prodlint 0.9.5 → 0.10.2

package/action.yml

@@ -1,152 +1,106 @@
-name: 'Prodlint'
-description: 'Production readiness for vibe-coded apps — check your AI code before you ship'
-branding:
-  icon: 'shield'
-  color: 'green'
-
-inputs:
-  path:
-    description: 'Path to scan (default: current directory)'
-    required: false
-    default: '.'
-  threshold:
-    description: 'Minimum score to pass (0-100). Fails the check if score is below this.'
-    required: false
-    default: '0'
-  ignore:
-    description: 'Glob patterns to ignore (comma-separated)'
-    required: false
-    default: ''
-  comment:
-    description: 'Post a PR comment with results (true/false)'
-    required: false
-    default: 'true'
-
-outputs:
-  score:
-    description: 'Overall prodlint score (0-100)'
-    value: ${{ steps.scan.outputs.score }}
-  critical:
-    description: 'Number of critical findings'
-    value: ${{ steps.scan.outputs.critical }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Setup Node.js
-      uses: actions/setup-node@v4
-      with:
-        node-version: '20'
-
-    - name: Run prodlint
-      id: scan
-      shell: bash
-      env:
-        INPUT_PATH: ${{ inputs.path }}
-        INPUT_IGNORE: ${{ inputs.ignore }}
-      run: |
-        CMD_ARGS=("$INPUT_PATH" "--json")
-        if [ -n "$INPUT_IGNORE" ]; then
-          IFS=',' read -ra PATTERNS <<< "$INPUT_IGNORE"
-          for p in "${PATTERNS[@]}"; do
-            trimmed=$(echo "$p" | xargs)
-            CMD_ARGS+=("--ignore" "$trimmed")
-          done
-        fi
-
-        OUTPUT=$(npx -y prodlint@latest "${CMD_ARGS[@]}" 2>&1) || true
-
-        SCORE=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.overallScore) || 0);
-        " 2>/dev/null || echo "0")
-        SCORE=$(echo "$SCORE" | tr -cd '0-9')
-
-        CRITICAL=$(echo "$OUTPUT" | node -e "
-          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
-          console.log(Number(d.summary.critical) || 0);
-        " 2>/dev/null || echo "0")
-        CRITICAL=$(echo "$CRITICAL" | tr -cd '0-9')
-
-        echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
-        echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
-        echo "$OUTPUT" > /tmp/prodlint-result.json
-
-    - name: Generate comment body
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      id: comment
-      shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-
-        if [ "$SCORE" -ge 80 ]; then
-          EMOJI="✅"
-          COLOR="brightgreen"
-        elif [ "$SCORE" -ge 60 ]; then
-          EMOJI="⚠️"
-          COLOR="yellow"
-        else
-          EMOJI="🚨"
-          COLOR="red"
-        fi
-
-        # Build comment from JSON with markdown sanitization
-        TMPFILE=$(mktemp "${RUNNER_TEMP:-/tmp}/prodlint-comment-XXXXXX.md")
-        node -e "
-          const fs = require('fs');
-          const d = JSON.parse(fs.readFileSync('/tmp/prodlint-result.json', 'utf8'));
-          const esc = s => String(s).replace(/[[\]()\\*_\`<>]/g, c => '\\\\' + c);
-          const lines = [];
-          lines.push('## ' + '$EMOJI' + ' Production Readiness: **' + d.overallScore + '/100**');
-          lines.push('');
-          lines.push('| Category | Score | Issues |');
-          lines.push('|----------|-------|--------|');
-          for (const c of d.categoryScores) {
-            const icon = c.score >= 80 ? '🟢' : c.score >= 60 ? '🟡' : '🔴';
-            lines.push('| ' + icon + ' ' + esc(c.category) + ' | ' + c.score + '/100 | ' + c.findingCount + ' |');
-          }
-          if (d.summary.critical > 0) {
-            lines.push('');
-            lines.push('### Critical Issues');
-            lines.push('');
-            const crits = d.findings.filter(f => f.severity === 'critical');
-            for (const f of crits.slice(0, 10)) {
-              lines.push('- \`' + esc(f.ruleId) + '\` \`' + esc(f.file) + ':' + f.line + '\` — ' + esc(f.message));
-            }
-            if (crits.length > 10) {
-              lines.push('- ...and ' + (crits.length - 10) + ' more');
-            }
-          }
-          lines.push('');
-          lines.push('---');
-          lines.push('*Scanned ' + d.filesScanned + ' files in ' + d.scanDurationMs + 'ms · [prodlint](https://prodlint.com)*');
-          fs.writeFileSync('$TMPFILE', lines.join('\n'));
-        "
-
-        # Use the generated file for the comment step
-        cp "$TMPFILE" /tmp/prodlint-comment.md
-
-    - name: Post PR comment
-      if: inputs.comment == 'true' && github.event_name == 'pull_request'
-      uses: marocchino/sticky-pull-request-comment@v3
-      with:
-        header: prodlint
-        path: /tmp/prodlint-comment.md
-
-    - name: Check threshold
-      if: inputs.threshold != '0'
-      shell: bash
-      env:
-        SCAN_SCORE: ${{ steps.scan.outputs.score }}
-        INPUT_THRESHOLD: ${{ inputs.threshold }}
-      run: |
-        SCORE="$SCAN_SCORE"
-        THRESHOLD="$INPUT_THRESHOLD"
-        if [ "$SCORE" -lt "$THRESHOLD" ]; then
-          echo "::error::Prodlint score ($SCORE) is below threshold ($THRESHOLD)"
-          exit 1
-        fi
+name: 'Prodlint'
+description: 'Production readiness for vibe-coded apps — check your AI code before you ship'
+branding:
+  icon: 'shield'
+  color: 'green'
+
+inputs:
+  path:
+    description: 'Path to scan (default: current directory)'
+    required: false
+    default: '.'
+  threshold:
+    description: 'Minimum score to pass (0-100). Fails the check if score is below this.'
+    required: false
+    default: '0'
+  ignore:
+    description: 'Glob patterns to ignore (comma-separated)'
+    required: false
+    default: ''
+  comment:
+    description: 'Post a PR comment with results (true/false)'
+    required: false
+    default: 'true'
+
+outputs:
+  score:
+    description: 'Overall prodlint score (0-100)'
+    value: ${{ steps.scan.outputs.score }}
+  critical:
+    description: 'Number of critical findings'
+    value: ${{ steps.scan.outputs.critical }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Setup Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version: '22'
+        # Automatic caching would key off the scanned repo's package.json; npx needs none.
+        package-manager-cache: false
+
+    - name: Run prodlint
+      id: scan
+      shell: bash
+      env:
+        INPUT_PATH: ${{ inputs.path }}
+        INPUT_IGNORE: ${{ inputs.ignore }}
+      run: |
+        CMD_ARGS=("$INPUT_PATH" "--json")
+        if [ -n "$INPUT_IGNORE" ]; then
+          IFS=',' read -ra PATTERNS <<< "$INPUT_IGNORE"
+          for p in "${PATTERNS[@]}"; do
+            trimmed=$(echo "$p" | xargs)
+            CMD_ARGS+=("--ignore" "$trimmed")
+          done
+        fi
+
+        # The exact release this action ships with (scripts/sync-versions.cjs bumps it), so
+        # pinning the action — @v1, a version tag or a commit SHA — also pins the scanner.
+        OUTPUT=$(npx -y prodlint@0.10.2 "${CMD_ARGS[@]}" 2>&1) || true
+
+        SCORE=$(echo "$OUTPUT" | node -e "
+          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+          console.log(Number(d.overallScore) || 0);
+        " 2>/dev/null || echo "0")
+        SCORE=$(echo "$SCORE" | tr -cd '0-9')
+
+        CRITICAL=$(echo "$OUTPUT" | node -e "
+          const d = JSON.parse(require('fs').readFileSync(0, 'utf8'));
+          console.log(Number(d.summary.critical) || 0);
+        " 2>/dev/null || echo "0")
+        CRITICAL=$(echo "$CRITICAL" | tr -cd '0-9')
+
+        echo "score=${SCORE:-0}" >> "$GITHUB_OUTPUT"
+        echo "critical=${CRITICAL:-0}" >> "$GITHUB_OUTPUT"
+        echo "$OUTPUT" > "$RUNNER_TEMP/prodlint-result.json"
+
+    # Built by a script file rather than inline `node -e`: the comment carries file paths
+    # and messages from the scanned repo, and the script's escaping is unit-tested.
+    - name: Generate comment body
+      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      id: comment
+      shell: bash
+      run: node "$GITHUB_ACTION_PATH/scripts/action-comment.cjs" "$RUNNER_TEMP/prodlint-result.json" "$RUNNER_TEMP/prodlint-comment.md"
+
+    - name: Post PR comment
+      if: inputs.comment == 'true' && github.event_name == 'pull_request'
+      uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5
+      with:
+        header: prodlint
+        path: ${{ runner.temp }}/prodlint-comment.md
+
+    - name: Check threshold
+      if: inputs.threshold != '0'
+      shell: bash
+      env:
+        SCAN_SCORE: ${{ steps.scan.outputs.score }}
+        INPUT_THRESHOLD: ${{ inputs.threshold }}
+      run: |
+        SCORE="$SCAN_SCORE"
+        THRESHOLD="$INPUT_THRESHOLD"
+        if [ "$SCORE" -lt "$THRESHOLD" ]; then
+          echo "::error::Prodlint score ($SCORE) is below threshold ($THRESHOLD)"
+          exit 1
+        fi

package/dist/cli.js

@@ -522,6 +522,33 @@ async function collectWorkspaceDependencies(root, patterns) {
   }
   return deps;
 }
+async function collectNestedPackageDependencies(root) {
+  const deps = /* @__PURE__ */ new Set();
+  try {
+    const pkgFiles = await fg(["**/package.json"], {
+      cwd: root,
+      absolute: false,
+      ignore: ["**/node_modules/**", "package.json"]
+    });
+    for (const pkgFile of pkgFiles) {
+      try {
+        const raw = await readFile(resolve(root, pkgFile), "utf-8");
+        const pkg = JSON.parse(raw);
+        if (pkg.name) deps.add(pkg.name);
+        for (const key of ["dependencies", "devDependencies", "peerDependencies"]) {
+          if (pkg[key] && typeof pkg[key] === "object") {
+            for (const dep of Object.keys(pkg[key])) {
+              deps.add(dep);
+            }
+          }
+        }
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
 async function buildProjectContext(root, files) {
   let packageJson = null;
   let declaredDependencies = /* @__PURE__ */ new Set();
@@ -549,6 +576,10 @@ async function buildProjectContext(root, files) {
       declaredDependencies.add(dep);
     }
   }
+  const nestedDeps = await collectNestedPackageDependencies(root);
+  for (const dep of nestedDeps) {
+    declaredDependencies.add(dep);
+  }
   for (const dep of declaredDependencies) {
     const framework = DEPENDENCY_TO_FRAMEWORK[dep];
     if (framework) {
@@ -4750,6 +4781,14 @@ function reportWebPretty(result) {
   return lines.join("\n");
 }
 
+// src/web-scanner/index.ts
+import { lookup as dnsLookup } from "dns";
+import { lookup as dnsLookupAll } from "dns/promises";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+import { BlockList, isIP } from "net";
+import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
+
 // src/web-scanner/checks.ts
 function make(id, name, description, maxPoints, severity, status, details) {
   return {
@@ -4889,72 +4928,157 @@ function getDomain(url) {
     return url;
   }
 }
-var PRIVATE_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "0.0.0.0", "[::1]", "metadata.google.internal"]);
+var PRIVATE_RANGES = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["224.0.0.0", 3]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+  ["::", 96],
+  ["64:ff9b:1::", 48],
+  ["2001::", 32],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) PRIVATE_RANGES.addSubnet(network, prefix, "ipv6");
+function ipv6Groups(address) {
+  const quad = address.match(/^(.*:)(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  const hex = quad ? `${quad[1]}${(+quad[2] << 8 | +quad[3]).toString(16)}:${(+quad[4] << 8 | +quad[5]).toString(16)}` : address;
+  const [head, tail] = hex.split("::");
+  const parse2 = (part) => part ? part.split(":").map((g) => parseInt(g, 16)) : [];
+  const front = parse2(head);
+  const back = parse2(tail);
+  return tail === void 0 ? front : [...front, ...Array(8 - front.length - back.length).fill(0), ...back];
+}
+function embeddedIPv4(address) {
+  const g = ipv6Groups(address);
+  const quad = (hi, lo) => `${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`;
+  const zero = (from, to) => g.slice(from, to).every((x) => x === 0);
+  if (zero(0, 5) && g[5] === 65535) return quad(g[6], g[7]);
+  if (g[0] === 100 && g[1] === 65435 && zero(2, 6)) return quad(g[6], g[7]);
+  if (g[0] === 8194) return quad(g[1], g[2]);
+  return null;
+}
+function isPrivateAddress(address) {
+  const ip = address.replace(/^\[|\]$/g, "").replace(/%.*$/, "");
+  const family = isIP(ip);
+  if (family === 4) return PRIVATE_RANGES.check(ip, "ipv4");
+  if (family !== 6) return false;
+  const v4 = embeddedIPv4(ip);
+  return v4 !== null && PRIVATE_RANGES.check(v4, "ipv4") || PRIVATE_RANGES.check(ip, "ipv6");
+}
 function isPrivateHost(hostname) {
-  if (PRIVATE_HOSTNAMES.has(hostname.toLowerCase())) return true;
-  const h = hostname.replace(/^\[|\]$/g, "").toLowerCase();
-  if (h === "::1" || h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd") || h === "::") return true;
-  const ipv4 = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-  if (ipv4) {
-    const [, a, b] = ipv4.map(Number);
-    if (a === 10 || a === 127 || a === 0) return true;
-    if (a === 172 && b >= 16 && b <= 31) return true;
-    if (a === 192 && b === 168) return true;
-    if (a === 169 && b === 254) return true;
-    if (a === 100 && b >= 64 && b <= 127) return true;
-    if (a === 198 && (b === 18 || b === 19)) return true;
-  }
-  return false;
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal")) return true;
+  return isPrivateAddress(host);
 }
-function validateRedirectUrl(responseUrl) {
+async function resolvesToPrivateAddress(hostname) {
   try {
-    const parsed = new URL(responseUrl);
-    return !isPrivateHost(parsed.hostname);
+    const addresses = await dnsLookupAll(hostname.replace(/^\[|\]$/g, ""), { all: true });
+    return addresses.some((a) => isPrivateAddress(a.address));
   } catch {
     return false;
   }
 }
-async function fetchText(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return null;
-    return r.ok ? await r.text() : null;
-  } catch {
-    return null;
+var guardedLookup = (hostname, options, callback) => {
+  dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+    if (err) return callback(err, "");
+    const blocked = addresses.find((a) => isPrivateAddress(a.address));
+    if (blocked) {
+      return callback(Object.assign(new Error(`${hostname} resolves to private address ${blocked.address}`), { code: "EPRIVATEADDR" }), "");
+    }
+    if (options.all) return callback(null, addresses);
+    callback(null, addresses[0].address, addresses[0].family);
+  });
+};
+var USER_AGENT = "Prodlint-WebScanner/1.0";
+var MAX_REDIRECTS = 5;
+var MAX_BODY_BYTES = 5 * 1024 * 1024;
+function flattenHeaders(res) {
+  const headers = {};
+  for (const [key, value] of Object.entries(res.headers)) {
+    if (value !== void 0) headers[key] = Array.isArray(value) ? value.join(", ") : value;
   }
+  return headers;
 }
-async function fetchHeaders(url, timeout = 8e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return {};
-    const h = {};
-    r.headers.forEach((v, k) => {
-      h[k.toLowerCase()] = v;
+function readBody(res) {
+  const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+  const decoder = encoding === "gzip" || encoding === "x-gzip" ? createGunzip() : encoding === "deflate" ? createInflate() : encoding === "br" ? createBrotliDecompress() : null;
+  const stream = decoder ? res.pipe(decoder) : res;
+  return new Promise((resolve4, reject) => {
+    const chunks = [];
+    let size = 0;
+    const done = () => resolve4(Buffer.concat(chunks).toString("utf8"));
+    stream.on("data", (chunk) => {
+      if (size >= MAX_BODY_BYTES) return;
+      chunks.push(chunk.subarray(0, MAX_BODY_BYTES - size));
+      size += chunk.length;
+      if (size >= MAX_BODY_BYTES) {
+        done();
+        res.destroy();
+        decoder?.destroy();
+      }
     });
-    return h;
-  } catch {
-    return {};
-  }
+    stream.on("end", done);
+    stream.on("error", reject);
+    res.on("error", reject);
+  });
 }
-async function fetchWithTiming(url, timeout = 15e3) {
-  try {
-    const c = new AbortController();
-    const t = setTimeout(() => c.abort(), timeout);
-    const start = Date.now();
-    const r = await fetch(url, { signal: c.signal, headers: { "User-Agent": "Prodlint-WebScanner/1.0" }, redirect: "follow" });
-    const html = await r.text();
-    clearTimeout(t);
-    if (r.url && !validateRedirectUrl(r.url)) return { html: null, loadTimeMs: null };
-    return r.ok ? { html, loadTimeMs: Date.now() - start } : { html: null, loadTimeMs: null };
-  } catch {
-    return { html: null, loadTimeMs: null };
-  }
+function guardedGet(url, timeoutMs, lookup = guardedLookup) {
+  return new Promise((resolve4) => {
+    let current;
+    const finish = (result) => {
+      clearTimeout(timer);
+      current?.destroy();
+      resolve4(result);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    const attempt = (target, redirectsLeft) => {
+      if (target.protocol !== "http:" && target.protocol !== "https:" || isPrivateHost(target.hostname)) return finish(null);
+      const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+      current = send(target, { agent: false, lookup, headers: { "User-Agent": USER_AGENT, "Accept-Encoding": "gzip, deflate, br" } }, (res) => {
+        const status = res.statusCode ?? 0;
+        const location = res.headers.location;
+        if (status >= 300 && status < 400 && location) {
+          res.resume();
+          let next;
+          try {
+            next = new URL(location, target);
+          } catch {
+            return finish(null);
+          }
+          return redirectsLeft > 0 ? attempt(next, redirectsLeft - 1) : finish(null);
+        }
+        readBody(res).then((body) => finish({ status, headers: flattenHeaders(res), body }), () => finish(null));
+      });
+      current.on("error", () => finish(null));
+      current.end();
+    };
+    try {
+      attempt(new URL(url), MAX_REDIRECTS);
+    } catch {
+      finish(null);
+    }
+  });
+}
+async function fetchText(url, timeout = 8e3) {
+  const r = await guardedGet(url, timeout);
+  return r && r.status >= 200 && r.status < 300 ? r.body : null;
+}
+async function fetchPage(url, timeout = 15e3) {
+  const start = Date.now();
+  const r = await guardedGet(url, timeout);
+  const ok = r !== null && r.status >= 200 && r.status < 300;
+  return { headers: r?.headers ?? {}, html: ok ? r.body : null, loadTimeMs: ok ? Date.now() - start : null };
 }
 function normalizeUrl(input) {
   let url = input.trim();
@@ -4966,7 +5090,7 @@ function normalizeUrl(input) {
 }
 async function runWebScan(targetUrl) {
   const domain = getDomain(targetUrl);
-  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, pageData] = await Promise.all([
+  const [robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, page] = await Promise.all([
     fetchText(`${targetUrl}/robots.txt`),
     fetchText(`${targetUrl}/llms.txt`),
     fetchText(`${targetUrl}/ai.txt`),
@@ -4974,10 +5098,9 @@ async function runWebScan(targetUrl) {
     fetchText(`${targetUrl}/.well-known/agent-card.json`),
     fetchText(`${targetUrl}/sitemap.xml`),
     fetchText(`${targetUrl}/.well-known/http-message-signatures-directory`),
-    fetchHeaders(targetUrl),
-    fetchWithTiming(targetUrl)
+    fetchPage(targetUrl)
   ]);
-  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, headers, html: pageData.html, loadTimeMs: pageData.loadTimeMs };
+  const ctx = { url: targetUrl, domain, robotsTxt, llmsTxt, aiTxt, tdmRep, agentCard, sitemapXml, httpSigDirectory, ...page };
   const checks = allChecks.map((fn) => fn(ctx));
   const totalPoints = checks.reduce((s, c) => s + c.points, 0);
   const maxPoints = checks.reduce((s, c) => s + c.maxPoints, 0);
@@ -5120,7 +5243,7 @@ async function runWebScan2(url, opts) {
     process.exit(2);
   }
   const hostname = new URL(normalizedUrl).hostname;
-  if (isPrivateHost(hostname)) {
+  if (isPrivateHost(hostname) || await resolvesToPrivateAddress(hostname)) {
     console.error("Cannot scan private/internal hosts.");
     process.exit(2);
   }