prodlint 0.8.1 → 0.9.1

package/dist/mcp.js

@@ -5,7 +5,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { stat as stat2 } from "fs/promises";
-import { resolve as resolve4 } from "path";
+import { resolve as resolve4, sep as sep2 } from "path";
 
 // src/utils/file-walker.ts
 import fg from "fast-glob";
@@ -719,8 +719,8 @@ function summarizeFindings(findings) {
 
 // src/rules/secrets.ts
 var SECRET_PATTERNS = [
-  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{20,}/ },
-  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{20,}/ },
+  { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{8,}/ },
+  { name: "Stripe test key", pattern: /sk_test_[a-zA-Z0-9]{8,}/ },
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/ },
   { name: "AWS secret key", pattern: /(?:aws_secret_access_key|AWS_SECRET)\s*[=:]\s*['"]?[A-Za-z0-9/+=]{40}['"]?/ },
   { name: "Supabase service role key", pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}\.[A-Za-z0-9_-]{20,}/ },
@@ -753,7 +753,8 @@ var secretsRule = {
             column: match.index + 1,
             message: `Hardcoded ${name} detected`,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Move the secret to an environment variable and access via process.env.SECRET_NAME"
           });
         }
       }
@@ -837,7 +838,8 @@ var hallucinatedImportsRule = {
             column: 1,
             message: `Package "${pkgName}" is imported but not in package.json`,
             severity: isNonProd ? "warning" : "critical",
-            category: "reliability"
+            category: "reliability",
+            fix: "Verify the package exists on npm. The AI may have invented this package name."
           });
         }
         return findings;
@@ -865,7 +867,8 @@ var hallucinatedImportsRule = {
           column: match.index + 1,
           message: `Package "${pkgName}" is imported but not in package.json`,
           severity: isNonProd ? "warning" : "critical",
-          category: "reliability"
+          category: "reliability",
+          fix: "Verify the package exists on npm. The AI may have invented this package name."
         });
       }
     }
@@ -948,7 +951,8 @@ var authChecksRule = {
       column: 1,
       message,
       severity,
-      category: "security"
+      category: "security",
+      fix: "Add authentication check: const session = await auth(); if (!session) return new Response('Unauthorized', { status: 401 })"
     }];
   }
 };
@@ -987,7 +991,8 @@ var envExposureRule = {
           column: 1,
           message: ".env is not listed in .gitignore \u2014 secrets may be committed",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Add .env to .gitignore to prevent committing secrets"
         });
       }
       return findings;
@@ -1009,7 +1014,8 @@ var envExposureRule = {
           column: match.index + 1,
           message: isSensitive ? `Sensitive server env var "${envName}" used in client component` : `Server env var "${envName}" used in client component (will be undefined at runtime)`,
           severity: isSensitive ? "critical" : "warning",
-          category: "security"
+          category: "security",
+          fix: "Move to server-only file or use NEXT_PUBLIC_ prefix only for non-sensitive values"
         });
       }
     }
@@ -1047,7 +1053,8 @@ var errorHandlingRule = {
       column: 1,
       message: "API route handler has no try/catch block",
       severity: "warning",
-      category: "reliability"
+      category: "reliability",
+      fix: "Wrap the handler body in try/catch and return appropriate error responses"
     }];
   }
 };
@@ -1105,7 +1112,8 @@ var inputValidationRule = {
       column: 1,
       message: "Request body accessed without validation (consider using Zod, Yup, or similar)",
       severity: "warning",
-      category: "security"
+      category: "security",
+      fix: "Validate input with Zod or a similar schema library before using it"
     }];
   }
 };
@@ -1162,12 +1170,22 @@ var rateLimitingRule = {
       column: 1,
       message: "No rate limiting \u2014 anyone could spam this endpoint and run up your API costs",
       severity: "info",
-      category: "security"
+      category: "security",
+      fix: "Add rate limiting: import { Ratelimit } from '@upstash/ratelimit' or use express-rate-limit"
     }];
   }
 };
 
 // src/rules/cors-config.ts
+function hasCredentialsNearby(lines, startLine, commentMap) {
+  const end = Math.min(lines.length, startLine + 8);
+  for (let j = startLine; j < end; j++) {
+    if (commentMap[j]) continue;
+    if (/credentials\s*:\s*true/.test(lines[j])) return true;
+    if (/Access-Control-Allow-Credentials['"]\s*[,:]\s*['"]true['"]/.test(lines[j])) return true;
+  }
+  return false;
+}
 var corsConfigRule = {
   id: "cors-config",
   name: "Permissive CORS",
@@ -1181,14 +1199,16 @@ var corsConfigRule = {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
       const line = file.lines[i];
       if (/['"]Access-Control-Allow-Origin['"]\s*[,:]\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("Access-Control") + 1,
-          message: 'Access-Control-Allow-Origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'Access-Control-Allow-Origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/cors\(\s*\)/.test(line)) {
@@ -1199,18 +1219,21 @@ var corsConfigRule = {
           column: line.indexOf("cors(") + 1,
           message: "cors() called without config allows all origins",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Pass explicit options: cors({ origin: 'https://yourdomain.com' })"
         });
       }
       if (/origin\s*:\s*['"]\*['"]/.test(line)) {
+        const withCreds = hasCredentialsNearby(file.lines, i, file.commentMap);
         findings.push({
           ruleId: "cors-config",
           file: file.relativePath,
           line: i + 1,
           column: line.indexOf("origin") + 1,
-          message: 'CORS origin set to "*" allows any domain',
-          severity: "warning",
-          category: "security"
+          message: withCreds ? "CORS wildcard with credentials allows any site to make authenticated requests" : 'CORS origin set to "*" allows any domain',
+          severity: withCreds ? "critical" : "warning",
+          category: "security",
+          fix: withCreds ? "Never use credentials with wildcard origin. Set origin to specific trusted domains." : "Restrict origin to specific domains: origin: ['https://yourdomain.com']"
         });
       }
       if (/origin\s*:\s*true/.test(line)) {
@@ -1221,7 +1244,8 @@ var corsConfigRule = {
           column: line.indexOf("origin") + 1,
           message: "CORS origin set to true mirrors any requesting origin",
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Set origin to specific domains instead of reflecting the request origin"
         });
       }
     }
@@ -1230,7 +1254,7 @@ var corsConfigRule = {
 };
 
 // src/rules/ai-smells.ts
-var CONSOLE_LOG_THRESHOLD = 5;
+var CONSOLE_LOG_THRESHOLD = 3;
 var ANY_TYPE_THRESHOLD = 5;
 var COMMENTED_CODE_THRESHOLD = 3;
 var aiSmellsRule = {
@@ -1264,7 +1288,8 @@ var aiSmellsRule = {
             column: line.indexOf(todoMatch[1]) + 1,
             message: `${todoMatch[1]} comment: ${todoMatch[2].trim() || "(no description)"}`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Resolve the TODO/FIXME before shipping to production"
           });
         }
         const commentContent = trimmed.slice(2).trim();
@@ -1279,7 +1304,8 @@ var aiSmellsRule = {
               column: 1,
               message: `${COMMENTED_CODE_THRESHOLD}+ consecutive lines of commented-out code`,
               severity: "info",
-              category: "ai-quality"
+              category: "ai-quality",
+              fix: "Remove commented-out code \u2014 use version control to recover old code if needed"
             });
           }
         } else {
@@ -1296,7 +1322,8 @@ var aiSmellsRule = {
           column: 1,
           message: 'Placeholder "not implemented" function',
           severity: "warning",
-          category: "ai-quality"
+          category: "ai-quality",
+          fix: "Replace with a production-ready implementation or remove the function"
         });
       }
       if (/console\.log\s*\(/.test(line)) {
@@ -1314,7 +1341,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${consoleLogCount} console.log statements (consider a proper logger)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Replace console.log with a structured logger (e.g., pino, winston) or remove debug logs"
       });
     }
     if (anyTypeCount > ANY_TYPE_THRESHOLD) {
@@ -1325,7 +1353,8 @@ var aiSmellsRule = {
         column: 1,
         message: `${anyTypeCount} uses of "any" type (consider proper typing)`,
         severity: "warning",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: 'Replace "any" with specific types or use "unknown" with type narrowing'
       });
     }
     return findings;
@@ -1367,7 +1396,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1393,7 +1423,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf("dangerouslySetInnerHTML") + 1,
                 message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1408,7 +1439,8 @@ var unsafeHtmlRule = {
                 column: file.lines[line - 1].indexOf(".innerHTML") + 1,
                 message: "Direct innerHTML assignment is an XSS risk",
                 severity: "critical",
-                category: "security"
+                category: "security",
+                fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
               });
             }
           }
@@ -1436,7 +1468,8 @@ var unsafeHtmlRule = {
           column: line.indexOf("dangerouslySetInnerHTML") + 1,
           message: "dangerouslySetInnerHTML is an XSS risk \u2014 sanitize with DOMPurify or similar",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
       if (/\w\.innerHTML\s*=/.test(line)) {
@@ -1447,7 +1480,8 @@ var unsafeHtmlRule = {
           column: line.indexOf(".innerHTML") + 1,
           message: "Direct innerHTML assignment is an XSS risk",
           severity: "critical",
-          category: "security"
+          category: "security",
+          fix: "Sanitize HTML with DOMPurify before rendering: DOMPurify.sanitize(html)"
         });
       }
     }
@@ -1509,7 +1543,8 @@ var sqlInjectionRule = {
             column: 1,
             message,
             severity,
-            category: "security"
+            category: "security",
+            fix: "Use parameterized queries: db.query('SELECT * FROM users WHERE id = $1', [id])"
           });
           break;
         }
@@ -1557,7 +1592,8 @@ var placeholderContentRule = {
             column: match.index + 1,
             message: label,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace placeholder content with real production values before deploying"
           });
           break;
         }
@@ -1603,7 +1639,8 @@ var staleFallbackRule = {
             column: match.index + 1,
             message: `${label} \u2014 use environment variable instead`,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Replace hardcoded URL with an environment variable: process.env.DATABASE_URL or similar"
           });
           break;
         }
@@ -1649,7 +1686,8 @@ var hallucinatedApiRule = {
             column: match.index + 1,
             message: fix,
             severity: "warning",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix
           });
         }
       }
@@ -1731,7 +1769,8 @@ var openRedirectRule = {
               column: col,
               message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
             return;
           }
@@ -1743,7 +1782,8 @@ var openRedirectRule = {
               column: col,
               message: "Possible user input in redirect \u2014 verify the URL is validated before use",
               severity: "warning",
-              category: "security"
+              category: "security",
+              fix: "Validate the redirect URL against an allowlist of trusted domains"
             });
           }
         });
@@ -1764,7 +1804,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "User input in redirect \u2014 validate against an allowlist to prevent open redirect",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1780,7 +1821,8 @@ var openRedirectRule = {
             column: match.index + 1,
             message: "Possible user input in redirect \u2014 verify the URL is validated before use",
             severity: "warning",
-            category: "security"
+            category: "security",
+            fix: "Validate the redirect URL against an allowlist of trusted domains"
           });
           break;
         }
@@ -1818,7 +1860,8 @@ var noSyncFsRule = {
           column: match.index + 1,
           message: `Synchronous ${fnName}() blocks the event loop \u2014 use async alternative`,
           severity,
-          category: "performance"
+          category: "performance",
+          fix: `Use the async version: fs.promises.${fnName.replace("Sync", "")}() instead of ${fnName}()`
         });
       }
     }
@@ -1876,7 +1919,8 @@ var noNPlusOneRule = {
             column: match.index + 1,
             message: "Database/fetch call inside loop \u2014 potential N+1 query, consider batching",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Use eager loading (include/join) or batch the queries outside the loop"
           });
           break;
         }
@@ -1912,7 +1956,8 @@ var noDynamicImportLoopRule = {
             column: match.index + 1,
             message: "Dynamic import() inside loop \u2014 move import outside or use Promise.all",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Move the dynamic import outside the loop and call it once"
           });
         }
       }
@@ -1944,7 +1989,8 @@ var noUnboundedQueryRule = {
           column: line.indexOf(".findMany") + 1,
           message: ".findMany() without take/limit \u2014 query may return unbounded results",
           severity: "warning",
-          category: "performance"
+          category: "performance",
+          fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
         });
         continue;
       }
@@ -1958,7 +2004,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".findMany") + 1,
             message: ".findMany() without take \u2014 add pagination or limit",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
         continue;
@@ -1974,7 +2021,8 @@ var noUnboundedQueryRule = {
             column: line.indexOf(".select") + 1,
             message: ".select('*') without .limit() or filter \u2014 add pagination or a where clause",
             severity: "warning",
-            category: "performance"
+            category: "performance",
+            fix: "Add a LIMIT clause or use pagination to prevent unbounded result sets"
           });
         }
       }
@@ -2053,7 +2101,8 @@ var unhandledPromiseRule = {
         column: col ? col.index + 1 : 1,
         message: "Async call without await, return, or assignment \u2014 promise result is lost",
         severity: "warning",
-        category: "reliability"
+        category: "reliability",
+        fix: "Add .catch() handler or use try/catch with await"
       });
     }
     return findings;
@@ -2085,7 +2134,8 @@ var missingLoadingStateRule = {
           column: 1,
           message: "useEffect with fetch but no loading/pending state \u2014 users see empty content during load",
           severity: "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Add a loading state: const [loading, setLoading] = useState(true) and show a spinner/skeleton while loading"
         }];
       }
     }
@@ -2116,7 +2166,8 @@ var missingErrorBoundaryRule = {
       column: 1,
       message: `Layout without error.tsx \u2014 errors in ${dir} will bubble up to parent error boundary`,
       severity: "info",
-      category: "reliability"
+      category: "reliability",
+      fix: "Add an error.tsx file in the same route segment to catch rendering errors"
     }];
   }
 };
@@ -2254,7 +2305,8 @@ var codebaseConsistencyRule = {
         column: 1,
         message: `${dim.label}: ${consistency}% consistent \u2014 dominant: ${dominant} (${dominantCount} files), minority: ${minorities.join(", ")}`,
         severity: consistency < 60 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Standardize on one pattern across the codebase for consistency"
       });
     }
     return findings;
@@ -2383,7 +2435,8 @@ var deadExportsRule = {
         column: 1,
         message: `${totalDead} exported symbols never imported \u2014 dead exports pollute AI context. Top files: ${topFiles.join(", ")}`,
         severity: totalDead > 20 ? "warning" : "info",
-        category: "ai-quality"
+        category: "ai-quality",
+        fix: "Remove the unused export or add a consumer"
       });
     }
     return findings;
@@ -2447,7 +2500,8 @@ var shallowCatchRule = {
               column: file.lines[catchLine].indexOf("catch") + 1,
               message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
               severity: score === 0 ? "warning" : "info",
-              category: "reliability"
+              category: "reliability",
+              fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
             });
           }
         });
@@ -2515,7 +2569,8 @@ var shallowCatchRule = {
           column: file.lines[i].indexOf("catch") + 1,
           message: score === 0 ? "Empty catch block \u2014 errors are silently swallowed" : `Decorative error handler: ${label}`,
           severity: score === 0 ? "warning" : "info",
-          category: "reliability"
+          category: "reliability",
+          fix: "Log the error with context and either re-throw, return an error response, or recover gracefully"
         });
       }
       i = bodyEnd;
@@ -2567,7 +2622,8 @@ var comprehensionDebtRule = {
             column: 1,
             message: `${fnName}() has ${params} parameters (max ${MAX_PARAMS}) \u2014 hard to call correctly`,
             severity: "info",
-            category: "ai-quality"
+            category: "ai-quality",
+            fix: "Group related parameters into an options object"
           });
         }
       }
@@ -2594,7 +2650,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() is ${length} lines long (max ${MAX_FUNCTION_LENGTH}) \u2014 consider splitting`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Break this into smaller, focused functions with clear names"
               });
             }
             if (maxDepthInFn > MAX_NESTING_DEPTH) {
@@ -2605,7 +2662,8 @@ var comprehensionDebtRule = {
                 column: 1,
                 message: `${fnName}() has nesting depth ${maxDepthInFn} (max ${MAX_NESTING_DEPTH}) \u2014 flatten with early returns`,
                 severity: "info",
-                category: "ai-quality"
+                category: "ai-quality",
+                fix: "Reduce nesting with early returns, guard clauses, or extracted helper functions"
               });
             }
             inFunction = false;
@@ -2712,7 +2770,8 @@ var phantomDependencyRule = {
           column: 1,
           message: `"${name}" is a commonly hallucinated package name \u2014 verify it exists and is the correct package`,
           severity: "warning",
-          category: "security"
+          category: "security",
+          fix: "Add the missing package to dependencies in package.json, or remove the import if the package is hallucinated"
         });
       }
       for (const pattern of SUSPICIOUS_PATTERNS) {
@@ -2724,7 +2783,8 @@ var phantomDependencyRule = {
             column: 1,
             message: `"${name}" has a suspicious package name pattern \u2014 verify it's legitimate`,
             severity: "info",
-            category: "security"
+            category: "security",
+            fix: "Verify the package on npm \u2014 suspicious names may indicate typosquatting or hallucination"
           });
           break;
         }
@@ -3234,6 +3294,7 @@ var useClientOveruseRule = {
 // src/rules/env-fallback-secret.ts
 var SENSITIVE_ENV = /process\.env\.(JWT_SECRET|SECRET_KEY|AUTH_SECRET|SESSION_SECRET|ENCRYPTION_KEY|API_SECRET|PRIVATE_KEY|SIGNING_KEY|NEXTAUTH_SECRET|TOKEN_SECRET|APP_SECRET|COOKIE_SECRET|HASH_SECRET)\s*(?:\|\||&&|\?\?)\s*['"`]/i;
 var ENV_FALLBACK = /process\.env\.\w*(SECRET|KEY|PASSWORD|TOKEN)\w*\s*(?:\|\||\?\?)\s*['"`]/i;
+var CONN_STRING_FALLBACK = /process\.env\.\w+\s*(?:\|\||\?\?)\s*['"`](?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\//i;
 var envFallbackSecretRule = {
   id: "env-fallback-secret",
   name: "Secret with Fallback Value",
@@ -3261,6 +3322,20 @@ var envFallbackSecretRule = {
         });
         continue;
       }
+      const connMatch = CONN_STRING_FALLBACK.exec(line);
+      if (connMatch) {
+        findings.push({
+          ruleId: "env-fallback-secret",
+          file: file.relativePath,
+          line: i + 1,
+          column: connMatch.index + 1,
+          message: "Connection string with credentials used as fallback \u2014 hardcoded DB/service URL becomes the production connection when env var is missing",
+          severity: "warning",
+          category: "security",
+          fix: "Fail fast when required env vars are missing instead of falling back to a default value"
+        });
+        continue;
+      }
       const genericMatch = ENV_FALLBACK.exec(line);
       if (genericMatch && !isConfigFile(file.relativePath)) {
         findings.push({
@@ -3477,7 +3552,8 @@ var evalInjectionRule = {
             column: match.index + 1,
             message: msg,
             severity: "critical",
-            category: "security"
+            category: "security",
+            fix: "Replace eval/Function constructor with a safe alternative like JSON.parse() or a sandboxed interpreter"
           });
           break;
         }
@@ -4274,44 +4350,57 @@ var clientSideAuthOnlyRule = {
 };
 
 // src/rules/missing-abort-controller.ts
-var FETCH_CALL = /\bfetch\s*\(/;
+var HTTP_CALL = /\b(fetch|axios)\s*[.(]/;
 var HAS_TIMEOUT = [
   /AbortController/,
   /abort/i,
   /signal\s*:/,
-  /timeout/i,
-  /setTimeout.*abort/s
+  /timeout\s*:/,
+  /timeout\s*=/,
+  /setTimeout.*abort/s,
+  /axios\.create\s*\([^)]*timeout/s
 ];
+var BACKGROUND_PATTERN = /\b(setInterval|cron|schedule|createWorker|bullmq|agenda|queue\.process)\b/;
+function isBackgroundFile(file) {
+  if (BACKGROUND_PATTERN.test(file.content)) return true;
+  const p = file.relativePath.toLowerCase();
+  return /\b(cron|jobs?|workers?|queues?|tasks?|background)\b/.test(p);
+}
 var missingAbortControllerRule = {
   id: "missing-abort-controller",
   name: "Missing Abort Controller",
-  description: "Detects fetch calls in API routes without timeout or AbortController \u2014 requests can hang indefinitely",
+  description: "Detects fetch/axios calls without timeout or AbortController \u2014 requests can hang indefinitely",
   category: "performance",
   severity: "info",
   fileExtensions: ["ts", "tsx", "js", "jsx"],
   check(file, _project) {
     if (isTestFile(file.relativePath)) return [];
-    if (!isApiRoute(file.relativePath) && !/['"]use server['"]/.test(file.content)) return [];
-    if (!FETCH_CALL.test(file.content)) return [];
+    const isRelevant = isApiRoute(file.relativePath) || /['"]use server['"]/.test(file.content) || isBackgroundFile(file);
+    if (!isRelevant) return [];
+    if (!HTTP_CALL.test(file.content)) return [];
     const hasTimeout = HAS_TIMEOUT.some((p) => p.test(file.content));
     if (hasTimeout) return [];
     let reportLine = 1;
+    let matchedCall = "fetch";
     for (let i = 0; i < file.lines.length; i++) {
       if (isCommentLine(file.lines, i, file.commentMap)) continue;
-      if (FETCH_CALL.test(file.lines[i])) {
+      const m = file.lines[i].match(HTTP_CALL);
+      if (m) {
         reportLine = i + 1;
+        matchedCall = m[1];
         break;
       }
     }
+    const isFetch = matchedCall === "fetch";
     return [{
       ruleId: "missing-abort-controller",
       file: file.relativePath,
       line: reportLine,
       column: 1,
-      message: "fetch() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond",
+      message: `${matchedCall}() without timeout or AbortController \u2014 request will hang indefinitely if the upstream server doesn't respond`,
       severity: "info",
       category: "performance",
-      fix: "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })"
+      fix: isFetch ? "Add a timeout: const controller = new AbortController(); setTimeout(() => controller.abort(), 10000); fetch(url, { signal: controller.signal })" : "Add a timeout: axios.get(url, { timeout: 10000 }) or configure in axios.create({ timeout: 10000 })"
     }];
   }
 };
@@ -4422,111 +4511,113 @@ async function scan(options) {
 }
 
 // src/web-scanner/checks.ts
-function make(id, name, description, maxPoints, severity, status, details) {
+function make(id, name, description, maxPoints, severity, maturity, status, details) {
   return {
     id,
     name,
     description,
     status,
     severity,
+    maturity,
     details,
     points: status === "pass" ? maxPoints : status === "warn" ? Math.floor(maxPoints / 2) : 0,
     maxPoints
   };
 }
 function checkRobotsTxt(ctx) {
-  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "fail", "No robots.txt found.");
-  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 5, "medium", "pass", "robots.txt found.");
+  if (!ctx.robotsTxt) return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "fail", "No robots.txt found.");
+  return make("robots_txt", "robots.txt", "robots.txt exists and is accessible", 7, "medium", "established", "pass", "robots.txt found.");
 }
 function checkRobotsAiDirectives(ctx) {
-  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No robots.txt found. AI bots have no guidance.");
-  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai"];
+  if (!ctx.robotsTxt) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No robots.txt found. AI bots have no guidance.");
+  const agents = ["GPTBot", "ChatGPT-User", "ClaudeBot", "Claude-Web", "Google-Extended", "PerplexityBot", "Bytespider", "CCBot", "anthropic-ai", "cohere-ai", "Applebot-Extended", "Grok"];
   const found = agents.filter((a) => ctx.robotsTxt.toLowerCase().includes(a.toLowerCase()));
-  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "fail", "No AI-specific user-agent directives found.");
-  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
-  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  if (found.length === 0) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "fail", "No AI-specific user-agent directives found.");
+  if (found.length < 3) return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "warn", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
+  return make("robots_ai_directives", "AI robots.txt Directives", "AI bot user-agents in robots.txt", 15, "critical", "established", "pass", `Found ${found.length} AI bot directive(s): ${found.join(", ")}.`);
 }
 function checkContentUsage(ctx) {
   const hasHeader = ctx.headers["content-usage"] != null;
   const hasInRobots = ctx.robotsTxt?.toLowerCase().includes("content-usage") ?? false;
-  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "fail", "No Content-Usage directives found.");
-  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 10, "high", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
+  if (!hasHeader && !hasInRobots) return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "fail", "No Content-Usage directives found.");
+  return make("content_usage", "Content-Usage (IETF aipref)", "Content-Usage header or directives", 5, "high", "emerging", "pass", hasHeader ? `Header: ${ctx.headers["content-usage"]}` : "Found in robots.txt.");
 }
 function checkLlmsTxt(ctx) {
-  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "fail", "No llms.txt found.");
-  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0);
-  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "warn", "llms.txt found but appears minimal.");
-  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 10, "high", "pass", `llms.txt found with ${lines.length} lines.`);
+  if (!ctx.llmsTxt) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "fail", "No llms.txt found.");
+  const lines = ctx.llmsTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
+  if (lines.length < 3) return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "warn", "llms.txt found but appears minimal.");
+  return make("llms_txt", "llms.txt", "LLM-optimized site summary at /llms.txt", 6, "high", "emerging", "pass", `llms.txt found with ${lines.length} content lines.`);
 }
 function checkTdmRep(ctx) {
   const hasWK = ctx.tdmRep != null;
   const hasHeader = ctx.headers["tdm-reservation"] != null;
-  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "fail", "No TDMRep configuration found.");
-  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 8, "medium", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
+  if (!hasWK && !hasHeader) return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "fail", "No TDMRep configuration found.");
+  return make("tdmrep", "TDMRep (W3C)", "Text & data mining reservation file or header", 4, "medium", "emerging", "pass", hasWK ? "/.well-known/tdmrep.json found." : `TDM-Reservation header: ${ctx.headers["tdm-reservation"]}`);
 }
 function checkAiDisclosure(ctx) {
-  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "fail", "No AI-Disclosure header found.");
-  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 5, "low", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
+  if (!ctx.headers["ai-disclosure"]) return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "fail", "No AI-Disclosure header found.");
+  return make("ai_disclosure", "AI-Disclosure Header", "Declares AI involvement in content generation", 2, "low", "emerging", "pass", `Header: ${ctx.headers["ai-disclosure"]}`);
 }
 function checkAgentCard(ctx) {
-  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "fail", "No A2A AgentCard found.");
+  if (!ctx.agentCard) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "fail", "No A2A AgentCard found.");
   try {
     const card = JSON.parse(ctx.agentCard);
-    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but missing name or skills.");
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
+    if (!card.name || !Array.isArray(card.skills) || card.skills.length === 0) return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but missing name or skills.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "pass", `AgentCard found with ${card.skills.length} skill(s).`);
   } catch {
-    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 10, "high", "warn", "AgentCard found but contains invalid JSON.");
+    return make("agent_card", "A2A AgentCard", "/.well-known/agent-card.json for agent discovery", 5, "high", "emerging", "warn", "AgentCard found but contains invalid JSON.");
   }
 }
 function checkAiTxt(ctx) {
-  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "fail", "No ai.txt found at site root.");
+  if (!ctx.aiTxt) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "fail", "No ai.txt found at site root.");
   const lines = ctx.aiTxt.split("\n").filter((l) => l.trim().length > 0 && !l.trim().startsWith("#"));
-  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "warn", "ai.txt found but appears minimal.");
-  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 5, "medium", "pass", `ai.txt found with ${lines.length} directive(s).`);
+  if (lines.length < 2) return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "warn", "ai.txt found but appears minimal.");
+  return make("ai_txt", "ai.txt", "AI training permissions per Spawning spec", 3, "medium", "emerging", "pass", `ai.txt found with ${lines.length} directive(s).`);
 }
 function checkWebMCP(ctx) {
-  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "info", "Could not check for WebMCP tools.");
+  if (!ctx.html) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "info", "Could not check for WebMCP tools.");
   const hasToolname = /toolname=/i.test(ctx.html);
   const hasModelContext = /navigator\.modelContext/i.test(ctx.html) || /registerTool/i.test(ctx.html);
-  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "fail", "No WebMCP tools detected.");
+  if (!hasToolname && !hasModelContext) return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "fail", "No WebMCP tools detected.");
   const count = (ctx.html.match(/toolname=/gi) || []).length;
-  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 10, "high", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
+  return make("webmcp", "WebMCP Tools", "Chrome 146+ WebMCP tool registration", 5, "high", "emerging", "pass", hasToolname ? `${count} form(s) with toolname attributes.` : "registerTool() usage detected.");
 }
 function checkStructuredData(ctx) {
-  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "info", "Could not fetch page HTML.");
+  if (!ctx.html) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "info", "Could not fetch page HTML.");
   const jsonLd = ctx.html.match(/<script[^>]*type=["']application\/ld\+json["'][^>]*>/gi);
   const hasMicrodata = ctx.html.includes("itemscope") && ctx.html.includes("itemtype");
-  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "fail", "No structured data found.");
-  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 10, "medium", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
+  if (!jsonLd && !hasMicrodata) return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "fail", "No structured data found.");
+  return make("structured_data", "Structured Data", "JSON-LD or Schema.org markup", 12, "medium", "established", "pass", `Found ${(jsonLd?.length || 0) + (hasMicrodata ? 1 : 0)} structured data block(s).`);
 }
 function checkOpenGraph(ctx) {
-  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "info", "Could not fetch HTML.");
+  if (!ctx.html) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "info", "Could not fetch HTML.");
   const checks = [/og:title/i.test(ctx.html), /og:description/i.test(ctx.html), /og:image/i.test(ctx.html), /name=["']description["']/i.test(ctx.html)];
   const passed = checks.filter(Boolean).length;
-  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "fail", "No OpenGraph tags or meta description.");
-  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "warn", `Found ${passed}/4 meta tags.`);
-  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 7, "low", "pass", `All ${passed} key meta tags present.`);
+  if (passed === 0) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "fail", "No OpenGraph tags or meta description.");
+  if (passed < 3) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "warn", `Found ${passed}/4 meta tags.`);
+  if (passed < 4) return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", `Found ${passed}/4 key meta tags.`);
+  return make("opengraph", "OpenGraph & Meta", "OG tags and meta description", 10, "low", "established", "pass", "All 4 key meta tags present.");
 }
 function checkSitemap(ctx) {
-  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "fail", "No sitemap.xml found.");
+  if (!ctx.sitemapXml) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "fail", "No sitemap.xml found.");
   const count = Math.max((ctx.sitemapXml.match(/<url>/gi) || []).length, (ctx.sitemapXml.match(/<loc>/gi) || []).length);
-  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", "Sitemap index found.");
-  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "warn", "sitemap.xml found but appears empty.");
-  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 5, "medium", "pass", `sitemap.xml found with ${count} URL(s).`);
+  if (count === 0 && /<sitemapindex/i.test(ctx.sitemapXml)) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", "Sitemap index found.");
+  if (count === 0) return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "warn", "sitemap.xml found but appears empty.");
+  return make("sitemap", "sitemap.xml", "Sitemap exists and is valid", 10, "medium", "established", "pass", `sitemap.xml found with ${count} URL(s).`);
 }
 function checkHttpSignatures(ctx) {
   const hasDirectory = ctx.httpSigDirectory != null;
   const hasSignatureHeader = ctx.headers["signature"] != null || ctx.headers["signature-input"] != null;
   const hasSignatureAgent = ctx.headers["signature-agent"] != null;
-  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "fail", "No HTTP signature support detected.");
-  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", "/.well-known/http-message-signatures-directory found.");
-  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 5, "medium", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
+  if (!hasDirectory && !hasSignatureHeader && !hasSignatureAgent) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "fail", "No HTTP signature support detected.");
+  if (hasDirectory) return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", "/.well-known/http-message-signatures-directory found.");
+  return make("http_signatures", "HTTP Message Signatures (RFC 9421)", "Agent identity verification via cryptographic signatures", 3, "medium", "emerging", "pass", hasSignatureAgent ? "Signature-Agent header detected." : "Signature/Signature-Input headers detected.");
 }
 function checkPageSpeed(ctx) {
-  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "info", "Could not measure.");
-  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
-  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
-  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 5, "low", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
+  if (ctx.loadTimeMs == null) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "info", "Could not measure.");
+  if (ctx.loadTimeMs > 5e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "fail", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 agents may time out.`);
+  if (ctx.loadTimeMs > 2e3) return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "warn", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s \u2014 consider optimizing.`);
+  return make("page_speed", "Page Load Time", "Response time for AI agent interactions", 8, "low", "established", "pass", `${(ctx.loadTimeMs / 1e3).toFixed(1)}s.`);
 }
 var allChecks = [
   checkRobotsTxt,
@@ -4565,6 +4656,29 @@ function isPrivateHost(hostname) {
   if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
   const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
   if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
+  const v4mapped = h.match(/^(?:::ffff:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4mapped) {
+    const [, a, b] = v4mapped.map(Number);
+    if (a === 10 || a === 127 || a === 0) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 169 && b === 254) return true;
+    return false;
+  }
+  if (/^(0[xX][0-9a-fA-F]+|0[0-7]+)(\.|$)/.test(hostname)) return true;
+  if (/^\d+$/.test(hostname)) {
+    const dec = parseInt(hostname, 10);
+    if (dec >= 0 && dec <= 4294967295) {
+      const a = dec >>> 24 & 255;
+      const b = dec >>> 16 & 255;
+      if (a === 10 || a === 127 || a === 0) return true;
+      if (a === 172 && b >= 16 && b <= 31) return true;
+      if (a === 192 && b === 168) return true;
+      if (a === 169 && b === 254) return true;
+      if (a === 100 && b >= 64 && b <= 127) return true;
+      if (a === 198 && (b === 18 || b === 19)) return true;
+    }
+  }
   const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
   if (ipv4) {
     const [, a, b] = ipv4.map(Number);
@@ -4577,22 +4691,49 @@ function isPrivateHost(hostname) {
   }
   return false;
 }
+function isAllowedProtocol(url) {
+  try {
+    const p = new URL(url).protocol;
+    return p === "https:" || p === "http:";
+  } catch {
+    return false;
+  }
+}
 function validateRedirectUrl(responseUrl) {
   try {
     const parsed = new URL(responseUrl);
+    if (!isAllowedProtocol(responseUrl)) return false;
     return !isPrivateHost(parsed.hostname);
   } catch {
     return false;
   }
 }
+var MAX_REDIRECTS = 5;
+async function safeFetch(url, timeout, signal) {
+  let current = url;
+  for (let i = 0; i < MAX_REDIRECTS; i++) {
+    const r = await fetch(current, { signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "manual" });
+    const status = r.status;
+    if (status >= 300 && status < 400) {
+      const location = r.headers.get("location");
+      if (!location) return null;
+      const resolved = new URL(location, current).toString();
+      if (!validateRedirectUrl(resolved)) return null;
+      current = resolved;
+      continue;
+    }
+    return r;
+  }
+  return null;
+}
 async function fetchText(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
+    const r = await safeFetch(url, timeout, c.signal);
     clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
+    if (!r || !r.ok) return null;
+    return await r.text();
   } catch {
     return null;
   }
@@ -4601,9 +4742,9 @@ async function fetchHeaders(url, timeout = 8e3) {
   try {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
+    const r = await safeFetch(url, timeout, c.signal);
     clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
+    if (!r) return {};
     const h = {};
     r.headers.forEach((v, k) => {
       h[k.toLowerCase()] = v;
@@ -4618,20 +4759,18 @@ async function fetchWithTiming(url, timeout = 15e3) {
     const c = new AbortController();
     const t = setTimeout(() => c.abort(), timeout);
     const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
+    const r = await safeFetch(url, timeout, c.signal);
     clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
+    if (!r || !r.ok) return { html: null, loadTimeMs: null };
+    const html = await r.text();
+    return { html, loadTimeMs: Date.now() - start };
   } catch {
     return { html: null, loadTimeMs: null };
   }
 }
 function normalizeUrl(input) {
   let url = input.trim();
-  if (!/^https?:\/\//i.test(url)) {
-    url = `https://${url}`;
-  }
+  if (!/^https?:\/\//i.test(url)) url = `https://${url}`;
   const parsed = new URL(url);
   return parsed.origin;
 }
@@ -4684,7 +4823,9 @@ server.tool(
   async ({ path, ignore }) => {
     const resolved = resolve4(path);
     const cwd = process.cwd();
-    if (!resolved.startsWith(cwd)) {
+    const normalizedResolved = process.platform === "win32" ? resolved.toLowerCase() : resolved;
+    const normalizedCwd = process.platform === "win32" ? cwd.toLowerCase() : cwd;
+    if (normalizedResolved !== normalizedCwd && !normalizedResolved.startsWith(normalizedCwd + sep2)) {
       return {
         content: [{ type: "text", text: `Error: Path must be within the current working directory (${cwd})` }],
         isError: true