0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-DW5UWPFY.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/shared-analysis.js
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+var FOXGUARD_PINNED_TAG = "v0.14.0";
+var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini"]);
+function bufferToString(value) {
+  if (!value) {
+    return "";
+  }
+  return Buffer.isBuffer(value) ? value.toString("utf-8") : value;
+}
+function mapSemgrepSeverity(level) {
+  switch (level.toUpperCase()) {
+    case "ERROR":
+      return "high";
+    case "WARNING":
+      return "medium";
+    case "INFO":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function mapFoxguardSeverity(level) {
+  switch ((level ?? "").toLowerCase()) {
+    case "error":
+    case "critical":
+      return "critical";
+    case "warning":
+    case "high":
+      return "high";
+    case "note":
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function runSemgrepScan(targetPath, emit, opts) {
+  emit({
+    type: "stage:start",
+    stage: "source-analysis",
+    message: "Running semgrep security scan..."
+  });
+  if (opts?.paths?.length === 0) {
+    emit({ type: "stage:end", stage: "source-analysis", message: "Semgrep: no files selected" });
+    return [];
+  }
+  const args = [
+    "scan",
+    "--config",
+    "auto",
+    "--json",
+    ...opts?.noGitIgnore ? ["--no-git-ignore"] : [],
+    "--timeout",
+    "60",
+    "--max-target-bytes",
+    "1000000",
+    ...opts?.paths ?? [targetPath]
+  ];
+  let rawOutput;
+  try {
+    rawOutput = execFileSync("semgrep", args, {
+      timeout: 3e5,
+      stdio: "pipe",
+      encoding: "utf-8",
+      env: { ...process.env, SEMGREP_SEND_METRICS: "off" }
+    });
+  } catch (err) {
+    if (!err || typeof err !== "object" || !("status" in err) || err.status !== 1)
+      throw err;
+    rawOutput = bufferToString("stdout" in err ? err.stdout : void 0);
+  }
+  const raw = JSON.parse(rawOutput);
+  if (!raw || !Array.isArray(raw.results))
+    throw new Error("invalid Semgrep JSON report");
+  const results = raw.results;
+  const findings = results.map((r) => ({
+    ruleId: r.check_id,
+    message: r.extra?.message ?? "",
+    severity: mapSemgrepSeverity(r.extra?.severity ?? "WARNING"),
+    path: r.path,
+    startLine: r.start?.line ?? 0,
+    endLine: r.end?.line ?? 0,
+    snippet: r.extra?.lines ?? "",
+    metadata: r.extra?.metadata
+  }));
+  emit({
+    type: "stage:end",
+    stage: "source-analysis",
+    message: `Semgrep: ${findings.length} findings`
+  });
+  return findings;
+}
+function selectedStaticScanner() {
+  return process.env["0SEC_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
+}
+function runFoxguardScan(targetPath, emit, opts) {
+  emit({
+    type: "stage:start",
+    stage: "source-analysis",
+    message: "Running foxguard security scan..."
+  });
+  if (opts?.paths?.length === 0) {
+    emit({ type: "stage:end", stage: "source-analysis", message: "Foxguard: no files selected" });
+    return [];
+  }
+  const foxguardTag = opts?.foxguardTag ?? FOXGUARD_PINNED_TAG;
+  const runner = opts?.runner ?? execFileSync;
+  const logger = opts?.logger ?? ((m) => console.warn(m));
+  const cwd = statSync(targetPath, { throwIfNoEntry: false })?.isFile() ? dirname(resolve(targetPath)) : resolve(targetPath);
+  let useNpm = opts?.foxguardCommand !== void 0 || opts?.foxguardTag !== void 0;
+  const findings = [];
+  let selectionDir;
+  try {
+    let selectionFile;
+    if (opts?.paths && !opts.diffBase) {
+      const paths = opts.paths.map((path) => {
+        const selected = relative(cwd, resolve(cwd, path));
+        if (isAbsolute(selected) || selected === ".." || selected.startsWith(`..${sep}`) || /[\r\n\0]/.test(selected)) {
+          throw new Error(`selected Foxguard path is outside the scan root or cannot be represented: ${path}`);
+        }
+        return selected.split(sep).join("/");
+      });
+      selectionDir = mkdtempSync(join(tmpdir(), "0sec-foxguard-"));
+      selectionFile = join(selectionDir, "changed-files.txt");
+      writeFileSync(selectionFile, `${paths.join("\n")}
+`, { mode: 384 });
+    }
+    const scanRoot = relative(cwd, resolve(targetPath)) || ".";
+    const invocations = [opts?.diffBase ? ["diff", opts.diffBase, scanRoot, "--format", "json"] : ["--format", "json", ...selectionFile ? ["--changed-files-from", selectionFile] : [], scanRoot]];
+    for (const args of invocations) {
+      let rawOutput;
+      const invoke = () => {
+        try {
+          return bufferToString(runner(useNpm ? opts?.foxguardCommand ?? "npx" : "foxguard", useNpm ? ["--yes", `foxguard@${foxguardTag}`, ...args] : args, {
+            cwd,
+            timeout: 3e5,
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: "pipe",
+            encoding: "utf-8"
+          }));
+        } catch (err) {
+          if (err && typeof err === "object" && "status" in err && err.status === 1) {
+            return bufferToString("stdout" in err ? err.stdout : void 0);
+          }
+          throw err;
+        }
+      };
+      try {
+        rawOutput = invoke();
+      } catch (err) {
+        if (!useNpm && err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+          useNpm = true;
+          rawOutput = invoke();
+        } else {
+          throw err;
+        }
+      }
+      const report = parseFoxguardJson(rawOutput);
+      if (report === null)
+        throw new Error("invalid Foxguard JSON report");
+      if (report.filesScanned === 0) {
+        throw new Error("Foxguard scanned 0 files; static coverage is unavailable (files may be excluded or unsupported)");
+      }
+      for (const finding of translateFoxguardFindings(report.findings)) {
+        finding.path = resolve(cwd, finding.path);
+        findings.push(finding);
+      }
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger(`[0sec] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set 0SEC_STATIC=semgrep to use semgrep.`);
+    emit({ type: "error", stage: "source-analysis", message: `Foxguard scan failed: ${message}` });
+    throw err;
+  } finally {
+    if (selectionDir)
+      rmSync(selectionDir, { recursive: true, force: true });
+  }
+  emit({
+    type: "stage:end",
+    stage: "source-analysis",
+    message: `Foxguard: ${findings.length} findings`
+  });
+  return findings;
+}
+function runSelectedStaticScan(targetPath, emit, opts) {
+  return selectedStaticScanner() === "foxguard" ? runFoxguardScan(targetPath, emit, opts) : runSemgrepScan(targetPath, emit, opts);
+}
+function parseFoxguardJson(rawJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch {
+    return null;
+  }
+  if (Array.isArray(parsed))
+    return { findings: parsed };
+  if (!parsed || typeof parsed !== "object" || !("findings" in parsed))
+    return null;
+  for (const field of ["schema_version", "finding_schema_version"]) {
+    if (field in parsed && !/^1\.\d+\.\d+$/.test(String(parsed[field]))) {
+      return null;
+    }
+  }
+  if (!Array.isArray(parsed.findings))
+    return null;
+  const target = "target" in parsed ? parsed.target : void 0;
+  const filesScanned = target && typeof target === "object" && "files_scanned" in target ? target.files_scanned : void 0;
+  if (filesScanned !== void 0 && (typeof filesScanned !== "number" || !Number.isSafeInteger(filesScanned) || filesScanned < 0))
+    return null;
+  return { findings: parsed.findings, ...typeof filesScanned === "number" ? { filesScanned } : {} };
+}
+function translateFoxguardFindings(rawFindings) {
+  const out = [];
+  for (const raw of rawFindings) {
+    if (!raw || typeof raw !== "object")
+      continue;
+    if (!raw.rule_id || !raw.file || typeof raw.line !== "number")
+      continue;
+    const startLine = raw.line;
+    const endLine = typeof raw.end_line === "number" ? raw.end_line : startLine;
+    const metadata = { scanner: "foxguard" };
+    if (raw.cwe)
+      metadata.cwe = raw.cwe;
+    if (typeof raw.confidence === "number")
+      metadata.confidence = raw.confidence;
+    if (typeof raw.taint_hops === "number")
+      metadata.taintHops = raw.taint_hops;
+    if (raw.source_line || raw.sink_line) {
+      metadata.dataflow = {
+        sourceLine: raw.source_line,
+        sourceDescription: raw.source_description,
+        sinkLine: raw.sink_line,
+        sinkDescription: raw.sink_description
+      };
+    }
+    if (raw.fix_suggestion)
+      metadata.fixSuggestion = raw.fix_suggestion;
+    if (raw.tags && raw.tags.length > 0)
+      metadata.tags = raw.tags;
+    if (raw.crypto_algorithm)
+      metadata.cryptoAlgorithm = raw.crypto_algorithm;
+    if (raw.cnsa2_deadline)
+      metadata.cnsa2Deadline = raw.cnsa2_deadline;
+    if (raw.dep_name)
+      metadata.depName = raw.dep_name;
+    out.push({
+      ruleId: raw.rule_id,
+      message: raw.description ?? "",
+      severity: mapFoxguardSeverity(raw.severity),
+      path: raw.file,
+      startLine,
+      endLine,
+      snippet: raw.snippet ?? "",
+      metadata
+    });
+  }
+  return out;
+}
+
+export {
+  CLI_RUNTIME_TYPES,
+  bufferToString,
+  selectedStaticScanner,
+  runSelectedStaticScan
+};