kubeagent 0.1.35 → 0.1.36

package/dist/detector/osv.test.js

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("./cache.js", () => ({
+    readCache: vi.fn(),
+    readStaleCache: vi.fn(),
+    writeCache: vi.fn(),
+}));
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+import { queryOsv } from "./osv.js";
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+const cacheRead = vi.mocked(readCache);
+const cacheStale = vi.mocked(readStaleCache);
+const cacheWrite = vi.mocked(writeCache);
+describe("queryOsv", () => {
+    beforeEach(() => {
+        mockFetch.mockReset();
+        cacheRead.mockReset();
+        cacheStale.mockReset();
+        cacheWrite.mockReset();
+        cacheRead.mockReturnValue(null);
+        cacheStale.mockReturnValue(null);
+    });
+    it("posts the package + version to api.osv.dev and returns mapped findings", async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                vulns: [
+                    {
+                        id: "CVE-2024-1",
+                        summary: "Test vuln",
+                        database_specific: { severity: "high" },
+                        affected: [{ ranges: [{ events: [{ introduced: "0" }, { fixed: "7.0.12" }] }] }],
+                        references: [{ type: "ADVISORY", url: "https://example.com/advisory" }],
+                    },
+                ],
+            }),
+        });
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(mockFetch).toHaveBeenCalledOnce();
+        expect(mockFetch.mock.calls[0][0]).toBe("https://api.osv.dev/v1/query");
+        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+        expect(body).toEqual({ package: { name: "redis" }, version: "7.0.5" });
+        expect(findings).toHaveLength(1);
+        expect(findings[0]).toMatchObject({
+            id: "CVE-2024-1",
+            severity: "high",
+            fixed: "7.0.12",
+            reference: "https://example.com/advisory",
+        });
+        expect(cacheWrite).toHaveBeenCalledOnce();
+    });
+    it("includes ecosystem in the OSV body when provided", async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
+        await queryOsv({ name: "postgresql", ecosystem: "Debian" }, "15.2", { noCache: true });
+        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+        expect(body.package).toEqual({ name: "postgresql", ecosystem: "Debian" });
+    });
+    it("returns empty when version is empty", async () => {
+        const findings = await queryOsv({ name: "redis" }, "", { noCache: true });
+        expect(findings).toEqual([]);
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it("returns [] on network error when no stale cache is present", async () => {
+        mockFetch.mockRejectedValue(new Error("network down"));
+        const findings = await queryOsv({ name: "redis" }, "7.0.99", { noCache: true });
+        expect(findings).toEqual([]);
+    });
+    it("serves a fresh cached entry without hitting the network", async () => {
+        cacheRead.mockReturnValue([{ id: "CVE-cached", summary: "from cache" }]);
+        const findings = await queryOsv({ name: "redis" }, "7.0.5");
+        expect(mockFetch).not.toHaveBeenCalled();
+        expect(findings[0].id).toBe("CVE-cached");
+    });
+    it("falls back to stale cache on network error", async () => {
+        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "from cache" }], fetchedAt: 1 });
+        mockFetch.mockRejectedValue(new Error("offline"));
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(findings[0].id).toBe("CVE-stale");
+    });
+    it("falls back to stale cache on non-2xx response", async () => {
+        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "x" }], fetchedAt: 1 });
+        mockFetch.mockResolvedValue({ ok: false, status: 500 });
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(findings[0].id).toBe("CVE-stale");
+    });
+});

package/dist/detector/report.d.ts

@@ -0,0 +1,6 @@
+import type { AuthState } from "../auth.js";
+import type { DetectionResult } from "./index.js";
+export interface ReportOptions {
+    onProgress?: (step: string) => void;
+}
+export declare function generateReport(result: DetectionResult, auth: AuthState, opts?: ReportOptions): Promise<string>;

package/dist/detector/report.js

@@ -0,0 +1,91 @@
+import { proxyRequest } from "../proxy-client.js";
+/**
+ * Trim the detection result to a compact JSON payload the model can reason
+ * over without blowing the context window. We cap CVEs per app and drop
+ * fields the model doesn't need (catalogMatch, sources, etc.).
+ */
+function buildPayload(result) {
+    const slimWorkload = (w) => ({
+        kind: w.kind,
+        namespace: w.namespace,
+        name: w.name,
+        ...(w.hosts && w.hosts.length > 0 ? { hosts: w.hosts } : {}),
+    });
+    const slimApp = (a) => ({
+        name: a.display,
+        version: a.version,
+        eol: a.eol?.eol
+            ? {
+                eolDate: a.eol.eolDate,
+                latestInCycle: a.eol.latest,
+            }
+            : null,
+        cveCount: a.cves.length,
+        cves: a.cves.slice(0, 10).map((c) => ({
+            id: c.id,
+            severity: c.severity ?? null,
+            fixed: c.fixed ?? null,
+            summary: c.summary ? c.summary.slice(0, 200) : null,
+        })),
+        workloads: a.workloads.map(slimWorkload),
+        publicFacing: a.workloads.some((w) => w.hosts && w.hosts.length > 0),
+    });
+    return {
+        apps: result.apps.map(slimApp),
+        unknownCount: result.unknowns.length,
+        scanned: result.scanned,
+    };
+}
+const INSTRUCTIONS = `You are producing a remediation report for a Kubernetes cluster scan.
+
+STRICT RULES — these are absolute, no exceptions:
+1. ONLY use facts from the JSON payload below. Do NOT invent CVE IDs, version numbers, EOL dates, or workload names.
+2. If a "latestInCycle" version is given, you may recommend upgrading to it. Do NOT recommend versions not present in the payload unless you explicitly mark them as "(verify upstream)".
+3. Do not speculate about CVE exploitability beyond what the summary says.
+4. Public-facing = workload has \`hosts\` field populated. Internal-only = no hosts.
+
+Produce a Markdown report with these sections:
+
+## Executive Summary
+2-3 sentences. Total findings, how many are critical (EOL or public-facing with CVEs), the single biggest risk.
+
+## Prioritized Fix List
+A numbered list, highest-risk first. For each item:
+- **App + version** (workloads affected)
+- **Why now** (1 sentence: EOL? public-facing? high CVE count?)
+- **Suggested next step** (which version to move to, or "investigate" if unclear)
+
+Prioritization order:
+1. EOL AND public-facing (has hosts)
+2. EOL internal-only
+3. Many CVEs AND public-facing
+4. Many CVEs internal-only
+5. Healthy
+
+## Notes
+Anything notable: duplicated infra (e.g. 5 Redis instances on same EOL version), version sprawl (same app at 3 different versions), missing-info gaps.
+
+Be concise. No padding. No emojis. No fabricated specifics.`;
+export async function generateReport(result, auth, opts = {}) {
+    opts.onProgress?.("preparing payload");
+    const payload = buildPayload(result);
+    const userMessage = `${INSTRUCTIONS}
+
+\`\`\`json
+${JSON.stringify(payload, null, 2)}
+\`\`\``;
+    opts.onProgress?.("calling model");
+    const response = await proxyRequest(auth, {
+        max_tokens: 8000,
+        messages: [{ role: "user", content: userMessage }],
+    });
+    const text = response.content
+        .filter((b) => b.type === "text")
+        .map((b) => b.text)
+        .join("\n")
+        .trim();
+    if (!text) {
+        throw new Error("Model returned no text content");
+    }
+    return text;
+}

package/dist/detector/sources.d.ts

@@ -0,0 +1,42 @@
+import { type KubectlOptions } from "../kubectl.js";
+export type WorkloadKind = "Deployment" | "StatefulSet" | "DaemonSet";
+export interface WorkloadRef {
+    kind: WorkloadKind;
+    namespace: string;
+    name: string;
+    hosts?: string[];
+}
+export declare function workloadKey(ref: {
+    kind: string;
+    namespace: string;
+    name: string;
+}): string;
+export interface ImageCandidate {
+    source: "image";
+    image: string;
+    workload: WorkloadRef;
+    container: string;
+}
+export interface LabelCandidate {
+    source: "label";
+    appName: string;
+    appVersion: string;
+    workload: WorkloadRef;
+}
+export interface HelmCandidate {
+    source: "helm";
+    chart: string;
+    chartVersion: string;
+    appVersion?: string;
+    namespace: string;
+    releaseName: string;
+}
+export type Candidate = ImageCandidate | LabelCandidate | HelmCandidate;
+export declare function fetchWorkloadCandidates(options: KubectlOptions): Promise<Candidate[]>;
+export declare function fetchHelmCandidates(options: KubectlOptions): Promise<HelmCandidate[]>;
+/**
+ * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
+ * Joins Ingresses → Services → workload pod-template labels best-effort.
+ * Returns an empty map on failure (ingress visibility is non-essential).
+ */
+export declare function fetchIngressHostMap(options: KubectlOptions): Promise<Map<string, string[]>>;

package/dist/detector/sources.js

@@ -0,0 +1,218 @@
+import { gunzipSync } from "node:zlib";
+import { Buffer } from "node:buffer";
+import { kubectlJson } from "../kubectl.js";
+import { dbg } from "../debug.js";
+export function workloadKey(ref) {
+    return `${ref.kind}/${ref.namespace}/${ref.name}`;
+}
+const LABEL_NAME = "app.kubernetes.io/name";
+const LABEL_VERSION = "app.kubernetes.io/version";
+async function fetchWorkload(kind, resource, options) {
+    return (await kubectlJson(["get", resource, "--all-namespaces"], options));
+}
+function extractFromWorkload(kind, w) {
+    const out = [];
+    const ref = { kind, namespace: w.metadata.namespace, name: w.metadata.name };
+    const containers = [
+        ...(w.spec?.template?.spec?.containers ?? []),
+        ...(w.spec?.template?.spec?.initContainers ?? []),
+    ];
+    for (const c of containers) {
+        if (c.image) {
+            out.push({ source: "image", image: c.image, workload: ref, container: c.name });
+        }
+    }
+    const labels = {
+        ...(w.metadata.labels ?? {}),
+        ...(w.spec?.template?.metadata?.labels ?? {}),
+    };
+    if (labels[LABEL_NAME] && labels[LABEL_VERSION]) {
+        out.push({
+            source: "label",
+            appName: labels[LABEL_NAME],
+            appVersion: labels[LABEL_VERSION],
+            workload: ref,
+        });
+    }
+    return out;
+}
+export async function fetchWorkloadCandidates(options) {
+    const [deploys, statefulsets, daemonsets] = await Promise.all([
+        fetchWorkload("Deployment", "deployments", options),
+        fetchWorkload("StatefulSet", "statefulsets", options),
+        fetchWorkload("DaemonSet", "daemonsets", options),
+    ]);
+    const all = [];
+    for (const w of deploys.items)
+        all.push(...extractFromWorkload("Deployment", w));
+    for (const w of statefulsets.items)
+        all.push(...extractFromWorkload("StatefulSet", w));
+    for (const w of daemonsets.items)
+        all.push(...extractFromWorkload("DaemonSet", w));
+    return all;
+}
+function decodeHelmRelease(b64) {
+    try {
+        // Helm v3 stores releases as base64(gzip(json)). When fetched via
+        // `kubectl get secrets -o json`, the API server applies its own base64
+        // layer on top of `data.release`, so we decode twice before gunzip.
+        const outer = Buffer.from(b64, "base64");
+        const inner = Buffer.from(outer.toString("utf-8"), "base64");
+        const json = gunzipSync(inner).toString("utf-8");
+        return JSON.parse(json);
+    }
+    catch (err) {
+        dbg("detector", `helm release decode failed: ${err.message}`);
+        return null;
+    }
+}
+export async function fetchHelmCandidates(options) {
+    let list;
+    try {
+        list = (await kubectlJson(["get", "secrets", "--all-namespaces", "-l", "owner=helm,status=deployed"], options));
+    }
+    catch (err) {
+        dbg("detector", `helm secret listing failed: ${err.message}`);
+        return [];
+    }
+    const seen = new Set();
+    const out = [];
+    for (const s of list.items) {
+        const release = s.data?.release;
+        if (!release)
+            continue;
+        const payload = decodeHelmRelease(release);
+        if (!payload)
+            continue;
+        const chart = payload.chart?.metadata?.name;
+        const version = payload.chart?.metadata?.version;
+        if (!chart || !version)
+            continue;
+        const key = `${s.metadata.namespace}/${payload.name}/${version}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({
+            source: "helm",
+            chart,
+            chartVersion: version,
+            appVersion: payload.chart?.metadata?.appVersion,
+            namespace: s.metadata.namespace,
+            releaseName: payload.name,
+        });
+    }
+    return out;
+}
+function selectorMatches(selector, labels) {
+    const keys = Object.keys(selector);
+    if (keys.length === 0)
+        return false;
+    for (const k of keys) {
+        if (labels[k] !== selector[k])
+            return false;
+    }
+    return true;
+}
+/**
+ * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
+ * Joins Ingresses → Services → workload pod-template labels best-effort.
+ * Returns an empty map on failure (ingress visibility is non-essential).
+ */
+export async function fetchIngressHostMap(options) {
+    const out = new Map();
+    let services;
+    let ingresses;
+    let workloadLists;
+    try {
+        [services, ingresses, ...workloadLists] = await Promise.all([
+            kubectlJson(["get", "services", "--all-namespaces"], options),
+            kubectlJson(["get", "ingresses", "--all-namespaces"], options),
+            fetchWorkload("Deployment", "deployments", options),
+            fetchWorkload("StatefulSet", "statefulsets", options),
+            fetchWorkload("DaemonSet", "daemonsets", options),
+        ]);
+    }
+    catch (err) {
+        dbg("detector", `ingress map fetch failed: ${err.message}`);
+        return out;
+    }
+    // service ns/name → selector
+    const serviceSelectors = new Map();
+    for (const svc of services.items) {
+        const sel = svc.spec?.selector;
+        if (!sel || Object.keys(sel).length === 0)
+            continue;
+        serviceSelectors.set(`${svc.metadata.namespace}/${svc.metadata.name}`, sel);
+    }
+    // service ns/name → set of hosts
+    const serviceHosts = new Map();
+    const addServiceHost = (ns, svc, host) => {
+        if (!svc || !host)
+            return;
+        const key = `${ns}/${svc}`;
+        let s = serviceHosts.get(key);
+        if (!s) {
+            s = new Set();
+            serviceHosts.set(key, s);
+        }
+        s.add(host);
+    };
+    for (const ing of ingresses.items) {
+        const ns = ing.metadata.namespace;
+        const tlsHosts = new Set();
+        for (const t of ing.spec?.tls ?? []) {
+            for (const h of t.hosts ?? [])
+                tlsHosts.add(h);
+        }
+        for (const rule of ing.spec?.rules ?? []) {
+            // A rule with no `host` matches all inbound hosts per the Ingress
+            // spec — the backend is still publicly reachable, so record it as `*`
+            // rather than dropping it (which would mis-classify as internal-only).
+            const host = rule.host ?? "*";
+            for (const p of rule.http?.paths ?? []) {
+                const svc = p.backend?.service?.name ?? p.backend?.serviceName;
+                addServiceHost(ns, svc, host);
+            }
+        }
+        const defSvc = ing.spec?.defaultBackend?.service?.name ?? ing.spec?.defaultBackend?.serviceName;
+        if (defSvc) {
+            // defaultBackend catches anything not matched by a rule — also wildcard
+            // exposure. Prefer explicit TLS hosts when present for better display.
+            if (tlsHosts.size > 0) {
+                for (const h of tlsHosts)
+                    addServiceHost(ns, defSvc, h);
+            }
+            else {
+                addServiceHost(ns, defSvc, "*");
+            }
+        }
+    }
+    const allWorkloads = [];
+    const kinds = ["Deployment", "StatefulSet", "DaemonSet"];
+    workloadLists.forEach((list, idx) => {
+        for (const item of list.items)
+            allWorkloads.push({ kind: kinds[idx], item });
+    });
+    for (const { kind, item } of allWorkloads) {
+        const ns = item.metadata.namespace;
+        const podLabels = item.spec?.template?.metadata?.labels ?? {};
+        if (Object.keys(podLabels).length === 0)
+            continue;
+        const hosts = new Set();
+        for (const [svcKey, sel] of serviceSelectors) {
+            if (!svcKey.startsWith(`${ns}/`))
+                continue;
+            if (!selectorMatches(sel, podLabels))
+                continue;
+            const hs = serviceHosts.get(svcKey);
+            if (!hs)
+                continue;
+            for (const h of hs)
+                hosts.add(h);
+        }
+        if (hosts.size > 0) {
+            out.set(workloadKey({ kind, namespace: ns, name: item.metadata.name }), [...hosts].sort());
+        }
+    }
+    return out;
+}

package/dist/diagnoser/tools.d.ts

@@ -25,11 +25,11 @@ export declare const kubectlDescribeSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     namespace: string;
-    resource_type: "pod" | "deployment" | "service" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "node" | "persistentvolumeclaim" | "configmap" | "endpoints";
+    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
 }, {
     name: string;
     namespace: string;
-    resource_type: "pod" | "deployment" | "service" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "node" | "persistentvolumeclaim" | "configmap" | "endpoints";
+    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
 }>;
 export declare const restartPodSchema: z.ZodObject<{
     namespace: z.ZodString;

package/dist/kb/loader.js

@@ -13,6 +13,12 @@ export function buildSystemPrompt(kbDir) {
         sections.push(readFileSync(clusterPath, "utf-8"));
         sections.push("");
     }
+    // Load applications.md (OSS app inventory with CVE/EOL status)
+    const applicationsPath = join(kbDir, "applications.md");
+    if (existsSync(applicationsPath)) {
+        sections.push(readFileSync(applicationsPath, "utf-8"));
+        sections.push("");
+    }
     // Load project files
     const projectsDir = join(kbDir, "projects");
     if (existsSync(projectsDir)) {

package/dist/kb/writer.d.ts

@@ -1,5 +1,6 @@
 export declare function ensureKbDir(kbDir: string): void;
 export declare function writeClusterKb(kbDir: string, content: string): void;
+export declare function writeApplicationsKb(kbDir: string, content: string): void;
 export declare function writeProjectKb(kbDir: string, projectName: string, content: string): void;
 export declare function writeRunbook(kbDir: string, name: string, content: string): void;
 /**

package/dist/kb/writer.js

@@ -12,6 +12,10 @@ export function writeClusterKb(kbDir, content) {
     ensureKbDir(kbDir);
     writeFileSync(join(kbDir, "cluster.md"), content);
 }
+export function writeApplicationsKb(kbDir, content) {
+    ensureKbDir(kbDir);
+    writeFileSync(join(kbDir, "applications.md"), content);
+}
 export function writeProjectKb(kbDir, projectName, content) {
     ensureKbDir(kbDir);
     writeFileSync(join(kbDir, "projects", `${projectName}.md`), content);

package/dist/onboard/index.js

@@ -4,7 +4,8 @@ import { scanCluster, formatClusterMarkdown } from "./cluster-scan.js";
 import { detectTechStack, formatProjectMarkdown } from "./code-scan.js";
 import { scanProjectDirectory, matchProjectsToWorkloads, bestMatches } from "./project-matcher.js";
 import { runInterview } from "./interview.js";
-import { writeClusterKb, writeProjectKb, ensureKbDir } from "../kb/writer.js";
+import { writeClusterKb, writeProjectKb, writeApplicationsKb, ensureKbDir } from "../kb/writer.js";
+import { detectApplications, formatApplicationsMarkdown } from "../detector/index.js";
 import { saveConfig, loadConfig, configDir, ALL_ACTIONS, DEFAULT_SAFE_ACTIONS } from "../config.js";
 import { interactiveAddChannel } from "../notify/setup.js";
 import { pickContext } from "../kubectl-config.js";
@@ -25,6 +26,25 @@ function pingOnboardComplete() {
 function expandPath(p) {
     return p.startsWith("~/") ? homedir() + p.slice(1) : p;
 }
+async function runAppDetection(kubectlOpts, kbDir) {
+    const spinner = ora("Detecting OSS applications...").start();
+    try {
+        const result = await detectApplications({
+            context: kubectlOpts.context,
+            onProgress: (step) => {
+                spinner.text = `Detecting OSS applications — ${step}...`;
+            },
+        });
+        writeApplicationsKb(kbDir, formatApplicationsMarkdown(result));
+        const eolCount = result.apps.filter((a) => a.eol?.eol).length;
+        const cveCount = result.apps.filter((a) => a.cves.length > 0).length;
+        spinner.succeed(`Inventoried ${result.apps.length} OSS app${result.apps.length === 1 ? "" : "s"} ` +
+            `(${eolCount} EOL, ${cveCount} with CVEs)`);
+    }
+    catch (err) {
+        spinner.warn(`OSS detection skipped: ${err.message}`);
+    }
+}
 async function ask(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
@@ -130,6 +150,7 @@ export async function onboard(opts = {}) {
                 writeProjectKb(kbDir, "_notes", `# Onboarding Notes\n\n${Array.from(notes.entries()).map(([q, a]) => `**${q}**\n${a}`).join("\n\n")}\n`);
             }
             earlyKbSpinner.succeed(`Knowledge base written (${totalItems} file${totalItems !== 1 ? "s" : ""})`);
+            await runAppDetection(kubectlOpts, kbDir);
             const currentSafeActions = existingConfig.remediation?.safe_actions ?? DEFAULT_SAFE_ACTIONS;
             const safeActions = await configureSafeActions(currentSafeActions);
             const existingChannels = existingConfig.notifications?.channels ?? [];
@@ -312,6 +333,7 @@ export async function onboard(opts = {}) {
         writeProjectKb(kbDir, "_notes", `# Onboarding Notes\n\n${generalNotes}\n`);
     }
     kbSpinner.succeed(`Knowledge base written (${totalKbItems} file${totalKbItems !== 1 ? "s" : ""})`);
+    await runAppDetection(kubectlOpts, kbDir);
     // Step 6b: Configure safe actions
     const currentSafeActions = existingConfig.remediation?.safe_actions ?? DEFAULT_SAFE_ACTIONS;
     const safeActions = await configureSafeActions(currentSafeActions);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kubeagent",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "AI-powered Kubernetes management CLI",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",