0sec-cli 0.18.0 → 0.22.0

package/chunks/{runtime-G7YWIO3B.js → runtime-G75TEWQY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   CliNativeRuntime,
   DEFAULT_ENSEMBLE_MODELS,
@@ -11,20 +11,19 @@ import {
   detectAvailableRuntimes,
   getRuntimeInfo,
   pickRuntimeForStage
-} from "./chunk-N7BOUYEV.js";
+} from "./chunk-5MWAG3FT.js";
+import {
+  ProcessRuntime
+} from "./chunk-W6UWZFKL.js";
 import {
   LlmApiRuntime,
   OperatorAbortError,
   QuotaExhaustedError,
   parseUsageLimitReached
-} from "./chunk-UR4ELX2Y.js";
-import {
-  ProcessRuntime
-} from "./chunk-ATATQACO.js";
-import "./chunk-ADOLI6DT.js";
-import "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-2GV4HQKE.js";
+import "./chunk-76KSBWOQ.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   CliNativeRuntime,
   DEFAULT_ENSEMBLE_MODELS,

package/chunks/runtime-XFWJTBUO.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  canUseOpenTui,
+  isBunRuntime
+} from "./chunk-GHWODZMR.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  canUseOpenTui,
+  isBunRuntime
+};

package/chunks/{scan-stream-FHI2FYZE.js → scan-stream-BMOCPKQX.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   source_default
-} from "./chunk-SF4KZ4O3.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-HLFS6WV2.js";
+import "./chunk-VCSFCHAJ.js";
 
 // packages/cli/src/ui/scan-stream.ts
 var STAGE_TAG = {
@@ -15,7 +15,7 @@ var STAGE_TAG = {
   report: source_default.gray
 };
 function tagFor(stage) {
-  if (!stage) return source_default.gray("[0sec]");
+  if (!stage) return source_default.gray("[0]");
   const colour = STAGE_TAG[stage] ?? source_default.gray;
   return colour(`[${stage}]`);
 }
@@ -36,7 +36,7 @@ function severityColour(sev) {
 function renderScanStream(opts) {
   const { version, target, depth, mode } = opts;
   console.log("");
-  console.log(`  ${source_default.bold("0sec")} ${source_default.dim(`v${version}`)}`);
+  console.log(`  ${source_default.bold("0")} ${source_default.dim(`v${version}`)}`);
   console.log(`    ${source_default.dim(`${mode}ing target ${target} \xB7 depth ${depth}`)}`);
   console.log("");
   const onEvent = (event) => {
@@ -63,7 +63,7 @@ function renderScanStream(opts) {
         if (event.message) console.log(`${tag} ${event.message}`);
         return;
       case "thinking":
-        if (process.env["0SEC_VERBOSE"] && event.message) {
+        if (process.env["ZERO_VERBOSE"] && event.message) {
           console.log(`${source_default.gray("  \u2026")} ${source_default.dim(event.message.slice(0, 200))}`);
         }
         return;

package/chunks/scope-WXI46UHJ.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  ScopePolicy,
+  extractUrls,
+  loadScope,
+  matchUrl,
+  normalizeScopeHostname
+} from "./chunk-7DEHG7YT.js";
+import "./chunk-5IBCBQEH.js";
+import "./chunk-76KSBWOQ.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  ScopePolicy,
+  extractUrls,
+  loadScope,
+  matchUrl,
+  normalizeScopeHostname
+};

package/chunks/{session-store-GZ4A4KYT.js → session-store-27L3ZU73.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   DEFAULT_PRUNE_KEEP,
   deleteSession,
@@ -11,10 +11,10 @@ import {
   relativeAge,
   saveSession,
   sessionsDir
-} from "./chunk-BVAZO4WA.js";
-import "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-MICHDTBK.js";
+import "./chunk-76KSBWOQ.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   DEFAULT_PRUNE_KEEP,
   deleteSession,

package/chunks/source-files-REHOM44I.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  collectScopeFiles,
+  countScopeFilesUpTo
+} from "./chunk-AZ7L3HFD.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  collectScopeFiles,
+  countScopeFilesUpTo
+};

package/chunks/{specdrift-WCLH6TTQ.js → specdrift-AFS54WEJ.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   extractSpecInvariants,
   mapInvariantsToImplementation,
   planSpecdriftHypotheses,
   runSpecdriftPlan,
   runSpecdriftScan
-} from "./chunk-BKZFDZ23.js";
-import "./chunk-53G27VPS.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-QCUFBVIZ.js";
+import "./chunk-AZ7L3HFD.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   extractSpecInvariants,
   mapInvariantsToImplementation,

package/chunks/token-KRWP5JYA.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  require_token_error,
+  require_token_util
+} from "./chunk-TRH2PJSN.js";
+import {
+  __commonJS
+} from "./chunk-VCSFCHAJ.js";
+
+// node_modules/.pnpm/@vercel+oidc@3.2.0/node_modules/@vercel/oidc/dist/token.js
+var require_token = __commonJS({
+  "node_modules/.pnpm/@vercel+oidc@3.2.0/node_modules/@vercel/oidc/dist/token.js"(exports, module) {
+    var __defProp = Object.defineProperty;
+    var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+    var __getOwnPropNames = Object.getOwnPropertyNames;
+    var __hasOwnProp = Object.prototype.hasOwnProperty;
+    var __export = (target, all) => {
+      for (var name in all)
+        __defProp(target, name, { get: all[name], enumerable: true });
+    };
+    var __copyProps = (to, from, except, desc) => {
+      if (from && typeof from === "object" || typeof from === "function") {
+        for (let key of __getOwnPropNames(from))
+          if (!__hasOwnProp.call(to, key) && key !== except)
+            __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+      }
+      return to;
+    };
+    var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+    var token_exports = {};
+    __export(token_exports, {
+      refreshToken: () => refreshToken
+    });
+    module.exports = __toCommonJS(token_exports);
+    var import_token_error = require_token_error();
+    var import_token_util = require_token_util();
+    async function refreshToken(options) {
+      let projectId = options?.project;
+      let teamId = options?.team;
+      if (!projectId && !teamId) {
+        const projectInfo = (0, import_token_util.findProjectInfo)();
+        projectId = projectInfo.projectId;
+        teamId = projectInfo.teamId;
+      } else if (!projectId || !teamId) {
+        const projectInfo = (0, import_token_util.findProjectInfo)();
+        projectId = projectId ?? projectInfo.projectId;
+        teamId = teamId ?? projectInfo.teamId;
+      }
+      if (!projectId) {
+        throw new import_token_error.VercelOidcTokenError(
+          "Failed to refresh OIDC token: No project specified. Try re-linking your project with `vc link`"
+        );
+      }
+      let maybeToken = (0, import_token_util.loadToken)(projectId);
+      if (!maybeToken || (0, import_token_util.isExpired)((0, import_token_util.getTokenPayload)(maybeToken.token), options?.expirationBufferMs)) {
+        const authToken = await (0, import_token_util.getVercelToken)({
+          expirationBufferMs: options?.expirationBufferMs
+        });
+        maybeToken = await (0, import_token_util.getVercelOidcToken)(authToken, projectId, teamId);
+        if (!maybeToken) {
+          throw new import_token_error.VercelOidcTokenError("Failed to refresh OIDC token");
+        }
+        (0, import_token_util.saveToken)(maybeToken, projectId);
+      }
+      process.env.VERCEL_OIDC_TOKEN = maybeToken.token;
+      return;
+    }
+  }
+});
+export default require_token();

package/chunks/token-util-DWTL33S3.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  require_token_util
+} from "./chunk-TRH2PJSN.js";
+import "./chunk-VCSFCHAJ.js";
+export default require_token_util();

package/chunks/variant-candidates-YWZORZMK.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  generateVariantCandidates
+} from "./chunk-HUNAPTKV.js";
+import "./chunk-2GV4HQKE.js";
+import "./chunk-76KSBWOQ.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  generateVariantCandidates
+};

package/chunks/{web-recon-prepass-JJGPEOLE.js → web-recon-prepass-YVMFXCIK.js}

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   enumerateJsChunkUrls,
   fingerprintWebStack,
   runBaselineWebChecks,
   summarizeWebStackFingerprint
-} from "./chunk-CMKXP5RR.js";
+} from "./chunk-LYUAM3TG.js";
 import {
   enumerateSubdomains,
   scanJsArtifacts,
   searchAdvisories
-} from "./chunk-YYRBQVFE.js";
-import "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-TZFIAMWZ.js";
+import "./chunk-76KSBWOQ.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 
 // packages/core/dist/stages/web-recon-prepass.js
 import { randomUUID } from "node:crypto";
@@ -459,7 +459,7 @@ async function checkRscBypass(opts) {
 }
 var DJANGO_DEBUG_ID = "DJANGO-DEBUG-TRUE-INFO-DISCLOSURE";
 var DJANGO_DEBUG_TITLE = "Django DEBUG=True exposes traceback / settings on error pages";
-var DJANGO_DEBUG_PROBE_PATH = "/0sec-debug-probe-0nonexistent-9z/?__0sec_debug_check__=1";
+var DJANGO_DEBUG_PROBE_PATH = "/0-debug-probe-0nonexistent-9z/?__0_debug_check__=1";
 var DJANGO_DEBUG_PROOF_RE = /You'?re seeing this error because you have\s+DEBUG\s*=\s*True/i;
 var DJANGO_DEBUG_CORROBORATING_RES = [
   /Django Version/i,
@@ -801,7 +801,7 @@ async function runWebReconPrePass(config, options = {}) {
   const resetEndpoint = baseline?.body ? findPasswordResetEndpoint(base, baseline.body) : void 0;
   if (resetBurstProbeAllowed && resetEndpoint && isInScopeUrl(resetEndpoint, targetHost, domain)) {
     try {
-      const invalidEmail = `0sec-noreply-${randomUUID().slice(0, 8)}@invalid.example`;
+      const invalidEmail = `0-noreply-${randomUUID().slice(0, 8)}@invalid.example`;
       const probe = await probeRateLimit({
         request: async () => {
           if (limiter)

package/cli-path-traversal-fixture.js

@@ -0,0 +1,352 @@
+import { spawn } from "node:child_process";
+import { createServer } from "node:http";
+import { access, mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { constants } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join, resolve, sep } from "node:path";
+const FIXTURE_ID = "fixture:cli-path-traversal";
+const DEFAULT_TIMEOUT_MS = 10_000;
+const SIGKILL_GRACE_MS = 1_000;
+const CAPTURE_BYTES = 1024 * 1024;
+const EXCERPT_BYTES = 4 * 1024;
+function excerpt(text, max = EXCERPT_BYTES) {
+    if (text.length <= max)
+        return text;
+    return text.slice(0, max) + "...[truncated]";
+}
+function isInside(root, candidate) {
+    return candidate === root || candidate.startsWith(root + sep);
+}
+async function exists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function appendCapped(current, chunk) {
+    if (current.length >= CAPTURE_BYTES)
+        return current;
+    const next = current + chunk.toString("utf8");
+    if (next.length <= CAPTURE_BYTES)
+        return next;
+    return next.slice(0, CAPTURE_BYTES) + "\n...[truncated at 1MiB]";
+}
+async function runCommand(argv, options) {
+    return await new Promise((resolveCommand) => {
+        let stdout = "";
+        let stderr = "";
+        let settled = false;
+        let timedOut = false;
+        let timer;
+        let killTimer;
+        const child = spawn(argv[0], argv.slice(1), {
+            cwd: options.cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (killTimer)
+                clearTimeout(killTimer);
+            resolveCommand(result);
+        };
+        timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            killTimer = setTimeout(() => {
+                if (settled)
+                    return;
+                child.kill("SIGKILL");
+                finish({
+                    exitCode: null,
+                    stdout,
+                    stderr,
+                    timedOut,
+                    error: `command timed out after ${options.timeoutMs}ms and did not exit after SIGTERM`,
+                });
+            }, SIGKILL_GRACE_MS);
+        }, options.timeoutMs);
+        child.stdout?.on("data", (chunk) => {
+            stdout = appendCapped(stdout, chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr = appendCapped(stderr, chunk);
+        });
+        child.on("error", (err) => {
+            finish({
+                exitCode: null,
+                stdout,
+                stderr,
+                timedOut,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        });
+        child.on("close", (code) => {
+            finish({
+                exitCode: code,
+                stdout,
+                stderr,
+                timedOut,
+                error: timedOut ? `command timed out after ${options.timeoutMs}ms` : undefined,
+            });
+        });
+    });
+}
+async function startMaliciousExportServer() {
+    const payload = {
+        rootPath: "demo",
+        paperclipExtensionPath: null,
+        warnings: [],
+        files: {
+            "../escaped-marker": "0 deterministic verification\n",
+            "README.md": "normal export content\n",
+        },
+    };
+    const server = createServer((req, res) => {
+        if (req.method === "GET" && req.url === "/company/export") {
+            res.statusCode = 200;
+            res.setHeader("content-type", "application/json");
+            res.end(JSON.stringify(payload));
+            return;
+        }
+        res.statusCode = 404;
+        res.end("not found");
+    });
+    await new Promise((resolveListen, rejectListen) => {
+        server.once("error", rejectListen);
+        server.listen(0, "127.0.0.1", () => resolveListen());
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        await closeServer(server);
+        throw new Error("failed to allocate fixture server port");
+    }
+    return {
+        server,
+        baseUrl: `http://127.0.0.1:${address.port}`,
+    };
+}
+async function closeServer(server) {
+    await new Promise((resolveClose) => {
+        server.close(() => resolveClose());
+    });
+}
+function expandCommandArgv(argv, replacements) {
+    return argv.map((arg) => arg
+        .replaceAll("{{apiUrl}}", replacements.apiUrl)
+        .replaceAll("{{exportDir}}", replacements.exportDir)
+        .replaceAll("{{fixtureMode}}", replacements.fixtureMode));
+}
+function assertion(kind, passed, detail) {
+    return { kind, passed, detail };
+}
+async function buildAssertions(paths) {
+    const [sandboxReal, exportReal] = await Promise.all([
+        realpath(paths.sandboxRoot),
+        realpath(paths.exportDir),
+    ]);
+    const escapedExists = await exists(paths.escapedPath);
+    const insideExportExists = await exists(paths.insideExportPath);
+    let escapedReal = resolve(paths.escapedPath);
+    if (escapedExists) {
+        escapedReal = await realpath(paths.escapedPath);
+    }
+    const homeReal = await realpath(homedir()).catch(() => homedir());
+    const profileNames = new Set([".bashrc", ".zshrc", ".profile", ".bash_profile"]);
+    const escapedBase = escapedReal.split(sep).at(-1) ?? "";
+    const escapedInsideHome = isInside(homeReal, escapedReal);
+    const escapedMatchesProfile = profileNames.has(escapedBase);
+    const noHomeProfileTouch = !escapedInsideHome && !escapedMatchesProfile;
+    const noHomeProfileTouchDetail = escapedInsideHome
+        ? `touched path ${escapedReal} is inside home directory ${homeReal}`
+        : escapedMatchesProfile
+            ? `touched path ${escapedReal} matches profile basename ${escapedBase}`
+            : `touched path ${escapedReal} is not a home directory or shell profile target`;
+    return [
+        assertion("filesystem_exists", escapedExists, escapedExists
+            ? `escaped marker exists at ${escapedReal}`
+            : `escaped marker not found at ${paths.escapedPath}`),
+        assertion("filesystem_not_exists", !insideExportExists, insideExportExists
+            ? `unexpected marker found inside export root at ${paths.insideExportPath}`
+            : `no escaped marker exists inside export root at ${paths.insideExportPath}`),
+        assertion("path_outside_export_root", escapedExists && !isInside(exportReal, escapedReal), escapedExists
+            ? `escaped marker realpath ${escapedReal} is outside export root ${exportReal}`
+            : "escaped marker missing, so export-root escape was not reproduced"),
+        assertion("path_inside_sandbox", escapedExists && isInside(sandboxReal, escapedReal), escapedExists
+            ? `escaped marker stayed inside sandbox ${sandboxReal}`
+            : "escaped marker missing, so sandbox containment could not be proven"),
+        assertion("no_home_profile_touch", noHomeProfileTouch, noHomeProfileTouchDetail),
+    ];
+}
+function resultStatus(args) {
+    const required = new Set([
+        "filesystem_exists",
+        "filesystem_not_exists",
+        "path_outside_export_root",
+        "path_inside_sandbox",
+        "no_home_profile_touch",
+    ]);
+    const filesystemAssertions = args.assertions.filter((a) => required.has(a.kind));
+    if (filesystemAssertions.length > 0) {
+        if (filesystemAssertions.some((a) => a.kind === "filesystem_exists" && a.passed)) {
+            return "reproduced";
+        }
+        if (args.command.timedOut)
+            return "error";
+        if (args.command.error && args.command.exitCode === null)
+            return "error";
+        return "not_reproduced";
+    }
+    if (args.command.error && args.command.exitCode === null)
+        return "error";
+    if (args.command.timedOut)
+        return "error";
+    if (args.command.exitCode !== 0)
+        return "error";
+    return "inconclusive";
+}
+function summaryFor(status) {
+    switch (status) {
+        case "reproduced":
+            return "CLI path traversal replay wrote a marker outside the selected export directory inside the sandbox.";
+        case "not_reproduced":
+            return "CLI path traversal replay completed but did not write outside the selected export directory.";
+        case "inconclusive":
+            return "CLI path traversal replay was inconclusive.";
+        case "error":
+            return "CLI path traversal replay failed before reaching a reliable verdict.";
+    }
+}
+/**
+ * Run the deterministic CLI path traversal replay from 0#195.
+ *
+ * The fixture starts a malicious local API server and runs the caller-supplied
+ * CLI command against a sandboxed export directory. The harness itself never
+ * implements export behavior; the verdict comes from the CLI under test plus
+ * filesystem assertions over the sandbox.
+ */
+export async function runCliPathTraversalReplayFixture(options = {}) {
+    const startedAt = new Date().toISOString();
+    const fixtureMode = options.fixtureMode ?? "vulnerable";
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const retainArtifacts = options.retainArtifacts || Boolean(options.artifactDir);
+    const sandboxRoot = options.artifactDir
+        ? resolve(options.artifactDir)
+        : await mkdtemp(join(tmpdir(), "0-verify-"));
+    const exportDir = join(sandboxRoot, "export");
+    const harnessDir = join(sandboxRoot, "harness");
+    const harnessRef = join(harnessDir, "harness.json");
+    const stdoutRef = join(sandboxRoot, "stdout.log");
+    const stderrRef = join(sandboxRoot, "stderr.log");
+    const artifacts = {};
+    if (retainArtifacts) {
+        artifacts.sandbox_ref = sandboxRoot;
+        artifacts.harness_ref = harnessRef;
+        artifacts.stdout_ref = stdoutRef;
+        artifacts.stderr_ref = stderrRef;
+        artifacts.export_ref = exportDir;
+    }
+    let server;
+    let argv = [];
+    let command;
+    try {
+        await mkdir(exportDir, { recursive: true });
+        const fixture = await startMaliciousExportServer();
+        server = fixture.server;
+        if (!options.commandArgv || options.commandArgv.length === 0) {
+            throw new Error("cli-path-traversal fixture requires commandArgv for the real CLI under test");
+        }
+        argv = expandCommandArgv(options.commandArgv, {
+            apiUrl: fixture.baseUrl,
+            exportDir,
+            fixtureMode,
+        });
+        await mkdir(harnessDir, { recursive: true });
+        await writeFile(harnessRef, JSON.stringify({
+            fixture: "cli-path-traversal",
+            fixtureMode,
+            commandArgv: options.commandArgv,
+            expandedArgv: argv,
+            apiUrl: fixture.baseUrl,
+            exportDir,
+        }, null, 2) + "\n", "utf8");
+        command = await runCommand(argv, {
+            cwd: sandboxRoot,
+            timeoutMs,
+        });
+        await writeFile(stdoutRef, command.stdout, "utf8");
+        await writeFile(stderrRef, command.stderr, "utf8");
+        const assertions = await buildAssertions({
+            sandboxRoot,
+            exportDir,
+            escapedPath: join(sandboxRoot, "escaped-marker"),
+            insideExportPath: join(exportDir, "escaped-marker"),
+        });
+        if (command.exitCode !== 0 || command.error) {
+            assertions.unshift(assertion("command_exit_zero", false, command.error ?? `fixture command exited ${String(command.exitCode)}`));
+        }
+        else {
+            assertions.unshift(assertion("command_exit_zero", true, "fixture command exited 0"));
+        }
+        const status = resultStatus({ command, assertions });
+        return {
+            status,
+            mode: "deterministic_replay",
+            finding_id: FIXTURE_ID,
+            engine_version: options.engineVersion ?? "unknown",
+            started_at: startedAt,
+            completed_at: new Date().toISOString(),
+            commands: [
+                {
+                    argv,
+                    exit_code: command.exitCode,
+                    stdout_excerpt: excerpt(command.stdout),
+                    stderr_excerpt: excerpt(command.stderr),
+                },
+            ],
+            assertions,
+            artifacts,
+            summary: summaryFor(status),
+            error_reason: status === "error" ? command.error ?? "fixture command failed" : null,
+        };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return {
+            status: "error",
+            mode: "deterministic_replay",
+            finding_id: FIXTURE_ID,
+            engine_version: options.engineVersion ?? "unknown",
+            started_at: startedAt,
+            completed_at: new Date().toISOString(),
+            commands: command
+                ? [
+                    {
+                        argv,
+                        exit_code: command.exitCode,
+                        stdout_excerpt: excerpt(command.stdout),
+                        stderr_excerpt: excerpt(command.stderr),
+                    },
+                ]
+                : [],
+            assertions: [],
+            artifacts,
+            summary: summaryFor("error"),
+            error_reason: reason,
+        };
+    }
+    finally {
+        if (server)
+            await closeServer(server);
+        if (!retainArtifacts) {
+            await rm(sandboxRoot, { recursive: true, force: true });
+        }
+    }
+}
+//# sourceMappingURL=cli-path-traversal-fixture.js.map

package/dashboard/assets/bot-Bg1Tp9_d.js

@@ -0,0 +1 @@
+import{_ as e}from"./input-TuVPR3Zl.js";var t=e(`bot`,[[`path`,{d:`M12 8V4H8`,key:`hb8ula`}],[`rect`,{width:`16`,height:`12`,x:`4`,y:`8`,rx:`2`,key:`enze0r`}],[`path`,{d:`M2 14h2`,key:`vft8re`}],[`path`,{d:`M20 14h2`,key:`4cs60a`}],[`path`,{d:`M15 13v2`,key:`1xurst`}],[`path`,{d:`M9 13v2`,key:`rq6x2g`}]]);export{t};