kubeagent 0.1.36 → 0.1.43

package/dist/diagnoser/approval.test.js

@@ -0,0 +1,49 @@
+import { describe, it, expect, vi } from "vitest";
+import { resolveApprovalDecision } from "./index.js";
+const SAFE = new Set(["get_logs", "get_events", "describe_resource", "ask_user_question"]);
+describe("resolveApprovalDecision", () => {
+    it("auto-executes a safe (read-only) action with no approver", async () => {
+        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, undefined);
+        expect(decision.execute).toBe(true);
+    });
+    it("DENIES a non-safe mutating action when no approver exists (non-interactive mode)", async () => {
+        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 0 }, SAFE, undefined);
+        expect(decision.execute).toBe(false);
+        if (!decision.execute) {
+            expect(decision.reason).toMatch(/no approver is available/i);
+        }
+    });
+    it("never invokes an executor implicitly — caller must gate on execute=false", async () => {
+        // Simulates the tool loop: a denied decision must not run the executor.
+        const executor = vi.fn();
+        const decision = await resolveApprovalDecision("restart_pod", { pod: "x" }, SAFE, undefined);
+        if (decision.execute)
+            executor();
+        expect(executor).not.toHaveBeenCalled();
+    });
+    it("calls onApproval for non-safe actions and executes when approved", async () => {
+        const onApproval = vi.fn().mockResolvedValue(true);
+        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 3 }, SAFE, onApproval);
+        expect(onApproval).toHaveBeenCalledWith("scale_deployment", { deployment: "web", replicas: 3 });
+        expect(decision.execute).toBe(true);
+    });
+    it("denies with the user-denial message when onApproval returns false", async () => {
+        const onApproval = vi.fn().mockResolvedValue(false);
+        const decision = await resolveApprovalDecision("restart_pod", {}, SAFE, onApproval);
+        expect(decision.execute).toBe(false);
+        if (!decision.execute) {
+            expect(decision.reason).toMatch(/denied by user/i);
+        }
+    });
+    it("does not call onApproval for safe actions", async () => {
+        const onApproval = vi.fn().mockResolvedValue(false);
+        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, onApproval);
+        expect(onApproval).not.toHaveBeenCalled();
+        expect(decision.execute).toBe(true);
+    });
+    it("treats user-configured safe_actions as auto-executable", async () => {
+        const safe = new Set([...SAFE, "rollout_restart"]);
+        const decision = await resolveApprovalDecision("rollout_restart", {}, safe, undefined);
+        expect(decision.execute).toBe(true);
+    });
+});

package/dist/diagnoser/index.d.ts

@@ -1,4 +1,20 @@
 import type { Issue } from "../monitor/types.js";
+export type ApprovalDecision = {
+    execute: true;
+} | {
+    execute: false;
+    reason: string;
+};
+/**
+ * Decide whether a tool call may execute, given the set of auto-safe actions and
+ * the (optional) approval callback.
+ *
+ * Security-critical: a missing/undefined `onApproval` MUST mean DENY for any
+ * action that is not in `safeActions`. In non-interactive mode the CLI passes no
+ * (or a deny-all) approver, and destructive remediation (e.g. scale-to-0) must
+ * never run unattended.
+ */
+export declare function resolveApprovalDecision(toolName: string, params: Record<string, unknown>, safeActions: Set<string>, onApproval?: (action: string, params: Record<string, unknown>) => Promise<boolean>): Promise<ApprovalDecision>;
 export interface DiagnosisResult {
     analysis: string;
     action?: {

package/dist/diagnoser/index.js

@@ -19,6 +19,32 @@ function truncateOutput(output) {
     const half = Math.floor(MAX_TOOL_OUTPUT_CHARS / 2);
     return output.slice(0, half) + "\n\n... [truncated] ...\n\n" + output.slice(-half);
 }
+/**
+ * Decide whether a tool call may execute, given the set of auto-safe actions and
+ * the (optional) approval callback.
+ *
+ * Security-critical: a missing/undefined `onApproval` MUST mean DENY for any
+ * action that is not in `safeActions`. In non-interactive mode the CLI passes no
+ * (or a deny-all) approver, and destructive remediation (e.g. scale-to-0) must
+ * never run unattended.
+ */
+export async function resolveApprovalDecision(toolName, params, safeActions, onApproval) {
+    // Safe (read-only or explicitly allowlisted) actions auto-execute.
+    if (safeActions.has(toolName))
+        return { execute: true };
+    // Non-safe action requires approval regardless of whether a callback exists.
+    if (!onApproval) {
+        return {
+            execute: false,
+            reason: "Action requires approval but no approver is available (non-interactive mode); denied. Propose a safe alternative or escalate to a human.",
+        };
+    }
+    const approved = await onApproval(toolName, params);
+    if (!approved) {
+        return { execute: false, reason: "Action denied by user. Propose an alternative." };
+    }
+    return { execute: true };
+}
 async function askUserQuestion(question, choices) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
@@ -184,17 +210,17 @@ If it requires a risky action (rollback, delete, scale to zero), propose it but
                         });
                         continue;
                     }
-                    // Check if action requires approval
-                    if (!effectiveSafeActions.has(block.name) && options?.onApproval) {
-                        const approved = await options.onApproval(block.name, block.input);
-                        if (!approved) {
-                            toolResults.push({
-                                type: "tool_result",
-                                tool_use_id: block.id,
-                                content: "Action denied by user. Propose an alternative.",
-                            });
-                            continue;
-                        }
+                    // Check if action requires approval. A missing onApproval callback
+                    // (non-interactive mode) means DENY for any non-safe action — never
+                    // execute destructive remediation unattended.
+                    const decision = await resolveApprovalDecision(block.name, block.input, effectiveSafeActions, options?.onApproval);
+                    if (!decision.execute) {
+                        toolResults.push({
+                            type: "tool_result",
+                            tool_use_id: block.id,
+                            content: decision.reason,
+                        });
+                        continue;
                     }
                     try {
                         const result = await executor(block.input, { context: clusterContext });

package/dist/monitor/index.d.ts

@@ -8,8 +8,18 @@ export interface CheckSummary {
     nodeCount: number;
     namespaceCount: number;
 }
+export interface RunChecksScope {
+    /**
+     * Namespaces to scope the scan to. When set, kubectl queries are issued
+     * per-namespace (e.g. `kubectl get pods -n foo`) instead of the
+     * cluster-wide `--all-namespaces` form. Cluster-scoped queries
+     * (`get nodes`, `get namespaces`) are still attempted but their failures
+     * are tolerated so namespace-scoped service accounts can use `kubeagent check`.
+     */
+    namespaces?: string[];
+}
 export declare function runChecks(options: KubectlOptions): Promise<Issue[]>;
-export declare function runChecks(options: KubectlOptions, withSummary: true): Promise<CheckSummary>;
+export declare function runChecks(options: KubectlOptions, withSummary: true, scope?: RunChecksScope): Promise<CheckSummary>;
 export declare function computeResolvedKeys(activeKeys: Set<string>, currentKeys: Set<string>): string[];
 export declare function updateActiveKeys(activeKeys: Set<string>, resolvedKeys: string[], currentKeys: Set<string>): void;
 export declare function startMonitor(options: KubectlOptions, intervalMs: number, onIssues: IssueCallback, onResolved?: ResolveCallback, onFirstCycle?: () => void): {

package/dist/monitor/index.js

@@ -33,28 +33,59 @@ function deduplicateIssues(issues) {
         return true;
     });
 }
-export async function runChecks(options, withSummary) {
+export async function runChecks(options, withSummary, scope) {
     const allIssues = [];
-    // Get all pods across namespaces
-    const podList = (await kubectlJson(["get", "pods", "--all-namespaces"], options));
-    allIssues.push(...findPodIssues(podList));
-    // Get nodes
-    const nodeList = (await kubectlJson(["get", "nodes"], options));
+    const scoped = scope?.namespaces && scope.namespaces.length > 0 ? scope.namespaces : null;
+    // Pods: query per-namespace when scoped (so ns-bound service accounts
+    // don't need cluster-wide list-pods), otherwise all-namespaces.
+    let podCount = 0;
+    if (scoped) {
+        for (const ns of scoped) {
+            const list = (await kubectlJson(["get", "pods", "-n", ns], options).catch(() => ({ items: [] })));
+            allIssues.push(...findPodIssues(list));
+            podCount += list.items.length;
+        }
+    }
+    else {
+        const podList = (await kubectlJson(["get", "pods", "--all-namespaces"], options));
+        allIssues.push(...findPodIssues(podList));
+        podCount = podList.items.length;
+    }
+    // Nodes: cluster-scoped. Tolerate forbidden so ns-bound service accounts
+    // still get a useful pod-level report (node issues just don't apply to them).
+    const nodeList = (await kubectlJson(["get", "nodes"], options).catch(() => ({ items: [] })));
     allIssues.push(...findNodeIssues(nodeList));
-    // Get failed jobs
-    const jobList = (await kubectlJson(["get", "jobs", "--all-namespaces", "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
-    allIssues.push(...findJobIssues(jobList));
+    // Failed jobs: per-namespace when scoped, otherwise all-namespaces.
+    if (scoped) {
+        for (const ns of scoped) {
+            const list = (await kubectlJson(["get", "jobs", "-n", ns, "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
+            allIssues.push(...findJobIssues(list));
+        }
+    }
+    else {
+        const jobList = (await kubectlJson(["get", "jobs", "--all-namespaces", "--field-selector=status.failed>0"], options).catch(() => ({ items: [] })));
+        allIssues.push(...findJobIssues(jobList));
+    }
     const issues = deduplicateIssues(allIssues);
     if (!withSummary)
         return issues;
-    // Fetch namespace count (non-fatal)
-    const nsList = await kubectlJson(["get", "namespaces"], options)
-        .catch(() => ({ items: [] }));
+    // Namespace count: cluster-scoped, tolerate forbidden the same way as nodes.
+    // When the caller already specified namespaces, use that length so the
+    // summary reflects the requested scope, not the cluster's namespace total.
+    let namespaceCount;
+    if (scoped) {
+        namespaceCount = scoped.length;
+    }
+    else {
+        const nsList = await kubectlJson(["get", "namespaces"], options)
+            .catch(() => ({ items: [] }));
+        namespaceCount = nsList.items.length;
+    }
     return {
         issues,
-        podCount: podList.items.length,
+        podCount,
         nodeCount: nodeList.items.length,
-        namespaceCount: nsList.items.length,
+        namespaceCount,
     };
 }
 // How long a pod must be Pending before it's reported as an issue.

package/dist/monitor/scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/monitor/scope.test.js

@@ -0,0 +1,87 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { runChecks } from "./index.js";
+import * as kubectl from "../kubectl.js";
+describe("runChecks namespace scope", () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+    });
+    it("queries per-namespace when scope.namespaces is set", async () => {
+        const calls = [];
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            calls.push(args);
+            return { items: [] };
+        });
+        await runChecks({}, true, { namespaces: ["foo", "bar"] });
+        // Pods: one per requested namespace, never --all-namespaces
+        const podCalls = calls.filter((c) => c[0] === "get" && c[1] === "pods");
+        expect(podCalls).toHaveLength(2);
+        expect(podCalls[0]).toEqual(["get", "pods", "-n", "foo"]);
+        expect(podCalls[1]).toEqual(["get", "pods", "-n", "bar"]);
+        expect(calls.some((c) => c.includes("--all-namespaces") && c[1] === "pods")).toBe(false);
+        // Jobs: same per-namespace pattern
+        const jobCalls = calls.filter((c) => c[0] === "get" && c[1] === "jobs");
+        expect(jobCalls).toHaveLength(2);
+        expect(jobCalls[0]).toContain("foo");
+        expect(jobCalls[1]).toContain("bar");
+        expect(calls.some((c) => c.includes("--all-namespaces") && c[1] === "jobs")).toBe(false);
+    });
+    it("uses --all-namespaces when no scope is given", async () => {
+        const calls = [];
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            calls.push(args);
+            return { items: [] };
+        });
+        await runChecks({});
+        expect(calls.some((c) => c[0] === "get" && c[1] === "pods" && c.includes("--all-namespaces"))).toBe(true);
+        expect(calls.some((c) => c[0] === "get" && c[1] === "jobs" && c.includes("--all-namespaces"))).toBe(true);
+    });
+    it("tolerates forbidden errors on cluster-scoped node queries", async () => {
+        // Simulate a namespace-scoped service account: pods succeed, nodes 403
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            if (args[1] === "nodes") {
+                throw new Error("Error from server (Forbidden): nodes is forbidden");
+            }
+            return { items: [] };
+        });
+        const result = await runChecks({}, true, { namespaces: ["foo"] });
+        expect(result.issues).toEqual([]);
+        expect(result.nodeCount).toBe(0);
+    });
+    it("reports namespaceCount = scope length when scoped (skips cluster ns list)", async () => {
+        const calls = [];
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            calls.push(args);
+            return { items: [] };
+        });
+        const result = await runChecks({}, true, { namespaces: ["foo", "bar", "baz"] });
+        expect(result.namespaceCount).toBe(3);
+        // Should not have called get namespaces — that's cluster-scoped and may 403.
+        expect(calls.some((c) => c[0] === "get" && c[1] === "namespaces")).toBe(false);
+    });
+    it("accumulates pod counts across namespaces", async () => {
+        const okPod = (ns, name) => ({
+            metadata: { name, namespace: ns },
+            status: { phase: "Running", containerStatuses: [] },
+        });
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            if (args[1] === "pods" && args[3] === "foo") {
+                return { items: [okPod("foo", "a"), okPod("foo", "b"), okPod("foo", "c")] };
+            }
+            if (args[1] === "pods" && args[3] === "bar") {
+                return { items: [okPod("bar", "x"), okPod("bar", "y")] };
+            }
+            return { items: [] };
+        });
+        const result = await runChecks({}, true, { namespaces: ["foo", "bar"] });
+        expect(result.podCount).toBe(5);
+    });
+    it("empty scope.namespaces is treated as no scope (all-namespaces)", async () => {
+        const calls = [];
+        vi.spyOn(kubectl, "kubectlJson").mockImplementation(async (args) => {
+            calls.push(args);
+            return { items: [] };
+        });
+        await runChecks({}, true, { namespaces: [] });
+        expect(calls.some((c) => c[0] === "get" && c[1] === "pods" && c.includes("--all-namespaces"))).toBe(true);
+    });
+});

package/dist/notify/discord.js

@@ -1,3 +1,4 @@
+import { isSafeWebhookUrl } from "./ssrf-guard.js";
 const CRITICAL_COLOR = 0xe74c3c; // red
 const WARNING_COLOR = 0xf39c12; // yellow
 const INFO_COLOR = 0x3498db; // blue
@@ -32,15 +33,9 @@ function formatDiscordPayload(issues, clusterContext) {
     };
 }
 async function postToDiscord(webhookUrl, payload) {
-    try {
-        const url = new URL(webhookUrl);
-        if (!["https:", "http:"].includes(url.protocol)) {
-            console.error("Discord: invalid URL protocol");
-            return;
-        }
-    }
-    catch {
-        console.error("Discord: invalid webhook URL");
+    // SSRF guard: reject invalid URLs and hosts in private/loopback/metadata ranges.
+    if (!(await isSafeWebhookUrl(webhookUrl))) {
+        console.error("Discord: invalid or unsafe webhook URL (must be a public host)");
         return;
     }
     try {
@@ -48,6 +43,8 @@ async function postToDiscord(webhookUrl, payload) {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(payload),
+            // Don't follow redirects to internal addresses (see ssrf-guard).
+            redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
         if (!res.ok)

package/dist/notify/ssrf-guard.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Returns true if the URL is safe to fetch (public host, valid scheme).
+ * Returns false for invalid URLs or hosts in any blocked range.
+ */
+export declare function isSafeWebhookUrl(rawUrl: string): Promise<boolean>;

package/dist/notify/ssrf-guard.js

@@ -0,0 +1,150 @@
+import { promises as dns } from "node:dns";
+import { isIP } from "node:net";
+/**
+ * Minimal SSRF guard for the CLI. The CLI is a separate package from the server
+ * (they do not share runtime code — see CLAUDE.md), so this duplicates the core
+ * of `server/src/lib/ssrf-guard.ts`: reject user-supplied webhook URLs that point
+ * at private/loopback/link-local/ULA/metadata/CGNAT ranges, resolving hostnames
+ * (all addresses) to defeat the common DNS-rebinding case.
+ */
+function ipv4ToInt(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4)
+        return null;
+    let value = 0;
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const n = Number(part);
+        if (n > 255)
+            return null;
+        value = value * 256 + n;
+    }
+    return value >>> 0;
+}
+function inV4Range(ipInt, cidrBase, prefix) {
+    const base = ipv4ToInt(cidrBase);
+    if (base === null)
+        return false;
+    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    return (ipInt & mask) === (base & mask);
+}
+function isBlockedIPv4(ip) {
+    const n = ipv4ToInt(ip);
+    if (n === null)
+        return true;
+    return (inV4Range(n, "10.0.0.0", 8) ||
+        inV4Range(n, "172.16.0.0", 12) ||
+        inV4Range(n, "192.168.0.0", 16) ||
+        inV4Range(n, "127.0.0.0", 8) ||
+        inV4Range(n, "169.254.0.0", 16) ||
+        inV4Range(n, "100.64.0.0", 10) ||
+        inV4Range(n, "0.0.0.0", 8));
+}
+function ipv6ToGroups(ipRaw) {
+    let ip = ipRaw.toLowerCase();
+    const pct = ip.indexOf("%");
+    if (pct !== -1)
+        ip = ip.slice(0, pct);
+    let v4Tail = null;
+    const lastColon = ip.lastIndexOf(":");
+    const tail = lastColon === -1 ? "" : ip.slice(lastColon + 1);
+    if (tail.includes(".")) {
+        const v4 = ipv4ToInt(tail);
+        if (v4 === null)
+            return null;
+        v4Tail = [(v4 >>> 16) & 0xffff, v4 & 0xffff];
+        ip = ip.slice(0, lastColon + 1);
+    }
+    const halves = ip.split("::");
+    if (halves.length > 2)
+        return null;
+    const parseSide = (side) => {
+        if (side === "")
+            return [];
+        const out = [];
+        for (const h of side.split(":")) {
+            if (h === "" || !/^[0-9a-f]{1,4}$/.test(h))
+                return null;
+            out.push(parseInt(h, 16));
+        }
+        return out;
+    };
+    const left = parseSide(halves[0]);
+    if (left === null)
+        return null;
+    let groups;
+    if (halves.length === 2) {
+        const right = parseSide(halves[1]);
+        if (right === null)
+            return null;
+        const rightAll = v4Tail ? [...right, ...v4Tail] : right;
+        const fill = 8 - left.length - rightAll.length;
+        if (fill < 0)
+            return null;
+        groups = [...left, ...Array(fill).fill(0), ...rightAll];
+    }
+    else {
+        groups = v4Tail ? [...left, ...v4Tail] : left;
+    }
+    if (groups.length !== 8)
+        return null;
+    return groups;
+}
+function isBlockedIPv6(ip) {
+    const g = ipv6ToGroups(ip);
+    if (g === null)
+        return true;
+    if (g.slice(0, 7).every((x) => x === 0) && g[7] === 1)
+        return true; // ::1
+    if (g.every((x) => x === 0))
+        return true; // ::
+    if ((g[0] & 0xfe00) === 0xfc00)
+        return true; // fc00::/7
+    if ((g[0] & 0xffc0) === 0xfe80)
+        return true; // fe80::/10
+    const isMapped = g.slice(0, 5).every((x) => x === 0) && g[5] === 0xffff;
+    const isCompat = g.slice(0, 6).every((x) => x === 0) && (g[6] !== 0 || g[7] > 1);
+    if (isMapped || isCompat) {
+        const v4 = `${(g[6] >> 8) & 0xff}.${g[6] & 0xff}.${(g[7] >> 8) & 0xff}.${g[7] & 0xff}`;
+        return isBlockedIPv4(v4);
+    }
+    return false;
+}
+function isBlockedIP(ip) {
+    const kind = isIP(ip);
+    if (kind === 4)
+        return isBlockedIPv4(ip);
+    if (kind === 6)
+        return isBlockedIPv6(ip);
+    return false;
+}
+/**
+ * Returns true if the URL is safe to fetch (public host, valid scheme).
+ * Returns false for invalid URLs or hosts in any blocked range.
+ */
+export async function isSafeWebhookUrl(rawUrl) {
+    let url;
+    try {
+        url = new URL(rawUrl);
+    }
+    catch {
+        return false;
+    }
+    if (!["https:", "http:"].includes(url.protocol))
+        return false;
+    let host = url.hostname;
+    if (host.startsWith("[") && host.endsWith("]"))
+        host = host.slice(1, -1);
+    if (isIP(host) !== 0)
+        return !isBlockedIP(host);
+    try {
+        const records = await dns.lookup(host, { all: true });
+        if (records.length === 0)
+            return false;
+        return records.every((r) => !isBlockedIP(r.address));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/notify/teams.js

@@ -1,3 +1,4 @@
+import { isSafeWebhookUrl } from "./ssrf-guard.js";
 function formatTeamsPayload(issues, clusterContext) {
     const critical = issues.filter((i) => i.severity === "critical");
     const warning = issues.filter((i) => i.severity === "warning");
@@ -25,15 +26,9 @@ function formatTeamsPayload(issues, clusterContext) {
     };
 }
 async function postToTeams(webhookUrl, payload) {
-    try {
-        const url = new URL(webhookUrl);
-        if (!["https:", "http:"].includes(url.protocol)) {
-            console.error("Teams: invalid URL protocol");
-            return;
-        }
-    }
-    catch {
-        console.error("Teams: invalid webhook URL");
+    // SSRF guard: reject invalid URLs and hosts in private/loopback/metadata ranges.
+    if (!(await isSafeWebhookUrl(webhookUrl))) {
+        console.error("Teams: invalid or unsafe webhook URL (must be a public host)");
         return;
     }
     try {
@@ -41,6 +36,8 @@ async function postToTeams(webhookUrl, payload) {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(payload),
+            // Don't follow redirects to internal addresses (see ssrf-guard).
+            redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
         if (!res.ok)

package/dist/notify/webhook.js

@@ -1,13 +1,8 @@
+import { isSafeWebhookUrl } from "./ssrf-guard.js";
 export async function sendWebhook(issues, channel, clusterContext) {
-    try {
-        const url = new URL(channel.url);
-        if (!["https:", "http:"].includes(url.protocol)) {
-            console.error("Webhook: invalid URL protocol");
-            return;
-        }
-    }
-    catch {
-        console.error("Webhook: invalid URL");
+    // SSRF guard: reject invalid URLs and hosts in private/loopback/metadata ranges.
+    if (!(await isSafeWebhookUrl(channel.url))) {
+        console.error("Webhook: invalid or unsafe URL (must be a public https/http host)");
         return;
     }
     const payload = {
@@ -31,6 +26,9 @@ export async function sendWebhook(issues, channel, clusterContext) {
             method: "POST",
             headers,
             body: JSON.stringify(payload),
+            // Don't follow redirects: a public host could 30x to an internal address
+            // (metadata/localhost/RFC-1918) that the guard above never saw.
+            redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
         if (!res.ok)

package/dist/notify/webhook.test.js

@@ -1,12 +1,20 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 const mockFetch = vi.fn();
 vi.stubGlobal("fetch", mockFetch);
+// Mock DNS so the SSRF guard resolves example.com to a public address without
+// real network access, keeping tests hermetic.
+const mockLookup = vi.fn();
+vi.mock("node:dns", () => ({
+    promises: { lookup: (...args) => mockLookup(...args) },
+}));
 const channel = { type: "webhook", url: "https://example.com/hook", secret: "testsecret", severity: "warning" };
 const issue = { kind: "pod_crashloop", severity: "critical", namespace: "prod", resource: "api-web", message: "Pod crash-looping", details: { restartCount: 3 }, timestamp: new Date("2026-01-01T00:00:00Z") };
 describe("sendWebhook", () => {
     beforeEach(() => {
         mockFetch.mockReset();
         mockFetch.mockResolvedValue({ ok: true, status: 200, statusText: "OK" });
+        mockLookup.mockReset();
+        mockLookup.mockResolvedValue([{ address: "93.184.216.34", family: 4 }]);
     });
     it("POSTs to the configured URL", async () => {
         const { sendWebhook } = await import("./webhook.js");
@@ -50,4 +58,17 @@ describe("sendWebhook", () => {
         await expect(sendWebhook([issue], badChannel)).resolves.not.toThrow();
         expect(mockFetch).not.toHaveBeenCalled();
     });
+    it("blocks SSRF: does not fetch a literal private/metadata IP", async () => {
+        const metaChannel = { ...channel, url: "http://169.254.169.254/latest/meta-data/" };
+        const { sendWebhook } = await import("./webhook.js");
+        await expect(sendWebhook([issue], metaChannel)).resolves.not.toThrow();
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it("blocks SSRF: does not fetch a hostname resolving to loopback", async () => {
+        mockLookup.mockResolvedValue([{ address: "127.0.0.1", family: 4 }]);
+        const rebindChannel = { ...channel, url: "https://internal.evil.example/hook" };
+        const { sendWebhook } = await import("./webhook.js");
+        await expect(sendWebhook([issue], rebindChannel)).resolves.not.toThrow();
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
 });

package/dist/orchestrator.js

@@ -140,7 +140,8 @@ export async function handleIssues(issues, config, clusterContext, noInteractive
         autoFix: config.remediation.auto_fix,
         safeActions: config.remediation.safe_actions,
         noInteractive,
-        onApproval: noInteractive ? undefined : askApproval,
+        // Non-interactive mode must auto-deny every approval-gated (non-safe) action.
+        onApproval: noInteractive ? (async () => false) : askApproval,
         onQuestion: (question, choices) => broadcastQuestion(question, choices, config, clusterContext),
     });
     // ── Analysis ──────────────────────────────────────────────