Deploy alpha smoke for VibeControls

@vibecontrols/vibe-plugin-security-deploy-alpha

Pure-JS smoke-check provider for the deploy.alpha lifecycle stage in VibeControls. Provider name: alpha-smoke. No binary, no Docker — uses the native fetch API only. Wave 2 scaffold — real probe integration pending; see src/provider.ts TODO.

Registers itself with @vibecontrols/vibe-plugin-security under the per-stage provider type security.release (per PROVIDER_TYPE_FOR_STAGE("deploy.alpha")). When the user picks "alpha-smoke" as their default provider for deploy.alpha, the security meta plugin dispatches scan runs here.

Install

vibe plugin install @vibecontrols/vibe-plugin-security-deploy-alpha
vibe security providers set-default --stage deploy.alpha --provider alpha-smoke

No external dependencies. Pure-JS, no subprocess, no privileged capabilities — runs anywhere the agent runs.

Behavior (planned)

For each URL in input.config.alphaUrls:

• TLS validity: cert not expired, hostname matches, chain valid.
• Response headers: Strict-Transport-Security, X-Content-Type-Options, Content-Security-Policy present on GET / (configurable per check).
• Auth challenge: GET /healthz returns 200 OK with a known JSON shape for public endpoints; protected endpoints return 401 + WWW-Authenticate.

Findings:

• severity: high — TLS invalid or HSTS missing.
• severity: medium — CSP or X-Content-Type-Options missing.
• severity: low — /healthz auth-challenge mismatch.

Evidence: raw probe results as a JSON artifact.

Configuration

Per-vibe config (stored in RepositorySecurityConfig.pluginAssignments["deploy.alpha"].config):

provider: alpha-smoke
config:
  alphaUrls:
    - https://alpha.example.com
    - https://api.alpha.example.com
  requireHsts: true
  requireCsp: true
  requireXcto: true
  healthzPath: /healthz
  extraHeaders:
    User-Agent: vibecontrols-alpha-smoke