const fixed = v.affected?.[0]?.ranges?.[0]?.events?.find((e) => e.fixed)?.fixed;
+    const reference = v.references?.find((r) => r.type === "ADVISORY")?.url ??
+        v.references?.[0]?.url;
+    return {
+        id: v.id,
+        summary: (v.summary ?? v.details ?? "").slice(0, 200),
+        severity: v.database_specific?.severity,
+        fixed,
+        reference,
+    };
+}
+export async function queryOsv(lookup, version, opts = {}) {
+    if (!version)
+        return [];
+    const cacheKey = `${lookup.ecosystem ?? "any"}-${lookup.name}@${version}`;
+    if (!opts.noCache) {
+        const cached = readCache("osv", cacheKey);
+        if (cached)
+            return cached;
+    }
+    const body = {
+        package: lookup.ecosystem
+            ? { name: lookup.name, ecosystem: lookup.ecosystem }
+            : { name: lookup.name },
+        version,
+    };
+    try {
+        const res = await fetch(OSV_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 8000),
+        });
+        if (!res.ok) {
+            const stale = readStaleCache("osv", cacheKey);
+            return stale?.data ?? [];
+        }
+        const data = (await res.json());
+        const findings = (data.vulns ?? []).map(summarize);
+        writeCache("osv", cacheKey, findings);
+        return findings;
+    }
+    catch {
+        const stale = readStaleCache("osv", cacheKey);
+        return stale?.data ?? [];
+    }
+}

package/dist/detector/osv.test.d.ts

@@ -0,0 +1 @@
+export {};