kubeagent 0.1.36 → 0.1.43

package/README.md

@@ -27,6 +27,7 @@ kubeagent watch
 | `status` | Quick cluster health check (no LLM) |
 | `onboard` | Scan cluster + codebases, generate knowledge base |
 | `watch` | Continuous monitoring with auto-remediation |
+| `check` | One-shot cluster health check for CI pipelines (read-only by default, JSON output, exit codes) |
 | `diagnose <resource>` | One-shot diagnosis of a pod/deployment/service |
 | `scan <directory>` | Match local project directories to cluster deployments |
 | `scan-apps` | Detect OSS apps in the cluster, list affected workloads + ingress domains, check for CVEs / EOL (`--report` for AI-prioritized remediation) |
@@ -43,6 +44,30 @@ kubeagent watch
 - `-i, --interval <seconds>` — Check interval for `watch` (default: 300)
 - `--no-interactive` — Auto-deny all approvals, skip questions (for `watch` in background/CI)
 
+## CI Usage
+
+`kubeagent check` is the one-shot mode for CI pipelines. It scans the cluster, prints a report, and exits with a code your build can gate on — no daemon, no prompts, no onboarding required.
+
+```bash
+# After deploying: confirm pods reached Ready
+kubectl rollout status deployment/my-app -n my-ns --timeout=5m
+
+# Then confirm the system is actually healthy
+kubeagent check -n my-ns
+```
+
+The two steps are complementary: `rollout status` answers *"did Kubernetes accept the deploy?"*, `kubeagent check` answers *"is the system actually healthy?"* — catching crashloops, evicted pods, and failed jobs that surface seconds after pods reach Ready.
+
+**Exit codes:** `0` = no issues at/above threshold · `1` = issues found · `2` = kubeagent error (unreachable cluster, bad flag, timeout).
+
+**Common flags:**
+- `-n, --namespace <ns>` — scope to one or more namespaces (repeatable)
+- `--fail-on <severity>` — fail-threshold: `info`, `warning`, or `critical` (default: `critical`)
+- `--format json` — emit a versioned JSON report instead of human output
+- `--diagnose` — run LLM root-cause analysis on findings (requires `KUBEAGENT_API_KEY` env var)
+
+See [docs/CI.md](docs/CI.md) for full reference, GitHub Actions and GitLab CI snippets, and the JSON schema.
+
 ## Knowledge Base
 
 KubeAgent builds a per-cluster knowledge base at `~/.kubeagent/clusters/<context>/` during onboarding:
@@ -124,6 +149,13 @@ Safe actions (pod restarts, rollout restarts, scaling up) are applied automatica
 **Where is my API key stored?**
 Credentials are stored locally at `~/.kubeagent/auth.json` and are never sent anywhere except the KubeAgent API.
 
+## Links
+
+- [Homepage](https://kubeagent.net)
+- [Blog](https://kubeagent.net/blog/) — incident walkthroughs, agentic-diagnosis patterns, on-call economics ([RSS](https://kubeagent.net/blog/rss.xml))
+- [Docs](https://kubeagent.net/docs)
+- [Sign up](https://app.kubeagent.net/register)
+
 ## License
 
 Proprietary — see [LICENSE](./LICENSE) for details. Commercial use requires a paid plan at [kubeagent.net](https://kubeagent.net).

package/dist/auth.js

@@ -7,7 +7,22 @@ import { dbg } from "./debug.js";
 function authPath() {
     return join(configDir(), "auth.json");
 }
+const DEFAULT_SERVER_URL = "https://api.kubeagent.net";
+const DEFAULT_APP_URL = "https://app.kubeagent.net";
 export function loadAuth() {
+    // Env-var path for CI: KUBEAGENT_API_KEY takes precedence so machines can
+    // run without a local auth.json. KUBEAGENT_SERVER_URL / KUBEAGENT_APP_URL
+    // are optional overrides for self-hosted setups.
+    const envKey = process.env.KUBEAGENT_API_KEY;
+    if (envKey) {
+        dbg("auth", "loaded from env", { keyPrefix: envKey.slice(0, 12) + "..." });
+        return {
+            serverUrl: process.env.KUBEAGENT_SERVER_URL ?? DEFAULT_SERVER_URL,
+            appUrl: process.env.KUBEAGENT_APP_URL ?? DEFAULT_APP_URL,
+            token: envKey,
+            apiKey: envKey,
+        };
+    }
     const path = authPath();
     if (!existsSync(path)) {
         dbg("auth", "no auth file found", { path });

package/dist/check/index.d.ts

@@ -0,0 +1,34 @@
+import type { Issue, Severity } from "../monitor/types.js";
+export declare const SEVERITY_RANK: Record<Severity, number>;
+export declare function isValidSeverity(s: string): s is Severity;
+export interface CheckReportSummary {
+    critical: number;
+    warning: number;
+    info: number;
+    podCount: number;
+    nodeCount: number;
+}
+export interface CheckReport {
+    version: 1;
+    context: string;
+    namespaces: string[] | "all";
+    scannedAt: string;
+    durationMs: number;
+    summary: CheckReportSummary;
+    issues: Issue[];
+    diagnosis: {
+        analysis: string;
+    } | null;
+    exit: {
+        code: 0 | 1;
+        reason: string;
+    };
+}
+export declare function filterIssuesByNamespace(issues: Issue[], namespaces: string[] | "all"): Issue[];
+export declare function summarizeIssues(issues: Issue[], podCount: number, nodeCount: number): CheckReportSummary;
+export declare function computeExitCode(summary: CheckReportSummary, failOn: Severity): {
+    code: 0 | 1;
+    reason: string;
+};
+export declare function renderJson(report: CheckReport): string;
+export declare function renderHuman(report: CheckReport): string;

package/dist/check/index.js

@@ -0,0 +1,77 @@
+import chalk from "chalk";
+export const SEVERITY_RANK = {
+    info: 0,
+    warning: 1,
+    critical: 2,
+};
+export function isValidSeverity(s) {
+    return s === "info" || s === "warning" || s === "critical";
+}
+export function filterIssuesByNamespace(issues, namespaces) {
+    if (namespaces === "all" || namespaces.length === 0)
+        return issues;
+    const set = new Set(namespaces);
+    return issues.filter((i) => set.has(i.namespace));
+}
+export function summarizeIssues(issues, podCount, nodeCount) {
+    return {
+        critical: issues.filter((i) => i.severity === "critical").length,
+        warning: issues.filter((i) => i.severity === "warning").length,
+        info: issues.filter((i) => i.severity === "info").length,
+        podCount,
+        nodeCount,
+    };
+}
+export function computeExitCode(summary, failOn) {
+    const threshold = SEVERITY_RANK[failOn];
+    const triggered = [];
+    if (SEVERITY_RANK.critical >= threshold && summary.critical > 0)
+        triggered.push("critical");
+    if (SEVERITY_RANK.warning >= threshold && summary.warning > 0)
+        triggered.push("warning");
+    if (SEVERITY_RANK.info >= threshold && summary.info > 0)
+        triggered.push("info");
+    if (triggered.length === 0) {
+        return { code: 0, reason: `no issues at or above fail-on=${failOn}` };
+    }
+    return { code: 1, reason: `fail-on=${failOn} threshold met (${triggered.join(", ")})` };
+}
+export function renderJson(report) {
+    return JSON.stringify({
+        ...report,
+        issues: report.issues.map((i) => ({
+            kind: i.kind,
+            severity: i.severity,
+            namespace: i.namespace,
+            resource: i.resource,
+            message: i.message,
+            details: i.details,
+        })),
+    }, null, 2);
+}
+export function renderHuman(report) {
+    const lines = [];
+    const nsLabel = report.namespaces === "all" ? "all" : report.namespaces.join(", ");
+    lines.push(`KubeAgent check — context: ${chalk.cyan(report.context)}  namespace: ${chalk.cyan(nsLabel)}`);
+    const { summary, durationMs } = report;
+    const headlineIcon = summary.critical > 0 ? chalk.red("✖") : summary.warning > 0 ? chalk.yellow("⚠") : chalk.green("✔");
+    const headlineMsg = summary.critical + summary.warning + summary.info === 0
+        ? "all clear"
+        : `${summary.critical} critical, ${summary.warning} warnings, ${summary.info} info`;
+    lines.push(`${headlineIcon} ${headlineMsg} ${chalk.dim(`(scanned ${summary.podCount} pods, ${summary.nodeCount} nodes in ${(durationMs / 1000).toFixed(1)}s)`)}`);
+    if (report.issues.length > 0) {
+        lines.push("");
+        for (const issue of report.issues) {
+            const sevColor = issue.severity === "critical" ? chalk.red : issue.severity === "warning" ? chalk.yellow : chalk.dim;
+            lines.push(`  ${sevColor(issue.severity.padEnd(8))}  ${issue.namespace}  ${chalk.dim(issue.kind.padEnd(16))}  ${issue.resource}  ${issue.message}`);
+        }
+    }
+    if (report.diagnosis) {
+        lines.push("");
+        lines.push(chalk.bold("Diagnosis:"));
+        lines.push(report.diagnosis.analysis);
+    }
+    lines.push("");
+    lines.push(chalk.dim(`Exit: ${report.exit.code} (${report.exit.reason})`));
+    return lines.join("\n");
+}

package/dist/check/index.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/check/index.test.js

@@ -0,0 +1,202 @@
+import { describe, it, expect } from "vitest";
+import { computeExitCode, filterIssuesByNamespace, isValidSeverity, renderHuman, renderJson, summarizeIssues, } from "./index.js";
+function makeIssue(overrides = {}) {
+    return {
+        kind: "pod_crashloop",
+        severity: "critical",
+        namespace: "default",
+        resource: "test-pod",
+        message: "CrashLoopBackOff",
+        details: {},
+        timestamp: new Date("2026-05-28T10:00:00Z"),
+        ...overrides,
+    };
+}
+describe("isValidSeverity", () => {
+    it("accepts the three valid severities", () => {
+        expect(isValidSeverity("info")).toBe(true);
+        expect(isValidSeverity("warning")).toBe(true);
+        expect(isValidSeverity("critical")).toBe(true);
+    });
+    it("rejects anything else", () => {
+        expect(isValidSeverity("bogus")).toBe(false);
+        expect(isValidSeverity("")).toBe(false);
+        expect(isValidSeverity("CRITICAL")).toBe(false);
+    });
+});
+describe("filterIssuesByNamespace", () => {
+    const issues = [
+        makeIssue({ namespace: "foo" }),
+        makeIssue({ namespace: "bar" }),
+        makeIssue({ namespace: "baz" }),
+    ];
+    it("returns all issues when scope is 'all'", () => {
+        expect(filterIssuesByNamespace(issues, "all")).toHaveLength(3);
+    });
+    it("returns all issues when namespace list is empty", () => {
+        expect(filterIssuesByNamespace(issues, [])).toHaveLength(3);
+    });
+    it("filters to the specified namespaces", () => {
+        const result = filterIssuesByNamespace(issues, ["foo", "baz"]);
+        expect(result.map((i) => i.namespace)).toEqual(["foo", "baz"]);
+    });
+    it("returns empty when no namespaces match", () => {
+        expect(filterIssuesByNamespace(issues, ["nope"])).toHaveLength(0);
+    });
+});
+describe("summarizeIssues", () => {
+    it("counts each severity", () => {
+        const issues = [
+            makeIssue({ severity: "critical" }),
+            makeIssue({ severity: "critical" }),
+            makeIssue({ severity: "warning" }),
+            makeIssue({ severity: "info" }),
+        ];
+        const s = summarizeIssues(issues, 10, 3);
+        expect(s).toEqual({ critical: 2, warning: 1, info: 1, podCount: 10, nodeCount: 3 });
+    });
+    it("zeros when no issues", () => {
+        expect(summarizeIssues([], 5, 2)).toEqual({
+            critical: 0,
+            warning: 0,
+            info: 0,
+            podCount: 5,
+            nodeCount: 2,
+        });
+    });
+});
+describe("computeExitCode", () => {
+    const empty = { critical: 0, warning: 0, info: 0, podCount: 0, nodeCount: 0 };
+    it("exits 0 when no issues at any threshold", () => {
+        expect(computeExitCode(empty, "critical").code).toBe(0);
+        expect(computeExitCode(empty, "warning").code).toBe(0);
+        expect(computeExitCode(empty, "info").code).toBe(0);
+    });
+    it("fail-on=critical only fails on critical", () => {
+        expect(computeExitCode({ ...empty, critical: 1 }, "critical").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 5 }, "critical").code).toBe(0);
+        expect(computeExitCode({ ...empty, info: 10 }, "critical").code).toBe(0);
+    });
+    it("fail-on=warning fails on warning or critical", () => {
+        expect(computeExitCode({ ...empty, critical: 1 }, "warning").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 1 }, "warning").code).toBe(1);
+        expect(computeExitCode({ ...empty, info: 1 }, "warning").code).toBe(0);
+    });
+    it("fail-on=info fails on anything", () => {
+        expect(computeExitCode({ ...empty, info: 1 }, "info").code).toBe(1);
+        expect(computeExitCode({ ...empty, warning: 1 }, "info").code).toBe(1);
+        expect(computeExitCode({ ...empty, critical: 1 }, "info").code).toBe(1);
+    });
+    it("reason mentions all triggered severities", () => {
+        const result = computeExitCode({ ...empty, critical: 1, warning: 1 }, "warning");
+        expect(result.code).toBe(1);
+        expect(result.reason).toContain("critical");
+        expect(result.reason).toContain("warning");
+    });
+});
+describe("renderJson", () => {
+    function makeReport(overrides = {}) {
+        return {
+            version: 1,
+            context: "hetzner-prod",
+            namespaces: ["kubeagent"],
+            scannedAt: "2026-05-28T10:00:00.000Z",
+            durationMs: 1200,
+            summary: { critical: 1, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [
+                makeIssue({
+                    namespace: "kubeagent",
+                    resource: "kubeagent-server-7d9-xj2",
+                    message: "CrashLoopBackOff (5 restarts)",
+                    details: { restartCount: 5 },
+                }),
+            ],
+            diagnosis: null,
+            exit: { code: 1, reason: "fail-on=critical threshold met (critical)" },
+            ...overrides,
+        };
+    }
+    it("emits versioned schema", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.version).toBe(1);
+    });
+    it("strips timestamp from issues (not part of v1 schema)", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.issues[0]).not.toHaveProperty("timestamp");
+        expect(parsed.issues[0].kind).toBe("pod_crashloop");
+        expect(parsed.issues[0].details.restartCount).toBe(5);
+    });
+    it("emits diagnosis: null when not run", () => {
+        const parsed = JSON.parse(renderJson(makeReport()));
+        expect(parsed.diagnosis).toBeNull();
+    });
+    it("includes diagnosis when present", () => {
+        const parsed = JSON.parse(renderJson(makeReport({ diagnosis: { analysis: "Root cause: DB unreachable" } })));
+        expect(parsed.diagnosis.analysis).toContain("DB unreachable");
+    });
+    it("handles empty issues", () => {
+        const parsed = JSON.parse(renderJson(makeReport({
+            issues: [],
+            summary: { critical: 0, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            exit: { code: 0, reason: "no issues at or above fail-on=critical" },
+        })));
+        expect(parsed.issues).toEqual([]);
+        expect(parsed.exit.code).toBe(0);
+    });
+});
+describe("renderHuman", () => {
+    const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
+    function makeReport(overrides = {}) {
+        return {
+            version: 1,
+            context: "hetzner-prod",
+            namespaces: "all",
+            scannedAt: "2026-05-28T10:00:00.000Z",
+            durationMs: 1200,
+            summary: { critical: 0, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [],
+            diagnosis: null,
+            exit: { code: 0, reason: "no issues at or above fail-on=critical" },
+            ...overrides,
+        };
+    }
+    it("shows 'all clear' when no issues", () => {
+        const out = stripAnsi(renderHuman(makeReport()));
+        expect(out).toContain("all clear");
+        expect(out).toContain("Exit: 0");
+    });
+    it("renders critical issues with severity column", () => {
+        const out = stripAnsi(renderHuman(makeReport({
+            summary: { critical: 1, warning: 0, info: 0, podCount: 14, nodeCount: 3 },
+            issues: [
+                {
+                    kind: "pod_crashloop",
+                    severity: "critical",
+                    namespace: "kubeagent",
+                    resource: "server-xj2",
+                    message: "CrashLoopBackOff",
+                    details: {},
+                    timestamp: new Date(),
+                },
+            ],
+            exit: { code: 1, reason: "fail-on=critical threshold met (critical)" },
+        })));
+        expect(out).toContain("1 critical");
+        expect(out).toContain("server-xj2");
+        expect(out).toContain("CrashLoopBackOff");
+        expect(out).toContain("Exit: 1");
+    });
+    it("shows diagnosis block when present", () => {
+        const out = stripAnsi(renderHuman(makeReport({ diagnosis: { analysis: "Root cause analysis here" } })));
+        expect(out).toContain("Diagnosis");
+        expect(out).toContain("Root cause analysis here");
+    });
+    it("shows 'all' for cluster-wide scope", () => {
+        const out = stripAnsi(renderHuman(makeReport({ namespaces: "all" })));
+        expect(out).toContain("namespace: all");
+    });
+    it("shows namespace list for scoped runs", () => {
+        const out = stripAnsi(renderHuman(makeReport({ namespaces: ["foo", "bar"] })));
+        expect(out).toContain("foo, bar");
+    });
+});

package/dist/check/run.d.ts

@@ -0,0 +1,10 @@
+export interface CheckCliOptions {
+    context?: string;
+    namespace?: string[];
+    allNamespaces?: boolean;
+    failOn: string;
+    format: string;
+    diagnose?: boolean;
+    timeout: string;
+}
+export declare function runCheck(opts: CheckCliOptions): Promise<void>;

package/dist/check/run.js

@@ -0,0 +1,114 @@
+import chalk from "chalk";
+import { kubectl } from "../kubectl.js";
+import { runChecks } from "../monitor/index.js";
+import { computeExitCode, isValidSeverity, renderHuman, renderJson, summarizeIssues, } from "./index.js";
+class CheckError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.hint = hint;
+    }
+}
+function emitError(message, hint) {
+    process.stderr.write(chalk.red(`✖ ${message}\n`));
+    if (hint)
+        process.stderr.write(chalk.dim(`  ${hint}\n`));
+    process.exit(2);
+}
+export async function runCheck(opts) {
+    // --- flag validation ---
+    if (!isValidSeverity(opts.failOn)) {
+        emitError(`invalid --fail-on value "${opts.failOn}"`, "expected one of: info, warning, critical");
+    }
+    if (opts.format !== "human" && opts.format !== "json") {
+        emitError(`invalid --format value "${opts.format}"`, "expected one of: human, json");
+    }
+    const timeoutSec = Number.parseInt(opts.timeout, 10);
+    if (!Number.isFinite(timeoutSec) || timeoutSec <= 0) {
+        emitError(`invalid --timeout value "${opts.timeout}"`, "expected a positive integer (seconds)");
+    }
+    if (opts.diagnose && !process.env.KUBEAGENT_API_KEY) {
+        emitError("--diagnose requires KUBEAGENT_API_KEY env var", "set it as a CI secret, e.g. in GitHub Actions: env: { KUBEAGENT_API_KEY: ${{ secrets.KUBEAGENT_API_KEY }} }");
+    }
+    const failOn = opts.failOn;
+    const namespaces = opts.allNamespaces || !opts.namespace || opts.namespace.length === 0
+        ? "all"
+        : opts.namespace;
+    // --- run with timeout wrapper ---
+    const startedAt = Date.now();
+    let timeoutHandle;
+    const timeoutPromise = new Promise((_, reject) => {
+        timeoutHandle = setTimeout(() => reject(new CheckError(`check timed out after ${timeoutSec}s`)), timeoutSec * 1000);
+    });
+    try {
+        const report = await Promise.race([
+            doCheck({ failOn, namespaces, format: opts.format, context: opts.context, diagnose: !!opts.diagnose, startedAt }),
+            timeoutPromise,
+        ]);
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+        const output = opts.format === "json" ? renderJson(report) : renderHuman(report);
+        process.stdout.write(output + "\n");
+        process.exit(report.exit.code);
+    }
+    catch (err) {
+        if (timeoutHandle)
+            clearTimeout(timeoutHandle);
+        const message = err.message || "check failed";
+        if (err instanceof CheckError) {
+            emitError(message, err.hint);
+        }
+        emitError(message);
+    }
+}
+async function doCheck(args) {
+    const { failOn, namespaces, context, diagnose: shouldDiagnose, startedAt } = args;
+    const kubectlOpts = context ? { context } : {};
+    // Preflight: confirm the cluster is reachable so we fail fast with exit 2
+    // rather than a confusing kubectl error mid-scan.
+    try {
+        await kubectl(["cluster-info", "--request-timeout=5s"], kubectlOpts);
+    }
+    catch (err) {
+        throw new CheckError(`cannot reach cluster: ${err.message}`, "check your kubeconfig and --context flag");
+    }
+    // Resolve effective context name for the report (kubectl current-context
+    // is fine when --context not passed).
+    let effectiveContext = context ?? "(current-context)";
+    if (!context) {
+        try {
+            effectiveContext = (await kubectl(["config", "current-context"])).trim();
+        }
+        catch {
+            // non-fatal — keep the placeholder
+        }
+    }
+    // Scope kubectl queries to the requested namespaces so namespace-bound
+    // CI service accounts don't need cluster-wide list permissions.
+    const scope = namespaces === "all" ? undefined : { namespaces };
+    const summaryResult = await runChecks(kubectlOpts, true, scope);
+    const filteredIssues = summaryResult.issues;
+    const summary = summarizeIssues(filteredIssues, summaryResult.podCount, summaryResult.nodeCount);
+    let diagnosis = null;
+    if (shouldDiagnose && filteredIssues.length > 0) {
+        const { diagnose } = await import("../diagnoser/index.js");
+        const result = await diagnose(filteredIssues, "", context, {
+            autoFix: false,
+            noInteractive: true,
+            onApproval: async () => false,
+        });
+        diagnosis = { analysis: result.analysis };
+    }
+    const exit = computeExitCode(summary, failOn);
+    return {
+        version: 1,
+        context: effectiveContext,
+        namespaces,
+        scannedAt: new Date(startedAt).toISOString(),
+        durationMs: Date.now() - startedAt,
+        summary,
+        issues: filteredIssues,
+        diagnosis,
+        exit,
+    };
+}

package/dist/cli.js

@@ -170,6 +170,20 @@ program
     // Keep process alive
     await new Promise(() => { });
 });
+program
+    .command("check")
+    .description("One-shot cluster health check (CI-friendly, read-only by default)")
+    .option("-c, --context <context>", "Kubernetes context (defaults to kubeconfig current-context)")
+    .option("-n, --namespace <namespace>", "Limit scope to namespace (repeatable)", (val, prev) => [...(prev ?? []), val], undefined)
+    .option("--all-namespaces", "Scan all namespaces (default; overrides -n if both set)")
+    .option("--fail-on <severity>", "Exit non-zero on issues >= severity (info|warning|critical)", "critical")
+    .option("--format <fmt>", "Output format: human|json", "human")
+    .option("--diagnose", "Run LLM analysis on findings (requires KUBEAGENT_API_KEY)")
+    .option("--timeout <seconds>", "Max time for the check itself", "60")
+    .action(async (opts) => {
+    const { runCheck } = await import("./check/run.js");
+    await runCheck(opts);
+});
 program
     .command("diagnose <resource>")
     .description("One-shot diagnosis of a specific pod/deployment/service")
@@ -338,12 +352,21 @@ program
     .action(async (opts) => {
     const { detectApplications, formatApplicationsMarkdown } = await import("./detector/index.js");
     const { writeApplicationsKb, ensureKbDir } = await import("./kb/writer.js");
-    const contextName = opts.context ?? "default";
+    const { kubectl } = await import("./kubectl.js");
+    let contextName = opts.context;
+    if (!contextName) {
+        try {
+            contextName = (await kubectl(["config", "current-context"])).trim();
+        }
+        catch {
+            contextName = "default";
+        }
+    }
     const spinner = ora("Scanning cluster for OSS applications...").start();
     let result;
     try {
         result = await detectApplications({
-            context: opts.context,
+            context: contextName,
             noCache: opts.cache === false,
             onProgress: (step) => {
                 spinner.text = `Scanning cluster for OSS applications — ${step}...`;

package/dist/detector/sources.d.ts

@@ -33,6 +33,18 @@ export interface HelmCandidate {
 }
 export type Candidate = ImageCandidate | LabelCandidate | HelmCandidate;
 export declare function fetchWorkloadCandidates(options: KubectlOptions): Promise<Candidate[]>;
+interface HelmReleasePayload {
+    name: string;
+    namespace: string;
+    chart?: {
+        metadata?: {
+            name?: string;
+            version?: string;
+            appVersion?: string;
+        };
+    };
+}
+export declare function decodeHelmRelease(b64: string): HelmReleasePayload | null;
 export declare function fetchHelmCandidates(options: KubectlOptions): Promise<HelmCandidate[]>;
 /**
  * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
@@ -40,3 +52,4 @@ export declare function fetchHelmCandidates(options: KubectlOptions): Promise<He
  * Returns an empty map on failure (ingress visibility is non-essential).
  */
 export declare function fetchIngressHostMap(options: KubectlOptions): Promise<Map<string, string[]>>;
+export {};

package/dist/detector/sources.js

@@ -51,7 +51,7 @@ export async function fetchWorkloadCandidates(options) {
         all.push(...extractFromWorkload("DaemonSet", w));
     return all;
 }
-function decodeHelmRelease(b64) {
+export function decodeHelmRelease(b64) {
     try {
         // Helm v3 stores releases as base64(gzip(json)). When fetched via
         // `kubectl get secrets -o json`, the API server applies its own base64

package/dist/detector/sources.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/detector/sources.test.js

@@ -0,0 +1,36 @@
+import { describe, it, expect } from "vitest";
+import { gzipSync } from "node:zlib";
+import { Buffer } from "node:buffer";
+import { decodeHelmRelease } from "./sources.js";
+// Reproduce the encoding chain Helm + the k8s API actually produce.
+// Helm stores the release as `base64(gzip(json))` inside the Secret value,
+// and the k8s API base64-encodes Secret `data.*` values on the wire — so the
+// string kubectl returns is `base64(base64(gzip(json)))`. This test exists
+// to lock in the decoder's behaviour against that chain so we can't
+// regress to a single-base64 decode (which silently drops every Helm
+// release at runtime).
+function encodeAsKubectlReturnsIt(payload) {
+    const json = JSON.stringify(payload);
+    const gzipped = gzipSync(Buffer.from(json, "utf-8"));
+    const helmLayer = gzipped.toString("base64");
+    const apiLayer = Buffer.from(helmLayer, "utf-8").toString("base64");
+    return apiLayer;
+}
+describe("decodeHelmRelease", () => {
+    it("decodes a release blob in the format kubectl returns", () => {
+        const release = {
+            name: "postgres",
+            namespace: "data",
+            chart: { metadata: { name: "postgresql", version: "12.0.0", appVersion: "15.2.0" } },
+        };
+        const encoded = encodeAsKubectlReturnsIt(release);
+        expect(decodeHelmRelease(encoded)).toEqual(release);
+    });
+    it("returns null on garbage input rather than throwing", () => {
+        expect(decodeHelmRelease("not-base64-and-not-gzip")).toBeNull();
+    });
+    it("returns null on valid base64 that isn't gzip", () => {
+        const apiLayer = Buffer.from("aGVsbG8gd29ybGQ=", "utf-8").toString("base64");
+        expect(decodeHelmRelease(apiLayer)).toBeNull();
+    });
+});

package/dist/diagnoser/approval.test.d.ts

@@ -0,0 +1 @@
+export {};