0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-ASUR522M.js

@@ -0,0 +1,518 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  verifyKernelFinding
+} from "./chunk-3KPWWJCI.js";
+import {
+  createJournalWriter
+} from "./chunk-UCYRA73C.js";
+import {
+  homeStateDir
+} from "./chunk-6L26OBWI.js";
+
+// packages/core/dist/cve/adapt-loop.js
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename } from "node:path";
+
+// packages/core/dist/cve/poc-fetcher.js
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+var MAX_POC_BYTES = 1 * 1024 * 1024;
+var LANG_EXT = {
+  c: "c",
+  py: "py",
+  sh: "sh",
+  syz: "syz"
+};
+var TEXT_CONTENT_TYPES = [
+  "text/",
+  "application/json",
+  "application/javascript",
+  "application/x-sh",
+  "application/x-shellscript",
+  "application/x-python",
+  "application/octet-stream"
+  // GitHub raw sometimes serves this for plaintext
+];
+var PocFetchError = class extends Error {
+  kind;
+  constructor(kind, message) {
+    super(message);
+    this.name = "PocFetchError";
+    this.kind = kind;
+  }
+};
+function defaultCacheDir() {
+  return process.env["0SEC_CVE_POC_CACHE"]?.trim() || join(homeStateDir(), "cve-pocs");
+}
+function buildHeaders(token) {
+  const headers = {
+    "Accept": "*/*",
+    "User-Agent": "0sec-cve-adapt/0.1"
+  };
+  const resolved = token ?? process.env.GITHUB_TOKEN?.trim();
+  if (resolved)
+    headers["Authorization"] = `Bearer ${resolved}`;
+  return headers;
+}
+function isTextContentType(contentType) {
+  if (!contentType)
+    return true;
+  const lower = contentType.toLowerCase();
+  return TEXT_CONTENT_TYPES.some((prefix) => lower.includes(prefix));
+}
+function extractInlineCodeBlock(html) {
+  const fenced = /```(?:[a-zA-Z0-9_+-]*)\n([\s\S]*?)\n?```/m.exec(html);
+  if (fenced && fenced[1]) {
+    return fenced[1];
+  }
+  const htmlBlock = /<pre[^>]*>\s*<code[^>]*>([\s\S]*?)<\/code>\s*<\/pre>/i.exec(html);
+  if (htmlBlock && htmlBlock[1]) {
+    return decodeHtmlEntities(htmlBlock[1]);
+  }
+  const preBlock = /<pre[^>]*>([\s\S]*?)<\/pre>/i.exec(html);
+  if (preBlock && preBlock[1]) {
+    return decodeHtmlEntities(preBlock[1]);
+  }
+  throw new PocFetchError("no-inline-block", "no fenced code block found in writeup");
+}
+function decodeHtmlEntities(input) {
+  return input.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&amp;/g, "&");
+}
+function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function cacheEntryPaths(cacheDir, sha, ext) {
+  return {
+    source: join(cacheDir, `${sha}.${ext}`),
+    meta: join(cacheDir, `${sha}.meta.json`)
+  };
+}
+function urlPointerPath(cacheDir, url) {
+  return join(cacheDir, `${sha256(url).slice(0, 24)}.url.json`);
+}
+function readUrlPointer(cacheDir, url) {
+  const path = urlPointerPath(cacheDir, url);
+  if (!existsSync(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    if (parsed.url !== url)
+      return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function writeUrlPointer(cacheDir, pointer) {
+  writeFileSync(urlPointerPath(cacheDir, pointer.url), JSON.stringify(pointer, null, 2), "utf-8");
+}
+async function fetchPoc(candidate, opts = {}) {
+  const cacheDir = opts.cacheDir ?? defaultCacheDir();
+  mkdirSync(cacheDir, { recursive: true });
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const pointer = readUrlPointer(cacheDir, candidate.url);
+  if (pointer) {
+    const { source: source2 } = cacheEntryPaths(cacheDir, pointer.sha256, pointer.ext);
+    if (existsSync(source2)) {
+      const bytes = readFileSync(source2);
+      if (sha256(bytes) === pointer.sha256) {
+        return {
+          local_path: source2,
+          language: candidate.language,
+          sha256: pointer.sha256,
+          source_url: candidate.url,
+          fetched_at: pointer.fetched_at
+        };
+      }
+    }
+  }
+  let response;
+  try {
+    response = await fetchImpl(candidate.url, {
+      method: "GET",
+      headers: buildHeaders(opts.githubToken)
+    });
+  } catch (err) {
+    throw new PocFetchError("network", `network error fetching ${candidate.url}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (!response.ok) {
+    throw new PocFetchError("http", `HTTP ${response.status} fetching ${candidate.url}: ${response.statusText}`);
+  }
+  const contentLength = response.headers.get("content-length");
+  if (contentLength && parseInt(contentLength, 10) > MAX_POC_BYTES) {
+    throw new PocFetchError("too-large", `PoC at ${candidate.url} is ${contentLength} bytes (cap ${MAX_POC_BYTES})`);
+  }
+  const contentType = response.headers.get("content-type");
+  if (!isTextContentType(contentType)) {
+    throw new PocFetchError("non-text", `PoC at ${candidate.url} has non-text content-type: ${contentType}`);
+  }
+  const buf = Buffer.from(await response.arrayBuffer());
+  if (buf.byteLength > MAX_POC_BYTES) {
+    throw new PocFetchError("too-large", `PoC at ${candidate.url} is ${buf.byteLength} bytes (cap ${MAX_POC_BYTES})`);
+  }
+  let payload = buf.toString("utf-8");
+  if (candidate.source === "inline-writeup") {
+    try {
+      payload = extractInlineCodeBlock(payload);
+    } catch (err) {
+      if (err instanceof PocFetchError)
+        throw err;
+      throw new PocFetchError("extract", `failed to extract inline code block: ${String(err)}`);
+    }
+  }
+  const newSha = sha256(payload);
+  const ext = LANG_EXT[candidate.language];
+  const { source } = cacheEntryPaths(cacheDir, newSha, ext);
+  if (pointer && pointer.sha256 !== newSha && opts.onShaMismatch) {
+    opts.onShaMismatch({ url: candidate.url, oldSha: pointer.sha256, newSha });
+  }
+  writeFileSync(source, payload, "utf-8");
+  const fetched_at = now().toISOString();
+  writeUrlPointer(cacheDir, { url: candidate.url, sha256: newSha, ext, fetched_at });
+  return {
+    local_path: source,
+    language: candidate.language,
+    sha256: newSha,
+    source_url: candidate.url,
+    fetched_at
+  };
+}
+
+// packages/core/dist/cve/adapt-loop.js
+var DEFAULT_ATTEMPTS = 5;
+var DEFAULT_WALL_CLOCK_MS = 30 * 60 * 1e3;
+function applyUnifiedDiff(source, diff) {
+  const sourceLines = source.split("\n");
+  const diffLines = diff.replace(/\r\n/g, "\n").split("\n");
+  while (diffLines.length > 0 && diffLines[diffLines.length - 1] === "") {
+    diffLines.pop();
+  }
+  let i = 0;
+  while (i < diffLines.length && !diffLines[i].startsWith("@@"))
+    i += 1;
+  if (i >= diffLines.length) {
+    return source;
+  }
+  const out = [...sourceLines];
+  let cursorOffset = 0;
+  while (i < diffLines.length) {
+    const header = diffLines[i];
+    const match = /^@@\s+-(\d+)(?:,(\d+))?\s+\+(\d+)(?:,(\d+))?\s+@@/.exec(header);
+    if (!match) {
+      throw new Error(`malformed hunk header: ${header}`);
+    }
+    const oldStart = parseInt(match[1], 10);
+    i += 1;
+    let target = oldStart - 1 + cursorOffset;
+    while (i < diffLines.length && !diffLines[i].startsWith("@@")) {
+      const line = diffLines[i];
+      const marker = line[0];
+      const text = line.slice(1);
+      if (marker === " ") {
+        if (out[target] !== text) {
+          throw new Error(`context mismatch at line ${target + 1}: expected "${text}", got "${out[target] ?? "<eof>"}"`);
+        }
+        target += 1;
+      } else if (marker === "-") {
+        if (out[target] !== text) {
+          throw new Error(`delete mismatch at line ${target + 1}: expected "${text}", got "${out[target] ?? "<eof>"}"`);
+        }
+        out.splice(target, 1);
+        cursorOffset -= 1;
+      } else if (marker === "+") {
+        out.splice(target, 0, text);
+        target += 1;
+        cursorOffset += 1;
+      } else if (marker === "\\") {
+      } else {
+        throw new Error(`unknown diff marker '${marker ?? "<empty>"}' at line: ${line}`);
+      }
+      i += 1;
+    }
+  }
+  return out.join("\n");
+}
+function inferAdaptedFilename(originalPath, attemptIndex) {
+  const base = basename(originalPath);
+  const dot = base.lastIndexOf(".");
+  if (dot < 0)
+    return `${base}.adapt${attemptIndex}`;
+  return `${base.slice(0, dot)}.adapt${attemptIndex}${base.slice(dot)}`;
+}
+function defaultAgent() {
+  return async () => {
+    return "";
+  };
+}
+function renderAdaptationPrompt(input) {
+  const lines = [];
+  lines.push(`# CVE adaptation request \u2014 ${input.cveId}`);
+  lines.push(`Attempt ${input.attemptIndex} did not reproduce the bug.`);
+  lines.push("");
+  lines.push("Your job: produce a **unified diff** against the PoC source below that", "makes the reproducer trigger on the target kernel. Output ONLY the diff,", "starting with `--- a/poc.<ext>` and `+++ b/poc.<ext>` headers. If you have", "no useful adaptation, output an empty diff (no `@@` hunks).");
+  lines.push("");
+  lines.push(`## PoC source (language=${input.pocLanguage})`);
+  lines.push("```");
+  lines.push(input.pocSource);
+  lines.push("```");
+  if (input.writeupText) {
+    lines.push("");
+    lines.push("## Writeup excerpt");
+    lines.push(input.writeupText);
+  }
+  if (input.targetKernelSubsystemSource) {
+    lines.push("");
+    lines.push("## Target kernel subsystem source (relevant slice)");
+    lines.push("```c");
+    lines.push(input.targetKernelSubsystemSource);
+    lines.push("```");
+  }
+  lines.push("");
+  lines.push("## Error log (build / dmesg from last attempt)");
+  lines.push("```");
+  lines.push(input.errorLog);
+  lines.push("```");
+  return lines.join("\n");
+}
+function nowMs(clock) {
+  return clock ? clock() : Date.now();
+}
+async function adaptAndVerify(cveId, opts) {
+  const attemptsBudget = opts.attempts ?? DEFAULT_ATTEMPTS;
+  const wallClockMs = opts.wallClockMs ?? DEFAULT_WALL_CLOCK_MS;
+  const fetcher = opts.fetcher ?? fetchPoc;
+  const runner = opts.runner ?? verifyKernelFinding;
+  const agent = opts.agent ?? defaultAgent();
+  const clock = opts.clock;
+  const startedAt = nowMs(clock);
+  const deadline = startedAt + wallClockMs;
+  const runId = opts.runId ?? `cve-adapt-${cveId.toLowerCase()}-${startedAt}`;
+  const journal = (opts.journalFactory ?? ((id) => createJournalWriter({ runId: id })))(runId);
+  journal.append({
+    kind: "dispatch",
+    targetAgent: "cve-adapt-loop",
+    objective: `adapt + verify PoC for ${cveId}`,
+    context: { kernelTree: opts.kernelTree, kernelConfig: opts.kernelConfig ?? "kasan", attemptsBudget, wallClockMs }
+  });
+  let artifacts;
+  try {
+    artifacts = await opts.artifactProvider(cveId);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    journal.append({ kind: "error", message: `artifact-provider failed: ${message}` });
+    journal.append({ kind: "done", status: "failed", summary: "artifact provider failed" });
+    return {
+      status: "no_artifact",
+      cveId,
+      attempts: [],
+      total_ms: nowMs(clock) - startedAt
+    };
+  }
+  if (!artifacts.pocCandidates || artifacts.pocCandidates.length === 0) {
+    journal.append({
+      kind: "observation",
+      source: "cve-adapt-loop",
+      summary: "no PoC candidates returned by artifact provider",
+      data: { cveId }
+    });
+    journal.append({ kind: "done", status: "failed", summary: "no_artifact" });
+    return {
+      status: "no_artifact",
+      cveId,
+      attempts: [],
+      total_ms: nowMs(clock) - startedAt
+    };
+  }
+  const ordered = [...artifacts.pocCandidates].sort((a, b) => b.confidence - a.confidence);
+  const attempts = [];
+  let totalAttempts = 0;
+  let lastPocPath;
+  for (const candidate of ordered) {
+    if (totalAttempts >= attemptsBudget)
+      break;
+    if (nowMs(clock) >= deadline)
+      break;
+    journal.append({
+      kind: "observation",
+      source: "cve-adapt-loop",
+      summary: "attempt_started",
+      data: { candidate, attemptIndex: totalAttempts }
+    });
+    const attemptStart = nowMs(clock);
+    let fetched = null;
+    try {
+      fetched = await fetcher(candidate, {});
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      journal.append({ kind: "error", message: `poc_fetch_failed: ${message}` });
+      attempts.push({
+        candidate,
+        attemptIndex: totalAttempts,
+        fetched: null,
+        verification: null,
+        diffApplied: false,
+        error: message,
+        durationMs: nowMs(clock) - attemptStart
+      });
+      totalAttempts += 1;
+      continue;
+    }
+    journal.append({
+      kind: "observation",
+      source: "cve-adapt-loop",
+      summary: "poc_fetched",
+      data: { sha256: fetched.sha256, source_url: fetched.source_url, local_path: fetched.local_path }
+    });
+    let currentPath = fetched.local_path;
+    let confirmed = null;
+    while (totalAttempts < attemptsBudget && nowMs(clock) < deadline) {
+      const verify = await runVerifySafe(runner, currentPath, fetched.language, opts);
+      journal.append({
+        kind: "observation",
+        source: "cve-adapt-loop",
+        summary: "verify_run",
+        data: {
+          attemptIndex: totalAttempts,
+          status: verify.status,
+          signature: verify.signature ?? null,
+          dmesg_path: verify.dmesg_path
+        }
+      });
+      if (verify.status === "reproduced") {
+        confirmed = verify;
+        attempts.push({
+          candidate,
+          attemptIndex: totalAttempts,
+          fetched,
+          verification: verify,
+          diffApplied: currentPath !== fetched.local_path,
+          durationMs: nowMs(clock) - attemptStart
+        });
+        lastPocPath = currentPath;
+        totalAttempts += 1;
+        break;
+      }
+      attempts.push({
+        candidate,
+        attemptIndex: totalAttempts,
+        fetched,
+        verification: verify,
+        diffApplied: currentPath !== fetched.local_path,
+        durationMs: nowMs(clock) - attemptStart
+      });
+      totalAttempts += 1;
+      lastPocPath = currentPath;
+      if (totalAttempts >= attemptsBudget || nowMs(clock) >= deadline)
+        break;
+      const errorLog = existsSync2(verify.dmesg_path) ? readFileSync2(verify.dmesg_path, "utf-8") : "";
+      const pocSource = readFileSync2(currentPath, "utf-8");
+      const promptInput = {
+        cveId,
+        pocSource,
+        pocLanguage: fetched.language,
+        writeupText: artifacts.writeupText,
+        errorLog,
+        attemptIndex: totalAttempts
+      };
+      let diff = "";
+      try {
+        diff = await agent(promptInput);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        journal.append({ kind: "error", message: `agent_failed: ${message}` });
+        break;
+      }
+      if (!diff.trim() || !diff.includes("@@")) {
+        journal.append({
+          kind: "observation",
+          source: "cve-adapt-loop",
+          summary: "adapt_diff_empty",
+          data: { attemptIndex: totalAttempts }
+        });
+        break;
+      }
+      let nextSource;
+      try {
+        nextSource = applyUnifiedDiff(pocSource, diff);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        journal.append({
+          kind: "error",
+          message: `apply_diff_failed: ${message}`
+        });
+        break;
+      }
+      const nextPath = inferAdaptedFilename(fetched.local_path, totalAttempts);
+      const nextAbs = currentPath.replace(basename(currentPath), basename(nextPath));
+      writeFileSync2(nextAbs, nextSource, "utf-8");
+      journal.append({
+        kind: "observation",
+        source: "cve-adapt-loop",
+        summary: "adapt_diff_applied",
+        data: { attemptIndex: totalAttempts, prev_path: currentPath, next_path: nextAbs },
+        artifacts: [
+          { name: "adapt.diff", mediaType: "text/x-diff", content: diff }
+        ]
+      });
+      currentPath = nextAbs;
+      lastPocPath = nextAbs;
+    }
+    if (confirmed) {
+      journal.append({ kind: "done", status: "success", summary: "reproduced" });
+      return {
+        status: "confirmed",
+        cveId,
+        attempts,
+        final_poc_path: lastPocPath,
+        signature: confirmed.signature,
+        total_ms: nowMs(clock) - startedAt
+      };
+    }
+  }
+  const exhaustedByBudget = totalAttempts >= attemptsBudget || nowMs(clock) >= deadline;
+  const status = exhaustedByBudget ? "budget_exhausted" : "unreproduced";
+  journal.append({
+    kind: "done",
+    status: "failed",
+    summary: status
+  });
+  return {
+    status,
+    cveId,
+    attempts,
+    final_poc_path: lastPocPath,
+    total_ms: nowMs(clock) - startedAt
+  };
+}
+async function runVerifySafe(runner, reproducerPath, language, opts) {
+  const isSyz = language === "syz";
+  try {
+    return await runner({
+      kernelTree: opts.kernelTree,
+      kernelConfig: opts.kernelConfig,
+      reproducerPath: isSyz ? void 0 : reproducerPath,
+      syzProgramPath: isSyz ? reproducerPath : void 0
+    });
+  } catch (err) {
+    return {
+      status: "run_failed",
+      dmesg_path: "",
+      build_cache_hit: false,
+      signature: void 0
+    };
+  }
+}
+
+export {
+  MAX_POC_BYTES,
+  PocFetchError,
+  extractInlineCodeBlock,
+  fetchPoc,
+  applyUnifiedDiff,
+  renderAdaptationPrompt,
+  adaptAndVerify
+};