prodlint 0.10.0 → 0.10.3

package/README.md

@@ -13,7 +13,7 @@ npx prodlint
 ```
 
 ```
-  prodlint v0.10.0
+  prodlint v0.10.3
   Scanned 148 files · 2 critical · 5 warnings · 1 info
 
   src/app/api/checkout/route.ts
@@ -187,7 +187,9 @@ jobs:
           threshold: 50
 ```
 
-Posts a score breakdown as a PR comment and fails the build if below threshold.
+Posts a score breakdown as a PR comment and fails the build if below threshold. Each
+release of the action runs its matching prodlint version, so pinning the action (`@v1`,
+a version tag, or a commit SHA) also pins the scanner.
 
 | Input | Default | Description |
 |-------|---------|-------------|

package/action.yml

@@ -34,9 +34,11 @@ runs:
   using: 'composite'
   steps:
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
-        node-version: '20'
+        node-version: '22'
+        # Automatic caching would key off the scanned repo's package.json; npx needs none.
+        package-manager-cache: false
 
     - name: Run prodlint
       id: scan
@@ -54,7 +56,9 @@ runs:
           done
         fi
 
-        OUTPUT=$(npx -y prodlint@latest "${CMD_ARGS[@]}" 2>&1) || true
+        # The exact release this action ships with (scripts/sync-versions.cjs bumps it), so
+        # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
+        OUTPUT=$(npx -y prodlint@0.10.3 "${CMD_ARGS[@]}" 2>&1) || true
 
         SCORE=$(echo "$OUTPUT" | node -e "
           const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
@@ -70,72 +74,22 @@ runs:
 
         echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
         echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
-        echo "$OUTPUT" > /tmp/prodlint-result.json
+        echo "$OUTPUT" > "$RUNNER_TEMP/prodlint-result.json"
 
+    # Built by a script file rather than inline `node -e`: the comment carries file paths
+    # and messages from the scanned repo, and the script's escaping is unit-tested.
     - name: Generate comment body
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
       id: comment
       shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-
-        if [ "$SCORE" -ge 80 ]; then
-          EMOJI="✅"
-          COLOR="brightgreen"
-        elif [ "$SCORE" -ge 60 ]; then
-          EMOJI="⚠️"
-          COLOR="yellow"
-        else
-          EMOJI="🚨"
-          COLOR="red"
-        fi
-
-        # Build comment from JSON with markdown sanitization
-        TMPFILE=$(mktemp "${RUNNER_TEMP:-/tmp}/prodlint-comment-XXXXXX.md")
-        node -e "
-          const fs = require('fs');
-          const d = JSON.parse(fs.readFileSync('/tmp/prodlint-result.json', 'utf8'));
-          const esc = s => String(s).replace(/[[\]()\\*_\`<>]/g, c => '\\\\' + c);
-          const lines = [];
-          lines.push('## ' + '$EMOJI' + ' Production Readiness: **' + d.overallScore + '/100**');
-          lines.push('');
-          lines.push('| Category | Score | Issues |');
-          lines.push('|----------|-------|--------|');
-          for (const c of d.categoryScores) {
-            const icon = c.score >= 80 ? '🟢' : c.score >= 60 ? '🟡' : '🔴';
-            lines.push('| ' + icon + ' ' + esc(c.category) + ' | ' + c.score + '/100 | ' + c.findingCount + ' |');
-          }
-          if (d.summary.critical > 0) {
-            lines.push('');
-            lines.push('### Critical Issues');
-            lines.push('');
-            const crits = d.findings.filter(f => f.severity === 'critical');
-            for (const f of crits.slice(0, 10)) {
-              lines.push('- \`' + esc(f.ruleId) + '\` \`' + esc(f.file) + ':' + f.line + '\` — ' + esc(f.message));
-            }
-            if (crits.length > 10) {
-              lines.push('- ...and ' + (crits.length - 10) + ' more');
-            }
-          }
-          lines.push('');
-          lines.push('---');
-          lines.push('*Scanned ' + d.filesScanned + ' files in ' + d.scanDurationMs + 'ms · [prodlint](https://prodlint.com)*');
-          fs.writeFileSync('$TMPFILE', lines.join('\n'));
-        "
-
-        # Use the generated file for the comment step
-        cp "$TMPFILE" /tmp/prodlint-comment.md
+      run: node "$GITHUB_ACTION_PATH/scripts/action-comment.cjs" "$RUNNER_TEMP/prodlint-result.json" "$RUNNER_TEMP/prodlint-comment.md"
 
     - name: Post PR comment
       if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: marocchino/sticky-pull-request-comment@v3
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
       with:
         header: prodlint
-        path: /tmp/prodlint-comment.md
+        path: ${{ runner.temp }}/prodlint-comment.md
 
     - name: Check threshold
       if: inputs.threshold != '0'

package/dist/cli.js

@@ -2487,15 +2487,16 @@ var deadExportsRule = {
 };
 
 // src/rules/shallow-catch.ts
-function scoreCatchBody(bodyLines) {
-  if (bodyLines.length === 0 || bodyLines.every((l) => l.trim() === "")) {
-    return { score: 0, label: "empty catch" };
-  }
-  const body = bodyLines.join("\n");
+function reportsError(value, param) {
+  if (/error/i.test(value) || /\berr|Err|status|Response|json/.test(value)) return true;
+  return param !== void 0 && new RegExp(`(?<![\\w$])${param.replace(/\$/g, "\\$")}(?![\\w$])`).test(value);
+}
+function scoreCatchBody({ text: body, empty, returned, param }) {
+  if (empty) return { score: 0, label: "empty catch" };
   let score = 0;
   if (/console\.(log|warn|error|info)\s*\(/.test(body)) score = 1;
   if ((/console\.(error|warn)\s*\(/.test(body) || /\b(logger|log)\.(error|warn)\s*\(/.test(body)) && /\b(err|error|e)\b/.test(body)) score = 2;
-  if (/\bthrow\b/.test(body) || /\breturn\b.*(?:error|err|status|Response|NextResponse|json)/.test(body) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
+  if (/\bthrow\b/.test(body) || returned.some((value) => reportsError(value, param)) || /\bset\w*Error\s*\(/.test(body) || /\bres\.\w+\s*\(/.test(body) || // Toast notifications (react-toastify, sonner, shadcn)
   /\btoast\.(error|warn|warning)\s*\(/.test(body) || /\btoast\s*\(\s*\{/.test(body) || // Error monitoring (Sentry, etc.)
   /\b(Sentry\.)?captureException\s*\(/.test(body) || /\b(Sentry\.)?captureMessage\s*\(/.test(body) || // Structured loggers
   /\b(logger|log)\.(error|fatal)\s*\(/.test(body) || // Error handler utilities
@@ -2505,13 +2506,56 @@ function scoreCatchBody(bodyLines) {
     score = 3;
   }
   const labels = {
-    0: "empty catch",
+    0: "catch swallows the error",
     1: "catch only logs (no recovery or propagation)",
     2: "catch logs error but does not propagate or recover",
     3: "catch handles error properly"
   };
   return { score, label: labels[score] };
 }
+function catchFinding(file, catchLine, body) {
+  const { score, label } = scoreCatchBody(body);
+  if (score > 1) return null;
+  return {
+    ruleId: "shallow-catch",
+    file: file.relativePath,
+    line: catchLine + 1,
+    column: file.lines[catchLine].indexOf("catch") + 1,
+    message: body.empty ? "Empty catch block \u2014 errors are silently swallowed" : score === 0 ? "Catch block swallows the error \u2014 it isn't logged, rethrown or returned" : `Decorative error handler: ${label}`,
+    severity: score === 0 ? "warning" : "info",
+    category: "reliability",
+    fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
+  };
+}
+var NON_CODE = /\/\/.*|\/\*[\s\S]*?\*\/|'(?:[^'\\\n]|\\[\s\S])*'|"(?:[^"\\\n]|\\[\s\S])*"|`(?:[^`\\]|\\[\s\S])*`/g;
+function blankOut(source, strings) {
+  const blank = (s) => s.replace(/[^\n]/g, " ");
+  return source.replace(NON_CODE, (m) => m[0] === "/" ? blank(m) : strings ? m[0] + blank(m.slice(1, -1)) + m[0] : m);
+}
+function closingBrace(code, open) {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === "{") depth++;
+    else if (code[i] === "}" && --depth === 0) return i;
+  }
+  return -1;
+}
+function returnedValues(code, text) {
+  const values = [];
+  for (const m of code.matchAll(/(?<![\w$.])return\b/g)) {
+    const start = m.index + "return".length;
+    let end = start;
+    for (let depth = 0; end < code.length; end++) {
+      const ch = code[end];
+      if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if (ch === ")" || ch === "]" || ch === "}") {
+        if (depth-- === 0) break;
+      } else if (depth === 0 && (ch === ";" || ch === "\n")) break;
+    }
+    values.push(text.slice(start, end));
+  }
+  return values;
+}
 var shallowCatchRule = {
   id: "shallow-catch",
   name: "Shallow Error Handler",
@@ -2528,95 +2572,45 @@ var shallowCatchRule = {
         walkAST(file.ast.program, (node) => {
           if (node.type !== "CatchClause") return;
           if (!node.loc) return;
-          const catchLine = node.loc.start.line - 1;
+          const catchLine2 = node.loc.start.line - 1;
           const body = node.body;
-          if (!body || !body.loc) return;
-          const bodyStart = body.loc.start.line - 1;
-          const bodyEnd = body.loc.end.line - 1;
-          const bodyLines = bodyStart === bodyEnd ? [file.lines[bodyStart]] : file.lines.slice(bodyStart + 1, bodyEnd);
-          const { score, label } = scoreCatchBody(bodyLines);
-          if (score <= 1) {
-            findings.push({
-              ruleId: "shallow-catch",
-              file: file.relativePath,
-              line: catchLine + 1,
-              column: file.lines[catchLine].indexOf("catch") + 1,
-              message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-              severity: score === 0 ? "warning" : "info",
-              category: "reliability",
-              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-            });
-          }
+          if (body?.start == null || body.end == null) return;
+          const returned = [];
+          walkAST(body, (n) => {
+            if (n.type === "ReturnStatement" && n.argument?.start != null && n.argument.end != null) {
+              returned.push(file.content.slice(n.argument.start, n.argument.end));
+            }
+          });
+          const finding = catchFinding(file, catchLine2, {
+            text: file.content.slice(body.start + 1, body.end - 1),
+            empty: body.body.length === 0,
+            returned,
+            param: node.param?.type === "Identifier" ? node.param.name : void 0
+          });
+          if (finding) findings.push(finding);
         });
         return findings;
       } catch {
       }
     }
-    for (let i = 0; i < file.lines.length; i++) {
-      if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      const trimmed = file.lines[i].trim();
-      if (!/\bcatch\s*\(/.test(trimmed) && !/\bcatch\s*\{/.test(trimmed)) continue;
-      let braceStart = -1;
-      for (let j = i; j < Math.min(i + 3, file.lines.length); j++) {
-        if (file.lines[j].includes("{")) {
-          braceStart = j;
-          break;
-        }
-      }
-      if (braceStart === -1) continue;
-      let depth = 0;
-      let bodyEnd = braceStart;
-      let inSingle = false;
-      let inDouble = false;
-      let inTemplate = false;
-      for (let j = braceStart; j < file.lines.length; j++) {
-        const line = file.lines[j];
-        const startPos = j === braceStart ? line.indexOf("{") : 0;
-        for (let k = startPos; k < line.length; k++) {
-          const ch = line[k];
-          const prev = k > 0 ? line[k - 1] : "";
-          const escaped = prev === "\\" && (k < 2 || line[k - 2] !== "\\");
-          if (!escaped) {
-            if (ch === "'" && !inDouble && !inTemplate) {
-              inSingle = !inSingle;
-              continue;
-            }
-            if (ch === '"' && !inSingle && !inTemplate) {
-              inDouble = !inDouble;
-              continue;
-            }
-            if (ch === "`" && !inSingle && !inDouble) {
-              inTemplate = !inTemplate;
-              continue;
-            }
-          }
-          if (inSingle || inDouble || inTemplate) continue;
-          if (ch === "{") depth++;
-          if (ch === "}") {
-            depth--;
-            if (depth === 0) {
-              bodyEnd = j;
-              break;
-            }
-          }
-        }
-        if (depth === 0) break;
-      }
-      const bodyLines = file.lines.slice(braceStart + 1, bodyEnd);
-      const { score, label } = scoreCatchBody(bodyLines);
-      if (score <= 1) {
-        findings.push({
-          ruleId: "shallow-catch",
-          file: file.relativePath,
-          line: i + 1,
-          column: file.lines[i].indexOf("catch") + 1,
-          message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
-          severity: score === 0 ? "warning" : "info",
-          category: "reliability",
-          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
-        });
-      }
-      i = bodyEnd;
+    const source = file.lines.join("\n");
+    const code = blankOut(source, true);
+    const noComments = blankOut(source, false);
+    const catchRe = /(?<![\w$.])catch\s*(?:\(([^)]*)\)\s*)?\{/g;
+    let catchLine = 0;
+    let scanned = 0;
+    for (let m = catchRe.exec(code); m; m = catchRe.exec(code)) {
+      for (; scanned < m.index; scanned++) if (code[scanned] === "\n") catchLine++;
+      const open = m.index + m[0].length - 1;
+      const close = closingBrace(code, open);
+      if (close === -1) continue;
+      const finding = catchFinding(file, catchLine, {
+        text: source.slice(open + 1, close),
+        empty: code.slice(open + 1, close).trim() === "",
+        returned: returnedValues(code.slice(open + 1, close), noComments.slice(open + 1, close)),
+        param: m[1]?.match(/^\s*([A-Za-z_$][\w$]*)/)?.[1]
+      });
+      if (finding) findings.push(finding);
     }
     return findings;
   }
@@ -4781,6 +4775,14 @@ function reportWebPretty(result) {
   return lines.join("\n");
 }
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4920,72 +4922,157 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
+}
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
 function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
 }
-function validateRedirectUrl(responseUrl) {
+async function resolvesToPrivateAddress(hostname) {
   try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
+    const addresses = await dnsLookupAll(hostname.replace(/^\[|\]$/g, ""), { all: true });
+    return addresses.some((a) => isPrivateAddress(a.address));
   } catch {
     return false;
   }
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve4(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve4) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve4(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 function normalizeUrl(input) {
   let url = input.trim();
@@ -4997,7 +5084,7 @@ function normalizeUrl(input) {
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -5005,10 +5092,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);
@@ -5151,7 +5237,7 @@ async function runWebScan2(url, opts) {
     process.exit(2);
   }
   const hostname = new URL(normalizedUrl).hostname;
-  if (isPrivateHost(hostname)) {
+  if (isPrivateHost(hostname) || await resolvesToPrivateAddress(hostname)) {
     console.error("Cannot scan private/internal hosts.");
     process.exit(2);
   }