0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-6L26OBWI.js → chunk-76KSBWOQ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   external_exports
-} from "./chunk-YLMN3N25.js";
+} from "./chunk-VIT5ALXF.js";
 
 // packages/shared/dist/identity.js
 function defaultRoleFor(auth) {
@@ -45,7 +45,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.18.0";
+    return "0.22.0";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -89,6 +89,9 @@ function meetsSeverityFloor(severity, floor = DEFAULT_SEVERITY_FLOOR) {
 // packages/shared/dist/pricing.oss.generated.js
 var OSS_PRICING = {
   "gpt-6-astra": { input: 10, output: 50, cachedInput: 1 },
+  "gpt-6-sol": { input: 2, output: 10, cachedInput: 0.2 },
+  "gpt-6.1-sol": { input: 2, output: 10, cachedInput: 0.1 },
+  "gpt-6-luna": { input: 0.1, output: 0.5, cachedInput: 0.01 },
   "claude-fable-5-1": { input: 10, output: 50, cachedInput: 0.25 },
   "claude-opus-5": { input: 5, output: 25, cachedInput: 0.5 },
   "claude-sonnet-5": { input: 2, output: 10, cachedInput: 0.2 },
@@ -111,13 +114,12 @@ var OSS_PRICING = {
   "o4-mini": { input: 1.1, output: 4.4, cachedInput: 0.275 },
   "gemini-2.5-pro": { input: 1.25, output: 10, cachedInput: 0.125 },
   "gemini-2.5-flash": { input: 0.3, output: 2.5, cachedInput: 0.03 },
-  "gemini-2.0-flash": { input: 0.1, output: 0.4, cachedInput: 0.025 },
   "deepseek-chat": { input: 0.28, output: 0.42, cachedInput: 0.028 },
   "deepseek-reasoner": { input: 0.28, output: 0.42, cachedInput: 0.028 }
 };
 
 // packages/shared/dist/pricing.js
-var PRICING_SNAPSHOT_DATE = "2026-09-11";
+var PRICING_SNAPSHOT_DATE = "2026-09-29";
 var MANUAL_PRICING = {
   // Anthropic (versioned; LiteLLM keys use different suffixes → keep manual)
   "claude-opus-4-7": { input: 5, output: 25, cachedInput: 0.5 },
@@ -126,6 +128,8 @@ var MANUAL_PRICING = {
   "claude-haiku-4-5": { input: 0.8, output: 4, cachedInput: 0.08 },
   // OpenAI codex alias — mirrors gpt-5.5 (OSS feed has only the bare key)
   "gpt-5.5-codex": { input: 5, output: 30 },
+  // LiteLLM no longer carries this exact key; retain its last published rate.
+  "gemini-2.0-flash": { input: 0.1, output: 0.4, cachedInput: 0.025 },
   // Meta (hosted) — not in the OSS feed
   "llama-4-maverick": { input: 0.5, output: 0.77 },
   "llama-4-scout": { input: 0.2, output: 0.35 },
@@ -200,25 +204,47 @@ var MANUAL_PRICING = {
   // which this schema cannot represent.
   "DeepSeek-V4-Pro": { input: 1.74, output: 3.48 },
   "DeepSeek-V4-Flash": { input: 0.19, output: 0.51 },
+  // Fireworks Priority list-rate estimate, not an Azure invoice.
+  // The cache estimate remains rounded; don't substitute direct API pricing
+  // for the separately metered Foundry deployment.
+  "deepseek-v4.1-flash": { input: 0.375, output: 1.5, cachedInput: 8e-3 },
   "Kimi-K2.7-Code": { input: 0.95, output: 4, cachedInput: 0.19 },
   "gpt-oss-120b": { input: 0.15, output: 0.6 },
   "gpt-5.6-sol": { input: 5, output: 30, cachedInput: 0.5 },
   "gpt-5.6-luna": { input: 1, output: 6, cachedInput: 0.1 },
   "gpt-5.6-terra": { input: 2.5, output: 15, cachedInput: 0.25 },
+  // Azure Global Standard short-context list estimate (2026-09-23).
+  // Hosted settlement separately meters cache writes and bounds input context.
+  "gpt-6-luna": { input: 0.1, output: 0.5, cachedInput: 0.01 },
   default: { input: 3, output: 15 }
 };
 var MODEL_PRICING = {
   ...MANUAL_PRICING,
   ...OSS_PRICING
 };
+var DISCOVERED_PRICING = /* @__PURE__ */ new Map();
+function registerModelPricing(model, rates) {
+  if (!model || model !== model.trim() || /[\s\x00-\x1f\x7f]/.test(model) || Object.hasOwn(MODEL_PRICING, model) || !Number.isFinite(rates.input) || rates.input < 0 || !Number.isFinite(rates.output) || rates.output < 0 || rates.cachedInput !== void 0 && (!Number.isFinite(rates.cachedInput) || rates.cachedInput < 0)) {
+    return false;
+  }
+  DISCOVERED_PRICING.set(model, Object.freeze({
+    input: rates.input,
+    output: rates.output,
+    ...rates.cachedInput !== void 0 ? { cachedInput: rates.cachedInput } : {}
+  }));
+  return true;
+}
 var AZURE_DEPLOYMENT_PRICE_ALIASES = /* @__PURE__ */ new Map([
   ["deepseek-v4-pro", "DeepSeek-V4-Pro"],
   ["deepseek-v4-flash", "DeepSeek-V4-Flash"],
+  ["deepseek-v4.1-flash", "deepseek-v4.1-flash"],
+  ["fw-deepseek-v4.1-flash", "deepseek-v4.1-flash"],
   ["kimi-k2.7-code", "Kimi-K2.7-Code"],
   ["gpt-oss-120b", "gpt-oss-120b"],
   ["gpt-5.6-sol", "gpt-5.6-sol"],
   ["gpt-5.6-luna", "gpt-5.6-luna"],
-  ["gpt-5.6-terra", "gpt-5.6-terra"]
+  ["gpt-5.6-terra", "gpt-5.6-terra"],
+  ["gpt-6-luna", "gpt-6-luna"]
 ]);
 function azureDeploymentPriceKey(model) {
   const lower = model.toLowerCase();
@@ -228,34 +254,46 @@ function azureDeploymentPriceKey(model) {
   }
   return null;
 }
+var MODEL_VENDOR_PREFIXES = [
+  "openai/",
+  "azure/",
+  "anthropic/",
+  "google/",
+  "deepseek/",
+  "meta/",
+  "mistral/",
+  "z-ai/",
+  "zai/",
+  "kimi/",
+  "moonshot/",
+  "qwen/",
+  "openrouter/",
+  "opencode/",
+  "xai/",
+  "x-ai/"
+];
 function normalizeModel(model) {
-  const prefixes = [
-    "openai/",
-    "anthropic/",
-    "google/",
-    "deepseek/",
-    "meta/",
-    "mistral/",
-    "z-ai/",
-    "zai/",
-    "kimi/",
-    "moonshot/",
-    "openrouter/",
-    "opencode/"
-  ];
-  for (const prefix of prefixes) {
-    if (model.startsWith(prefix))
-      return model.slice(prefix.length);
+  let key = model;
+  for (; ; ) {
+    let stripped = false;
+    for (const prefix of MODEL_VENDOR_PREFIXES) {
+      if (!key.startsWith(prefix))
+        continue;
+      key = key.slice(prefix.length);
+      stripped = true;
+      break;
+    }
+    if (!stripped)
+      return key;
   }
-  return model;
 }
 function getRates(model) {
   const key = model ? normalizeModel(model) : "";
   const aliasKey = azureDeploymentPriceKey(key);
-  const rates = MODEL_PRICING[key] ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0);
+  const rates = (model && Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : void 0) ?? (model ? DISCOVERED_PRICING.get(model) : void 0) ?? (Object.hasOwn(MODEL_PRICING, key) ? MODEL_PRICING[key] : void 0) ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0) ?? DISCOVERED_PRICING.get(key);
   if (!rates) {
     if (model)
-      console.warn(`[0sec] Unknown model for cost estimation: ${model}`);
+      console.warn(`[0] Unknown model for cost estimation: ${model}`);
     return MODEL_PRICING.default;
   }
   return rates;
@@ -276,6 +314,8 @@ function modelProvider(model) {
   const lowered = model.toLowerCase();
   if (lowered.startsWith("openai/"))
     return "openai";
+  if (lowered.startsWith("azure/"))
+    return "azure";
   if (lowered.startsWith("anthropic/"))
     return "anthropic";
   if (lowered.startsWith("google/"))
@@ -349,7 +389,7 @@ var VerificationModeSchema = external_exports.enum([
   "deterministic_replay",
   "agent_assisted"
 ]);
-var RunnerKindSchema = external_exports.enum(["local", "docker", "qemu"]);
+var RunnerKindSchema = external_exports.enum(["local", "smolvm", "docker", "qemu"]);
 var EngineMetadataSchema = external_exports.object({
   os: external_exports.string(),
   arch: external_exports.string(),
@@ -360,7 +400,9 @@ var VerificationCommandSchema = external_exports.object({
   exit_code: external_exports.number().int().nullable(),
   stdout_excerpt: external_exports.string().optional(),
   stderr_excerpt: external_exports.string().optional(),
-  duration_ms: external_exports.number().nonnegative()
+  duration_ms: external_exports.number().nonnegative(),
+  timed_out: external_exports.boolean().optional(),
+  cancelled: external_exports.boolean().optional()
 });
 var AssertionKindSchema = external_exports.enum([
   "file_exists",
@@ -831,18 +873,22 @@ function researchPlatformLpeDisclosureReady(envelope, platform) {
 // packages/shared/dist/paths.js
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
-function homeStateDir(home = homedir()) {
-  return join2(home, ".0sec");
+function homeStateDir(home = process.env.HOME || homedir()) {
+  return join2(home, ".0");
+}
+function cloudStateDir(home = process.env.HOME || homedir(), env = process.env) {
+  const state = homeStateDir(home);
+  return env["ZERO_DEV_SOURCE_ROOT"]?.trim() ? join2(state, "dev") : state;
 }
 function runStateDir(runId, home) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(runId)) {
-    throw new Error(`Invalid 0sec run id ${JSON.stringify(runId)}.`);
+    throw new Error(`Invalid 0 run id ${JSON.stringify(runId)}.`);
   }
   return join2(homeStateDir(home), "runs", runId);
 }
 
 // packages/shared/dist/agent-assurance.js
-var AGENT_ACTION_ASSURANCE_SCHEMA_VERSION = "0sec.agent-action-assurance/v1";
+var AGENT_ACTION_ASSURANCE_SCHEMA_VERSION = "0.agent-action-assurance/v1";
 var AgentInjectionVectorSchema = external_exports.enum([
   "readme",
   "code-comment",
@@ -972,7 +1018,7 @@ function parseAgentActionEvidenceManifest(value) {
 }
 
 // packages/shared/dist/presentation.js
-var PRESENTATION_PROTOCOL = "0sec.presentation/v1";
+var PRESENTATION_PROTOCOL = "0.presentation/v1";
 function createTranscriptDocument(entries) {
   return {
     protocol: PRESENTATION_PROTOCOL,
@@ -1015,6 +1061,176 @@ var DESKTOP_CONSOLE_SCHEMA_VERSION = 1;
 var DEFAULT_AUTONOMY_MODE = "yolo";
 var DEFAULT_ALLOW_MODEL_SELF_EXTENSION = true;
 
+// packages/shared/dist/jev.js
+var FEATURES = ["browser", "memory", "dedupe", "redteam", "kernel", "crash", "radar", "foxguard"];
+var INPUT_USD_PER_TOKEN = 0.042 / 1e6;
+var MAX_INPUT_TOKENS = 65536;
+var REQUEST_RESERVATION_USD = MAX_INPUT_TOKENS * INPUT_USD_PER_TOKEN;
+var probability = external_exports.number().finite().min(0).max(1);
+var questionSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("boolean"),
+    instructions: external_exports.string().min(1).max(8192),
+    criteria: external_exports.object({ true: external_exports.string().max(4096), false: external_exports.string().max(4096) }).optional()
+  }).strict(),
+  external_exports.object({
+    type: external_exports.literal("choice"),
+    instructions: external_exports.string().min(1).max(8192),
+    criteria: external_exports.record(external_exports.string().min(1).max(128), external_exports.string().max(4096)).refine((value) => Object.keys(value).length >= 2 && Object.keys(value).length <= 64)
+  }).strict()
+]);
+var normalizedAnswerSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("boolean"), probability }),
+  external_exports.object({ type: external_exports.literal("choice"), choice: external_exports.string(), probabilities: external_exports.record(probability) })
+]);
+var usageSchema = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().max(MAX_INPUT_TOKENS),
+  outputTokens: external_exports.number().int().nonnegative()
+});
+function positiveNumber(value, fallback, name) {
+  if (value === void 0)
+    return fallback;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0)
+    throw new Error(`${name} must be a positive number`);
+  return parsed;
+}
+function jevConfigFromEnvironment(feature, environment) {
+  const requested = (environment["ZERO_JEV_FEATURES"] ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+  for (const name of requested) {
+    if (!FEATURES.includes(name))
+      throw new Error(`Unknown ZERO_JEV_FEATURES entry: ${name}`);
+  }
+  if (!requested.includes(feature))
+    return void 0;
+  const provider = environment["ZERO_JEV_PROVIDER"] ?? "vercel";
+  if (provider !== "vercel" && provider !== "cloud") {
+    throw new Error("ZERO_JEV_PROVIDER must be vercel or cloud");
+  }
+  const common = {
+    timeoutMs: positiveNumber(environment["ZERO_JEV_TIMEOUT_MS"], 1e4, "ZERO_JEV_TIMEOUT_MS"),
+    maxRequests: positiveNumber(environment["ZERO_JEV_MAX_REQUESTS"], 100, "ZERO_JEV_MAX_REQUESTS"),
+    maxCostUsd: positiveNumber(environment["ZERO_JEV_MAX_COST_USD"], 0.1, "ZERO_JEV_MAX_COST_USD")
+  };
+  const keyName = provider === "cloud" ? "ZERO_JEV_CLOUD_TOKEN" : "AI_GATEWAY_API_KEY";
+  const apiKey = environment[keyName]?.trim();
+  if (!apiKey)
+    throw new Error(`${keyName} is required when Jev assistance is enabled`);
+  if (provider === "cloud") {
+    return { provider, apiKey, cloudUrl: environment["ZERO_JEV_CLOUD_URL"], feature, ...common };
+  }
+  return {
+    provider,
+    apiKey,
+    ...common
+  };
+}
+function createJevEvaluator(config) {
+  if (!config.apiKey.trim())
+    throw new Error("A Jev provider credential is required");
+  const timeoutMs = config.timeoutMs ?? 1e4;
+  const maxRequests = config.maxRequests ?? 100;
+  const maxCostUsd = config.maxCostUsd ?? 0.1;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4 || !Number.isInteger(maxRequests) || maxRequests < 1 || maxRequests > 1e4 || !Number.isFinite(maxCostUsd) || maxCostUsd <= 0) {
+    throw new Error("Invalid Jev timeout, request limit, or cost budget");
+  }
+  if (config.provider === "cloud") {
+    const url = new URL(config.cloudUrl ?? "");
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) || url.username || url.password || url.search || url.hash || !config.feature || !FEATURES.includes(config.feature)) {
+      throw new Error("Invalid Jev cloud evaluation endpoint or feature");
+    }
+  }
+  let requests = 0;
+  let chargedOrReservedUsd = 0;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  return {
+    async evaluate(request) {
+      request.signal?.throwIfAborted();
+      const questions = external_exports.record(external_exports.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/), questionSchema).parse(request.questions);
+      const questionIds = Object.keys(questions);
+      if (questionIds.length < 1 || questionIds.length > 64)
+        throw new Error("Jev requires between 1 and 64 questions");
+      const encoded = JSON.stringify({ state: request.state, questions });
+      if (encoded.length > 32e3)
+        throw new Error("Jev state and questions exceed the bounded input limit");
+      if (requests >= maxRequests || chargedOrReservedUsd + REQUEST_RESERVATION_USD > maxCostUsd) {
+        throw new Error("Jev workflow evaluation budget exhausted");
+      }
+      requests++;
+      chargedOrReservedUsd += REQUEST_RESERVATION_USD;
+      const startedAt = performance.now();
+      const signal = request.signal ? AbortSignal.any([request.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+      let rawAnswers;
+      let model;
+      let rawUsage;
+      try {
+        if (config.provider === "cloud") {
+          const response = await fetchImpl(config.cloudUrl, {
+            method: "POST",
+            signal,
+            redirect: "error",
+            headers: { Authorization: `Bearer ${config.apiKey}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ feature: config.feature, state: request.state, questions })
+          });
+          if (!response.ok)
+            throw new Error(`Jev provider returned HTTP ${response.status}`);
+          const body = external_exports.object({ model: external_exports.string().min(1), answers: external_exports.record(external_exports.unknown()), usage: usageSchema }).parse(await response.json());
+          model = body.model;
+          rawUsage = body.usage;
+          rawAnswers = body.answers;
+        } else {
+          const [{ experimental_evaluate: evaluate }, { createGateway }] = await Promise.all([
+            import("./dist-KEULE5IQ.js"),
+            import("./dist-XZB53PS5.js")
+          ]);
+          signal.throwIfAborted();
+          const gateway = createGateway({ apiKey: config.apiKey, fetch: fetchImpl });
+          const result = await evaluate({
+            model: gateway.evaluationModel("typesafe-ai/jev"),
+            state: typeof request.state === "string" ? request.state : JSON.stringify(request.state),
+            questions,
+            abortSignal: signal,
+            maxRetries: 0
+          });
+          model = result.response.modelId;
+          rawUsage = result.usage;
+          rawAnswers = result.answers;
+        }
+        signal.throwIfAborted();
+        const parsedUsage = usageSchema.parse(rawUsage);
+        const usage = { ...parsedUsage, estimatedCostUsd: parsedUsage.inputTokens * INPUT_USD_PER_TOKEN };
+        chargedOrReservedUsd += usage.estimatedCostUsd - REQUEST_RESERVATION_USD;
+        config.onUsage?.(usage);
+        if (Object.keys(rawAnswers).length !== questionIds.length)
+          throw new Error("Jev returned unexpected answer IDs");
+        const answers = /* @__PURE__ */ Object.create(null);
+        for (const id of questionIds) {
+          const question = questions[id];
+          const answer = normalizedAnswerSchema.parse(rawAnswers[id]);
+          if (question.type !== answer.type)
+            throw new Error("Jev answer type does not match its question");
+          if (question.type === "choice" && answer.type === "choice") {
+            const options = Object.keys(question.criteria);
+            if (!Object.hasOwn(question.criteria, answer.choice) || Object.keys(answer.probabilities).length !== options.length || options.some((option) => !Object.hasOwn(answer.probabilities, option)) || Math.abs(options.reduce((sum, option) => sum + answer.probabilities[option], 0) - 1) > 0.02 || options.some((option) => answer.probabilities[option] > answer.probabilities[answer.choice])) {
+              throw new Error("Jev returned an invalid choice distribution");
+            }
+          }
+          answers[id] = answer;
+        }
+        return { model, answers, usage, durationMs: performance.now() - startedAt };
+      } catch (error) {
+        if (signal.aborted)
+          throw new Error(request.signal?.aborted ? "Jev evaluation cancelled" : "Jev evaluation timed out");
+        if (error instanceof external_exports.ZodError)
+          throw new Error("Jev provider returned malformed evaluation data");
+        if (error instanceof Error && /^Jev (provider returned HTTP \d{3}|returned (unexpected answer IDs|an invalid choice distribution)|answer type does not match its question)$/.test(error.message))
+          throw error;
+        throw new Error("Jev evaluation unavailable; retain the existing decision path");
+      }
+    }
+  };
+}
+
 export {
   defaultRoleFor,
   resolveIdentities,
@@ -1033,6 +1249,7 @@ export {
   PRICING_SNAPSHOT_DATE,
   MANUAL_PRICING,
   MODEL_PRICING,
+  registerModelPricing,
   getRates,
   estimateCost,
   priceRun,
@@ -1073,6 +1290,7 @@ export {
   researchWindowsLpeDisclosureReady,
   researchPlatformLpeDisclosureReady,
   homeStateDir,
+  cloudStateDir,
   runStateDir,
   AGENT_ACTION_ASSURANCE_SCHEMA_VERSION,
   AgentInjectionVectorSchema,
@@ -1090,5 +1308,7 @@ export {
   isPresentationEvent,
   DESKTOP_CONSOLE_SCHEMA_VERSION,
   DEFAULT_AUTONOMY_MODE,
-  DEFAULT_ALLOW_MODEL_SELF_EXTENSION
+  DEFAULT_ALLOW_MODEL_SELF_EXTENSION,
+  jevConfigFromEnvironment,
+  createJevEvaluator
 };