kubeagent 0.1.35 → 0.1.43

package/dist/detector/sources.d.ts

@@ -0,0 +1,55 @@
+import { type KubectlOptions } from "../kubectl.js";
+export type WorkloadKind = "Deployment" | "StatefulSet" | "DaemonSet";
+export interface WorkloadRef {
+    kind: WorkloadKind;
+    namespace: string;
+    name: string;
+    hosts?: string[];
+}
+export declare function workloadKey(ref: {
+    kind: string;
+    namespace: string;
+    name: string;
+}): string;
+export interface ImageCandidate {
+    source: "image";
+    image: string;
+    workload: WorkloadRef;
+    container: string;
+}
+export interface LabelCandidate {
+    source: "label";
+    appName: string;
+    appVersion: string;
+    workload: WorkloadRef;
+}
+export interface HelmCandidate {
+    source: "helm";
+    chart: string;
+    chartVersion: string;
+    appVersion?: string;
+    namespace: string;
+    releaseName: string;
+}
+export type Candidate = ImageCandidate | LabelCandidate | HelmCandidate;
+export declare function fetchWorkloadCandidates(options: KubectlOptions): Promise<Candidate[]>;
+interface HelmReleasePayload {
+    name: string;
+    namespace: string;
+    chart?: {
+        metadata?: {
+            name?: string;
+            version?: string;
+            appVersion?: string;
+        };
+    };
+}
+export declare function decodeHelmRelease(b64: string): HelmReleasePayload | null;
+export declare function fetchHelmCandidates(options: KubectlOptions): Promise<HelmCandidate[]>;
+/**
+ * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
+ * Joins Ingresses → Services → workload pod-template labels best-effort.
+ * Returns an empty map on failure (ingress visibility is non-essential).
+ */
+export declare function fetchIngressHostMap(options: KubectlOptions): Promise<Map<string, string[]>>;
+export {};

package/dist/detector/sources.js

@@ -0,0 +1,218 @@
+import { gunzipSync } from "node:zlib";
+import { Buffer } from "node:buffer";
+import { kubectlJson } from "../kubectl.js";
+import { dbg } from "../debug.js";
+export function workloadKey(ref) {
+    return `${ref.kind}/${ref.namespace}/${ref.name}`;
+}
+const LABEL_NAME = "app.kubernetes.io/name";
+const LABEL_VERSION = "app.kubernetes.io/version";
+async function fetchWorkload(kind, resource, options) {
+    return (await kubectlJson(["get", resource, "--all-namespaces"], options));
+}
+function extractFromWorkload(kind, w) {
+    const out = [];
+    const ref = { kind, namespace: w.metadata.namespace, name: w.metadata.name };
+    const containers = [
+        ...(w.spec?.template?.spec?.containers ?? []),
+        ...(w.spec?.template?.spec?.initContainers ?? []),
+    ];
+    for (const c of containers) {
+        if (c.image) {
+            out.push({ source: "image", image: c.image, workload: ref, container: c.name });
+        }
+    }
+    const labels = {
+        ...(w.metadata.labels ?? {}),
+        ...(w.spec?.template?.metadata?.labels ?? {}),
+    };
+    if (labels[LABEL_NAME] && labels[LABEL_VERSION]) {
+        out.push({
+            source: "label",
+            appName: labels[LABEL_NAME],
+            appVersion: labels[LABEL_VERSION],
+            workload: ref,
+        });
+    }
+    return out;
+}
+export async function fetchWorkloadCandidates(options) {
+    const [deploys, statefulsets, daemonsets] = await Promise.all([
+        fetchWorkload("Deployment", "deployments", options),
+        fetchWorkload("StatefulSet", "statefulsets", options),
+        fetchWorkload("DaemonSet", "daemonsets", options),
+    ]);
+    const all = [];
+    for (const w of deploys.items)
+        all.push(...extractFromWorkload("Deployment", w));
+    for (const w of statefulsets.items)
+        all.push(...extractFromWorkload("StatefulSet", w));
+    for (const w of daemonsets.items)
+        all.push(...extractFromWorkload("DaemonSet", w));
+    return all;
+}
+export function decodeHelmRelease(b64) {
+    try {
+        // Helm v3 stores releases as base64(gzip(json)). When fetched via
+        // `kubectl get secrets -o json`, the API server applies its own base64
+        // layer on top of `data.release`, so we decode twice before gunzip.
+        const outer = Buffer.from(b64, "base64");
+        const inner = Buffer.from(outer.toString("utf-8"), "base64");
+        const json = gunzipSync(inner).toString("utf-8");
+        return JSON.parse(json);
+    }
+    catch (err) {
+        dbg("detector", `helm release decode failed: ${err.message}`);
+        return null;
+    }
+}
+export async function fetchHelmCandidates(options) {
+    let list;
+    try {
+        list = (await kubectlJson(["get", "secrets", "--all-namespaces", "-l", "owner=helm,status=deployed"], options));
+    }
+    catch (err) {
+        dbg("detector", `helm secret listing failed: ${err.message}`);
+        return [];
+    }
+    const seen = new Set();
+    const out = [];
+    for (const s of list.items) {
+        const release = s.data?.release;
+        if (!release)
+            continue;
+        const payload = decodeHelmRelease(release);
+        if (!payload)
+            continue;
+        const chart = payload.chart?.metadata?.name;
+        const version = payload.chart?.metadata?.version;
+        if (!chart || !version)
+            continue;
+        const key = `${s.metadata.namespace}/${payload.name}/${version}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({
+            source: "helm",
+            chart,
+            chartVersion: version,
+            appVersion: payload.chart?.metadata?.appVersion,
+            namespace: s.metadata.namespace,
+            releaseName: payload.name,
+        });
+    }
+    return out;
+}
+function selectorMatches(selector, labels) {
+    const keys = Object.keys(selector);
+    if (keys.length === 0)
+        return false;
+    for (const k of keys) {
+        if (labels[k] !== selector[k])
+            return false;
+    }
+    return true;
+}
+/**
+ * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
+ * Joins Ingresses → Services → workload pod-template labels best-effort.
+ * Returns an empty map on failure (ingress visibility is non-essential).
+ */
+export async function fetchIngressHostMap(options) {
+    const out = new Map();
+    let services;
+    let ingresses;
+    let workloadLists;
+    try {
+        [services, ingresses, ...workloadLists] = await Promise.all([
+            kubectlJson(["get", "services", "--all-namespaces"], options),
+            kubectlJson(["get", "ingresses", "--all-namespaces"], options),
+            fetchWorkload("Deployment", "deployments", options),
+            fetchWorkload("StatefulSet", "statefulsets", options),
+            fetchWorkload("DaemonSet", "daemonsets", options),
+        ]);
+    }
+    catch (err) {
+        dbg("detector", `ingress map fetch failed: ${err.message}`);
+        return out;
+    }
+    // service ns/name → selector
+    const serviceSelectors = new Map();
+    for (const svc of services.items) {
+        const sel = svc.spec?.selector;
+        if (!sel || Object.keys(sel).length === 0)
+            continue;
+        serviceSelectors.set(`${svc.metadata.namespace}/${svc.metadata.name}`, sel);
+    }
+    // service ns/name → set of hosts
+    const serviceHosts = new Map();
+    const addServiceHost = (ns, svc, host) => {
+        if (!svc || !host)
+            return;
+        const key = `${ns}/${svc}`;
+        let s = serviceHosts.get(key);
+        if (!s) {
+            s = new Set();
+            serviceHosts.set(key, s);
+        }
+        s.add(host);
+    };
+    for (const ing of ingresses.items) {
+        const ns = ing.metadata.namespace;
+        const tlsHosts = new Set();
+        for (const t of ing.spec?.tls ?? []) {
+            for (const h of t.hosts ?? [])
+                tlsHosts.add(h);
+        }
+        for (const rule of ing.spec?.rules ?? []) {
+            // A rule with no `host` matches all inbound hosts per the Ingress
+            // spec — the backend is still publicly reachable, so record it as `*`
+            // rather than dropping it (which would mis-classify as internal-only).
+            const host = rule.host ?? "*";
+            for (const p of rule.http?.paths ?? []) {
+                const svc = p.backend?.service?.name ?? p.backend?.serviceName;
+                addServiceHost(ns, svc, host);
+            }
+        }
+        const defSvc = ing.spec?.defaultBackend?.service?.name ?? ing.spec?.defaultBackend?.serviceName;
+        if (defSvc) {
+            // defaultBackend catches anything not matched by a rule — also wildcard
+            // exposure. Prefer explicit TLS hosts when present for better display.
+            if (tlsHosts.size > 0) {
+                for (const h of tlsHosts)
+                    addServiceHost(ns, defSvc, h);
+            }
+            else {
+                addServiceHost(ns, defSvc, "*");
+            }
+        }
+    }
+    const allWorkloads = [];
+    const kinds = ["Deployment", "StatefulSet", "DaemonSet"];
+    workloadLists.forEach((list, idx) => {
+        for (const item of list.items)
+            allWorkloads.push({ kind: kinds[idx], item });
+    });
+    for (const { kind, item } of allWorkloads) {
+        const ns = item.metadata.namespace;
+        const podLabels = item.spec?.template?.metadata?.labels ?? {};
+        if (Object.keys(podLabels).length === 0)
+            continue;
+        const hosts = new Set();
+        for (const [svcKey, sel] of serviceSelectors) {
+            if (!svcKey.startsWith(`${ns}/`))
+                continue;
+            if (!selectorMatches(sel, podLabels))
+                continue;
+            const hs = serviceHosts.get(svcKey);
+            if (!hs)
+                continue;
+            for (const h of hs)
+                hosts.add(h);
+        }
+        if (hosts.size > 0) {
+            out.set(workloadKey({ kind, namespace: ns, name: item.metadata.name }), [...hosts].sort());
+        }
+    }
+    return out;
+}

package/dist/detector/sources.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/sources.test.js

@@ -0,0 +1,36 @@
+import { describe, it, expect } from "vitest";
+import { gzipSync } from "node:zlib";
+import { Buffer } from "node:buffer";
+import { decodeHelmRelease } from "./sources.js";
+// Reproduce the encoding chain Helm + the k8s API actually produce.
+// Helm stores the release as `base64(gzip(json))` inside the Secret value,
+// and the k8s API base64-encodes Secret `data.*` values on the wire — so the
+// string kubectl returns is `base64(base64(gzip(json)))`. This test exists
+// to lock in the decoder's behaviour against that chain so we can't
+// regress to a single-base64 decode (which silently drops every Helm
+// release at runtime).
+function encodeAsKubectlReturnsIt(payload) {
+    const json = JSON.stringify(payload);
+    const gzipped = gzipSync(Buffer.from(json, "utf-8"));
+    const helmLayer = gzipped.toString("base64");
+    const apiLayer = Buffer.from(helmLayer, "utf-8").toString("base64");
+    return apiLayer;
+}
+describe("decodeHelmRelease", () => {
+    it("decodes a release blob in the format kubectl returns", () => {
+        const release = {
+            name: "postgres",
+            namespace: "data",
+            chart: { metadata: { name: "postgresql", version: "12.0.0", appVersion: "15.2.0" } },
+        };
+        const encoded = encodeAsKubectlReturnsIt(release);
+        expect(decodeHelmRelease(encoded)).toEqual(release);
+    });
+    it("returns null on garbage input rather than throwing", () => {
+        expect(decodeHelmRelease("not-base64-and-not-gzip")).toBeNull();
+    });
+    it("returns null on valid base64 that isn't gzip", () => {
+        const apiLayer = Buffer.from("aGVsbG8gd29ybGQ=", "utf-8").toString("base64");
+        expect(decodeHelmRelease(apiLayer)).toBeNull();
+    });
+});

package/dist/diagnoser/approval.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/diagnoser/approval.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect, vi } from "vitest";
+import { resolveApprovalDecision } from "./index.js";
+const SAFE = new Set(["get_logs", "get_events", "describe_resource", "ask_user_question"]);
+describe("resolveApprovalDecision", () => {
+    it("auto-executes a safe (read-only) action with no approver", async () => {
+        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, undefined);
+        expect(decision.execute).toBe(true);
+    });
+    it("DENIES a non-safe mutating action when no approver exists (non-interactive mode)", async () => {
+        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 0 }, SAFE, undefined);
+        expect(decision.execute).toBe(false);
+        if (!decision.execute) {
+            expect(decision.reason).toMatch(/no approver is available/i);
+        }
+    });
+    it("never invokes an executor implicitly — caller must gate on execute=false", async () => {
+        // Simulates the tool loop: a denied decision must not run the executor.
+        const executor = vi.fn();
+        const decision = await resolveApprovalDecision("restart_pod", { pod: "x" }, SAFE, undefined);
+        if (decision.execute)
+            executor();
+        expect(executor).not.toHaveBeenCalled();
+    });
+    it("calls onApproval for non-safe actions and executes when approved", async () => {
+        const onApproval = vi.fn().mockResolvedValue(true);
+        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 3 }, SAFE, onApproval);
+        expect(onApproval).toHaveBeenCalledWith("scale_deployment", { deployment: "web", replicas: 3 });
+        expect(decision.execute).toBe(true);
+    });
+    it("denies with the user-denial message when onApproval returns false", async () => {
+        const onApproval = vi.fn().mockResolvedValue(false);
+        const decision = await resolveApprovalDecision("restart_pod", {}, SAFE, onApproval);
+        expect(decision.execute).toBe(false);
+        if (!decision.execute) {
+            expect(decision.reason).toMatch(/denied by user/i);
+        }
+    });
+    it("does not call onApproval for safe actions", async () => {
+        const onApproval = vi.fn().mockResolvedValue(false);
+        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, onApproval);
+        expect(onApproval).not.toHaveBeenCalled();
+        expect(decision.execute).toBe(true);
+    });
+    it("treats user-configured safe_actions as auto-executable", async () => {
+        const safe = new Set([...SAFE, "rollout_restart"]);
+        const decision = await resolveApprovalDecision("rollout_restart", {}, safe, undefined);
+        expect(decision.execute).toBe(true);
+    });
+});

package/dist/diagnoser/index.d.ts

@@ -1,4 +1,20 @@
 import type { Issue } from "../monitor/types.js";
+export type ApprovalDecision = {
+    execute: true;
+} | {
+    execute: false;
+    reason: string;
+};
+/**
+ * Decide whether a tool call may execute, given the set of auto-safe actions and
+ * the (optional) approval callback.
+ *
+ * Security-critical: a missing/undefined `onApproval` MUST mean DENY for any
+ * action that is not in `safeActions`. In non-interactive mode the CLI passes no
+ * (or a deny-all) approver, and destructive remediation (e.g. scale-to-0) must
+ * never run unattended.
+ */
+export declare function resolveApprovalDecision(toolName: string, params: Record<string, unknown>, safeActions: Set<string>, onApproval?: (action: string, params: Record<string, unknown>) => Promise<boolean>): Promise<ApprovalDecision>;
 export interface DiagnosisResult {
     analysis: string;
     action?: {

package/dist/diagnoser/index.js

@@ -19,6 +19,32 @@ function truncateOutput(output) {
     const half = Math.floor(MAX_TOOL_OUTPUT_CHARS / 2);
     return output.slice(0, half) + "\n\n... [truncated] ...\n\n" + output.slice(-half);
 }
+/**
+ * Decide whether a tool call may execute, given the set of auto-safe actions and
+ * the (optional) approval callback.
+ *
+ * Security-critical: a missing/undefined `onApproval` MUST mean DENY for any
+ * action that is not in `safeActions`. In non-interactive mode the CLI passes no
+ * (or a deny-all) approver, and destructive remediation (e.g. scale-to-0) must
+ * never run unattended.
+ */
+export async function resolveApprovalDecision(toolName, params, safeActions, onApproval) {
+    // Safe (read-only or explicitly allowlisted) actions auto-execute.
+    if (safeActions.has(toolName))
+        return { execute: true };
+    // Non-safe action requires approval regardless of whether a callback exists.
+    if (!onApproval) {
+        return {
+            execute: false,
+            reason: "Action requires approval but no approver is available (non-interactive mode); denied. Propose a safe alternative or escalate to a human.",
+        };
+    }
+    const approved = await onApproval(toolName, params);
+    if (!approved) {
+        return { execute: false, reason: "Action denied by user. Propose an alternative." };
+    }
+    return { execute: true };
+}
 async function askUserQuestion(question, choices) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
@@ -184,17 +210,17 @@ If it requires a risky action (rollback, delete, scale to zero), propose it but
                         });
                         continue;
                     }
-                    // Check if action requires approval
-                    if (!effectiveSafeActions.has(block.name) && options?.onApproval) {
-                        const approved = await options.onApproval(block.name, block.input);
-                        if (!approved) {
-                            toolResults.push({
-                                type: "tool_result",
-                                tool_use_id: block.id,
-                                content: "Action denied by user. Propose an alternative.",
-                            });
-                            continue;
-                        }
+                    // Check if action requires approval. A missing onApproval callback
+                    // (non-interactive mode) means DENY for any non-safe action — never
+                    // execute destructive remediation unattended.
+                    const decision = await resolveApprovalDecision(block.name, block.input, effectiveSafeActions, options?.onApproval);
+                    if (!decision.execute) {
+                        toolResults.push({
+                            type: "tool_result",
+                            tool_use_id: block.id,
+                            content: decision.reason,
+                        });
+                        continue;
                     }
                     try {
                         const result = await executor(block.input, { context: clusterContext });

package/dist/diagnoser/tools.d.ts

@@ -25,11 +25,11 @@ export declare const kubectlDescribeSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     namespace: string;
-    resource_type: "pod" | "deployment" | "service" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "node" | "persistentvolumeclaim" | "configmap" | "endpoints";
+    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
 }, {
     name: string;
     namespace: string;
-    resource_type: "pod" | "deployment" | "service" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "node" | "persistentvolumeclaim" | "configmap" | "endpoints";
+    resource_type: "service" | "node" | "pod" | "deployment" | "statefulset" | "daemonset" | "replicaset" | "job" | "cronjob" | "ingress" | "persistentvolumeclaim" | "configmap" | "endpoints";
 }>;
 export declare const restartPodSchema: z.ZodObject<{
     namespace: z.ZodString;

package/dist/kb/loader.js

@@ -13,6 +13,12 @@ export function buildSystemPrompt(kbDir) {
         sections.push(readFileSync(clusterPath, "utf-8"));
         sections.push("");
     }
+    // Load applications.md (OSS app inventory with CVE/EOL status)
+    const applicationsPath = join(kbDir, "applications.md");
+    if (existsSync(applicationsPath)) {
+        sections.push(readFileSync(applicationsPath, "utf-8"));
+        sections.push("");
+    }
     // Load project files
     const projectsDir = join(kbDir, "projects");
     if (existsSync(projectsDir)) {

package/dist/kb/writer.d.ts

@@ -1,5 +1,6 @@
 export declare function ensureKbDir(kbDir: string): void;
 export declare function writeClusterKb(kbDir: string, content: string): void;
+export declare function writeApplicationsKb(kbDir: string, content: string): void;
 export declare function writeProjectKb(kbDir: string, projectName: string, content: string): void;
 export declare function writeRunbook(kbDir: string, name: string, content: string): void;
 /**

package/dist/kb/writer.js

@@ -12,6 +12,10 @@ export function writeClusterKb(kbDir, content) {
     ensureKbDir(kbDir);
     writeFileSync(join(kbDir, "cluster.md"), content);
 }
+export function writeApplicationsKb(kbDir, content) {
+    ensureKbDir(kbDir);
+    writeFileSync(join(kbDir, "applications.md"), content);
+}
 export function writeProjectKb(kbDir, projectName, content) {
     ensureKbDir(kbDir);
     writeFileSync(join(kbDir, "projects", `${projectName}.md`), content);

package/dist/monitor/index.d.ts

@@ -8,8 +8,18 @@ export interface CheckSummary {
     nodeCount: number;
     namespaceCount: number;
 }
+export interface RunChecksScope {
+    /**
+     * Namespaces to scope the scan to. When set, kubectl queries are issued
+     * per-namespace (e.g. `kubectl get pods -n foo`) instead of the
+     * cluster-wide `--all-namespaces` form. Cluster-scoped queries
+     * (`get nodes`, `get namespaces`) are still attempted but their failures
+     * are tolerated so namespace-scoped service accounts can use `kubeagent check`.
+     */
+    namespaces?: string[];
+}
 export declare function runChecks(options: KubectlOptions): Promise<Issue[]>;
-export declare function runChecks(options: KubectlOptions, withSummary: true): Promise<CheckSummary>;
+export declare function runChecks(options: KubectlOptions, withSummary: true, scope?: RunChecksScope): Promise<CheckSummary>;
 export declare function computeResolvedKeys(activeKeys: Set<string>, currentKeys: Set<string>): string[];
 export declare function updateActiveKeys(activeKeys: Set<string>, resolvedKeys: string[], currentKeys: Set<string>): void;
 export declare function startMonitor(options: KubectlOptions, intervalMs: number, onIssues: IssueCallback, onResolved?: ResolveCallback, onFirstCycle?: () => void): {

package/dist/monitor/index.js

@@ -33,28 +33,59 @@ function deduplicateIssues(issues) {
         return true;
     });
 }
-export async function runChecks(options, withSummary) {
+export async function runChecks(options, withSummary, scope) {
     const allIssues = [];
-    // Get all pods across namespaces
-    const podList = (await kubectlJson(["get", "pods", "--all-namespaces"], options));
-    allIssues.push(...findPodIssues(podList));
-    // Get nodes
-    const nodeList = (await kubectlJson(["get", "nodes"], options));
+    const scoped = scope?.namespaces && scope.namespaces.length > 0 ? scope.namespaces : null;
+    // Pods: query per-namespace when scoped (so ns-bound service accounts
+    // don't need cluster-wide list-pods), otherwise all-namespaces.
+    let podCount = 0;
+    if (scoped) {
+        for (const ns of scoped) {
+            const list = (await kubectlJson(["get", "pods", "-n", ns], options).catch(() => ({ items: [] })));
+            allIssues.push(...findPodIssues(list));
+            podCount += list.items.length;
+        }
+    }
+    else {
+        const podList = (await kubectlJson(["get", "pods", "--all-namespaces"], options));
+        allIssues.push(...findPodIssues(podList));
+        podCount = podList.items.length;
+    }
+    // Nodes: cluster-scoped. Tolerate forbidden so ns-bound service accounts
+    // still get a useful pod-level report (node issues just don't apply to them).
+    const nodeList = (await kubectlJson(["get", "nodes"], options).catch(() => ({ items: [] })));
     allIssues.push(...findNodeIssues(nodeList));
-    // Get failed jobs
-    const jobList = (await kubectlJson(["get", "jobs", "--all-namespaces", "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
-    allIssues.push(...findJobIssues(jobList));
+    // Failed jobs: per-namespace when scoped, otherwise all-namespaces.
+    if (scoped) {
+        for (const ns of scoped) {
+            const list = (await kubectlJson(["get", "jobs", "-n", ns, "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
+            allIssues.push(...findJobIssues(list));
+        }
+    }
+    else {
+        const jobList = (await kubectlJson(["get", "jobs", "--all-namespaces", "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
+        allIssues.push(...findJobIssues(jobList));
+    }
     const issues = deduplicateIssues(allIssues);
     if (!withSummary)
         return issues;
-    // Fetch namespace count (non-fatal)
-    const nsList = await kubectlJson(["get", "namespaces"], options)
-        .catch(() => ({ items: [] }));
+    // Namespace count: cluster-scoped, tolerate forbidden the same way as nodes.
+    // When the caller already specified namespaces, use that length so the
+    // summary reflects the requested scope, not the cluster's namespace total.
+    let namespaceCount;
+    if (scoped) {
+        namespaceCount = scoped.length;
+    }
+    else {
+        const nsList = await kubectlJson(["get", "namespaces"], options)
+            .catch(() => ({ items: [] }));
+        namespaceCount = nsList.items.length;
+    }
     return {
         issues,
-        podCount: podList.items.length,
+        podCount,
         nodeCount: nodeList.items.length,
-        namespaceCount: nsList.items.length,
+        namespaceCount,
     };
 }
 // How long a pod must be Pending before it's reported as an issue.

package/dist/monitor/scope.test.d.ts

@@ -0,0 +1 @@
+export {};