0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-ATATQACO.js

@@ -0,0 +1,471 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  eventBus,
+  isCloudEventSinkActive
+} from "./chunk-ADOLI6DT.js";
+
+// packages/core/dist/runtime/process.js
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { writeFileSync } from "node:fs";
+var dim = (text) => `\x1B[2m${text}\x1B[0m`;
+function formatToolDetail(input) {
+  const inp = input;
+  if (inp?.file_path)
+    return String(inp.file_path).split("/").slice(-2).join("/");
+  if (inp?.command)
+    return String(inp.command).slice(0, 60);
+  if (inp?.pattern)
+    return String(inp.pattern).slice(0, 40);
+  if (inp?.path)
+    return String(inp.path).slice(0, 60);
+  if (inp?.content)
+    return "(writing file)";
+  return "";
+}
+function friendlyToolName(name) {
+  const stripped = name.replace(/^mcp__\w+__/, "");
+  return stripped.split("_").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function showToolCall(onToolCall, name, input) {
+  const rawName = name || "tool";
+  if (/^(ToolSearch|Read|Glob|Grep|Write|Edit|Bash|LSP|Agent)$/i.test(rawName))
+    return;
+  const toolName = friendlyToolName(rawName);
+  const detail = formatToolDetail(input);
+  if (onToolCall) {
+    onToolCall(toolName, detail);
+  }
+  if (process.stderr.isTTY && !onToolCall) {
+    process.stderr.write(dim(`    ${toolName}${detail ? ": " + detail : ""}
+`));
+  }
+}
+var RUNTIME_COMMANDS = {
+  claude: "claude",
+  codex: "codex",
+  gemini: "gemini"
+};
+function resolveCliEntrypoint() {
+  return resolve(process.argv[1] ?? join(process.cwd(), "dist", "index.js"));
+}
+function buildOsecMcpCommandArgs(context) {
+  const cliEntrypoint = resolveCliEntrypoint();
+  const args = [
+    cliEntrypoint,
+    "mcp-server",
+    "--target",
+    context.target ?? "",
+    "--scan-id",
+    context.scanId ?? "no-scan-id"
+  ];
+  if (context.mcp?.dbPath) {
+    args.push("--db-path", context.mcp.dbPath);
+  }
+  if (context.mcp?.scopeFile) {
+    args.push("--scope", context.mcp.scopeFile);
+  }
+  if (context.mcp?.rateLimit) {
+    args.push("--rate-limit", context.mcp.rateLimit);
+  }
+  if (context.mcp?.allowScanners) {
+    args.push("--allow-scanners");
+  }
+  return args;
+}
+function numericField(obj, key) {
+  const v = obj[key];
+  if (typeof v === "number" && Number.isFinite(v))
+    return v;
+  if (typeof v === "string" && /^\d+$/.test(v))
+    return Number(v);
+  return void 0;
+}
+function safeJsonStringify(v) {
+  try {
+    return JSON.stringify(v) ?? "";
+  } catch {
+    return "(unserialisable)";
+  }
+}
+function buildClaudeMcpConfig(context) {
+  return JSON.stringify({
+    mcpServers: {
+      "0sec": {
+        command: process.execPath,
+        args: buildOsecMcpCommandArgs(context)
+      }
+    }
+  });
+}
+var ProcessRuntime = class {
+  type;
+  config;
+  command;
+  constructor(config) {
+    this.type = config.type;
+    this.config = config;
+    this.command = RUNTIME_COMMANDS[config.type] ?? config.type;
+  }
+  async execute(prompt, context) {
+    const start = Date.now();
+    const args = this.buildArgs(prompt, context);
+    const env = this.buildEnv(context);
+    const onToolCall = this.config.onToolCall;
+    const scanId = context?.scanId;
+    const emitScanEvents = this.type === "codex" && isCloudEventSinkActive();
+    const maxTurnsHint = 40;
+    let turnNumber = 0;
+    let toolCallSeq = 0;
+    let deltaSeq = 0;
+    let turnStartedAt = 0;
+    const toolCallStartedAt = /* @__PURE__ */ new Map();
+    const seenSequenceNumbers = /* @__PURE__ */ new Set();
+    const isSeenSequence = (event) => {
+      const seq = event.sequence_number;
+      if (typeof seq !== "number" && typeof seq !== "string")
+        return false;
+      const key = `${event.type ?? "?"}|${seq}`;
+      if (seenSequenceNumbers.has(key))
+        return true;
+      seenSequenceNumbers.add(key);
+      return false;
+    };
+    const emitCodexCloudEvents = (event) => {
+      if (isSeenSequence(event))
+        return;
+      const eventType = typeof event.type === "string" ? event.type : "";
+      switch (eventType) {
+        case "thread.started": {
+          eventBus.emit("llm_planner_invoked", {
+            turn: 0,
+            model: this.config.model,
+            role: "attack"
+          });
+          return;
+        }
+        case "turn.started": {
+          turnNumber += 1;
+          turnStartedAt = Date.now();
+          deltaSeq = 0;
+          eventBus.emit("agent_turn_started", {
+            turn: turnNumber,
+            max_turns: maxTurnsHint,
+            role: "attack"
+          });
+          eventBus.emit("llm_planner_invoked", {
+            turn: turnNumber,
+            model: this.config.model,
+            role: "attack"
+          });
+          return;
+        }
+        case "turn.completed": {
+          const usage = event.usage ?? {};
+          const inputTokens = numericField(usage, "input_tokens");
+          const cachedInputTokens = numericField(usage, "cached_input_tokens");
+          const outputTokens = numericField(usage, "output_tokens");
+          const reasoningTokens = numericField(usage, "reasoning_output_tokens");
+          const durationMs = turnStartedAt > 0 ? Date.now() - turnStartedAt : 0;
+          eventBus.emit("agent_turn_completed", {
+            turn: turnNumber,
+            duration_ms: durationMs,
+            reason: "continue",
+            role: "attack"
+          });
+          eventBus.emit("cost_update", {
+            turn: turnNumber,
+            cost_usd: 0,
+            input_tokens: inputTokens,
+            output_tokens: outputTokens,
+            token_input: inputTokens,
+            token_output: outputTokens,
+            cached_input_tokens: cachedInputTokens,
+            reasoning_output_tokens: reasoningTokens
+          });
+          return;
+        }
+        case "item.started": {
+          const item = event.item ?? {};
+          const itemType = typeof item.type === "string" ? item.type : "";
+          if (itemType === "command_execution" && typeof item.command === "string") {
+            toolCallSeq += 1;
+            toolCallStartedAt.set(toolCallSeq, Date.now());
+            eventBus.emit("tool_call_started", {
+              tool: "shell",
+              turn: turnNumber,
+              args_preview: item.command.slice(0, 200),
+              ts: Date.now()
+            });
+          } else if (itemType === "mcp_tool_call") {
+            toolCallSeq += 1;
+            toolCallStartedAt.set(toolCallSeq, Date.now());
+            const server = typeof item.server === "string" ? item.server : "?";
+            const tool = typeof item.tool === "string" ? item.tool : "?";
+            const argsRaw = item.arguments ?? {};
+            const argsPreview = typeof argsRaw === "string" ? argsRaw : safeJsonStringify(argsRaw);
+            eventBus.emit("tool_call_started", {
+              tool: `${server}__${tool}`,
+              turn: turnNumber,
+              args_preview: argsPreview.slice(0, 200),
+              ts: Date.now()
+            });
+          }
+          return;
+        }
+        case "item.completed": {
+          const item = event.item ?? {};
+          const itemType = typeof item.type === "string" ? item.type : "";
+          if (itemType === "command_execution") {
+            const startedAt = toolCallStartedAt.get(toolCallSeq);
+            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
+            toolCallStartedAt.delete(toolCallSeq);
+            eventBus.emit("tool_call_completed", {
+              tool: "shell",
+              turn: turnNumber,
+              duration_ms: durationMs,
+              status: "ok",
+              ts: Date.now()
+            });
+          } else if (itemType === "mcp_tool_call") {
+            const startedAt = toolCallStartedAt.get(toolCallSeq);
+            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
+            toolCallStartedAt.delete(toolCallSeq);
+            const server = typeof item.server === "string" ? item.server : "?";
+            const tool = typeof item.tool === "string" ? item.tool : "?";
+            const status = item.status === "success" || item.status === "completed" ? "ok" : "error";
+            const errorMsg = status === "error" ? typeof item.error === "string" ? item.error : safeJsonStringify(item.error ?? null) : void 0;
+            eventBus.emit("tool_call_completed", {
+              tool: `${server}__${tool}`,
+              turn: turnNumber,
+              duration_ms: durationMs,
+              status,
+              ...errorMsg ? { error: errorMsg.slice(0, 400) } : {},
+              ts: Date.now()
+            });
+          } else if (itemType === "function_call" || itemType === "tool_call") {
+            toolCallSeq += 1;
+            const toolName = typeof item.tool_name === "string" && item.tool_name || typeof item.name === "string" && item.name || "mcp_tool";
+            const argsField = item.arguments ?? item.input ?? "";
+            const detail = typeof argsField === "string" ? argsField : safeJsonStringify(argsField);
+            eventBus.emit("tool_call_started", {
+              tool: toolName,
+              turn: turnNumber,
+              args_preview: detail.slice(0, 200),
+              ts: Date.now()
+            });
+            eventBus.emit("tool_call_completed", {
+              tool: toolName,
+              turn: turnNumber,
+              duration_ms: 0,
+              status: "ok",
+              ts: Date.now()
+            });
+          } else if (itemType === "reasoning") {
+            const reasoningText = typeof item.text === "string" && item.text || typeof item.summary === "string" && item.summary || "";
+            if (reasoningText.length > 0) {
+              eventBus.emit("reasoning_summary", {
+                turn: turnNumber,
+                summary: reasoningText.slice(0, 2e3)
+              });
+            }
+          } else if (itemType === "agent_message") {
+            const messageText = typeof item.text === "string" ? item.text : "";
+            if (messageText.length > 0) {
+              deltaSeq += 1;
+              eventBus.emit("delta", {
+                turn: turnNumber,
+                scope: "assistant_response",
+                text: messageText.slice(0, 2e3),
+                seq: deltaSeq,
+                role: "attack"
+              });
+            }
+          }
+          return;
+        }
+      }
+    };
+    return new Promise((resolve2) => {
+      let stdout = "";
+      let stderr = "";
+      let resultText = "";
+      let timedOut = false;
+      const isJsonStream = args.includes("stream-json") || args.includes("--json");
+      const proc = spawn(this.command, args, {
+        cwd: this.config.cwd ?? process.cwd(),
+        env: { ...process.env, ...env },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      proc.stdout.on("data", (chunk) => {
+        const text = chunk.toString();
+        stdout += text;
+        if (isJsonStream) {
+          for (const line of text.split("\n")) {
+            if (!line.trim())
+              continue;
+            try {
+              const event = JSON.parse(line);
+              if (event.type === "assistant" && event.message?.content) {
+                for (const block of event.message.content) {
+                  if (block.type === "text") {
+                    resultText += block.text;
+                    this.config.onThinking?.(block.text);
+                  } else if (block.type === "tool_use") {
+                    showToolCall(onToolCall, block.name, block.input);
+                  }
+                }
+              } else if (event.type === "result") {
+                resultText = event.result || resultText;
+              }
+              if (event.type === "item.started" && event.item?.type === "command_execution") {
+                showToolCall(onToolCall, "shell", { command: event.item.command });
+              }
+              if (event.type === "item.completed" && event.item) {
+                if (event.item.type === "agent_message" && event.item.text) {
+                  resultText += event.item.text;
+                  this.config.onThinking?.(event.item.text);
+                } else if (event.item.type === "command_execution" && event.item.command) {
+                }
+              }
+              if (emitScanEvents)
+                emitCodexCloudEvents(event);
+            } catch {
+            }
+          }
+        }
+      });
+      proc.stderr.on("data", (chunk) => {
+        const text = chunk.toString();
+        stderr += text;
+        if (/permission|approve|allow.*tool/i.test(stderr) && stderr.length > 500) {
+          proc.kill("SIGTERM");
+          stderr += "\n[0sec] Subprocess killed: MCP tools require interactive approval. Use --runtime api instead.";
+        }
+      });
+      const timer = setTimeout(() => {
+        timedOut = true;
+        proc.kill("SIGTERM");
+        setTimeout(() => proc.kill("SIGKILL"), 5e3);
+      }, this.config.timeout);
+      proc.on("close", (code) => {
+        clearTimeout(timer);
+        const output = isJsonStream ? (resultText || stdout).trim() : stdout.trim();
+        resolve2({
+          output,
+          exitCode: code,
+          timedOut,
+          durationMs: Date.now() - start,
+          error: code !== 0 ? stderr.trim() || void 0 : void 0
+        });
+      });
+      proc.on("error", (err) => {
+        clearTimeout(timer);
+        resolve2({
+          output: "",
+          exitCode: 1,
+          timedOut: false,
+          durationMs: Date.now() - start,
+          error: err.message
+        });
+      });
+    });
+  }
+  async isAvailable() {
+    const attempt = (timeoutMs) => new Promise((resolve2) => {
+      const proc = spawn(this.command, ["--version"], {
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+      let settled = false;
+      const finish = (ok) => {
+        if (settled)
+          return;
+        settled = true;
+        resolve2(ok);
+      };
+      proc.on("close", (code) => finish(code === 0));
+      proc.on("error", () => finish(false));
+      setTimeout(() => {
+        proc.kill();
+        finish(false);
+      }, timeoutMs).unref?.();
+    });
+    if (await attempt(5e3))
+      return true;
+    return attempt(15e3);
+  }
+  buildArgs(prompt, context) {
+    switch (this.type) {
+      case "claude": {
+        const args = ["-p", prompt, "--verbose", "--output-format", "stream-json"];
+        if (context?.mcp?.enableTargetTools && context.target && context.scanId) {
+          args.push("--mcp-config", buildClaudeMcpConfig(context), "--dangerously-skip-permissions");
+        }
+        if (context?.systemPrompt) {
+          args.push("--system-prompt", context.systemPrompt);
+        }
+        if (this.config.outputSchema) {
+          args.push("--json-schema", JSON.stringify(this.config.outputSchema));
+        }
+        return args;
+      }
+      case "codex": {
+        const args = [
+          "exec",
+          "--skip-git-repo-check",
+          "--json"
+        ];
+        if (this.config.model) {
+          args.push("--model", this.config.model);
+        }
+        if (context?.mcp?.enableTargetTools && context.target && context.scanId) {
+          throw new Error("Codex CLI MCP target tools are not supported. Use the direct ChatGPT Codex provider for live target scans.");
+        }
+        if (this.config.outputSchema) {
+          const schemaPath = join(tmpdir(), `0sec-schema-${Date.now()}.json`);
+          writeFileSync(schemaPath, JSON.stringify(this.config.outputSchema));
+          args.push("--output-schema", schemaPath);
+        }
+        args.push(prompt);
+        return args;
+      }
+      case "gemini": {
+        const args = ["-p", prompt, "--output-format", "stream-json"];
+        return args;
+      }
+      default:
+        return ["-p", prompt];
+    }
+  }
+  buildEnv(context) {
+    const env = {
+      ...this.config.env
+    };
+    if (context?.target) {
+      env["0SEC_TARGET"] = context.target;
+    }
+    if (context?.findings) {
+      env["0SEC_FINDINGS"] = context.findings;
+    }
+    if (context?.templateId) {
+      env["0SEC_TEMPLATE_ID"] = context.templateId;
+    }
+    if (context?.mcp?.auth) {
+      env["0SEC_MCP_AUTH_JSON"] = JSON.stringify(context.mcp.auth);
+    }
+    if (context?.mcp?.attributionHeaders) {
+      env["0SEC_MCP_ATTRIBUTION_HEADERS_JSON"] = JSON.stringify(context.mcp.attributionHeaders);
+    }
+    if (context?.mcp?.attributionUaToken) {
+      env["0SEC_MCP_ATTRIBUTION_UA_TOKEN"] = context.mcp.attributionUaToken;
+    }
+    return env;
+  }
+};
+
+export {
+  ProcessRuntime
+};