kubeagent 0.1.35 → 0.1.43

package/README.md

@@ -27,8 +27,10 @@ kubeagent watch
 | `status` | Quick cluster health check (no LLM) |
 | `onboard` | Scan cluster + codebases, generate knowledge base |
 | `watch` | Continuous monitoring with auto-remediation |
+| `check` | One-shot cluster health check for CI pipelines (read-only by default, JSON output, exit codes) |
 | `diagnose <resource>` | One-shot diagnosis of a pod/deployment/service |
 | `scan <directory>` | Match local project directories to cluster deployments |
+| `scan-apps` | Detect OSS apps in the cluster, list affected workloads + ingress domains, check for CVEs / EOL (`--report` for AI-prioritized remediation) |
 | `notify` | Manage notification channels (`list`, `add`, `remove`, `test`) |
 | `login` | Log in to KubeAgent (browser or `--device` for headless) |
 | `account` | Show account info and token balance |
@@ -42,6 +44,30 @@ kubeagent watch
 - `-i, --interval <seconds>` — Check interval for `watch` (default: 300)
 - `--no-interactive` — Auto-deny all approvals, skip questions (for `watch` in background/CI)
 
+## CI Usage
+
+`kubeagent check` is the one-shot mode for CI pipelines. It scans the cluster, prints a report, and exits with a code your build can gate on — no daemon, no prompts, no onboarding required.
+
+```bash
+# After deploying: confirm pods reached Ready
+kubectl rollout status deployment/my-app -n my-ns --timeout=5m
+
+# Then confirm the system is actually healthy
+kubeagent check -n my-ns
+```
+
+The two steps are complementary: `rollout status` answers *"did Kubernetes accept the deploy?"*, `kubeagent check` answers *"is the system actually healthy?"* — catching crashloops, evicted pods, and failed jobs that surface seconds after pods reach Ready.
+
+**Exit codes:** `0` = no issues at/above threshold · `1` = issues found · `2` = kubeagent error (unreachable cluster, bad flag, timeout).
+
+**Common flags:**
+- `-n, --namespace <ns>` — scope to one or more namespaces (repeatable)
+- `--fail-on <severity>` — fail-threshold: `info`, `warning`, or `critical` (default: `critical`)
+- `--format json` — emit a versioned JSON report instead of human output
+- `--diagnose` — run LLM root-cause analysis on findings (requires `KUBEAGENT_API_KEY` env var)
+
+See [docs/CI.md](docs/CI.md) for full reference, GitHub Actions and GitLab CI snippets, and the JSON schema.
+
 ## Knowledge Base
 
 KubeAgent builds a per-cluster knowledge base at `~/.kubeagent/clusters/<context>/` during onboarding:
@@ -52,6 +78,7 @@ KubeAgent builds a per-cluster knowledge base at `~/.kubeagent/clusters/<context
   clusters/
     hetzner-prod/
       cluster.md           # Nodes, namespaces, deployments, services
+      applications.md      # Detected OSS apps with CVE / EOL status
       projects/
         api.md             # Tech stack, dependencies, notes
       runbooks/            # Custom runbooks (manually added)
@@ -122,6 +149,13 @@ Safe actions (pod restarts, rollout restarts, scaling up) are applied automatica
 **Where is my API key stored?**
 Credentials are stored locally at `~/.kubeagent/auth.json` and are never sent anywhere except the KubeAgent API.
 
+## Links
+
+- [Homepage](https://kubeagent.net)
+- [Blog](https://kubeagent.net/blog/) — incident walkthroughs, agentic-diagnosis patterns, on-call economics ([RSS](https://kubeagent.net/blog/rss.xml))
+- [Docs](https://kubeagent.net/docs)
+- [Sign up](https://app.kubeagent.net/register)
+
 ## License
 
 Proprietary — see [LICENSE](./LICENSE) for details. Commercial use requires a paid plan at [kubeagent.net](https://kubeagent.net).

package/dist/auth.js

@@ -7,7 +7,22 @@ import { dbg } from "./debug.js";
 function authPath() {
     return join(configDir(), "auth.json");
 }
+const DEFAULT_SERVER_URL = "https://api.kubeagent.net";
+const DEFAULT_APP_URL = "https://app.kubeagent.net";
 export function loadAuth() {
+    // Env-var path for CI: KUBEAGENT_API_KEY takes precedence so machines can
+    // run without a local auth.json. KUBEAGENT_SERVER_URL / KUBEAGENT_APP_URL
+    // are optional overrides for self-hosted setups.
+    const envKey = process.env.KUBEAGENT_API_KEY;
+    if (envKey) {
+        dbg("auth", "loaded from env", { keyPrefix: envKey.slice(0, 12) + "..." });
+        return {
+            serverUrl: process.env.KUBEAGENT_SERVER_URL ?? DEFAULT_SERVER_URL,
+            appUrl: process.env.KUBEAGENT_APP_URL ?? DEFAULT_APP_URL,
+            token: envKey,
+            apiKey: envKey,
+        };
+    }
     const path = authPath();
     if (!existsSync(path)) {
         dbg("auth", "no auth file found", { path });

package/dist/check/index.d.ts

@@ -0,0 +1,34 @@
+import type { Issue, Severity } from "../monitor/types.js";
+export declare const SEVERITY_RANK: Record<Severity, number>;
+export declare function isValidSeverity(s: string): s is Severity;
+export interface CheckReportSummary {
+    critical: number;
+    warning: number;
+    info: number;
+    podCount: number;
+    nodeCount: number;
+}
+export interface CheckReport {
+    version: 1;
+    context: string;
+    namespaces: string[] | "all";
+    scannedAt: string;
+    durationMs: number;
+    summary: CheckReportSummary;
+    issues: Issue[];
+    diagnosis: {
+        analysis: string;
+    } | null;
+    exit: {
+        code: 0 | 1;
+        reason: string;
+    };
+}
+export declare function filterIssuesByNamespace(issues: Issue[], namespaces: string[] | "all"): Issue[];
+export declare function summarizeIssues(issues: Issue[], podCount: number, nodeCount: number): CheckReportSummary;
+export declare function computeExitCode(summary: CheckReportSummary, failOn: Severity): {
+    code: 0 | 1;
+    reason: string;
+};
+export declare function renderJson(report: CheckReport): string;
+export declare function renderHuman(report: CheckReport): string;

package/dist/check/index.js

@@ -0,0 +1,77 @@
+import chalk from "chalk";
+export const SEVERITY_RANK = {
+    info: 0,
+    warning: 1,
+    critical: 2,
+};
+export function isValidSeverity(s) {
+    return s === "info" || s === "warning" || s === "critical";
+}
+export function filterIssuesByNamespace(issues, namespaces) {
+    if (namespaces === "all" || namespaces.length === 0)
+        return issues;
+    const set = new Set(namespaces);
+    return issues.filter((i) => set.has(i.namespace));
+}
+export function summarizeIssues(issues, podCount, nodeCount) {
+    return {
+        critical: issues.filter((i) => i.severity === "critical").length,
+        warning: issues.filter((i) => i.severity === "warning").length,
+        info: issues.filter((i) => i.severity === "info").length,
+        podCount,
+        nodeCount,
+    };
+}
+export function computeExitCode(summary, failOn) {
+    const threshold = SEVERITY_RANK[failOn];
+    const triggered = [];
+    if (SEVERITY_RANK.critical >= threshold && summary.critical > 0)
+        triggered.push("critical");
+    if (SEVERITY_RANK.warning >= threshold && summary.warning > 0)
+        triggered.push("warning");
+    if (SEVERITY_RANK.info >= threshold && summary.info > 0)
+        triggered.push("info");
+    if (triggered.length === 0) {
+        return { code: 0, reason: `no issues at or above fail-on=${failOn}` };
+    }
+    return { code: 1, reason: `fail-on=${failOn} threshold met (${triggered.join(", ")})` };
+}
+export function renderJson(report) {
+    return JSON.stringify({
+        ...report,
+        issues: report.issues.map((i) => ({
+            kind: i.kind,
+            severity: i.severity,
+            namespace: i.namespace,
+            resource: i.resource,
+            message: i.message,
+            details: i.details,
+        })),
+    }, null, 2);
+}
+export function renderHuman(report) {
+    const lines = [];
+    const nsLabel = report.namespaces === "all" ? "all" : report.namespaces.join(", ");
+    lines.push(`KubeAgent check — context: ${chalk.cyan(report.context)}  namespace: ${chalk.cyan(nsLabel)}`);
+    const { summary, durationMs } = report;
+    const headlineIcon = summary.critical > 0 ? chalk.red("✖") : summary.warning > 0 ? chalk.yellow("⚠") : chalk.green("✔");
+    const headlineMsg = summary.critical + summary.warning + summary.info === 0
+        ? "all clear"
+        : `${summary.critical} critical, ${summary.warning} warnings, ${summary.info} info`;
+    lines.push(`${headlineIcon} ${headlineMsg} ${chalk.dim(`(scanned ${summary.podCount} pods, ${summary.nodeCount} nodes in ${(durationMs / 1000).toFixed(1)}s)`)}`);
+    if (report.issues.length > 0) {
+        lines.push("");
+        for (const issue of report.issues) {
+            const sevColor = issue.severity === "critical" ? chalk.red : issue.severity === "warning" ? chalk.yellow : chalk.dim;
+            lines.push(`  ${sevColor(issue.severity.padEnd(8))}  ${issue.namespace}  ${chalk.dim(issue.kind.padEnd(16))}  ${issue.resource}  ${issue.message}`);
+        }
+    }
+    if (report.diagnosis) {
+        lines.push("");
+        lines.push(chalk.bold("Diagnosis:"));
+        lines.push(report.diagnosis.analysis);
+    }
+    lines.push("");
+    lines.push(chalk.dim(`Exit: ${report.exit.code} (${report.exit.reason})`));
+    return lines.join("\n");
+}

package/dist/check/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/check/index.test.js

@@ -0,0 +1,202 @@
+import { describe, it, expect } from "vitest";
+import { computeExitCode, filterIssuesByNamespace, isValidSeverity, renderHuman, renderJson, summarizeIssues, } from "./index.js";
+function makeIssue(overrides = {}) {
+    return {
+        kind: "pod_crashloop",
+        severity: "critical",
+        namespace: "default",
+        resource: "test-pod",
+        message: "CrashLoopBackOff",
+        details: {},
+        timestamp: new Date("2026-05-28T10:00:00Z"),
+        ...overrides,
+    };
+}
+describe("isValidSeverity", () => {
+    it("accepts the three valid severities", () => {
+        expect(isValidSeverity("info")).toBe(true);
+        expect(isValidSeverity("warning")).toBe(true);
+        expect(isValidSeverity("critical")).toBe(true);
+    });
+    it("rejects anything else", () => {
+        expect(isValidSeverity("bogus")).toBe(false);
+        expect(isValidSeverity("")).toBe(false);
+        expect(isValidSeverity("CRITICAL")).toBe(false);
+    });
+});
+describe("filterIssuesByNamespace", () => {
+    const issues = [
+        makeIssue({ namespace: "foo" }),
+        makeIssue({ namespace: "bar" }),
+        makeIssue({ namespace: "baz" }),
+    ];
+    it("returns all issues when scope is 'all'", () => {
+        expect(filterIssuesByNamespace(issues, "all")).toHaveLength(3);
+    });
+    it("returns all issues when namespace list is empty", () => {
+        expect(filterIssuesByNamespace(issues, [])).toHaveLength(3);
+    });
+    it("filters to the specified namespaces", () => {
+        const result = filterIssuesByNamespace(issues, ["foo", "baz"]);
+        expect(result.map((i) => i.namespace)).toEqual(["foo", "baz"]);
+    });
+    it("returns empty when no namespaces match", () => {
+        expect(filterIssuesByNamespace(issues, ["nope"])).toHaveLength(0);
+    });
+});
+describe("summarizeIssues", () => {
+    it("counts each severity", () => {
+        const issues = [
+            makeIssue({ severity: "critical" }),
+            makeIssue({ severity: "critical" }),
+            makeIssue({ severity: "warning" }),
+            makeIssue({ severity: "info" }),
+        ];
+        const s = summarizeIssues(issues, 10, 3);
+        expect(s).toEqual({ critical: 2, warning: 1, info: 1, podCount: 10, nodeCount: 3 });
+    });
+    it("zeros when no issues", () => {
+        expect(summarizeIssues([], 5, 2)).toEqual({
+            critical: 0,
+            warning: 0,
+            info: 0,
+            podCount: 5,
+            nodeCount: 2,
+        });
+    });
+});
+describe("computeExitCode", () => {
+    const empty = { critical: 0, warning: 0, info: 0, podCount: 0, nodeCount: 0 };
+    it("exits 0 when no issues at any threshold", () => {
+        expect(computeExitCode(empty, "critical").code).toBe(0);
+        expect(computeExitCode(empty, "warning").code).toBe(0);
+        expect(computeExitCode(empty, "info").code).toBe(0);
+    });
+    it("fail-on=critical only fails on critical", () => {
+        expect(computeExitCode({ ...empty, critical: 1 }, "critical").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 5 }, "critical").code).toBe(0);
+        expect(computeExitCode({ ...empty, info: 10 }, "critical").code).toBe(0);
+    });
+    it("fail-on=warning fails on warning or critical", () => {
+        expect(computeExitCode({ ...empty, critical: 1 }, "warning").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 1 }, "warning").code).toBe(1);
+        expect(computeExitCode({ ...empty, info: 1 }, "warning").code).toBe(0);
+    });
+    it("fail-on=info fails on anything", () => {
+        expect(computeExitCode({ ...empty, info: 1 }, "info").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 1 }, "info").code).toBe(1);
+        expect(computeExitCode({ ...empty, critical: 1 }, "info").code).toBe(1);
+    });
+    it("reason mentions all triggered severities", () => {
+        const result = computeExitCode({ ...empty, critical: 1, warning: 1 }, "warning");
+        expect(result.code).toBe(1);
+        expect(result.reason).toContain("critical");
+        expect(result.reason).toContain("warning");
+    });
+});
+describe("renderJson", () => {
+    function makeReport(overrides = {}) {
+        return {
+            version: 1,
+            context: "hetzner-prod",
+            namespaces: ["kubeagent"],
+            scannedAt: "2026-05-28T10:00:00.000Z",
+            durationMs: 1200,
+            summary: { critical: 1, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [
+                makeIssue({
+                    namespace: "kubeagent",
+                    resource: "kubeagent-server-7d9-xj2",
+                    message: "CrashLoopBackOff (5 restarts)",
+                    details: { restartCount: 5 },
+                }),
+            ],
+            diagnosis: null,
+            exit: { code: 1, reason: "fail-on=critical threshold met (critical)" },
+            ...overrides,
+        };
+    }
+    it("emits versioned schema", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.version).toBe(1);
+    });
+    it("strips timestamp from issues (not part of v1 schema)", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.issues[0]).not.toHaveProperty("timestamp");
+        expect(parsed.issues[0].kind).toBe("pod_crashloop");
+        expect(parsed.issues[0].details.restartCount).toBe(5);
+    });
+    it("emits diagnosis: null when not run", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.diagnosis).toBeNull();
+    });
+    it("includes diagnosis when present", () => {
+        const parsed = JSON.parse(renderJson(makeReport({ diagnosis: { analysis: "Root cause: DB unreachable" } })));
+        expect(parsed.diagnosis.analysis).toContain("DB unreachable");
+    });
+    it("handles empty issues", () => {
+        const parsed = JSON.parse(renderJson(makeReport({
+            issues: [],
+            summary: { critical: 0, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            exit: { code: 0, reason: "no issues at or above fail-on=critical" },
+        })));
+        expect(parsed.issues).toEqual([]);
+        expect(parsed.exit.code).toBe(0);
+    });
+});
+describe("renderHuman", () => {
+    const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
+    function makeReport(overrides = {}) {
+        return {
+            version: 1,
+            context: "hetzner-prod",
+            namespaces: "all",
+            scannedAt: "2026-05-28T10:00:00.000Z",
+            durationMs: 1200,
+            summary: { critical: 0, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [],
+            diagnosis: null,
+            exit: { code: 0, reason: "no issues at or above fail-on=critical" },
+            ...overrides,
+        };
+    }
+    it("shows 'all clear' when no issues", () => {
+        const out = stripAnsi(renderHuman(makeReport()));
+        expect(out).toContain("all clear");
+        expect(out).toContain("Exit: 0");
+    });
+    it("renders critical issues with severity column", () => {
+        const out = stripAnsi(renderHuman(makeReport({
+            summary: { critical: 1, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [
+                {
+                    kind: "pod_crashloop",
+                    severity: "critical",
+                    namespace: "kubeagent",
+                    resource: "server-xj2",
+                    message: "CrashLoopBackOff",
+                    details: {},
+                    timestamp: new Date(),
+                },
+            ],
+            exit: { code: 1, reason: "fail-on=critical threshold met (critical)" },
+        })));
+        expect(out).toContain("1 critical");
+        expect(out).toContain("server-xj2");
+        expect(out).toContain("CrashLoopBackOff");
+        expect(out).toContain("Exit: 1");
+    });
+    it("shows diagnosis block when present", () => {
+        const out = stripAnsi(renderHuman(makeReport({ diagnosis: { analysis: "Root cause analysis here" } })));
+        expect(out).toContain("Diagnosis");
+        expect(out).toContain("Root cause analysis here");
+    });
+    it("shows 'all' for cluster-wide scope", () => {
+        const out = stripAnsi(renderHuman(makeReport({ namespaces: "all" })));
+        expect(out).toContain("namespace: all");
+    });
+    it("shows namespace list for scoped runs", () => {
+        const out = stripAnsi(renderHuman(makeReport({ namespaces: ["foo", "bar"] })));
+        expect(out).toContain("foo, bar");
+    });
+});

package/dist/check/run.d.ts

@@ -0,0 +1,10 @@
+export interface CheckCliOptions {
+    context?: string;
+    namespace?: string[];
+    allNamespaces?: boolean;
+    failOn: string;
+    format: string;
+    diagnose?: boolean;
+    timeout: string;
+}
+export declare function runCheck(opts: CheckCliOptions): Promise<void>;

package/dist/check/run.js

@@ -0,0 +1,114 @@
+import chalk from "chalk";
+import { kubectl } from "../kubectl.js";
+import { runChecks } from "../monitor/index.js";
+import { computeExitCode, isValidSeverity, renderHuman, renderJson, summarizeIssues, } from "./index.js";
+class CheckError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.hint = hint;
+    }
+}
+function emitError(message, hint) {
+    process.stderr.write(chalk.red(`✖ ${message}\n`));
+    if (hint)
+        process.stderr.write(chalk.dim(`  ${hint}\n`));
+    process.exit(2);
+}
+export async function runCheck(opts) {
+    // --- flag validation ---
+    if (!isValidSeverity(opts.failOn)) {
+        emitError(`invalid --fail-on value "${opts.failOn}"`, "expected one of: info, warning, critical");
+    }
+    if (opts.format !== "human" && opts.format !== "json") {
+        emitError(`invalid --format value "${opts.format}"`, "expected one of: human, json");
+    }
+    const timeoutSec = Number.parseInt(opts.timeout, 10);
+    if (!Number.isFinite(timeoutSec) || timeoutSec <= 0) {
+        emitError(`invalid --timeout value "${opts.timeout}"`, "expected a positive integer (seconds)");
+    }
+    if (opts.diagnose && !process.env.KUBEAGENT_API_KEY) {
+        emitError("--diagnose requires KUBEAGENT_API_KEY env var", "set it as a CI secret, e.g. in GitHub Actions: env: { KUBEAGENT_API_KEY: ${{ secrets.KUBEAGENT_API_KEY }} }");
+    }
+    const failOn = opts.failOn;
+    const namespaces = opts.allNamespaces || !opts.namespace || opts.namespace.length === 0
+        ? "all"
+        : opts.namespace;
+    // --- run with timeout wrapper ---
+    const startedAt = Date.now();
+    let timeoutHandle;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeoutHandle = setTimeout(() => reject(new CheckError(`check timed out after ${timeoutSec}s`)), timeoutSec * 1000);
+    });
+    try {
+        const report = await Promise.race([
+            doCheck({ failOn, namespaces, format: opts.format, context: opts.context, diagnose: !!opts.diagnose, startedAt }),
+            timeoutPromise,
+        ]);
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+        const output = opts.format === "json" ? renderJson(report) : renderHuman(report);
+        process.stdout.write(output + "\n");
+        process.exit(report.exit.code);
+    }
+    catch (err) {
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+        const message = err.message || "check failed";
+        if (err instanceof CheckError) {
+            emitError(message, err.hint);
+        }
+        emitError(message);
+    }
+}
+async function doCheck(args) {
+    const { failOn, namespaces, context, diagnose: shouldDiagnose, startedAt } = args;
+    const kubectlOpts = context ? { context } : {};
+    // Preflight: confirm the cluster is reachable so we fail fast with exit 2
+    // rather than a confusing kubectl error mid-scan.
+    try {
+        await kubectl(["cluster-info", "--request-timeout=5s"], kubectlOpts);
+    }
+    catch (err) {
+        throw new CheckError(`cannot reach cluster: ${err.message}`, "check your kubeconfig and --context flag");
+    }
+    // Resolve effective context name for the report (kubectl current-context
+    // is fine when --context not passed).
+    let effectiveContext = context ?? "(current-context)";
+    if (!context) {
+        try {
+            effectiveContext = (await kubectl(["config", "current-context"])).trim();
+        }
+        catch {
+            // non-fatal — keep the placeholder
+        }
+    }
+    // Scope kubectl queries to the requested namespaces so namespace-bound
+    // CI service accounts don't need cluster-wide list permissions.
+    const scope = namespaces === "all" ? undefined : { namespaces };
+    const summaryResult = await runChecks(kubectlOpts, true, scope);
+    const filteredIssues = summaryResult.issues;
+    const summary = summarizeIssues(filteredIssues, summaryResult.podCount, summaryResult.nodeCount);
+    let diagnosis = null;
+    if (shouldDiagnose && filteredIssues.length > 0) {
+        const { diagnose } = await import("../diagnoser/index.js");
+        const result = await diagnose(filteredIssues, "", context, {
+            autoFix: false,
+            noInteractive: true,
+            onApproval: async () => false,
+        });
+        diagnosis = { analysis: result.analysis };
+    }
+    const exit = computeExitCode(summary, failOn);
+    return {
+        version: 1,
+        context: effectiveContext,
+        namespaces,
+        scannedAt: new Date(startedAt).toISOString(),
+        durationMs: Date.now() - startedAt,
+        summary,
+        issues: filteredIssues,
+        diagnosis,
+        exit,
+    };
+}

package/dist/cli.js

@@ -170,6 +170,20 @@ program
     // Keep process alive
     await new Promise(() => { });
 });
+program
+    .command("check")
+    .description("One-shot cluster health check (CI-friendly, read-only by default)")
+    .option("-c, --context <context>", "Kubernetes context (defaults to kubeconfig current-context)")
+    .option("-n, --namespace <namespace>", "Limit scope to namespace (repeatable)", (val, prev) => [...(prev ?? []), val], undefined)
+    .option("--all-namespaces", "Scan all namespaces (default; overrides -n if both set)")
+    .option("--fail-on <severity>", "Exit non-zero on issues >= severity (info|warning|critical)", "critical")
+    .option("--format <fmt>", "Output format: human|json", "human")
+    .option("--diagnose", "Run LLM analysis on findings (requires KUBEAGENT_API_KEY)")
+    .option("--timeout <seconds>", "Max time for the check itself", "60")
+    .action(async (opts) => {
+    const { runCheck } = await import("./check/run.js");
+    await runCheck(opts);
+});
 program
     .command("diagnose <resource>")
     .description("One-shot diagnosis of a specific pod/deployment/service")
@@ -328,6 +342,123 @@ program
         }
     }
 });
+program
+    .command("scan-apps")
+    .description("Detect open-source apps in the cluster and check for CVEs / EOL versions")
+    .option("-c, --context <context>", "Kubernetes context")
+    .option("--no-cache", "Force refresh of CVE/EOL data")
+    .option("--json", "Print JSON result instead of writing the knowledge base")
+    .option("--report", "Also generate an AI-prioritized remediation report (uses tokens)")
+    .action(async (opts) => {
+    const { detectApplications, formatApplicationsMarkdown } = await import("./detector/index.js");
+    const { writeApplicationsKb, ensureKbDir } = await import("./kb/writer.js");
+    const { kubectl } = await import("./kubectl.js");
+    let contextName = opts.context;
+    if (!contextName) {
+        try {
+            contextName = (await kubectl(["config", "current-context"])).trim();
+        }
+        catch {
+            contextName = "default";
+        }
+    }
+    const spinner = ora("Scanning cluster for OSS applications...").start();
+    let result;
+    try {
+        result = await detectApplications({
+            context: contextName,
+            noCache: opts.cache === false,
+            onProgress: (step) => {
+                spinner.text = `Scanning cluster for OSS applications — ${step}...`;
+            },
+        });
+    }
+    catch (err) {
+        spinner.fail(`Scan failed: ${err.message}`);
+        process.exit(1);
+    }
+    const eolCount = result.apps.filter((a) => a.eol?.eol).length;
+    const cveCount = result.apps.filter((a) => a.cves.length > 0).length;
+    spinner.succeed(`Inventoried ${result.apps.length} app${result.apps.length === 1 ? "" : "s"} ` +
+        `(${eolCount} EOL, ${cveCount} with CVEs, ${result.unknowns.length} unmatched)`);
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    const kbDir = join(configDir(), "clusters", contextName);
+    ensureKbDir(kbDir);
+    writeApplicationsKb(kbDir, formatApplicationsMarkdown(result));
+    console.log(chalk.dim(`Inventory written to ${join(kbDir, "applications.md")}`));
+    if (result.apps.length === 0 && result.unknowns.length === 0) {
+        console.log(chalk.dim("No detectable OSS applications found."));
+        return;
+    }
+    const renderWorkloads = (workloads) => {
+        for (const w of workloads) {
+            const hosts = w.hosts && w.hosts.length > 0 ? chalk.cyan(`  ${w.hosts.join(", ")}`) : "";
+            console.log(chalk.dim(`           ↳ ${w.kind}/${w.namespace}/${w.name}`) + hosts);
+        }
+    };
+    console.log();
+    for (const a of result.apps) {
+        if (a.eol?.eol) {
+            const since = a.eol.eolDate ? ` since ${a.eol.eolDate}` : "";
+            const latest = a.eol.latest ? chalk.dim(` (latest: ${a.eol.latest})`) : "";
+            console.log(chalk.red(`[critical] ${a.display} ${a.version} — EOL${since}`) +
+                latest +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+        else if (a.cves.length > 0) {
+            const ids = a.cves.slice(0, 3).map((c) => c.id).join(", ");
+            const more = a.cves.length > 3 ? ` + ${a.cves.length - 3} more` : "";
+            console.log(chalk.yellow(`[warning]  ${a.display} ${a.version} — ${a.cves.length} CVE(s): ${ids}${more}`) +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+        else {
+            console.log(chalk.green(`[info]     ${a.display} ${a.version} — no known CVEs`) +
+                chalk.dim(`  ${a.workloads.length} workload(s)`));
+            renderWorkloads(a.workloads);
+        }
+    }
+    if (opts.report) {
+        if (result.apps.length === 0) {
+            console.log(chalk.dim("\nNo apps to analyze — skipping report."));
+            return;
+        }
+        const auth = loadAuth();
+        if (!auth?.apiKey) {
+            console.error(chalk.red("\n--report requires login. Run: kubeagent login"));
+            process.exit(1);
+        }
+        const { generateReport } = await import("./detector/report.js");
+        const { writeFileSync } = await import("node:fs");
+        const reportSpinner = ora("Generating remediation report...").start();
+        let report;
+        try {
+            report = await generateReport(result, auth, {
+                onProgress: (s) => { reportSpinner.text = `Generating remediation report — ${s}...`; },
+            });
+        }
+        catch (err) {
+            const e = err;
+            if (e.status === 402 || e.code === "token_exhausted") {
+                reportSpinner.fail("Token balance exhausted. Run: kubeagent account");
+            }
+            else {
+                reportSpinner.fail(`Report failed: ${e.message.replace("KubeAgent proxy: ", "")}`);
+            }
+            return;
+        }
+        reportSpinner.succeed("Remediation report ready");
+        const reportPath = join(kbDir, "report.md");
+        writeFileSync(reportPath, report);
+        console.log(chalk.dim(`Report written to ${reportPath}`));
+        console.log();
+        console.log(report);
+    }
+});
 // Notify commands
 const notifyCmd = program.command("notify").description("Manage notification channels");
 notifyCmd