kubeagent 0.1.35 → 0.1.43

package/dist/detector/index.js

@@ -0,0 +1,217 @@
+import { fetchWorkloadCandidates, fetchHelmCandidates, fetchIngressHostMap, workloadKey, } from "./sources.js";
+import { parseImage, normalizeVersion } from "./image-parser.js";
+import { lookupCatalog, lookupChart } from "./catalog.js";
+import { queryOsv } from "./osv.js";
+import { queryEol } from "./eol.js";
+function recordWorkload(map, ref, hostsByWorkload) {
+    const key = workloadKey(ref);
+    if (!map.has(key)) {
+        const hosts = hostsByWorkload?.get(key);
+        map.set(key, hosts && hosts.length > 0 ? { ...ref, hosts } : ref);
+    }
+}
+function helmWorkloadRef(c) {
+    return { kind: "Deployment", namespace: c.namespace, name: c.releaseName };
+}
+export async function detectApplications(opts = {}) {
+    const { onProgress, noCache } = opts;
+    const kubectlOpts = {
+        context: opts.context,
+        namespace: opts.namespace,
+        timeout: opts.timeout,
+    };
+    onProgress?.("workloads");
+    const [workloadCandidates, ingressMap] = await Promise.all([
+        fetchWorkloadCandidates(kubectlOpts),
+        fetchIngressHostMap(kubectlOpts).catch(() => new Map()),
+    ]);
+    onProgress?.("helm");
+    const helmCandidates = await fetchHelmCandidates(kubectlOpts);
+    const known = new Map();
+    const unknowns = new Map();
+    for (const c of workloadCandidates) {
+        if (c.source === "image") {
+            const parsed = parseImage(c.image);
+            const version = normalizeVersion(parsed.tag);
+            const match = lookupCatalog(parsed.repository, parsed.name);
+            if (match && version) {
+                const key = `${match.canonical}@${version}`;
+                let det = known.get(key);
+                if (!det) {
+                    det = {
+                        canonical: match.canonical,
+                        display: match.entry.display,
+                        version,
+                        entry: match.entry,
+                        sources: new Set(),
+                        workloads: new Map(),
+                    };
+                    known.set(key, det);
+                }
+                det.sources.add("image");
+                recordWorkload(det.workloads, c.workload, ingressMap);
+            }
+            else if (version) {
+                const key = `${parsed.name}@${version}`;
+                let u = unknowns.get(key);
+                if (!u) {
+                    u = { name: parsed.name, version, workloads: [] };
+                    unknowns.set(key, u);
+                }
+                if (!u.workloads.some((w) => w.kind === c.workload.kind && w.namespace === c.workload.namespace && w.name === c.workload.name)) {
+                    const hosts = ingressMap.get(workloadKey(c.workload));
+                    u.workloads.push(hosts && hosts.length > 0 ? { ...c.workload, hosts } : c.workload);
+                }
+            }
+        }
+        else if (c.source === "label") {
+            const match = lookupCatalog(c.appName, c.appName);
+            const version = normalizeVersion(c.appVersion);
+            if (match && version) {
+                const key = `${match.canonical}@${version}`;
+                let det = known.get(key);
+                if (!det) {
+                    det = {
+                        canonical: match.canonical,
+                        display: match.entry.display,
+                        version,
+                        entry: match.entry,
+                        sources: new Set(),
+                        workloads: new Map(),
+                    };
+                    known.set(key, det);
+                }
+                det.sources.add("label");
+                recordWorkload(det.workloads, c.workload, ingressMap);
+            }
+        }
+    }
+    for (const c of helmCandidates) {
+        const match = lookupChart(c.chart);
+        const version = normalizeVersion(c.appVersion ?? c.chartVersion);
+        if (match && version) {
+            const key = `${match.canonical}@${version}`;
+            let det = known.get(key);
+            if (!det) {
+                det = {
+                    canonical: match.canonical,
+                    display: match.entry.display,
+                    version,
+                    entry: match.entry,
+                    sources: new Set(),
+                    workloads: new Map(),
+                };
+                known.set(key, det);
+            }
+            det.sources.add("helm");
+            recordWorkload(det.workloads, helmWorkloadRef(c), ingressMap);
+        }
+    }
+    onProgress?.("cve");
+    const apps = [];
+    for (const det of known.values()) {
+        const cves = det.entry.osv
+            ? await queryOsv(det.entry.osv, det.version, { noCache })
+            : [];
+        const eol = det.entry.eolProduct
+            ? await queryEol(det.entry.eolProduct, det.version, { noCache })
+            : null;
+        apps.push({
+            canonical: det.canonical,
+            display: det.display,
+            version: det.version,
+            sources: [...det.sources],
+            workloads: [...det.workloads.values()],
+            cves,
+            eol,
+            catalogMatch: true,
+        });
+    }
+    apps.sort((a, b) => {
+        const sev = (x) => {
+            if (x.eol?.eol)
+                return 0;
+            if (x.cves.length > 0)
+                return 1;
+            return 2;
+        };
+        const s = sev(a) - sev(b);
+        return s !== 0 ? s : a.display.localeCompare(b.display);
+    });
+    return {
+        apps,
+        unknowns: [...unknowns.values()].sort((a, b) => a.name.localeCompare(b.name)),
+        scanned: {
+            workloads: workloadCandidates.length,
+            helmReleases: helmCandidates.length,
+        },
+    };
+}
+function workloadLabel(w) {
+    const base = `${w.kind}/${w.namespace}/${w.name}`;
+    return w.hosts && w.hosts.length > 0 ? `${base} (${w.hosts.join(", ")})` : base;
+}
+function escapeMd(s) {
+    return s.replace(/\|/g, "\\|");
+}
+export function formatApplicationsMarkdown(result) {
+    const lines = [];
+    lines.push("# Detected Open-Source Applications", "");
+    lines.push(`_Scanned ${result.scanned.workloads} workload container(s) and ${result.scanned.helmReleases} Helm release(s)._`, "");
+    const eolApps = result.apps.filter((a) => a.eol?.eol);
+    const cveApps = result.apps.filter((a) => !a.eol?.eol && a.cves.length > 0);
+    const healthy = result.apps.filter((a) => !a.eol?.eol && a.cves.length === 0);
+    if (eolApps.length > 0) {
+        lines.push("## End-of-Life", "");
+        lines.push("| App | Version | EOL since | Latest in cycle | Workloads |");
+        lines.push("|-----|---------|-----------|-----------------|-----------|");
+        for (const a of eolApps) {
+            const eolStr = a.eol?.eolDate ?? "yes";
+            const latest = a.eol?.latest ?? "—";
+            const wls = a.workloads.map(workloadLabel).join(", ");
+            lines.push(`| ${escapeMd(a.display)} | \`${a.version}\` | ${eolStr} | \`${latest}\` | ${escapeMd(wls)} |`);
+        }
+        lines.push("");
+    }
+    if (cveApps.length > 0) {
+        lines.push("## Known Vulnerabilities", "");
+        for (const a of cveApps) {
+            lines.push(`### ${a.display} \`${a.version}\``);
+            lines.push(`Workloads: ${a.workloads.map(workloadLabel).join(", ")}`);
+            lines.push("");
+            lines.push("| CVE | Severity | Fixed in | Summary |");
+            lines.push("|-----|----------|----------|---------|");
+            for (const c of a.cves.slice(0, 20)) {
+                const ref = c.reference ? `[${c.id}](${c.reference})` : c.id;
+                const fixed = c.fixed ? `\`${c.fixed}\`` : "—";
+                const sev = c.severity ?? "—";
+                lines.push(`| ${ref} | ${sev} | ${fixed} | ${escapeMd(c.summary || "")} |`);
+            }
+            if (a.cves.length > 20) {
+                lines.push(`| _… and ${a.cves.length - 20} more_ | | | |`);
+            }
+            lines.push("");
+        }
+    }
+    if (healthy.length > 0) {
+        lines.push("## Up-to-date", "");
+        lines.push("| App | Version | Workloads |");
+        lines.push("|-----|---------|-----------|");
+        for (const a of healthy) {
+            const wls = a.workloads.map(workloadLabel).join(", ");
+            lines.push(`| ${escapeMd(a.display)} | \`${a.version}\` | ${escapeMd(wls)} |`);
+        }
+        lines.push("");
+    }
+    if (result.unknowns.length > 0) {
+        lines.push("## Other / not in catalog", "");
+        lines.push("Images that look like OSS apps but aren't in the CVE/EOL catalog yet:");
+        lines.push("");
+        for (const u of result.unknowns) {
+            const wls = u.workloads.map(workloadLabel).join(", ");
+            lines.push(`- \`${u.name}:${u.version}\` — ${wls}`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n");
+}

package/dist/detector/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/index.test.js

@@ -0,0 +1,210 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("./sources.js", () => ({
+    fetchWorkloadCandidates: vi.fn(),
+    fetchHelmCandidates: vi.fn(),
+    fetchIngressHostMap: vi.fn(),
+    workloadKey: (ref) => `${ref.kind}/${ref.namespace}/${ref.name}`,
+}));
+vi.mock("./osv.js", () => ({
+    queryOsv: vi.fn(),
+}));
+vi.mock("./eol.js", () => ({
+    queryEol: vi.fn(),
+}));
+import { fetchWorkloadCandidates, fetchHelmCandidates, fetchIngressHostMap } from "./sources.js";
+import { queryOsv } from "./osv.js";
+import { queryEol } from "./eol.js";
+import { detectApplications, formatApplicationsMarkdown } from "./index.js";
+const fetchWorkloads = vi.mocked(fetchWorkloadCandidates);
+const fetchHelm = vi.mocked(fetchHelmCandidates);
+const fetchIngress = vi.mocked(fetchIngressHostMap);
+const osv = vi.mocked(queryOsv);
+const eol = vi.mocked(queryEol);
+describe("detectApplications", () => {
+    beforeEach(() => {
+        fetchWorkloads.mockReset();
+        fetchHelm.mockReset();
+        fetchIngress.mockReset();
+        osv.mockReset();
+        eol.mockReset();
+        fetchIngress.mockResolvedValue(new Map());
+        osv.mockResolvedValue([]);
+        eol.mockResolvedValue(null);
+    });
+    it("merges image and label candidates pointing at the same app/version", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "postgres:15.2",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+            {
+                source: "label",
+                appName: "postgres",
+                appVersion: "15.2",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(1);
+        expect(result.apps[0].canonical).toBe("postgres");
+        expect(result.apps[0].version).toBe("15.2");
+        expect(result.apps[0].sources.sort()).toEqual(["image", "label"]);
+        expect(result.apps[0].workloads).toHaveLength(1);
+    });
+    it("tracks images not in the catalog as unknowns", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "acme/internal-app:1.2.3",
+                container: "app",
+                workload: { kind: "Deployment", namespace: "team-x", name: "foo" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(0);
+        expect(result.unknowns).toHaveLength(1);
+        expect(result.unknowns[0]).toMatchObject({ name: "internal-app", version: "1.2.3" });
+    });
+    it("flags EOL apps via the eol lookup", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "postgres:11.18",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        eol.mockResolvedValue({
+            product: "postgres",
+            cycle: "11",
+            eol: true,
+            eolDate: "2023-11-09",
+            latest: "11.22",
+            lts: false,
+        });
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps[0].eol?.eol).toBe(true);
+        expect(result.apps[0].eol?.eolDate).toBe("2023-11-09");
+    });
+    it("attaches CVE findings from OSV", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "redis:7.0.5",
+                container: "cache",
+                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        osv.mockResolvedValue([
+            { id: "CVE-2023-9999", summary: "Boom.", severity: "high", fixed: "7.0.12" },
+        ]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps[0].cves).toHaveLength(1);
+        expect(result.apps[0].cves[0].id).toBe("CVE-2023-9999");
+    });
+    it("orders apps by severity (EOL → CVEs → healthy)", async () => {
+        fetchWorkloads.mockResolvedValue([
+            {
+                source: "image",
+                image: "nginx:1.25.3",
+                container: "web",
+                workload: { kind: "Deployment", namespace: "edge", name: "nginx" },
+            },
+            {
+                source: "image",
+                image: "postgres:11.18",
+                container: "db",
+                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
+            },
+            {
+                source: "image",
+                image: "redis:7.0.5",
+                container: "cache",
+                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
+            },
+        ]);
+        fetchHelm.mockResolvedValue([]);
+        eol.mockImplementation(async (product) => product === "postgres"
+            ? { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", lts: false }
+            : null);
+        osv.mockImplementation(async (lookup) => lookup.name === "redis"
+            ? [{ id: "CVE-2023-1", summary: "x", severity: "medium" }]
+            : []);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps.map((a) => a.canonical)).toEqual(["postgres", "redis", "nginx"]);
+    });
+    it("uses Helm chart appVersion when available", async () => {
+        fetchWorkloads.mockResolvedValue([]);
+        fetchHelm.mockResolvedValue([
+            {
+                source: "helm",
+                chart: "postgresql",
+                chartVersion: "12.0.0",
+                appVersion: "15.2.0",
+                namespace: "data",
+                releaseName: "primary",
+            },
+        ]);
+        const result = await detectApplications({ noCache: true });
+        expect(result.apps).toHaveLength(1);
+        expect(result.apps[0].canonical).toBe("postgres");
+        expect(result.apps[0].version).toBe("15.2.0");
+        expect(result.apps[0].sources).toContain("helm");
+    });
+});
+describe("formatApplicationsMarkdown", () => {
+    it("produces sections for EOL, CVEs, healthy, and unknowns", () => {
+        const md = formatApplicationsMarkdown({
+            apps: [
+                {
+                    canonical: "postgres",
+                    display: "PostgreSQL",
+                    version: "11.18",
+                    sources: ["image"],
+                    workloads: [{ kind: "StatefulSet", namespace: "prod", name: "db" }],
+                    cves: [],
+                    eol: { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", latest: "11.22", lts: false },
+                    catalogMatch: true,
+                },
+                {
+                    canonical: "redis",
+                    display: "Redis",
+                    version: "7.0.5",
+                    sources: ["image"],
+                    workloads: [{ kind: "Deployment", namespace: "infra", name: "redis" }],
+                    cves: [{ id: "CVE-2023-1", summary: "boom", severity: "high", fixed: "7.0.12" }],
+                    eol: null,
+                    catalogMatch: true,
+                },
+                {
+                    canonical: "nginx",
+                    display: "nginx",
+                    version: "1.25.3",
+                    sources: ["image"],
+                    workloads: [{ kind: "Deployment", namespace: "edge", name: "nginx" }],
+                    cves: [],
+                    eol: null,
+                    catalogMatch: true,
+                },
+            ],
+            unknowns: [
+                { name: "internal-app", version: "1.2.3", workloads: [{ kind: "Deployment", namespace: "team-x", name: "foo" }] },
+            ],
+            scanned: { workloads: 4, helmReleases: 0 },
+        });
+        expect(md).toContain("## End-of-Life");
+        expect(md).toContain("PostgreSQL");
+        expect(md).toContain("## Known Vulnerabilities");
+        expect(md).toContain("CVE-2023-1");
+        expect(md).toContain("## Up-to-date");
+        expect(md).toContain("nginx");
+        expect(md).toContain("## Other / not in catalog");
+        expect(md).toContain("internal-app");
+    });
+});

package/dist/detector/osv.d.ts

@@ -0,0 +1,12 @@
+import type { OsvLookup } from "./catalog.js";
+export interface CveFinding {
+    id: string;
+    summary: string;
+    severity?: string;
+    fixed?: string;
+    reference?: string;
+}
+export declare function queryOsv(lookup: OsvLookup, version: string, opts?: {
+    noCache?: boolean;
+    timeoutMs?: number;
+}): Promise<CveFinding[]>;

package/dist/detector/osv.js

@@ -0,0 +1,50 @@
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+const OSV_URL = "https://api.osv.dev/v1/query";
+function summarize(v) {
+    const fixed = v.affected?.[0]?.ranges?.[0]?.events?.find((e) => e.fixed)?.fixed;
+    const reference = v.references?.find((r) => r.type === "ADVISORY")?.url ??
+        v.references?.[0]?.url;
+    return {
+        id: v.id,
+        summary: (v.summary ?? v.details ?? "").slice(0, 200),
+        severity: v.database_specific?.severity,
+        fixed,
+        reference,
+    };
+}
+export async function queryOsv(lookup, version, opts = {}) {
+    if (!version)
+        return [];
+    const cacheKey = `${lookup.ecosystem ?? "any"}-${lookup.name}@${version}`;
+    if (!opts.noCache) {
+        const cached = readCache("osv", cacheKey);
+        if (cached)
+            return cached;
+    }
+    const body = {
+        package: lookup.ecosystem
+            ? { name: lookup.name, ecosystem: lookup.ecosystem }
+            : { name: lookup.name },
+        version,
+    };
+    try {
+        const res = await fetch(OSV_URL, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 8000),
+        });
+        if (!res.ok) {
+            const stale = readStaleCache("osv", cacheKey);
+            return stale?.data ?? [];
+        }
+        const data = (await res.json());
+        const findings = (data.vulns ?? []).map(summarize);
+        writeCache("osv", cacheKey, findings);
+        return findings;
+    }
+    catch {
+        const stale = readStaleCache("osv", cacheKey);
+        return stale?.data ?? [];
+    }
+}

package/dist/detector/osv.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/osv.test.js

@@ -0,0 +1,86 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+vi.mock("./cache.js", () => ({
+    readCache: vi.fn(),
+    readStaleCache: vi.fn(),
+    writeCache: vi.fn(),
+}));
+import { readCache, readStaleCache, writeCache } from "./cache.js";
+import { queryOsv } from "./osv.js";
+const mockFetch = vi.fn();
+vi.stubGlobal("fetch", mockFetch);
+const cacheRead = vi.mocked(readCache);
+const cacheStale = vi.mocked(readStaleCache);
+const cacheWrite = vi.mocked(writeCache);
+describe("queryOsv", () => {
+    beforeEach(() => {
+        mockFetch.mockReset();
+        cacheRead.mockReset();
+        cacheStale.mockReset();
+        cacheWrite.mockReset();
+        cacheRead.mockReturnValue(null);
+        cacheStale.mockReturnValue(null);
+    });
+    it("posts the package + version to api.osv.dev and returns mapped findings", async () => {
+        mockFetch.mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                vulns: [
+                    {
+                        id: "CVE-2024-1",
+                        summary: "Test vuln",
+                        database_specific: { severity: "high" },
+                        affected: [{ ranges: [{ events: [{ introduced: "0" }, { fixed: "7.0.12" }] }] }],
+                        references: [{ type: "ADVISORY", url: "https://example.com/advisory" }],
+                    },
+                ],
+            }),
+        });
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(mockFetch).toHaveBeenCalledOnce();
+        expect(mockFetch.mock.calls[0][0]).toBe("https://api.osv.dev/v1/query");
+        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+        expect(body).toEqual({ package: { name: "redis" }, version: "7.0.5" });
+        expect(findings).toHaveLength(1);
+        expect(findings[0]).toMatchObject({
+            id: "CVE-2024-1",
+            severity: "high",
+            fixed: "7.0.12",
+            reference: "https://example.com/advisory",
+        });
+        expect(cacheWrite).toHaveBeenCalledOnce();
+    });
+    it("includes ecosystem in the OSV body when provided", async () => {
+        mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
+        await queryOsv({ name: "postgresql", ecosystem: "Debian" }, "15.2", { noCache: true });
+        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+        expect(body.package).toEqual({ name: "postgresql", ecosystem: "Debian" });
+    });
+    it("returns empty when version is empty", async () => {
+        const findings = await queryOsv({ name: "redis" }, "", { noCache: true });
+        expect(findings).toEqual([]);
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it("returns [] on network error when no stale cache is present", async () => {
+        mockFetch.mockRejectedValue(new Error("network down"));
+        const findings = await queryOsv({ name: "redis" }, "7.0.99", { noCache: true });
+        expect(findings).toEqual([]);
+    });
+    it("serves a fresh cached entry without hitting the network", async () => {
+        cacheRead.mockReturnValue([{ id: "CVE-cached", summary: "from cache" }]);
+        const findings = await queryOsv({ name: "redis" }, "7.0.5");
+        expect(mockFetch).not.toHaveBeenCalled();
+        expect(findings[0].id).toBe("CVE-cached");
+    });
+    it("falls back to stale cache on network error", async () => {
+        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "from cache" }], fetchedAt: 1 });
+        mockFetch.mockRejectedValue(new Error("offline"));
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(findings[0].id).toBe("CVE-stale");
+    });
+    it("falls back to stale cache on non-2xx response", async () => {
+        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "x" }], fetchedAt: 1 });
+        mockFetch.mockResolvedValue({ ok: false, status: 500 });
+        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
+        expect(findings[0].id).toBe("CVE-stale");
+    });
+});

package/dist/detector/report.d.ts

@@ -0,0 +1,6 @@
+import type { AuthState } from "../auth.js";
+import type { DetectionResult } from "./index.js";
+export interface ReportOptions {
+    onProgress?: (step: string) => void;
+}
+export declare function generateReport(result: DetectionResult, auth: AuthState, opts?: ReportOptions): Promise<string>;

package/dist/detector/report.js

@@ -0,0 +1,91 @@
+import { proxyRequest } from "../proxy-client.js";
+/**
+ * Trim the detection result to a compact JSON payload the model can reason
+ * over without blowing the context window. We cap CVEs per app and drop
+ * fields the model doesn't need (catalogMatch, sources, etc.).
+ */
+function buildPayload(result) {
+    const slimWorkload = (w) => ({
+        kind: w.kind,
+        namespace: w.namespace,
+        name: w.name,
+        ...(w.hosts && w.hosts.length > 0 ? { hosts: w.hosts } : {}),
+    });
+    const slimApp = (a) => ({
+        name: a.display,
+        version: a.version,
+        eol: a.eol?.eol
+            ? {
+                eolDate: a.eol.eolDate,
+                latestInCycle: a.eol.latest,
+            }
+            : null,
+        cveCount: a.cves.length,
+        cves: a.cves.slice(0, 10).map((c) => ({
+            id: c.id,
+            severity: c.severity ?? null,
+            fixed: c.fixed ?? null,
+            summary: c.summary ? c.summary.slice(0, 200) : null,
+        })),
+        workloads: a.workloads.map(slimWorkload),
+        publicFacing: a.workloads.some((w) => w.hosts && w.hosts.length > 0),
+    });
+    return {
+        apps: result.apps.map(slimApp),
+        unknownCount: result.unknowns.length,
+        scanned: result.scanned,
+    };
+}
+const INSTRUCTIONS = `You are producing a remediation report for a Kubernetes cluster scan.
+
+STRICT RULES — these are absolute, no exceptions:
+1. ONLY use facts from the JSON payload below. Do NOT invent CVE IDs, version numbers, EOL dates, or workload names.
+2. If a "latestInCycle" version is given, you may recommend upgrading to it. Do NOT recommend versions not present in the payload unless you explicitly mark them as "(verify upstream)".
+3. Do not speculate about CVE exploitability beyond what the summary says.
+4. Public-facing = workload has \`hosts\` field populated. Internal-only = no hosts.
+
+Produce a Markdown report with these sections:
+
+## Executive Summary
+2-3 sentences. Total findings, how many are critical (EOL or public-facing with CVEs), the single biggest risk.
+
+## Prioritized Fix List
+A numbered list, highest-risk first. For each item:
+- **App + version** (workloads affected)
+- **Why now** (1 sentence: EOL? public-facing? high CVE count?)
+- **Suggested next step** (which version to move to, or "investigate" if unclear)
+
+Prioritization order:
+1. EOL AND public-facing (has hosts)
+2. EOL internal-only
+3. Many CVEs AND public-facing
+4. Many CVEs internal-only
+5. Healthy
+
+## Notes
+Anything notable: duplicated infra (e.g. 5 Redis instances on same EOL version), version sprawl (same app at 3 different versions), missing-info gaps.
+
+Be concise. No padding. No emojis. No fabricated specifics.`;
+export async function generateReport(result, auth, opts = {}) {
+    opts.onProgress?.("preparing payload");
+    const payload = buildPayload(result);
+    const userMessage = `${INSTRUCTIONS}
+
+\`\`\`json
+${JSON.stringify(payload, null, 2)}
+\`\`\``;
+    opts.onProgress?.("calling model");
+    const response = await proxyRequest(auth, {
+        max_tokens: 8000,
+        messages: [{ role: "user", content: userMessage }],
+    });
+    const text = response.content
+        .filter((b) => b.type === "text")
+        .map((b) => b.text)
+        .join("\n")
+        .trim();
+    if (!text) {
+        throw new Error("Model returned no text content");
+    }
+    return text;
+}