0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-H2FFLZNK.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);

package/chunks/chunk-IOL7D5YV.js

@@ -0,0 +1,515 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  external_exports
+} from "./chunk-YLMN3N25.js";
+
+// packages/core/dist/protocol/http-conformance.js
+import { randomUUID } from "node:crypto";
+
+// packages/core/dist/protocol/conformance-gen.js
+var REQUIREMENT_LEVELS = [
+  "MUST",
+  "MUST NOT",
+  "SHOULD",
+  "SHOULD NOT",
+  "MAY"
+];
+var HTTP_SURFACES = ["method", "header", "status"];
+var httpExerciseSchema = external_exports.object({
+  method: external_exports.string().min(1),
+  path: external_exports.string().optional(),
+  headers: external_exports.record(external_exports.string()).optional(),
+  body: external_exports.string().optional()
+}).strict();
+var conformanceRuleSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  specCitation: external_exports.string().min(1),
+  level: external_exports.enum(REQUIREMENT_LEVELS),
+  surface: external_exports.enum(HTTP_SURFACES),
+  mandate: external_exports.string().min(1),
+  exercise: httpExerciseSchema
+}).strict();
+var predictionSchema = external_exports.object({
+  surface: external_exports.enum(HTTP_SURFACES),
+  expectedStatusIn: external_exports.array(external_exports.number().int()).optional(),
+  forbiddenStatusIn: external_exports.array(external_exports.number().int()).optional(),
+  requiredHeader: external_exports.string().optional(),
+  forbiddenHeader: external_exports.string().optional(),
+  whenStatusIn: external_exports.array(external_exports.number().int()).optional(),
+  unlessStatusIn: external_exports.array(external_exports.number().int()).optional()
+}).strict().refine((p) => p.expectedStatusIn && p.expectedStatusIn.length > 0 || p.forbiddenStatusIn && p.forbiddenStatusIn.length > 0 || Boolean(p.requiredHeader) || Boolean(p.forbiddenHeader), { message: "predictedObservable carries no matcher (status set or header)" }).refine((p) => {
+  if (!p.expectedStatusIn || !p.forbiddenStatusIn)
+    return true;
+  const forbidden = new Set(p.forbiddenStatusIn);
+  return !p.expectedStatusIn.some((s) => forbidden.has(s));
+}, {
+  message: "predictedObservable has overlapping expectedStatusIn and forbiddenStatusIn (a status cannot be both conformant and a violation)"
+});
+var divergenceHypothesisSchema = external_exports.object({
+  ruleId: external_exports.string().min(1),
+  specCitation: external_exports.string().min(1),
+  level: external_exports.enum(REQUIREMENT_LEVELS),
+  implLocation: external_exports.string().min(1),
+  rationale: external_exports.string().min(1),
+  predictedObservable: predictionSchema,
+  exercise: httpExerciseSchema,
+  confidence: external_exports.number().min(0).max(1)
+}).strict();
+var conformanceModelSchema = external_exports.object({
+  rules: external_exports.array(conformanceRuleSchema).min(1),
+  hypotheses: external_exports.array(divergenceHypothesisSchema)
+}).strict().superRefine((model, ctx) => {
+  const ruleIds = new Set(model.rules.map((r) => r.id));
+  model.hypotheses.forEach((h, i) => {
+    if (!ruleIds.has(h.ruleId)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["hypotheses", i, "ruleId"],
+        message: `hypothesis references unknown ruleId \`${h.ruleId}\``
+      });
+    }
+  });
+});
+function structurallyValidateConformanceModel(candidate) {
+  const parsed = conformanceModelSchema.safeParse(candidate);
+  if (parsed.success) {
+    return { valid: true, model: parsed.data, errors: [] };
+  }
+  const errors = parsed.error.issues.map((issue) => ({
+    path: issue.path.join("."),
+    message: issue.message
+  }));
+  return { valid: false, errors };
+}
+var SYSTEM_PROMPT = [
+  "You are a protocol-conformance analyst. Given (a) an authoritative protocol",
+  "specification excerpt and (b) a slice of an implementation's source, you",
+  "extract the spec's testable requirements and hypothesize where the",
+  "implementation diverges from them.",
+  "",
+  "Rules:",
+  "- Output ONLY a single ```json fenced block \u2014 no prose outside it.",
+  "- The JSON has exactly two top-level keys: `rules` and `hypotheses`.",
+  "- A rule is { id, specCitation, level, surface, mandate, exercise }.",
+  "  - `level` is one of MUST, MUST NOT, SHOULD, SHOULD NOT, MAY (RFC 2119).",
+  "  - `surface` is one of method, header, status (Tier-1 is HTTP/text only).",
+  "  - `exercise` is the HTTP request that exercises the rule:",
+  "    { method, path?, headers?, body? }.",
+  "- A hypothesis is { ruleId, specCitation, level, implLocation, rationale,",
+  "  predictedObservable, exercise, confidence }.",
+  "  - `ruleId` MUST reference one of the rules you emitted.",
+  "  - `predictedObservable` is the deterministic, machine-checkable shape a",
+  "    CONFORMANT response must have: { surface, expectedStatusIn?,",
+  "    forbiddenStatusIn?, requiredHeader?, forbiddenHeader?, whenStatusIn?,",
+  "    unlessStatusIn? }. It MUST carry at least one matcher. Use",
+  "    `forbiddenStatusIn` for codes that CONCRETELY prove a violation (e.g. a",
+  "    2xx to a method the spec says MUST be rejected). `expectedStatusIn` and",
+  "    `forbiddenStatusIn` MUST NOT share any code.",
+  "  - For a HEADER rule, the requirement is almost always CONDITIONAL on the",
+  "    status (e.g. `Location` is required only on a 201/3xx; `Content-Range` is",
+  "    forbidden except on 206). Carry `whenStatusIn` (rule applies only on these",
+  "    statuses) so an unrelated response (e.g. a 500) is not mistaken for a",
+  "    conformant 201 missing its header. Use `unlessStatusIn` for the inverse.",
+  "  - `confidence` is your prior plausibility (0\u20131) that the impl diverges. It",
+  "    is NOT a verdict \u2014 a deterministic oracle decides confirmed/refuted.",
+  "- Prefer MUST/MUST NOT rules: only those can be confirmed by the oracle.",
+  "  SHOULD-level divergences are advisory and cannot be confirmed, so do not",
+  "  over-invest hypotheses in them."
+].join("\n");
+function buildInitialPrompt(model, implExcerpt, focusHint) {
+  const hint = focusHint ? `
+Focus: ${focusHint}
+` : "";
+  return [
+    `# Protocol: ${model.name} (${model.version}, ${model.specRef})`,
+    hint,
+    "Extract the testable conformance requirements from the specification",
+    "excerpt below, then hypothesize where the implementation source diverges",
+    "from them. Emit a single ```json fenced block with `rules` and",
+    "`hypotheses`.",
+    "",
+    "## Specification excerpt",
+    "```",
+    model.specExcerpt ?? "",
+    "```",
+    "",
+    "## Implementation source excerpt",
+    "```",
+    implExcerpt,
+    "```"
+  ].join("\n");
+}
+function buildRepairPrompt(rawCandidate, errors) {
+  const errorList = errors.map((e) => e.path ? `- ${e.path}: ${e.message}` : `- ${e.message}`).join("\n");
+  return [
+    "The JSON you produced failed structural validation.",
+    "Fix ONLY the reported problems and re-emit the COMPLETE corrected JSON",
+    "inside a single ```json fenced block. Do not add commentary.",
+    "",
+    "## Your output",
+    "```",
+    rawCandidate,
+    "```",
+    "",
+    "## Validation errors",
+    errorList
+  ].join("\n");
+}
+function extractJsonBlock(response) {
+  const fenced = response.match(/```(?:json)?\s*\n([\s\S]*?)```/i) ?? response.match(/```\s*\n([\s\S]*?)```/);
+  return (fenced ? fenced[1] : response).trim();
+}
+function responseText(content) {
+  return content.filter((b) => b.type === "text").map((b) => b.text).join("\n");
+}
+function parseCandidate(raw) {
+  try {
+    return { ok: true, value: JSON.parse(raw) };
+  } catch (err) {
+    return {
+      ok: false,
+      error: `not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+async function generateConformanceModel(model, implExcerpt, llm, opts = {}) {
+  const maxIterations = Math.max(1, opts.maxIterations ?? 4);
+  const validate = opts.validator ?? structurallyValidateConformanceModel;
+  let prompt = buildInitialPrompt(model, implExcerpt, opts.focusHint);
+  let rawCandidate = "";
+  let errors = [];
+  for (let iteration = 1; iteration <= maxIterations; iteration++) {
+    const message = {
+      role: "user",
+      content: [{ type: "text", text: prompt }]
+    };
+    const result = await llm.executeNative(SYSTEM_PROMPT, [message], []);
+    rawCandidate = extractJsonBlock(responseText(result.content));
+    const parsed = parseCandidate(rawCandidate);
+    if (!parsed.ok) {
+      errors = [{ path: "", message: parsed.error }];
+      prompt = buildRepairPrompt(rawCandidate, errors);
+      continue;
+    }
+    const verdict = await validate(parsed.value);
+    if (verdict.valid && verdict.model) {
+      return {
+        ok: true,
+        model: verdict.model,
+        rawCandidate,
+        iterations: iteration,
+        errors: []
+      };
+    }
+    errors = verdict.errors;
+    prompt = buildRepairPrompt(rawCandidate, errors);
+  }
+  return { ok: false, rawCandidate, iterations: maxIterations, errors };
+}
+
+// packages/core/dist/protocol/oracle-http.js
+var CONFIRMABLE_LEVELS = /* @__PURE__ */ new Set(["MUST", "MUST NOT"]);
+function inSet(value, set) {
+  return Boolean(set && set.includes(value));
+}
+function setsOverlap(a, b) {
+  if (!a || !b)
+    return false;
+  const bset = new Set(b);
+  return a.some((x) => bset.has(x));
+}
+function ruleApplies(prediction, status) {
+  if (prediction.whenStatusIn && prediction.whenStatusIn.length > 0) {
+    if (!prediction.whenStatusIn.includes(status))
+      return false;
+  }
+  if (prediction.unlessStatusIn && prediction.unlessStatusIn.includes(status)) {
+    return false;
+  }
+  return true;
+}
+function lowerHeaders(headers) {
+  const out = {};
+  if (!headers)
+    return out;
+  for (const [k, v] of Object.entries(headers))
+    out[k.toLowerCase()] = v;
+  return out;
+}
+function judgeHttpDivergence(hypothesis, observed) {
+  const base = {
+    ruleId: hypothesis.ruleId
+  };
+  const prediction = hypothesis.predictedObservable;
+  if (observed.error !== void 0) {
+    return {
+      ...base,
+      status: "inconclusive",
+      confidence: hypothesis.confidence,
+      evidence: `no response observed (transport error: ${observed.error}); cannot judge conformance`
+    };
+  }
+  const confirmable = CONFIRMABLE_LEVELS.has(hypothesis.level);
+  const headers = lowerHeaders(observed.headers);
+  if (setsOverlap(prediction.expectedStatusIn, prediction.forbiddenStatusIn)) {
+    return {
+      ...base,
+      status: "inconclusive",
+      confidence: hypothesis.confidence,
+      evidence: `contradictory prediction: status set [${prediction.expectedStatusIn?.join(", ")}] is marked both conformant and forbidden; cannot confirm a violation`
+    };
+  }
+  if (prediction.surface === "method" || prediction.surface === "status") {
+    if (inSet(observed.status, prediction.forbiddenStatusIn)) {
+      if (!confirmable) {
+        return {
+          ...base,
+          status: "inconclusive",
+          confidence: hypothesis.confidence,
+          evidence: `observed status ${observed.status} is in the forbidden set [${prediction.forbiddenStatusIn?.join(", ")}], but the rule is ${hypothesis.level}-level (advisory) \u2014 not a confirmable violation`
+        };
+      }
+      return {
+        ...base,
+        status: "confirmed",
+        confidence: 1,
+        evidence: `${hypothesis.level} violation: observed status ${observed.status}, which the spec forbids for this input (forbidden set [${prediction.forbiddenStatusIn?.join(", ")}]). Rule ${hypothesis.specCitation}.`
+      };
+    }
+    if (inSet(observed.status, prediction.expectedStatusIn)) {
+      return {
+        ...base,
+        status: "refuted",
+        confidence: 0,
+        evidence: `observed status ${observed.status} matches the conformant set [${prediction.expectedStatusIn?.join(", ")}] \u2014 no divergence`
+      };
+    }
+    return {
+      ...base,
+      status: "inconclusive",
+      confidence: hypothesis.confidence,
+      evidence: `observed status ${observed.status} is neither in the conformant set [${prediction.expectedStatusIn?.join(", ") ?? ""}] nor a declared forbidden status [${prediction.forbiddenStatusIn?.join(", ") ?? ""}]; insufficient evidence to confirm a violation`
+    };
+  }
+  if (prediction.surface === "header") {
+    if (!ruleApplies(prediction, observed.status)) {
+      return {
+        ...base,
+        status: "inconclusive",
+        confidence: hypothesis.confidence,
+        evidence: `header rule does not apply to status ${observed.status} (guard: whenStatusIn=[${prediction.whenStatusIn?.join(", ") ?? ""}], unlessStatusIn=[${prediction.unlessStatusIn?.join(", ") ?? ""}]); header presence/absence proves nothing here`
+      };
+    }
+    if (prediction.forbiddenHeader) {
+      const name = prediction.forbiddenHeader.toLowerCase();
+      const present = name in headers;
+      if (present) {
+        if (!confirmable) {
+          return {
+            ...base,
+            status: "inconclusive",
+            confidence: hypothesis.confidence,
+            evidence: `forbidden header \`${prediction.forbiddenHeader}\` present, but the rule is ${hypothesis.level}-level (advisory) \u2014 not confirmable`
+          };
+        }
+        return {
+          ...base,
+          status: "confirmed",
+          confidence: 1,
+          evidence: `${hypothesis.level} violation: response carries header \`${prediction.forbiddenHeader}\`, which the spec forbids. Rule ${hypothesis.specCitation}.`
+        };
+      }
+      return {
+        ...base,
+        status: "refuted",
+        confidence: 0,
+        evidence: `forbidden header \`${prediction.forbiddenHeader}\` absent \u2014 no divergence`
+      };
+    }
+    if (prediction.requiredHeader) {
+      const name = prediction.requiredHeader.toLowerCase();
+      const present = name in headers;
+      if (!present) {
+        if (!confirmable) {
+          return {
+            ...base,
+            status: "inconclusive",
+            confidence: hypothesis.confidence,
+            evidence: `required header \`${prediction.requiredHeader}\` missing, but the rule is ${hypothesis.level}-level (advisory) \u2014 not confirmable`
+          };
+        }
+        return {
+          ...base,
+          status: "confirmed",
+          confidence: 1,
+          evidence: `${hypothesis.level} violation: response is missing required header \`${prediction.requiredHeader}\`. Rule ${hypothesis.specCitation}.`
+        };
+      }
+      return {
+        ...base,
+        status: "refuted",
+        confidence: 0,
+        evidence: `required header \`${prediction.requiredHeader}\` present \u2014 no divergence`
+      };
+    }
+  }
+  return {
+    ...base,
+    status: "inconclusive",
+    confidence: hypothesis.confidence,
+    evidence: "predictedObservable carried no matcher applicable to its surface"
+  };
+}
+
+// packages/core/dist/protocol/http-conformance.js
+var DEFAULT_MAX_EXERCISES = 8;
+function exerciseUrl(targetUrl, exercise) {
+  const path = exercise.path ?? "/";
+  const base = targetUrl.replace(/\/+$/, "");
+  const suffix = path.startsWith("/") ? path : `/${path}`;
+  return `${base}${suffix}`;
+}
+function toObserved(result) {
+  if (!result.success || !result.output || typeof result.output.status !== "number") {
+    return { status: 0, error: result.error ?? "http_request did not return a status" };
+  }
+  const headers = {};
+  if (result.output.headers) {
+    for (const [k, v] of Object.entries(result.output.headers))
+      headers[k] = v;
+  }
+  return { status: result.output.status, headers };
+}
+function confirmedDivergenceToFinding(protocolModel, attempt) {
+  const { hypothesis, observed, verdict } = attempt;
+  return {
+    id: randomUUID(),
+    templateId: `protocol-conformance-${protocolModel.name}-${hypothesis.ruleId}`,
+    title: `${protocolModel.name} conformance divergence: ${hypothesis.ruleId} (${hypothesis.specCitation})`,
+    description: [
+      `Implementation diverges from ${protocolModel.name} (${protocolModel.specRef}).`,
+      `Rule ${hypothesis.specCitation} (${hypothesis.level}): ${hypothesis.rationale}`,
+      `Predicted at ${hypothesis.implLocation}.`,
+      `Confirmed by sending ${hypothesis.exercise.method} ${hypothesis.exercise.path ?? "/"}`,
+      `and observing status ${observed.status}.`
+    ].join(" "),
+    severity: "medium",
+    category: "missing-validation",
+    status: "confirmed",
+    evidence: {
+      request: `${hypothesis.exercise.method} ${hypothesis.exercise.path ?? "/"}`,
+      response: `status=${observed.status}`,
+      analysis: [
+        "Source: protocol-conformance (Tier-1 HTTP)",
+        `Protocol: ${protocolModel.name} ${protocolModel.version} (${protocolModel.specRef})`,
+        `Rule: ${hypothesis.specCitation} [${hypothesis.level}]`,
+        "Hypothesis: false",
+        `Oracle: confirmed`,
+        `Evidence: ${verdict.evidence}`
+      ].join("\n")
+    },
+    fingerprint: `protoconf:${protocolModel.name}:${hypothesis.ruleId}`,
+    triageStatus: "new",
+    // Same promotion contract as kernel-verify: confirmed ⇒ confidence 1.0.
+    confidence: verdict.confidence,
+    timestamp: Date.now()
+  };
+}
+function reconcileHypothesisWithRule(hypothesis, rule) {
+  if (hypothesis.predictedObservable.surface !== rule.surface) {
+    return null;
+  }
+  return {
+    ...hypothesis,
+    // Authoritative fields come from the RULE, not the hypothesis's copies.
+    level: rule.level,
+    specCitation: rule.specCitation,
+    exercise: rule.exercise,
+    predictedObservable: {
+      ...hypothesis.predictedObservable,
+      surface: rule.surface
+    }
+  };
+}
+async function runHttpConformanceCheck(specExcerpt, implExcerpt, targetUrl, llm, send, protocol, opts = {}) {
+  const protocolModel = {
+    name: protocol.name,
+    version: protocol.version,
+    specRef: protocol.specRef,
+    specExcerpt
+  };
+  const gen = await generateConformanceModel(protocolModel, implExcerpt, llm, opts.gen);
+  if (!gen.ok || !gen.model) {
+    return {
+      ok: false,
+      findings: [],
+      attempts: [],
+      genIterations: gen.iterations,
+      reason: `conformance-gen failed after ${gen.iterations} iteration(s): ${gen.errors.map((e) => e.path ? `${e.path}: ${e.message}` : e.message).join("; ")}`
+    };
+  }
+  const cap = Math.max(0, opts.maxExercises ?? DEFAULT_MAX_EXERCISES);
+  const rawHypotheses = gen.model.hypotheses.slice(0, cap);
+  const rulesById = new Map(gen.model.rules.map((r) => [r.id, r]));
+  const attempts = [];
+  const findings = [];
+  for (const rawHypothesis of rawHypotheses) {
+    const rule = rulesById.get(rawHypothesis.ruleId);
+    const hypothesis = rule ? reconcileHypothesisWithRule(rawHypothesis, rule) : null;
+    if (!hypothesis) {
+      const observed2 = {
+        status: 0,
+        error: rule ? `hypothesis surface "${rawHypothesis.predictedObservable.surface}" disagrees with rule "${rule.id}" surface "${rule.surface}"; not exercised (cannot confirm on drifted hypothesis)` : `hypothesis references unknown rule "${rawHypothesis.ruleId}"; not exercised`
+      };
+      attempts.push({
+        hypothesis: rawHypothesis,
+        observed: observed2,
+        verdict: {
+          ruleId: rawHypothesis.ruleId,
+          status: "inconclusive",
+          confidence: rawHypothesis.confidence,
+          evidence: observed2.error ?? "drifted hypothesis; not exercised"
+        }
+      });
+      continue;
+    }
+    const url = exerciseUrl(targetUrl, hypothesis.exercise);
+    let observed;
+    try {
+      const sendArgs = {
+        url,
+        method: hypothesis.exercise.method,
+        ...hypothesis.exercise.headers ? { headers: hypothesis.exercise.headers } : {},
+        ...hypothesis.exercise.body !== void 0 ? { body: hypothesis.exercise.body } : {}
+      };
+      const result = await send(sendArgs);
+      observed = toObserved(result);
+    } catch (err) {
+      observed = {
+        status: 0,
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const verdict = judgeHttpDivergence(hypothesis, observed);
+    const attempt = { hypothesis, observed, verdict };
+    attempts.push(attempt);
+    if (verdict.status === "confirmed") {
+      findings.push(confirmedDivergenceToFinding(protocolModel, attempt));
+    }
+  }
+  return {
+    ok: true,
+    findings,
+    attempts,
+    genIterations: gen.iterations
+  };
+}
+
+export {
+  structurallyValidateConformanceModel,
+  generateConformanceModel,
+  judgeHttpDivergence,
+  runHttpConformanceCheck
+};

package/chunks/chunk-IR537GON.js

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __require,
+  __commonJS,
+  __export,
+  __toESM
+};