0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-53G27VPS.js

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/source-files.js
+import { lstatSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+var DEFAULT_SOURCE_EXTS = /* @__PURE__ */ new Set([
+  ".js",
+  ".mjs",
+  ".cjs",
+  ".ts",
+  ".mts",
+  ".cts",
+  ".jsx",
+  ".tsx",
+  ".json",
+  ".yml",
+  ".yaml",
+  ".py",
+  ".pyx",
+  ".pyi",
+  ".rs",
+  ".go",
+  ".rb",
+  ".php",
+  ".java",
+  ".kt",
+  ".c",
+  ".h",
+  ".cc",
+  ".cpp",
+  ".cxx",
+  ".hpp",
+  ".sol"
+]);
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "target",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".tox",
+  "vendor",
+  "third_party",
+  "deps",
+  ".cache",
+  ".next",
+  ".nuxt",
+  "coverage"
+]);
+var DEFAULT_MAX_FILES = 50;
+var DEFAULT_MAX_FILE_SIZE = 2e5;
+function collectScopeFiles(dir, opts = {}) {
+  const maxFiles = opts.maxFiles ?? DEFAULT_MAX_FILES;
+  const maxFileSize = opts.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+  const exts = opts.extensions ?? DEFAULT_SOURCE_EXTS;
+  const files = [];
+  function walk(d) {
+    if (files.length >= maxFiles)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(d);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (files.length >= maxFiles)
+        return;
+      if (SKIP_DIRS.has(entry))
+        continue;
+      const full = join(d, entry);
+      try {
+        const st = lstatSync(full);
+        if (st.isDirectory()) {
+          walk(full);
+        } else if (st.isFile() && st.nlink === 1 && st.size < maxFileSize) {
+          const ext = full.slice(full.lastIndexOf("."));
+          if (exts.has(ext)) {
+            files.push(full);
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  walk(dir);
+  return files;
+}
+function countScopeFilesUpTo(dir, limit, opts = {}) {
+  const maxFileSize = opts.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;
+  const exts = opts.extensions ?? DEFAULT_SOURCE_EXTS;
+  let count = 0;
+  function walk(d) {
+    if (count > limit)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(d);
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (count > limit)
+        return;
+      if (SKIP_DIRS.has(entry))
+        continue;
+      const full = join(d, entry);
+      try {
+        const st = lstatSync(full);
+        if (st.isDirectory()) {
+          walk(full);
+        } else if (st.isFile() && st.nlink === 1 && st.size < maxFileSize) {
+          const ext = full.slice(full.lastIndexOf("."));
+          if (exts.has(ext)) {
+            count += 1;
+            if (count > limit)
+              return;
+          }
+        }
+      } catch {
+      }
+    }
+  }
+  walk(dir);
+  return count;
+}
+
+export {
+  collectScopeFiles,
+  countScopeFilesUpTo
+};

package/chunks/chunk-57ZENEX2.js

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+
+// packages/core/dist/scope/scope.js
+import { readFileSync } from "node:fs";
+import { isIP } from "node:net";
+var ScopePolicy = class _ScopePolicy {
+  inScope;
+  outOfScope;
+  /**
+   * Original JSON the policy was constructed from. Exposed read-only so
+   * downstream features (0sec#216 attribution headers) can pull their
+   * own optional blocks out of the same file without re-reading it.
+   */
+  raw;
+  constructor(json) {
+    this.inScope = (json.in_scope ?? []).map(parseRule);
+    this.outOfScope = (json.out_of_scope ?? []).map(parseRule);
+    this.raw = json;
+  }
+  /**
+   * Load a policy from a JSON file on disk.
+   *
+   * Bubbles up the underlying ENOENT/JSON-parse error to the caller; the
+   * scan CLI is responsible for translating these into a user-facing
+   * "scope file not found / malformed" message and exiting non-zero before
+   * the agent ever boots.
+   */
+  static fromJsonFile(path) {
+    const raw = readFileSync(path, "utf-8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      throw new Error(`Scope file ${path} is not valid JSON: ${msg}`);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error(`Scope file ${path} must be a JSON object with in_scope/out_of_scope arrays`);
+    }
+    return _ScopePolicy.fromJson(parsed);
+  }
+  static fromJson(obj) {
+    return new _ScopePolicy(obj);
+  }
+  /**
+   * Decide whether a URL is allowed by this policy.
+   *
+   * The contract used by every call site:
+   *   - allowed=true  → URL is in scope, callers may proceed.
+   *   - allowed=false → URL is out of scope; callers MUST surface this as
+   *                     a hard error (`ToolResult.error`), not a warning.
+   *
+   * `reason` is human-readable and meant to be embedded in the error
+   * message returned to the agent so it can self-correct.
+   */
+  match(url) {
+    let host;
+    try {
+      host = normalizeScopeHostname(new URL(url).hostname);
+    } catch {
+      return { allowed: false, reason: `out-of-scope: not a valid URL (${url})` };
+    }
+    const denyHit = this.outOfScope.find((rule) => matches(rule, host));
+    if (denyHit) {
+      return { allowed: false, reason: `out-of-scope: host '${host}' matches deny rule '${denyHit.raw}'` };
+    }
+    if (this.inScope.length === 0) {
+      return { allowed: false, reason: `out-of-scope: host '${host}' (no in_scope rules defined)` };
+    }
+    const allowHit = this.inScope.find((rule) => matches(rule, host));
+    if (allowHit) {
+      return { allowed: true, reason: `in-scope: host '${host}' matches '${allowHit.raw}'` };
+    }
+    return { allowed: false, reason: `out-of-scope: host '${host}' did not match any in_scope rule` };
+  }
+};
+function extractUrls(text) {
+  const re = /https?:\/\/[^\s'"`<>|]+/gi;
+  const out = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    let url = m[0];
+    while (url.length > 0 && /[.,;:)\]}]$/.test(url)) {
+      url = url.slice(0, -1);
+    }
+    if (url.length > 0)
+      out.push(url);
+  }
+  return out;
+}
+function loadScope(path) {
+  return ScopePolicy.fromJsonFile(path);
+}
+function matchUrl(url, policy) {
+  return policy.match(url);
+}
+function normalizeScopeHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.+$/, "");
+  const address = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
+  return isIP(address) === 6 ? new URL(`http://[${address}]/`).hostname : normalized;
+}
+function parseRule(raw) {
+  if (typeof raw !== "string" || raw.trim().length === 0) {
+    throw new Error(`Invalid scope rule: ${JSON.stringify(raw)} (must be a non-empty string)`);
+  }
+  const rule = raw.trim().toLowerCase();
+  if (rule.includes("/")) {
+    const parts = rule.split("/");
+    if (parts.length !== 2) {
+      throw new Error(`Invalid CIDR '${raw}': expected exactly one '/'`);
+    }
+    const [ip, prefixStr] = parts;
+    if (!/^\d+$/.test(prefixStr)) {
+      throw new Error(`Invalid CIDR prefix in '${raw}': must be a non-negative integer 0-32`);
+    }
+    const prefix = Number(prefixStr);
+    if (prefix < 0 || prefix > 32) {
+      throw new Error(`Invalid CIDR prefix in '${raw}': must be 0-32`);
+    }
+    if (isIP(ip) !== 4) {
+      throw new Error(`Invalid CIDR '${raw}': only IPv4 CIDR is supported`);
+    }
+    return { raw, kind: "cidr", cidr: { network: ipv4ToInt(ip), prefix } };
+  }
+  if (rule.startsWith("*.")) {
+    const suffix = normalizeScopeHostname(rule.slice(2));
+    if (suffix.length === 0 || suffix.includes("*")) {
+      throw new Error(`Invalid wildcard rule '${raw}': must be of the form '*.domain.tld'`);
+    }
+    return { raw, kind: "wildcard", suffix };
+  }
+  if (rule.includes("*")) {
+    throw new Error(`Invalid scope rule '${raw}': only leading '*.' wildcards are supported`);
+  }
+  return { raw, kind: "exact", host: normalizeScopeHostname(rule) };
+}
+function matches(rule, host) {
+  switch (rule.kind) {
+    case "exact":
+      return rule.host === host;
+    case "wildcard": {
+      const suffix = "." + rule.suffix;
+      return host !== rule.suffix && host.endsWith(suffix);
+    }
+    case "cidr": {
+      if (isIP(host) !== 4)
+        return false;
+      const { network, prefix } = rule.cidr;
+      if (prefix === 0)
+        return true;
+      const mask = prefix === 32 ? 4294967295 : ~((1 << 32 - prefix) - 1) >>> 0;
+      return (ipv4ToInt(host) & mask) >>> 0 === (network & mask) >>> 0;
+    }
+  }
+}
+function ipv4ToInt(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  return (parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
+}
+
+export {
+  ScopePolicy,
+  extractUrls,
+  loadScope,
+  matchUrl,
+  normalizeScopeHostname
+};

package/chunks/chunk-5G3ZXFBW.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  getDetectorById,
+  resolveDetectors,
+  runDetectorOnPackage
+} from "./chunk-RWONANDA.js";
+
+// packages/core/dist/stages/npm-dynamic-discovery.js
+import { randomUUID } from "node:crypto";
+function leadToFinding(pkg, detector, lead) {
+  const conf = lead.confirmation;
+  const severity = conf.severity ?? detector.severityFloor;
+  const novel = lead.dedup.novel;
+  const versionLabel = pkg.version ? `@${pkg.version}` : "";
+  const escalation = conf.evidence.escalation;
+  const description = [
+    `${detector.title} confirmed in npm package ${pkg.name}${versionLabel}.`,
+    `Class: ${detector.cwe} (${detector.category}).`,
+    `Observed consequence: ${conf.evidence.observation}`,
+    escalation ? `Escalation ${escalation.kind}: ${escalation.achieved ? "ACHIEVED" : "not achieved"}${escalation.note ? ` (${escalation.note})` : ""}.` : "",
+    novel ? "Novelty: no live advisory / fork-twin / prior report matched (disclosure-eligible)." : `Novelty: NON-novel \u2014 ${lead.dedup.source} (${lead.dedup.advisories.join("; ")}).`
+  ].filter(Boolean).join("\n");
+  const analysis = [
+    `Detector: ${detector.id}`,
+    `Candidate/source: ${conf.source ?? lead.candidateId}`,
+    `Severity: ${severity}`,
+    pkg.weeklyDownloads !== void 0 ? `Weekly downloads: ${pkg.weeklyDownloads}` : "",
+    "",
+    "---observed consequence (assume-FP: this is the runtime fact)---",
+    conf.evidence.observation,
+    conf.evidence.analysis ? `
+${conf.evidence.analysis}` : "",
+    "",
+    "---dedup---",
+    `novel=${novel} source=${lead.dedup.source}`,
+    ...lead.dedup.advisories.map((a) => `  ${a}`)
+  ].filter(Boolean).join("\n");
+  return {
+    id: randomUUID(),
+    templateId: `npm-dynamic-${detector.id}`,
+    title: `${detector.title} in ${pkg.name}${versionLabel}`,
+    description,
+    severity,
+    category: detector.category,
+    status: "discovered",
+    evidence: {
+      request: conf.evidence.payload ?? `${detector.id} candidate ${lead.candidateId}`,
+      response: conf.evidence.observation,
+      analysis
+    },
+    fingerprint: `npm-dynamic:${detector.id}:${pkg.name}:${conf.source ?? lead.candidateId}`,
+    // A runtime-observed consequence is a high-confidence lead; the shared
+    // adversarial-verify stage re-runs it at the publication bar regardless.
+    confidence: 0.85,
+    noveltyVerdict: novel ? "novel" : "possibly-known",
+    dedupRefs: lead.dedup.advisories,
+    timestamp: Date.now()
+  };
+}
+async function pool(items, limit, fn) {
+  let next = 0;
+  const n = Math.max(1, Math.min(limit, items.length || 1));
+  const workers = Array.from({ length: n }, async () => {
+    for (; ; ) {
+      const i = next++;
+      if (i >= items.length)
+        return;
+      await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+}
+async function runNpmDynamicDiscovery(opts) {
+  const log = opts.log ?? (() => {
+  });
+  if (!opts.packageRunner && !opts.probeFactory) {
+    throw new Error("runNpmDynamicDiscovery: provide a packageRunner (sandbox) or a probeFactory (in-process)");
+  }
+  const { detectors, unknown: unknownDetectors } = resolveDetectors(opts.detectorIds);
+  for (const u of unknownDetectors)
+    log(`WARN unknown detector id "${u}" \u2014 skipped`);
+  const findings = [];
+  const novel = [];
+  const known = [];
+  const unpreparable = [];
+  const warnings = [];
+  const statById = /* @__PURE__ */ new Map();
+  for (const d of detectors)
+    statById.set(d.id, { detectorId: d.id, packagesRun: 0, candidates: 0, confirmed: 0, novel: 0 });
+  const promote = async (pkg, detector, outcome) => {
+    for (const w of outcome.warnings)
+      warnings.push(`${pkg.name}/${detector.id}: ${w}`);
+    const stat = statById.get(detector.id);
+    if (!stat)
+      return;
+    if (outcome.ran)
+      stat.packagesRun += 1;
+    stat.candidates += outcome.candidates;
+    for (const lead of outcome.leads) {
+      stat.confirmed += 1;
+      const finding = leadToFinding(pkg, detector, lead);
+      findings.push(finding);
+      if (lead.dedup.novel) {
+        stat.novel += 1;
+        novel.push(finding);
+        if (opts.onConfirmed) {
+          try {
+            await opts.onConfirmed(finding);
+          } catch (e) {
+            warnings.push(`onConfirmed(${finding.id}) threw: ${e instanceof Error ? e.message : String(e)}`);
+          }
+        }
+      } else {
+        known.push(finding);
+      }
+      log(`${lead.dedup.novel ? "NOVEL" : "known"} ${detector.id} ${pkg.name}: ${lead.confirmation.evidence.observation}`);
+    }
+  };
+  await pool(opts.worklist, opts.concurrency ?? 1, async (pkg) => {
+    if (opts.packageRunner) {
+      let ran;
+      try {
+        ran = await opts.packageRunner(pkg, detectors.map((d) => d.id));
+      } catch (e) {
+        ran = void 0;
+        warnings.push(`${pkg.name}: packageRunner threw: ${e instanceof Error ? e.message : String(e)}`);
+      }
+      if (!ran) {
+        unpreparable.push(pkg.name);
+        log(`SKIP ${pkg.name}: sandbox could not prepare/execute (skipped, not confirmed)`);
+        return;
+      }
+      for (const w of ran.warnings)
+        warnings.push(`${pkg.name}: ${w}`);
+      for (const outcome of ran.outcomes) {
+        const detector = getDetectorById(outcome.detectorId);
+        if (!detector) {
+          warnings.push(`${pkg.name}: sandbox returned unknown detector "${outcome.detectorId}"`);
+          continue;
+        }
+        await promote(pkg, detector, outcome);
+      }
+      return;
+    }
+    let probe;
+    try {
+      probe = await opts.probeFactory(pkg);
+    } catch (e) {
+      probe = void 0;
+      warnings.push(`${pkg.name}: probeFactory threw: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!probe) {
+      unpreparable.push(pkg.name);
+      log(`SKIP ${pkg.name}: could not prepare execution probe`);
+      return;
+    }
+    for (const detector of detectors) {
+      const outcome = await runDetectorOnPackage(detector, probe, {
+        guards: opts.guards,
+        advisoryLookup: opts.advisoryLookup
+      });
+      await promote(pkg, detector, outcome);
+    }
+  });
+  return {
+    findings,
+    novel,
+    known,
+    unpreparable,
+    unknownDetectors,
+    scannedPackages: opts.worklist.length,
+    perDetector: [...statById.values()],
+    warnings
+  };
+}
+
+export {
+  leadToFinding,
+  runNpmDynamicDiscovery
+};