0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-YYRBQVFE.js → chunk-TZFIAMWZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-76KSBWOQ.js";
 
 // packages/core/dist/scope/waf-detect.js
 function readHeader(headers, name) {
@@ -574,7 +574,7 @@ async function defaultFetchJson(url, timeoutMs) {
   try {
     const res = await fetch(url, {
       signal: controller.signal,
-      headers: { Accept: "application/json", "User-Agent": "0sec-recon" }
+      headers: { Accept: "application/json", "User-Agent": "0-recon" }
     });
     if (!res.ok)
       throw new Error(`crt.sh HTTP ${res.status}`);
@@ -839,6 +839,13 @@ async function cachedJson(cache, source, key, fetcher, opts = {}) {
   cache.set(source, key, value, opts.ttlMs);
   return value;
 }
+var HttpStatusError = class extends Error {
+  status;
+  constructor(status, url) {
+    super(`HTTP ${status} for ${url}`);
+    this.status = status;
+  }
+};
 async function fetchJson(url, init = {}, opts = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e4);
@@ -848,7 +855,7 @@ async function fetchJson(url, init = {}, opts = {}) {
       signal: controller.signal
     });
     if (!res.ok) {
-      throw new Error(`HTTP ${res.status} for ${url}`);
+      throw new HttpStatusError(res.status, url);
     }
     return await res.json();
   } finally {
@@ -1041,8 +1048,8 @@ async function lookupKev(input, opts = {}) {
 }
 async function fetchKevCatalog(input, opts) {
   const cache = new IntelCache(input.cacheDir);
-  const url = process.env["0SEC_CISA_KEV_URL"] ?? DEFAULT_KEV_URL;
-  return await cachedJson(cache, "cisa-kev", url, async () => await fetchJson(url, { headers: { "User-Agent": "0sec-intel/0.1" } }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+  const url = process.env["ZERO_CISA_KEV_URL"] ?? DEFAULT_KEV_URL;
+  return await cachedJson(cache, "cisa-kev", url, async () => await fetchJson(url, { headers: { "User-Agent": "0-intel/0.1" } }, opts), { offline: input.offline, ttlMs: input.ttlMs });
 }
 
 // packages/core/dist/intel/github.js
@@ -1183,7 +1190,7 @@ function githubHeaders(extra) {
   const headers = {
     Accept: "application/vnd.github+json",
     "X-GitHub-Api-Version": "2022-11-28",
-    "User-Agent": "0sec-intel/0.1",
+    "User-Agent": "0-intel/0.1",
     ...extra ?? {}
   };
   const token = resolveGitHubToken();
@@ -1193,7 +1200,7 @@ function githubHeaders(extra) {
 }
 var cachedGitHubToken;
 function resolveGitHubToken() {
-  const envToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env["0SEC_GITHUB_TOKEN"];
+  const envToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env["ZERO_GITHUB_TOKEN"];
   if (envToken && envToken.trim())
     return envToken.trim();
   if (cachedGitHubToken !== void 0)
@@ -2020,11 +2027,46 @@ function snippet(body) {
 }
 
 // packages/core/dist/intel/nvd.js
+var NVD_COOLDOWN_MS = 3e4;
+var nvdRequests = /* @__PURE__ */ new WeakMap();
+var NvdRateLimitedError = class extends Error {
+};
+async function nvdJson(url, opts) {
+  const transport = opts.fetchImpl ?? globalThis.fetch;
+  let state = nvdRequests.get(transport);
+  if (!state) {
+    state = { tail: Promise.resolve(), blockedUntil: 0 };
+    nvdRequests.set(transport, state);
+  }
+  const queue = state;
+  const request = queue.tail.then(async () => {
+    if (Date.now() < queue.blockedUntil)
+      throw new NvdRateLimitedError();
+    try {
+      return await fetchJson(url, { headers: nvdHeaders(opts.headers) }, opts);
+    } catch (error) {
+      if (error instanceof HttpStatusError && error.status === 429) {
+        queue.blockedUntil = Date.now() + NVD_COOLDOWN_MS;
+        console.warn("[intel] NVD rate limited; pausing requests for 30s");
+        throw new NvdRateLimitedError();
+      }
+      throw error;
+    }
+  });
+  queue.tail = request.then(() => void 0, () => void 0);
+  return request;
+}
 async function lookupNvdCve(input, opts = {}) {
   const cveId = normalizeCveId(input.cveId);
   const cache = new IntelCache(input.cacheDir);
-  const raw = await cachedJson(cache, "nvd-cve", cveId, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${encodeURIComponent(cveId)}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
-  return parseNvdResponse(raw)[0] ?? null;
+  try {
+    const raw = await cachedJson(cache, "nvd-cve", cveId, () => nvdJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${encodeURIComponent(cveId)}`, opts), { offline: input.offline, ttlMs: input.ttlMs });
+    return parseNvdResponse(raw)[0] ?? null;
+  } catch (error) {
+    if (error instanceof NvdRateLimitedError)
+      return null;
+    throw error;
+  }
 }
 async function searchNvdSimilar(input, opts = {}) {
   const terms = uniqueStrings([input.cwe, ...input.keywords ?? []]);
@@ -2037,8 +2079,14 @@ async function searchNvdSimilar(input, opts = {}) {
     keywordSearch: terms.join(" "),
     resultsPerPage: String(limit)
   });
-  const raw = await cachedJson(cache, "nvd-search", key, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
-  return parseNvdResponse(raw);
+  try {
+    const raw = await cachedJson(cache, "nvd-search", key, () => nvdJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, opts), { offline: input.offline, ttlMs: input.ttlMs });
+    return parseNvdResponse(raw);
+  } catch (error) {
+    if (error instanceof NvdRateLimitedError)
+      return [];
+    throw error;
+  }
 }
 async function searchNvdTargetHistory(input, opts = {}) {
   const terms = targetHistorySearchTerms(input);
@@ -2052,8 +2100,14 @@ async function searchNvdTargetHistory(input, opts = {}) {
       keywordSearch: term,
       resultsPerPage: String(limit)
     });
-    const raw = await cachedJson(cache, "nvd-target-history", key, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
-    return parseNvdResponse(raw);
+    try {
+      const raw = await cachedJson(cache, "nvd-target-history", key, () => nvdJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, opts), { offline: input.offline, ttlMs: input.ttlMs });
+      return parseNvdResponse(raw);
+    } catch (error) {
+      if (error instanceof NvdRateLimitedError)
+        return [];
+      throw error;
+    }
   }));
   return results.flat();
 }
@@ -2113,7 +2167,7 @@ function pickMetric(cve) {
 }
 function nvdHeaders(extra) {
   const headers = {
-    "User-Agent": "0sec-intel/0.1",
+    "User-Agent": "0-intel/0.1",
     ...extra ?? {}
   };
   if (process.env.NVD_API_KEY)