prodlint 0.10.0 → 0.10.2

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.10.0
+  prodlint v0.10.2
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
@@ -187,7 +187,9 @@ jobs:
           threshold: 50
 ```
 
-Posts a score breakdown as a PR comment and fails the build if below threshold.
+Posts a score breakdown as a PR comment and fails the build if below threshold. Each
+release of the action runs its matching prodlint version, so pinning the action (`@v1`,
+a version tag, or a commit SHA) also pins the scanner.
 
 | Input | Default | Description |
 |-------|---------|-------------|

package/action.yml

@@ -34,9 +34,11 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: '20'
+        node-version: '22'
+        # Automatic caching would key off the scanned repo's package.json; npx needs none.
+        package-manager-cache: false
 
     - name: Run prodlint
       id: scan
@@ -54,7 +56,9 @@ runs:
           done
         fi
 
-        OUTPUT=$(npx -y prodlint@latest "${CMD_ARGS[@]}" 2>&1) || true
+        # The exact release this action ships with (scripts/sync-versions.cjs bumps it), so
+        # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
+        OUTPUT=$(npx -y prodlint@0.10.2 "${CMD_ARGS[@]}" 2>&1) || true
 
         SCORE=$(echo "$OUTPUT" | node -e "
           const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
@@ -70,72 +74,22 @@ runs:
 
         echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
         echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
-        echo "$OUTPUT" > /tmp/prodlint-result.json
+        echo "$OUTPUT" > "$RUNNER_TEMP/prodlint-result.json"
 
+    # Built by a script file rather than inline `node -e`: the comment carries file paths
+    # and messages from the scanned repo, and the script's escaping is unit-tested.
     - name: Generate comment body
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
       id: comment
       shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-
-        if [ "$SCORE" -ge 80 ]; then
-          EMOJI="✅"
-          COLOR="brightgreen"
-        elif [ "$SCORE" -ge 60 ]; then
-          EMOJI="⚠️"
-          COLOR="yellow"
-        else
-          EMOJI="🚨"
-          COLOR="red"
-        fi
-
-        # Build comment from JSON with markdown sanitization
-        TMPFILE=$(mktemp "${RUNNER_TEMP:-/tmp}/prodlint-comment-XXXXXX.md")
-        node -e "
-          const fs = require('fs');
-          const d = JSON.parse(fs.readFileSync('/tmp/prodlint-result.json', 'utf8'));
-          const esc = s => String(s).replace(/[[\]()\\*_\`<>]/g, c => '\\\\' + c);
-          const lines = [];
-          lines.push('## ' + '$EMOJI' + ' Production Readiness: **' + d.overallScore + '/100**');
-          lines.push('');
-          lines.push('| Category | Score | Issues |');
-          lines.push('|----------|-------|--------|');
-          for (const c of d.categoryScores) {
-            const icon = c.score >= 80 ? '🟢' : c.score >= 60 ? '🟡' : '🔴';
-            lines.push('| ' + icon + ' ' + esc(c.category) + ' | ' + c.score + '/100 | ' + c.findingCount + ' |');
-          }
-          if (d.summary.critical > 0) {
-            lines.push('');
-            lines.push('### Critical Issues');
-            lines.push('');
-            const crits = d.findings.filter(f => f.severity === 'critical');
-            for (const f of crits.slice(0, 10)) {
-              lines.push('- \`' + esc(f.ruleId) + '\` \`' + esc(f.file) + ':' + f.line + '\` — ' + esc(f.message));
-            }
-            if (crits.length > 10) {
-              lines.push('- ...and ' + (crits.length - 10) + ' more');
-            }
-          }
-          lines.push('');
-          lines.push('---');
-          lines.push('*Scanned ' + d.filesScanned + ' files in ' + d.scanDurationMs + 'ms · [prodlint](https://prodlint.com)*');
-          fs.writeFileSync('$TMPFILE', lines.join('\n'));
-        "
-
-        # Use the generated file for the comment step
-        cp "$TMPFILE" /tmp/prodlint-comment.md
+      run: node "$GITHUB_ACTION_PATH/scripts/action-comment.cjs" "$RUNNER_TEMP/prodlint-result.json" "$RUNNER_TEMP/prodlint-comment.md"
 
     - name: Post PR comment
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: marocchino/sticky-pull-request-comment@v3
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
       with:
         header: prodlint
-        path: /tmp/prodlint-comment.md
+        path: ${{ runner.temp }}/prodlint-comment.md
 
     - name: Check threshold
       if: inputs.threshold != '0'

package/dist/cli.js

@@ -4781,6 +4781,14 @@ function reportWebPretty(result) {
   return lines.join("\n");
 }
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4920,72 +4928,157 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
+}
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
 function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
 }
-function validateRedirectUrl(responseUrl) {
+async function resolvesToPrivateAddress(hostname) {
   try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
+    const addresses = await dnsLookupAll(hostname.replace(/^\[|\]$/g, ""), { all: true });
+    return addresses.some((a) => isPrivateAddress(a.address));
   } catch {
     return false;
   }
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve4(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve4) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve4(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 function normalizeUrl(input) {
   let url = input.trim();
@@ -4997,7 +5090,7 @@ function normalizeUrl(input) {
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -5005,10 +5098,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);
@@ -5151,7 +5243,7 @@ async function runWebScan2(url, opts) {
     process.exit(2);
   }
   const hostname = new URL(normalizedUrl).hostname;
-  if (isPrivateHost(hostname)) {
+  if (isPrivateHost(hostname) || await resolvesToPrivateAddress(hostname)) {
     console.error("Cannot scan private/internal hosts.");
     process.exit(2);
   }

package/dist/index.js

@@ -4740,6 +4740,14 @@ var STATUS_ICONS = {
   info: pc.blue
 };
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4879,76 +4887,153 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
-function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
 }
-function validateRedirectUrl(responseUrl) {
-  try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
-  } catch {
-    return false;
-  }
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
+function isPrivateHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
+}
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve4(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve4) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve4(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -4956,10 +5041,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);

package/dist/mcp.js

@@ -4556,6 +4556,14 @@ async function scan(options) {
   };
 }
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4695,72 +4703,157 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
+}
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
 function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
 }
-function validateRedirectUrl(responseUrl) {
+async function resolvesToPrivateAddress(hostname) {
   try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
+    const addresses = await dnsLookupAll(hostname.replace(/^\[|\]$/g, ""), { all: true });
+    return addresses.some((a) => isPrivateAddress(a.address));
   } catch {
     return false;
   }
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve5, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve5(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve5) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve5(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 function normalizeUrl(input) {
   let url = input.trim();
@@ -4772,7 +4865,7 @@ function normalizeUrl(input) {
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -4780,10 +4873,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);
@@ -4885,7 +4977,7 @@ server.tool(
       };
     }
     const hostname = new URL(normalizedUrl).hostname;
-    if (isPrivateHost(hostname)) {
+    if (isPrivateHost(hostname) || await resolvesToPrivateAddress(hostname)) {
       return {
         content: [{ type: "text", text: "Error: Cannot scan private or internal hosts." }],
         isError: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prodlint",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Production readiness for vibe-coded apps — know your AI code is ready to ship",
   "license": "MIT",
   "author": "prodlint contributors",
@@ -58,7 +58,7 @@
     "@types/node": "^26.1.2",
     "tsup": "^8.4.0",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.7"
+    "vitest": "^5.0.5"
   },
   "overrides": {
     "esbuild": "^0.28.1"