0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-KLTNTE2Z.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/agent/sanitized-env.js
+var SENSITIVE_ENV_PATTERNS = [
+  // ── Generic credential shapes (see note above) ──────────────────────────
+  "TOKEN",
+  // *_TOKEN, AWS_SESSION_TOKEN, API_TOKEN, …
+  "SECRET",
+  // *_SECRET, AWS_SECRET_ACCESS_KEY, CLIENT_SECRET, …
+  "PASSWORD",
+  "PASSWD",
+  "PASSPHRASE",
+  "CRED",
+  // CREDS, CREDENTIAL(S), NVD_CREDS, …
+  "APIKEY",
+  // MY_COMPANY_APIKEY (no separator)
+  "API_KEY",
+  // *_API_KEY beyond the vendor list below
+  "PRIVATE_KEY",
+  "ACCESS_KEY",
+  // AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
+  "SECRET_KEY",
+  "_PAT",
+  // GH_PAT / *_PAT personal access tokens (NOT "PATH": no underscore)
+  "SESSION_TOKEN",
+  "AUTH_TOKEN",
+  "BEARER",
+  // ── Vendor-specific LLM provider keys ────────────────────────────────────
+  "OPENROUTER_API",
+  "ANTHROPIC_API",
+  "OPENAI_API",
+  "AZURE_OPENAI_API",
+  "GEMINI_API",
+  "MISTRAL_API",
+  "XAI_API",
+  "COHERE_API",
+  "GROQ_API",
+  "TOGETHER_API",
+  "PERPLEXITY_API",
+  "FIREWORKS_API",
+  "AI21_API",
+  "DEEPSEEK_API",
+  "HUGGING_FACE_",
+  "HF_TOKEN",
+  "Z_AI_API",
+  "KIMI_API",
+  "QWEN_API",
+  // Non-LLM service credentials.
+  "NVD_API",
+  "E2B_API",
+  "WPSCAN_API_TOKEN",
+  "0SEC_WPSCAN_API_TOKEN",
+  "GITHUB_TOKEN",
+  "GITLAB_TOKEN",
+  "GH_TOKEN",
+  "GL_TOKEN",
+  // Per-dispatch secrets injected by 0cloud's worker-controller.
+  "0SEC_CLOUD_TOKEN",
+  "0SEC_CHATGPT_ACCESS_TOKEN",
+  "0SEC_CHATGPT_OAUTH_REFRESH_TOKEN",
+  "0SEC_GITHUB_TOKEN",
+  "0SEC_GITLAB_TOKEN",
+  "0SEC_TARGET_AUTH_JSON",
+  "0SEC_GRAPH_ACCESS_TOKEN",
+  "0SEC_LLM_TARGET_KEY"
+];
+function sanitizedEnv(env = process.env) {
+  return allowlistedChildEnv({}, env);
+}
+var CHILD_ENV_ALLOWLIST = [
+  "PATH",
+  "HOME",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "TEMP",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "SSH_AUTH_SOCK",
+  "NODE_OPTIONS",
+  "NO_COLOR",
+  "CI",
+  "GIT_CONFIG_GLOBAL",
+  "XDG_CONFIG_HOME",
+  "XDG_CACHE_HOME",
+  // Target auth and target identity are deliberately available to authorized
+  // child requests. They are not provider / cloud control-plane credentials.
+  "TARGET",
+  "AUTH_HEADER",
+  "AUTH_VALUE",
+  "AUTH_CURL_FLAG",
+  // Existing child-runtime configuration contract; each name is non-secret.
+  "0SEC_FEATURE_JIT_SKILLS",
+  "0SEC_BASH_TIMEOUT_MS",
+  "0SEC_CLOUD_SCAN_ID"
+];
+function allowlistedChildEnv(extras = {}, env = process.env) {
+  const out = {};
+  for (const key of CHILD_ENV_ALLOWLIST) {
+    const value = env[key];
+    if (value !== void 0)
+      out[key] = value;
+  }
+  for (const [key, value] of Object.entries(extras)) {
+    const upper = key.toUpperCase();
+    if (SENSITIVE_ENV_PATTERNS.some((pattern) => upper.includes(pattern)))
+      continue;
+    out[key] = value;
+  }
+  return out;
+}
+
+export {
+  sanitizedEnv,
+  allowlistedChildEnv
+};