kubeagent 0.1.43 → 0.1.45

package/dist/detector/image-parser.test.js

@@ -1,87 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { parseImage, normalizeVersion, majorMinor, major } from "./image-parser.js";
-describe("parseImage", () => {
-    it("parses a bare image name", () => {
-        expect(parseImage("nginx")).toEqual({
-            registry: "docker.io",
-            repository: "library/nginx",
-            name: "nginx",
-            tag: "latest",
-            digest: undefined,
-        });
-    });
-    it("parses a bare image with a tag", () => {
-        expect(parseImage("nginx:1.24.0")).toMatchObject({
-            registry: "docker.io",
-            repository: "library/nginx",
-            name: "nginx",
-            tag: "1.24.0",
-        });
-    });
-    it("parses a docker hub user/repo image", () => {
-        expect(parseImage("bitnami/postgresql:15")).toMatchObject({
-            registry: "docker.io",
-            repository: "bitnami/postgresql",
-            name: "postgresql",
-            tag: "15",
-        });
-    });
-    it("parses a custom registry", () => {
-        expect(parseImage("quay.io/prometheus/prometheus:v2.45.0")).toMatchObject({
-            registry: "quay.io",
-            repository: "prometheus/prometheus",
-            name: "prometheus",
-            tag: "v2.45.0",
-        });
-    });
-    it("parses registry.k8s.io single-segment paths without forcing library/", () => {
-        expect(parseImage("registry.k8s.io/etcd:3.5.9-0")).toMatchObject({
-            registry: "registry.k8s.io",
-            repository: "etcd",
-            name: "etcd",
-            tag: "3.5.9-0",
-        });
-    });
-    it("parses a registry with a port", () => {
-        expect(parseImage("localhost:5000/mything:1.0")).toMatchObject({
-            registry: "localhost:5000",
-            repository: "mything",
-            name: "mything",
-            tag: "1.0",
-        });
-    });
-    it("parses a digest-only reference", () => {
-        const p = parseImage("nginx@sha256:abcdef");
-        expect(p.repository).toBe("library/nginx");
-        expect(p.tag).toBe("");
-        expect(p.digest).toBe("sha256:abcdef");
-    });
-    it("parses tag + digest", () => {
-        const p = parseImage("nginx:1.24@sha256:abcdef");
-        expect(p.tag).toBe("1.24");
-        expect(p.digest).toBe("sha256:abcdef");
-    });
-});
-describe("normalizeVersion", () => {
-    it("strips a leading v", () => {
-        expect(normalizeVersion("v1.2.3")).toBe("1.2.3");
-    });
-    it("strips suffixes like -alpine", () => {
-        expect(normalizeVersion("15.2-alpine")).toBe("15.2");
-    });
-    it("returns empty for placeholder tags", () => {
-        expect(normalizeVersion("latest")).toBe("");
-        expect(normalizeVersion("stable")).toBe("");
-        expect(normalizeVersion("")).toBe("");
-    });
-});
-describe("major/majorMinor", () => {
-    it("extracts major", () => {
-        expect(major("15.2.1")).toBe("15");
-        expect(major("11")).toBe("11");
-    });
-    it("extracts major.minor", () => {
-        expect(majorMinor("15.2.1")).toBe("15.2");
-        expect(majorMinor("11")).toBe("11");
-    });
-});

package/dist/detector/index.d.ts

@@ -1,33 +0,0 @@
-import type { KubectlOptions } from "../kubectl.js";
-import { type Candidate, type WorkloadRef } from "./sources.js";
-import { type CveFinding } from "./osv.js";
-import { type EolStatus } from "./eol.js";
-export interface DetectedApp {
-    canonical: string;
-    display: string;
-    version: string;
-    sources: Array<Candidate["source"]>;
-    workloads: WorkloadRef[];
-    cves: CveFinding[];
-    eol: EolStatus | null;
-    catalogMatch: boolean;
-}
-export interface UnknownApp {
-    name: string;
-    version: string;
-    workloads: WorkloadRef[];
-}
-export interface DetectionResult {
-    apps: DetectedApp[];
-    unknowns: UnknownApp[];
-    scanned: {
-        workloads: number;
-        helmReleases: number;
-    };
-}
-export interface DetectOptions extends KubectlOptions {
-    noCache?: boolean;
-    onProgress?: (step: string) => void;
-}
-export declare function detectApplications(opts?: DetectOptions): Promise<DetectionResult>;
-export declare function formatApplicationsMarkdown(result: DetectionResult): string;

package/dist/detector/index.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/index.test.js

@@ -1,210 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-vi.mock("./sources.js", () => ({
-    fetchWorkloadCandidates: vi.fn(),
-    fetchHelmCandidates: vi.fn(),
-    fetchIngressHostMap: vi.fn(),
-    workloadKey: (ref) => `${ref.kind}/${ref.namespace}/${ref.name}`,
-}));
-vi.mock("./osv.js", () => ({
-    queryOsv: vi.fn(),
-}));
-vi.mock("./eol.js", () => ({
-    queryEol: vi.fn(),
-}));
-import { fetchWorkloadCandidates, fetchHelmCandidates, fetchIngressHostMap } from "./sources.js";
-import { queryOsv } from "./osv.js";
-import { queryEol } from "./eol.js";
-import { detectApplications, formatApplicationsMarkdown } from "./index.js";
-const fetchWorkloads = vi.mocked(fetchWorkloadCandidates);
-const fetchHelm = vi.mocked(fetchHelmCandidates);
-const fetchIngress = vi.mocked(fetchIngressHostMap);
-const osv = vi.mocked(queryOsv);
-const eol = vi.mocked(queryEol);
-describe("detectApplications", () => {
-    beforeEach(() => {
-        fetchWorkloads.mockReset();
-        fetchHelm.mockReset();
-        fetchIngress.mockReset();
-        osv.mockReset();
-        eol.mockReset();
-        fetchIngress.mockResolvedValue(new Map());
-        osv.mockResolvedValue([]);
-        eol.mockResolvedValue(null);
-    });
-    it("merges image and label candidates pointing at the same app/version", async () => {
-        fetchWorkloads.mockResolvedValue([
-            {
-                source: "image",
-                image: "postgres:15.2",
-                container: "db",
-                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
-            },
-            {
-                source: "label",
-                appName: "postgres",
-                appVersion: "15.2",
-                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
-            },
-        ]);
-        fetchHelm.mockResolvedValue([]);
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps).toHaveLength(1);
-        expect(result.apps[0].canonical).toBe("postgres");
-        expect(result.apps[0].version).toBe("15.2");
-        expect(result.apps[0].sources.sort()).toEqual(["image", "label"]);
-        expect(result.apps[0].workloads).toHaveLength(1);
-    });
-    it("tracks images not in the catalog as unknowns", async () => {
-        fetchWorkloads.mockResolvedValue([
-            {
-                source: "image",
-                image: "acme/internal-app:1.2.3",
-                container: "app",
-                workload: { kind: "Deployment", namespace: "team-x", name: "foo" },
-            },
-        ]);
-        fetchHelm.mockResolvedValue([]);
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps).toHaveLength(0);
-        expect(result.unknowns).toHaveLength(1);
-        expect(result.unknowns[0]).toMatchObject({ name: "internal-app", version: "1.2.3" });
-    });
-    it("flags EOL apps via the eol lookup", async () => {
-        fetchWorkloads.mockResolvedValue([
-            {
-                source: "image",
-                image: "postgres:11.18",
-                container: "db",
-                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
-            },
-        ]);
-        fetchHelm.mockResolvedValue([]);
-        eol.mockResolvedValue({
-            product: "postgres",
-            cycle: "11",
-            eol: true,
-            eolDate: "2023-11-09",
-            latest: "11.22",
-            lts: false,
-        });
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps[0].eol?.eol).toBe(true);
-        expect(result.apps[0].eol?.eolDate).toBe("2023-11-09");
-    });
-    it("attaches CVE findings from OSV", async () => {
-        fetchWorkloads.mockResolvedValue([
-            {
-                source: "image",
-                image: "redis:7.0.5",
-                container: "cache",
-                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
-            },
-        ]);
-        fetchHelm.mockResolvedValue([]);
-        osv.mockResolvedValue([
-            { id: "CVE-2023-9999", summary: "Boom.", severity: "high", fixed: "7.0.12" },
-        ]);
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps[0].cves).toHaveLength(1);
-        expect(result.apps[0].cves[0].id).toBe("CVE-2023-9999");
-    });
-    it("orders apps by severity (EOL → CVEs → healthy)", async () => {
-        fetchWorkloads.mockResolvedValue([
-            {
-                source: "image",
-                image: "nginx:1.25.3",
-                container: "web",
-                workload: { kind: "Deployment", namespace: "edge", name: "nginx" },
-            },
-            {
-                source: "image",
-                image: "postgres:11.18",
-                container: "db",
-                workload: { kind: "StatefulSet", namespace: "prod", name: "db" },
-            },
-            {
-                source: "image",
-                image: "redis:7.0.5",
-                container: "cache",
-                workload: { kind: "Deployment", namespace: "infra", name: "redis" },
-            },
-        ]);
-        fetchHelm.mockResolvedValue([]);
-        eol.mockImplementation(async (product) => product === "postgres"
-            ? { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", lts: false }
-            : null);
-        osv.mockImplementation(async (lookup) => lookup.name === "redis"
-            ? [{ id: "CVE-2023-1", summary: "x", severity: "medium" }]
-            : []);
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps.map((a) => a.canonical)).toEqual(["postgres", "redis", "nginx"]);
-    });
-    it("uses Helm chart appVersion when available", async () => {
-        fetchWorkloads.mockResolvedValue([]);
-        fetchHelm.mockResolvedValue([
-            {
-                source: "helm",
-                chart: "postgresql",
-                chartVersion: "12.0.0",
-                appVersion: "15.2.0",
-                namespace: "data",
-                releaseName: "primary",
-            },
-        ]);
-        const result = await detectApplications({ noCache: true });
-        expect(result.apps).toHaveLength(1);
-        expect(result.apps[0].canonical).toBe("postgres");
-        expect(result.apps[0].version).toBe("15.2.0");
-        expect(result.apps[0].sources).toContain("helm");
-    });
-});
-describe("formatApplicationsMarkdown", () => {
-    it("produces sections for EOL, CVEs, healthy, and unknowns", () => {
-        const md = formatApplicationsMarkdown({
-            apps: [
-                {
-                    canonical: "postgres",
-                    display: "PostgreSQL",
-                    version: "11.18",
-                    sources: ["image"],
-                    workloads: [{ kind: "StatefulSet", namespace: "prod", name: "db" }],
-                    cves: [],
-                    eol: { product: "postgres", cycle: "11", eol: true, eolDate: "2023-11-09", latest: "11.22", lts: false },
-                    catalogMatch: true,
-                },
-                {
-                    canonical: "redis",
-                    display: "Redis",
-                    version: "7.0.5",
-                    sources: ["image"],
-                    workloads: [{ kind: "Deployment", namespace: "infra", name: "redis" }],
-                    cves: [{ id: "CVE-2023-1", summary: "boom", severity: "high", fixed: "7.0.12" }],
-                    eol: null,
-                    catalogMatch: true,
-                },
-                {
-                    canonical: "nginx",
-                    display: "nginx",
-                    version: "1.25.3",
-                    sources: ["image"],
-                    workloads: [{ kind: "Deployment", namespace: "edge", name: "nginx" }],
-                    cves: [],
-                    eol: null,
-                    catalogMatch: true,
-                },
-            ],
-            unknowns: [
-                { name: "internal-app", version: "1.2.3", workloads: [{ kind: "Deployment", namespace: "team-x", name: "foo" }] },
-            ],
-            scanned: { workloads: 4, helmReleases: 0 },
-        });
-        expect(md).toContain("## End-of-Life");
-        expect(md).toContain("PostgreSQL");
-        expect(md).toContain("## Known Vulnerabilities");
-        expect(md).toContain("CVE-2023-1");
-        expect(md).toContain("## Up-to-date");
-        expect(md).toContain("nginx");
-        expect(md).toContain("## Other / not in catalog");
-        expect(md).toContain("internal-app");
-    });
-});

package/dist/detector/osv.d.ts

@@ -1,12 +0,0 @@
-import type { OsvLookup } from "./catalog.js";
-export interface CveFinding {
-    id: string;
-    summary: string;
-    severity?: string;
-    fixed?: string;
-    reference?: string;
-}
-export declare function queryOsv(lookup: OsvLookup, version: string, opts?: {
-    noCache?: boolean;
-    timeoutMs?: number;
-}): Promise<CveFinding[]>;

package/dist/detector/osv.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/osv.test.js

@@ -1,86 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-vi.mock("./cache.js", () => ({
-    readCache: vi.fn(),
-    readStaleCache: vi.fn(),
-    writeCache: vi.fn(),
-}));
-import { readCache, readStaleCache, writeCache } from "./cache.js";
-import { queryOsv } from "./osv.js";
-const mockFetch = vi.fn();
-vi.stubGlobal("fetch", mockFetch);
-const cacheRead = vi.mocked(readCache);
-const cacheStale = vi.mocked(readStaleCache);
-const cacheWrite = vi.mocked(writeCache);
-describe("queryOsv", () => {
-    beforeEach(() => {
-        mockFetch.mockReset();
-        cacheRead.mockReset();
-        cacheStale.mockReset();
-        cacheWrite.mockReset();
-        cacheRead.mockReturnValue(null);
-        cacheStale.mockReturnValue(null);
-    });
-    it("posts the package + version to api.osv.dev and returns mapped findings", async () => {
-        mockFetch.mockResolvedValue({
-            ok: true,
-            json: async () => ({
-                vulns: [
-                    {
-                        id: "CVE-2024-1",
-                        summary: "Test vuln",
-                        database_specific: { severity: "high" },
-                        affected: [{ ranges: [{ events: [{ introduced: "0" }, { fixed: "7.0.12" }] }] }],
-                        references: [{ type: "ADVISORY", url: "https://example.com/advisory" }],
-                    },
-                ],
-            }),
-        });
-        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
-        expect(mockFetch).toHaveBeenCalledOnce();
-        expect(mockFetch.mock.calls[0][0]).toBe("https://api.osv.dev/v1/query");
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body).toEqual({ package: { name: "redis" }, version: "7.0.5" });
-        expect(findings).toHaveLength(1);
-        expect(findings[0]).toMatchObject({
-            id: "CVE-2024-1",
-            severity: "high",
-            fixed: "7.0.12",
-            reference: "https://example.com/advisory",
-        });
-        expect(cacheWrite).toHaveBeenCalledOnce();
-    });
-    it("includes ecosystem in the OSV body when provided", async () => {
-        mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) });
-        await queryOsv({ name: "postgresql", ecosystem: "Debian" }, "15.2", { noCache: true });
-        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
-        expect(body.package).toEqual({ name: "postgresql", ecosystem: "Debian" });
-    });
-    it("returns empty when version is empty", async () => {
-        const findings = await queryOsv({ name: "redis" }, "", { noCache: true });
-        expect(findings).toEqual([]);
-        expect(mockFetch).not.toHaveBeenCalled();
-    });
-    it("returns [] on network error when no stale cache is present", async () => {
-        mockFetch.mockRejectedValue(new Error("network down"));
-        const findings = await queryOsv({ name: "redis" }, "7.0.99", { noCache: true });
-        expect(findings).toEqual([]);
-    });
-    it("serves a fresh cached entry without hitting the network", async () => {
-        cacheRead.mockReturnValue([{ id: "CVE-cached", summary: "from cache" }]);
-        const findings = await queryOsv({ name: "redis" }, "7.0.5");
-        expect(mockFetch).not.toHaveBeenCalled();
-        expect(findings[0].id).toBe("CVE-cached");
-    });
-    it("falls back to stale cache on network error", async () => {
-        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "from cache" }], fetchedAt: 1 });
-        mockFetch.mockRejectedValue(new Error("offline"));
-        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
-        expect(findings[0].id).toBe("CVE-stale");
-    });
-    it("falls back to stale cache on non-2xx response", async () => {
-        cacheStale.mockReturnValue({ data: [{ id: "CVE-stale", summary: "x" }], fetchedAt: 1 });
-        mockFetch.mockResolvedValue({ ok: false, status: 500 });
-        const findings = await queryOsv({ name: "redis" }, "7.0.5", { noCache: true });
-        expect(findings[0].id).toBe("CVE-stale");
-    });
-});

package/dist/detector/report.d.ts

@@ -1,6 +0,0 @@
-import type { AuthState } from "../auth.js";
-import type { DetectionResult } from "./index.js";
-export interface ReportOptions {
-    onProgress?: (step: string) => void;
-}
-export declare function generateReport(result: DetectionResult, auth: AuthState, opts?: ReportOptions): Promise<string>;

package/dist/detector/sources.d.ts

@@ -1,55 +0,0 @@
-import { type KubectlOptions } from "../kubectl.js";
-export type WorkloadKind = "Deployment" | "StatefulSet" | "DaemonSet";
-export interface WorkloadRef {
-    kind: WorkloadKind;
-    namespace: string;
-    name: string;
-    hosts?: string[];
-}
-export declare function workloadKey(ref: {
-    kind: string;
-    namespace: string;
-    name: string;
-}): string;
-export interface ImageCandidate {
-    source: "image";
-    image: string;
-    workload: WorkloadRef;
-    container: string;
-}
-export interface LabelCandidate {
-    source: "label";
-    appName: string;
-    appVersion: string;
-    workload: WorkloadRef;
-}
-export interface HelmCandidate {
-    source: "helm";
-    chart: string;
-    chartVersion: string;
-    appVersion?: string;
-    namespace: string;
-    releaseName: string;
-}
-export type Candidate = ImageCandidate | LabelCandidate | HelmCandidate;
-export declare function fetchWorkloadCandidates(options: KubectlOptions): Promise<Candidate[]>;
-interface HelmReleasePayload {
-    name: string;
-    namespace: string;
-    chart?: {
-        metadata?: {
-            name?: string;
-            version?: string;
-            appVersion?: string;
-        };
-    };
-}
-export declare function decodeHelmRelease(b64: string): HelmReleasePayload | null;
-export declare function fetchHelmCandidates(options: KubectlOptions): Promise<HelmCandidate[]>;
-/**
- * Build a map of workload key (Kind/namespace/name) → ingress hostnames.
- * Joins Ingresses → Services → workload pod-template labels best-effort.
- * Returns an empty map on failure (ingress visibility is non-essential).
- */
-export declare function fetchIngressHostMap(options: KubectlOptions): Promise<Map<string, string[]>>;
-export {};

package/dist/detector/sources.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/detector/sources.test.js

@@ -1,36 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { gzipSync } from "node:zlib";
-import { Buffer } from "node:buffer";
-import { decodeHelmRelease } from "./sources.js";
-// Reproduce the encoding chain Helm + the k8s API actually produce.
-// Helm stores the release as `base64(gzip(json))` inside the Secret value,
-// and the k8s API base64-encodes Secret `data.*` values on the wire — so the
-// string kubectl returns is `base64(base64(gzip(json)))`. This test exists
-// to lock in the decoder's behaviour against that chain so we can't
-// regress to a single-base64 decode (which silently drops every Helm
-// release at runtime).
-function encodeAsKubectlReturnsIt(payload) {
-    const json = JSON.stringify(payload);
-    const gzipped = gzipSync(Buffer.from(json, "utf-8"));
-    const helmLayer = gzipped.toString("base64");
-    const apiLayer = Buffer.from(helmLayer, "utf-8").toString("base64");
-    return apiLayer;
-}
-describe("decodeHelmRelease", () => {
-    it("decodes a release blob in the format kubectl returns", () => {
-        const release = {
-            name: "postgres",
-            namespace: "data",
-            chart: { metadata: { name: "postgresql", version: "12.0.0", appVersion: "15.2.0" } },
-        };
-        const encoded = encodeAsKubectlReturnsIt(release);
-        expect(decodeHelmRelease(encoded)).toEqual(release);
-    });
-    it("returns null on garbage input rather than throwing", () => {
-        expect(decodeHelmRelease("not-base64-and-not-gzip")).toBeNull();
-    });
-    it("returns null on valid base64 that isn't gzip", () => {
-        const apiLayer = Buffer.from("aGVsbG8gd29ybGQ=", "utf-8").toString("base64");
-        expect(decodeHelmRelease(apiLayer)).toBeNull();
-    });
-});

package/dist/diagnoser/approval.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/diagnoser/approval.test.js

@@ -1,49 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { resolveApprovalDecision } from "./index.js";
-const SAFE = new Set(["get_logs", "get_events", "describe_resource", "ask_user_question"]);
-describe("resolveApprovalDecision", () => {
-    it("auto-executes a safe (read-only) action with no approver", async () => {
-        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, undefined);
-        expect(decision.execute).toBe(true);
-    });
-    it("DENIES a non-safe mutating action when no approver exists (non-interactive mode)", async () => {
-        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 0 }, SAFE, undefined);
-        expect(decision.execute).toBe(false);
-        if (!decision.execute) {
-            expect(decision.reason).toMatch(/no approver is available/i);
-        }
-    });
-    it("never invokes an executor implicitly — caller must gate on execute=false", async () => {
-        // Simulates the tool loop: a denied decision must not run the executor.
-        const executor = vi.fn();
-        const decision = await resolveApprovalDecision("restart_pod", { pod: "x" }, SAFE, undefined);
-        if (decision.execute)
-            executor();
-        expect(executor).not.toHaveBeenCalled();
-    });
-    it("calls onApproval for non-safe actions and executes when approved", async () => {
-        const onApproval = vi.fn().mockResolvedValue(true);
-        const decision = await resolveApprovalDecision("scale_deployment", { deployment: "web", replicas: 3 }, SAFE, onApproval);
-        expect(onApproval).toHaveBeenCalledWith("scale_deployment", { deployment: "web", replicas: 3 });
-        expect(decision.execute).toBe(true);
-    });
-    it("denies with the user-denial message when onApproval returns false", async () => {
-        const onApproval = vi.fn().mockResolvedValue(false);
-        const decision = await resolveApprovalDecision("restart_pod", {}, SAFE, onApproval);
-        expect(decision.execute).toBe(false);
-        if (!decision.execute) {
-            expect(decision.reason).toMatch(/denied by user/i);
-        }
-    });
-    it("does not call onApproval for safe actions", async () => {
-        const onApproval = vi.fn().mockResolvedValue(false);
-        const decision = await resolveApprovalDecision("get_logs", {}, SAFE, onApproval);
-        expect(onApproval).not.toHaveBeenCalled();
-        expect(decision.execute).toBe(true);
-    });
-    it("treats user-configured safe_actions as auto-executable", async () => {
-        const safe = new Set([...SAFE, "rollout_restart"]);
-        const decision = await resolveApprovalDecision("rollout_restart", {}, safe, undefined);
-        expect(decision.execute).toBe(true);
-    });
-});

package/dist/diagnoser/index.d.ts

@@ -1,33 +0,0 @@
-import type { Issue } from "../monitor/types.js";
-export type ApprovalDecision = {
-    execute: true;
-} | {
-    execute: false;
-    reason: string;
-};
-/**
- * Decide whether a tool call may execute, given the set of auto-safe actions and
- * the (optional) approval callback.
- *
- * Security-critical: a missing/undefined `onApproval` MUST mean DENY for any
- * action that is not in `safeActions`. In non-interactive mode the CLI passes no
- * (or a deny-all) approver, and destructive remediation (e.g. scale-to-0) must
- * never run unattended.
- */
-export declare function resolveApprovalDecision(toolName: string, params: Record<string, unknown>, safeActions: Set<string>, onApproval?: (action: string, params: Record<string, unknown>) => Promise<boolean>): Promise<ApprovalDecision>;
-export interface DiagnosisResult {
-    analysis: string;
-    action?: {
-        name: string;
-        safe: boolean;
-        params: Record<string, unknown>;
-    };
-    verificationContract?: string;
-}
-export declare function diagnose(issues: Issue[], kbDir: string, clusterContext?: string, options?: {
-    autoFix?: boolean;
-    safeActions?: string[];
-    noInteractive?: boolean;
-    onApproval?: (action: string, params: Record<string, unknown>) => Promise<boolean>;
-    onQuestion?: (question: string, choices: string[] | undefined) => Promise<void>;
-}): Promise<DiagnosisResult>;