kubeagent 0.1.36 → 0.1.44

package/dist/notify/teams.js

@@ -1,3 +1,4 @@
+import { isSafeWebhookUrl } from "./ssrf-guard.js";
 function formatTeamsPayload(issues, clusterContext) {
     const critical = issues.filter((i) => i.severity === "critical");
     const warning = issues.filter((i) => i.severity === "warning");
@@ -25,15 +26,9 @@ function formatTeamsPayload(issues, clusterContext) {
     };
 }
 async function postToTeams(webhookUrl, payload) {
-    try {
-        const url = new URL(webhookUrl);
-        if (!["https:", "http:"].includes(url.protocol)) {
-            console.error("Teams: invalid URL protocol");
-            return;
-        }
-    }
-    catch {
-        console.error("Teams: invalid webhook URL");
+    // SSRF guard: reject invalid URLs and hosts in private/loopback/metadata ranges.
+    if (!(await isSafeWebhookUrl(webhookUrl))) {
+        console.error("Teams: invalid or unsafe webhook URL (must be a public host)");
         return;
     }
     try {
@@ -41,6 +36,8 @@ async function postToTeams(webhookUrl, payload) {
             method: "POST",
             headers: { "Content-Type": "application/json" },
             body: JSON.stringify(payload),
+            // Don't follow redirects to internal addresses (see ssrf-guard).
+            redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
         if (!res.ok)

package/dist/notify/webhook.js

@@ -1,13 +1,8 @@
+import { isSafeWebhookUrl } from "./ssrf-guard.js";
 export async function sendWebhook(issues, channel, clusterContext) {
-    try {
-        const url = new URL(channel.url);
-        if (!["https:", "http:"].includes(url.protocol)) {
-            console.error("Webhook: invalid URL protocol");
-            return;
-        }
-    }
-    catch {
-        console.error("Webhook: invalid URL");
+    // SSRF guard: reject invalid URLs and hosts in private/loopback/metadata ranges.
+    if (!(await isSafeWebhookUrl(channel.url))) {
+        console.error("Webhook: invalid or unsafe URL (must be a public https/http host)");
         return;
     }
     const payload = {
@@ -31,6 +26,9 @@ export async function sendWebhook(issues, channel, clusterContext) {
             method: "POST",
             headers,
             body: JSON.stringify(payload),
+            // Don't follow redirects: a public host could 30x to an internal address
+            // (metadata/localhost/RFC-1918) that the guard above never saw.
+            redirect: "error",
             signal: AbortSignal.timeout(10_000),
         });
         if (!res.ok)

package/dist/orchestrator.js

@@ -140,7 +140,8 @@ export async function handleIssues(issues, config, clusterContext, noInteractive
         autoFix: config.remediation.auto_fix,
         safeActions: config.remediation.safe_actions,
         noInteractive,
-        onApproval: noInteractive ? undefined : askApproval,
+        // Non-interactive mode must auto-deny every approval-gated (non-safe) action.
+        onApproval: noInteractive ? (async () => false) : askApproval,
         onQuestion: (question, choices) => broadcastQuestion(question, choices, config, clusterContext),
     });
     // ── Analysis ──────────────────────────────────────────────

package/dist/telemetry.js

@@ -1,9 +1,34 @@
-import { existsSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, writeFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { homedir, platform, arch } from "node:os";
+import { randomUUID } from "node:crypto";
 const TELEMETRY_DIR = join(homedir(), ".kubeagent");
 const SENT_FILE = join(TELEMETRY_DIR, ".telemetry-sent");
+const MACHINE_ID_FILE = join(TELEMETRY_DIR, ".machine-id");
 const SERVER = "https://api.kubeagent.net";
+/**
+ * Stable, anonymous per-machine ID. Used as the PostHog distinct_id for CLI
+ * events so install→auth→first-run funnels stitch together across invocations.
+ * Not tied to any user identity until the CLI logs in (server-side alias).
+ */
+function getOrCreateMachineId() {
+    try {
+        if (!existsSync(TELEMETRY_DIR))
+            mkdirSync(TELEMETRY_DIR, { recursive: true });
+        if (existsSync(MACHINE_ID_FILE)) {
+            const id = readFileSync(MACHINE_ID_FILE, "utf8").trim();
+            if (id)
+                return id;
+        }
+        const id = randomUUID();
+        writeFileSync(MACHINE_ID_FILE, id);
+        return id;
+    }
+    catch {
+        // If we cannot persist, return an ephemeral id — better than nothing.
+        return randomUUID();
+    }
+}
 export function sendTelemetry(cliVersion) {
     // Only fire once per machine
     if (existsSync(SENT_FILE))
@@ -24,6 +49,7 @@ export function sendTelemetry(cliVersion) {
         os: platform(),
         arch: arch(),
         nodeVersion: process.version,
+        machineId: getOrCreateMachineId(),
     });
     fetch(`${SERVER}/telemetry`, {
         method: "POST",

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "kubeagent",
-  "version": "0.1.36",
+  "version": "0.1.44",
   "description": "AI-powered Kubernetes management CLI",
   "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kubeagent-net/KubeAgent.git"
+  },
+  "homepage": "https://kubeagent.net",
+  "bugs": {
+    "url": "https://github.com/kubeagent-net/KubeAgent/issues"
+  },
   "type": "module",
   "bin": {
     "kubeagent": "./dist/cli.js"
@@ -24,6 +32,7 @@
   "engines": {
     "node": ">=22"
   },
+  "packageManager": "npm@11.16.0",
   "dependencies": {
     "@anthropic-ai/sdk": "^0.81.0",
     "chalk": "^5.4.0",

package/dist/auth.d.ts

@@ -1,29 +0,0 @@
-export interface AuthState {
-    serverUrl: string;
-    appUrl: string;
-    token: string;
-    email?: string;
-    name?: string;
-    apiKey?: string;
-}
-export declare function loadAuth(): AuthState | null;
-export declare function saveAuth(auth: AuthState): void;
-export declare function clearAuth(): void;
-export declare function loginBrowser(serverUrl: string, appUrl: string): Promise<AuthState>;
-export declare function loginDevice(serverUrl: string, appUrl: string): Promise<AuthState>;
-export declare function createApiKey(auth: AuthState, name: string): Promise<{
-    key: string;
-    prefix: string;
-}>;
-export interface BalanceInfo {
-    monthlyRemaining: number;
-    extraRemaining: number;
-    totalRemaining: number;
-    resetsAt: string;
-    plan: string | null;
-    planName: string | null;
-    monthlyTotal: number;
-}
-export declare function showAccount(auth: AuthState): Promise<{
-    balance: BalanceInfo;
-}>;

package/dist/cli.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-export {};

package/dist/config.d.ts

@@ -1,75 +0,0 @@
-export interface ProjectMapping {
-    name: string;
-    dir: string;
-    deployment: string;
-    namespace: string;
-    kind: "Deployment" | "StatefulSet";
-}
-export interface ClusterConfig {
-    context: string;
-    interval: number;
-    codepaths: string[];
-    projects?: ProjectMapping[];
-}
-export type NotificationSeverity = "info" | "warning" | "critical";
-export interface SlackChannel {
-    type: "slack";
-    webhook_url: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export interface TelegramChannel {
-    type: "telegram";
-    bot_token: string;
-    chat_id: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export interface WebhookChannel {
-    type: "webhook";
-    url: string;
-    secret?: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export interface PagerDutyChannel {
-    type: "pagerduty";
-    routing_key: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export interface DiscordChannel {
-    type: "discord";
-    webhook_url: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export interface TeamsChannel {
-    type: "teams";
-    webhook_url: string;
-    severity: NotificationSeverity;
-    label?: string;
-}
-export type NotificationChannel = SlackChannel | TelegramChannel | WebhookChannel | PagerDutyChannel | DiscordChannel | TeamsChannel;
-export declare const ALL_ACTIONS: readonly ["restart_pod", "rollout_restart", "scale_deployment", "set_resources"];
-export type RemediationAction = (typeof ALL_ACTIONS)[number];
-export interface KubeAgentConfig {
-    clusters: ClusterConfig[];
-    notifications: {
-        terminal: boolean;
-        channels: NotificationChannel[];
-    };
-    remediation: {
-        auto_fix: boolean;
-        max_retries: number;
-        cooldown: number;
-        safe_actions: RemediationAction[];
-    };
-}
-export declare const DEFAULT_SAFE_ACTIONS: RemediationAction[];
-export declare function defaultConfig(): KubeAgentConfig;
-export declare function parseConfig(raw: Record<string, unknown>): KubeAgentConfig;
-export declare function configDir(): string;
-export declare function configPath(): string;
-export declare function loadConfig(): KubeAgentConfig;
-export declare function saveConfig(config: KubeAgentConfig): void;

package/dist/debug.d.ts

@@ -1,10 +0,0 @@
-/**
- * Debug logging — enabled with KUBEAGENT_DEBUG=1 (or any truthy value).
- *
- * Usage:
- *   KUBEAGENT_DEBUG=1 kubeagent watch
- *
- * Logs to stderr so it doesn't interfere with piped output.
- */
-export declare const DEBUG: boolean;
-export declare function dbg(tag: string, message: string, data?: unknown): void;

package/dist/detector/cache.d.ts

@@ -1,6 +0,0 @@
-export declare function readCache<T>(kind: string, key: string): T | null;
-export declare function readStaleCache<T>(kind: string, key: string): {
-    data: T;
-    fetchedAt: number;
-} | null;
-export declare function writeCache<T>(kind: string, key: string, data: T): void;

package/dist/detector/cache.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/cache.test.js

@@ -1,54 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { mkdtempSync, rmSync, existsSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-let tmpHome;
-let originalHome;
-beforeEach(() => {
-    originalHome = process.env.HOME;
-    tmpHome = mkdtempSync(join(tmpdir(), "kubeagent-cache-test-"));
-    process.env.HOME = tmpHome;
-});
-afterEach(() => {
-    if (originalHome !== undefined)
-        process.env.HOME = originalHome;
-    else
-        delete process.env.HOME;
-    rmSync(tmpHome, { recursive: true, force: true });
-});
-describe("cache", () => {
-    it("round-trips data within the TTL", async () => {
-        const { readCache, writeCache } = await import("./cache.js");
-        writeCache("osv", "redis@7.0.5", [{ id: "CVE-1" }]);
-        const got = readCache("osv", "redis@7.0.5");
-        expect(got).toEqual([{ id: "CVE-1" }]);
-    });
-    it("returns null for a missing entry", async () => {
-        const { readCache } = await import("./cache.js");
-        expect(readCache("osv", "nope")).toBeNull();
-    });
-    it("creates the cache directory on write", async () => {
-        const { writeCache } = await import("./cache.js");
-        writeCache("eol", "postgres", [{ cycle: "15" }]);
-        expect(existsSync(join(tmpHome, ".kubeagent", "cache", "eol", "postgres.json"))).toBe(true);
-    });
-    it("sanitizes unsafe characters in cache keys", async () => {
-        const { writeCache } = await import("./cache.js");
-        writeCache("osv", "foo/../bar@1.0", { x: 1 });
-        expect(existsSync(join(tmpHome, ".kubeagent", "cache", "osv", "foo_.._bar@1.0.json"))).toBe(true);
-    });
-    it("readStaleCache returns data and a fetchedAt timestamp", async () => {
-        const { writeCache, readStaleCache } = await import("./cache.js");
-        writeCache("osv", "k", "v");
-        const stale = readStaleCache("osv", "k");
-        expect(stale?.data).toBe("v");
-        expect(typeof stale?.fetchedAt).toBe("number");
-    });
-    it("treats a malformed cache file as a miss", async () => {
-        const { writeCache, readCache } = await import("./cache.js");
-        writeCache("osv", "k", "v");
-        const path = join(tmpHome, ".kubeagent", "cache", "osv", "k.json");
-        writeFileSync(path, "not json");
-        expect(readCache("osv", "k")).toBeNull();
-    });
-});

package/dist/detector/catalog.d.ts

@@ -1,17 +0,0 @@
-export interface OsvLookup {
-    name: string;
-    ecosystem?: string;
-}
-export interface ProductEntry {
-    display: string;
-    eolProduct?: string;
-    osv?: OsvLookup;
-}
-export declare const PRODUCTS: Record<string, ProductEntry>;
-export declare const ALIASES: Record<string, string>;
-export interface CatalogMatch {
-    canonical: string;
-    entry: ProductEntry;
-}
-export declare function lookupCatalog(repository: string, name: string): CatalogMatch | null;
-export declare function lookupChart(chartName: string): CatalogMatch | null;

package/dist/detector/catalog.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/catalog.test.js

@@ -1,33 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { lookupCatalog, lookupChart } from "./catalog.js";
-describe("lookupCatalog", () => {
-    it("matches bare image names from the products map", () => {
-        const m = lookupCatalog("library/postgres", "postgres");
-        expect(m?.canonical).toBe("postgres");
-        expect(m?.entry.display).toBe("PostgreSQL");
-    });
-    it("resolves aliases for bitnami charts", () => {
-        const m = lookupCatalog("bitnami/postgresql", "postgresql");
-        expect(m?.canonical).toBe("postgres");
-    });
-    it("resolves quay.io prometheus", () => {
-        const m = lookupCatalog("prometheus/prometheus", "prometheus");
-        expect(m?.canonical).toBe("prometheus");
-    });
-    it("handles case-insensitive lookups", () => {
-        const m = lookupCatalog("Library/PostgreSQL", "PostgreSQL");
-        expect(m?.canonical).toBe("postgres");
-    });
-    it("returns null for unknown repositories", () => {
-        expect(lookupCatalog("acme/internal-app", "internal-app")).toBeNull();
-    });
-});
-describe("lookupChart", () => {
-    it("matches chart names to canonical products", () => {
-        expect(lookupChart("postgresql")?.canonical).toBe("postgres");
-        expect(lookupChart("redis")?.canonical).toBe("redis");
-    });
-    it("returns null for unknown charts", () => {
-        expect(lookupChart("unknown-chart")).toBeNull();
-    });
-});

package/dist/detector/eol.d.ts

@@ -1,13 +0,0 @@
-export interface EolStatus {
-    product: string;
-    cycle: string;
-    eol: boolean;
-    eolDate?: string;
-    latest?: string;
-    releaseDate?: string;
-    lts: boolean;
-}
-export declare function queryEol(product: string, version: string, opts?: {
-    noCache?: boolean;
-    timeoutMs?: number;
-}): Promise<EolStatus | null>;

package/dist/detector/eol.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/eol.test.js

@@ -1,78 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-vi.mock("./cache.js", () => ({
-    readCache: vi.fn(),
-    readStaleCache: vi.fn(),
-    writeCache: vi.fn(),
-}));
-import { readCache, readStaleCache, writeCache } from "./cache.js";
-import { queryEol } from "./eol.js";
-const mockFetch = vi.fn();
-vi.stubGlobal("fetch", mockFetch);
-const cacheRead = vi.mocked(readCache);
-const cacheStale = vi.mocked(readStaleCache);
-const cacheWrite = vi.mocked(writeCache);
-const POSTGRES_FIXTURE = [
-    { cycle: "16", releaseDate: "2023-09-14", eol: "2028-11-09", latest: "16.2", lts: false },
-    { cycle: "15", releaseDate: "2022-10-13", eol: "2027-11-11", latest: "15.6", lts: false },
-    { cycle: "11", releaseDate: "2018-10-18", eol: "2023-11-09", latest: "11.22", lts: false },
-];
-describe("queryEol", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        cacheRead.mockReset();
-        cacheStale.mockReset();
-        cacheWrite.mockReset();
-        cacheRead.mockReturnValue(null);
-        cacheStale.mockReturnValue(null);
-    });
-    it("hits endoflife.date and picks the matching cycle by major version", async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
-        const status = await queryEol("postgres", "15.2", { noCache: true });
-        expect(mockFetch.mock.calls[0][0]).toBe("https://endoflife.date/api/postgres.json");
-        expect(status).toMatchObject({
-            product: "postgres",
-            cycle: "15",
-            eol: false,
-            eolDate: "2027-11-11",
-            latest: "15.6",
-        });
-        expect(cacheWrite).toHaveBeenCalledOnce();
-    });
-    it("flags a cycle as EOL when its date is in the past", async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
-        const status = await queryEol("postgres", "11.18", { noCache: true });
-        expect(status?.cycle).toBe("11");
-        expect(status?.eol).toBe(true);
-        expect(status?.eolDate).toBe("2023-11-09");
-    });
-    it("returns null when no cycle matches", async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: async () => POSTGRES_FIXTURE });
-        const status = await queryEol("postgres", "99.0", { noCache: true });
-        expect(status).toBeNull();
-    });
-    it("returns null on network error with no cache", async () => {
-        mockFetch.mockRejectedValue(new Error("network down"));
-        const status = await queryEol("postgres", "15.2", { noCache: true });
-        expect(status).toBeNull();
-    });
-    it("serves a fresh cached entry without hitting the network", async () => {
-        cacheRead.mockReturnValue(POSTGRES_FIXTURE);
-        const status = await queryEol("postgres", "15.2");
-        expect(mockFetch).not.toHaveBeenCalled();
-        expect(status?.cycle).toBe("15");
-    });
-    it("falls back to stale cache on network error", async () => {
-        cacheStale.mockReturnValue({ data: POSTGRES_FIXTURE, fetchedAt: 1 });
-        mockFetch.mockRejectedValue(new Error("offline"));
-        const status = await queryEol("postgres", "11.18", { noCache: true });
-        expect(status?.eol).toBe(true);
-    });
-    it("treats eol: true as EOL regardless of date", async () => {
-        mockFetch.mockResolvedValue({
-            ok: true,
-            json: async () => [{ cycle: "1.0", eol: true, latest: "1.0.5" }],
-        });
-        const status = await queryEol("oldthing", "1.0", { noCache: true });
-        expect(status?.eol).toBe(true);
-    });
-});

package/dist/detector/image-parser.d.ts

@@ -1,11 +0,0 @@
-export interface ParsedImage {
-    registry: string;
-    repository: string;
-    name: string;
-    tag: string;
-    digest?: string;
-}
-export declare function parseImage(image: string): ParsedImage;
-export declare function normalizeVersion(tag: string): string;
-export declare function majorMinor(version: string): string;
-export declare function major(version: string): string;

package/dist/detector/image-parser.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/image-parser.test.js

@@ -1,87 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { parseImage, normalizeVersion, majorMinor, major } from "./image-parser.js";
-describe("parseImage", () => {
-    it("parses a bare image name", () => {
-        expect(parseImage("nginx")).toEqual({
-            registry: "docker.io",
-            repository: "library/nginx",
-            name: "nginx",
-            tag: "latest",
-            digest: undefined,
-        });
-    });
-    it("parses a bare image with a tag", () => {
-        expect(parseImage("nginx:1.24.0")).toMatchObject({
-            registry: "docker.io",
-            repository: "library/nginx",
-            name: "nginx",
-            tag: "1.24.0",
-        });
-    });
-    it("parses a docker hub user/repo image", () => {
-        expect(parseImage("bitnami/postgresql:15")).toMatchObject({
-            registry: "docker.io",
-            repository: "bitnami/postgresql",
-            name: "postgresql",
-            tag: "15",
-        });
-    });
-    it("parses a custom registry", () => {
-        expect(parseImage("quay.io/prometheus/prometheus:v2.45.0")).toMatchObject({
-            registry: "quay.io",
-            repository: "prometheus/prometheus",
-            name: "prometheus",
-            tag: "v2.45.0",
-        });
-    });
-    it("parses registry.k8s.io single-segment paths without forcing library/", () => {
-        expect(parseImage("registry.k8s.io/etcd:3.5.9-0")).toMatchObject({
-            registry: "registry.k8s.io",
-            repository: "etcd",
-            name: "etcd",
-            tag: "3.5.9-0",
-        });
-    });
-    it("parses a registry with a port", () => {
-        expect(parseImage("localhost:5000/mything:1.0")).toMatchObject({
-            registry: "localhost:5000",
-            repository: "mything",
-            name: "mything",
-            tag: "1.0",
-        });
-    });
-    it("parses a digest-only reference", () => {
-        const p = parseImage("nginx@sha256:abcdef");
-        expect(p.repository).toBe("library/nginx");
-        expect(p.tag).toBe("");
-        expect(p.digest).toBe("sha256:abcdef");
-    });
-    it("parses tag + digest", () => {
-        const p = parseImage("nginx:1.24@sha256:abcdef");
-        expect(p.tag).toBe("1.24");
-        expect(p.digest).toBe("sha256:abcdef");
-    });
-});
-describe("normalizeVersion", () => {
-    it("strips a leading v", () => {
-        expect(normalizeVersion("v1.2.3")).toBe("1.2.3");
-    });
-    it("strips suffixes like -alpine", () => {
-        expect(normalizeVersion("15.2-alpine")).toBe("15.2");
-    });
-    it("returns empty for placeholder tags", () => {
-        expect(normalizeVersion("latest")).toBe("");
-        expect(normalizeVersion("stable")).toBe("");
-        expect(normalizeVersion("")).toBe("");
-    });
-});
-describe("major/majorMinor", () => {
-    it("extracts major", () => {
-        expect(major("15.2.1")).toBe("15");
-        expect(major("11")).toBe("11");
-    });
-    it("extracts major.minor", () => {
-        expect(majorMinor("15.2.1")).toBe("15.2");
-        expect(majorMinor("11")).toBe("11");
-    });
-});

package/dist/detector/index.d.ts

@@ -1,33 +0,0 @@
-import type { KubectlOptions } from "../kubectl.js";
-import { type Candidate, type WorkloadRef } from "./sources.js";
-import { type CveFinding } from "./osv.js";
-import { type EolStatus } from "./eol.js";
-export interface DetectedApp {
-    canonical: string;
-    display: string;
-    version: string;
-    sources: Array<Candidate["source"]>;
-    workloads: WorkloadRef[];
-    cves: CveFinding[];
-    eol: EolStatus | null;
-    catalogMatch: boolean;
-}
-export interface UnknownApp {
-    name: string;
-    version: string;
-    workloads: WorkloadRef[];
-}
-export interface DetectionResult {
-    apps: DetectedApp[];
-    unknowns: UnknownApp[];
-    scanned: {
-        workloads: number;
-        helmReleases: number;
-    };
-}
-export interface DetectOptions extends KubectlOptions {
-    noCache?: boolean;
-    onProgress?: (step: string) => void;
-}
-export declare function detectApplications(opts?: DetectOptions): Promise<DetectionResult>;
-export declare function formatApplicationsMarkdown(result: DetectionResult): string;

package/dist/detector/index.test.d.ts

@@ -1 +0,0 @@
-export {};