0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-AD7WXDH6.js → chunk-7UFUALR2.js}

@@ -1,17 +1,36 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
-  loadLayeredSettings
-} from "./chunk-GMT2AZKM.js";
+  FEEDBACK_OPT_OUT_ENV,
+  PROVIDERS,
+  accountEnvPatch,
+  loadAccountStore,
+  loadGlobalSettings,
+  loadLayeredSettings,
+  maybeLoadCodexAuth,
+  normalizeSettings,
+  saveSettings,
+  submissionBlockedReason
+} from "./chunk-YIQSGNAA.js";
+import {
+  runSmolvmWorkbench
+} from "./chunk-EGZGZFAH.js";
+import {
+  ANALYTICS_LEVEL_ENV,
+  getSmolvmWorkbenchStatus,
+  isAdmittedSmolvmWorkbench,
+  levelAtLeast,
+  resolveAnalyticsLevel
+} from "./chunk-RE5EZDG2.js";
 import {
   homeStateDir
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-76KSBWOQ.js";
 import {
   __commonJS,
   __require,
   __toESM
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // node_modules/.pnpm/commander@12.1.0/node_modules/commander/lib/error.js
 var require_error = __commonJS({
@@ -3023,11 +3042,249 @@ var {
   Help
 } = import_index.default;
 
+// packages/cli/src/workbench.ts
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var WORKBENCH_INNER_ARGUMENT = "--workbench-inner";
+function workbenchConfigPath(home = process.env.HOME || homedir()) {
+  return join(homeStateDir(home), "workbench.json");
+}
+function defaultWorkbenchStateRoot(home = process.env.HOME || homedir()) {
+  return join(homeStateDir(home), "workbench");
+}
+function positiveInteger(value, maximum) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= maximum;
+}
+function isPinnedWorkbenchImageReference(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/.test(value) && !value.slice(0, value.indexOf("@")).slice(value.lastIndexOf("/") + 1).includes(":");
+}
+function normalizeWorkbenchConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("Invalid workbench operator choices.");
+  const config = raw;
+  const approvedImages = [];
+  if (config.approvedImages !== void 0) {
+    if (!Array.isArray(config.approvedImages)) throw new Error("Invalid workbench sandbox image catalog.");
+    const references = /* @__PURE__ */ new Set();
+    for (const rawImage of config.approvedImages) {
+      if (typeof rawImage !== "object" || rawImage === null || Array.isArray(rawImage)) throw new Error("Invalid workbench sandbox image catalog.");
+      const image = rawImage;
+      if (!isPinnedWorkbenchImageReference(image.reference) || typeof image.archive !== "string" || !isAbsolute(image.archive) || typeof image.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(image.digest) || references.has(image.reference)) throw new Error("Sandbox image grants require unique immutable repository@sha256 references and approved local archives.");
+      references.add(image.reference);
+      approvedImages.push({ reference: image.reference, archive: image.archive, digest: image.digest });
+    }
+  }
+  if (config.schemaVersion !== 1 || typeof config.image !== "string" || !isAbsolute(config.image) || typeof config.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(config.imageDigest) || typeof config.stateRoot !== "string" || !isAbsolute(config.stateRoot) || config.workspaceRoot !== void 0 && (typeof config.workspaceRoot !== "string" || !isAbsolute(config.workspaceRoot)) || !Array.isArray(config.providers) || config.providers.some((id) => typeof id !== "string" || !PROVIDERS.some((provider) => provider.id === id)) || typeof config.github !== "boolean" || !positiveInteger(config.cpus, 64) || !positiveInteger(config.memoryMb, 262144) || !positiveInteger(config.storageGb, 1024)) {
+    throw new Error("Invalid workbench operator choices.");
+  }
+  return {
+    schemaVersion: 1,
+    image: config.image,
+    imageDigest: config.imageDigest,
+    stateRoot: config.stateRoot,
+    ...config.workspaceRoot === void 0 ? {} : { workspaceRoot: config.workspaceRoot },
+    providers: [...new Set(config.providers)],
+    github: config.github,
+    cpus: config.cpus,
+    memoryMb: config.memoryMb,
+    storageGb: config.storageGb,
+    ...approvedImages.length ? { approvedImages } : {}
+  };
+}
+function loadWorkbenchConfig(home) {
+  const file = workbenchConfigPath(home);
+  if (!existsSync(file)) return void 0;
+  try {
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()) {
+      throw new Error("Workbench configuration must be an operator-owned, private regular file (mode 0600).");
+    }
+    return normalizeWorkbenchConfig(JSON.parse(readFileSync(file, "utf8")));
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Workbench configuration must")) throw error;
+    throw new Error(`Unreadable or invalid workbench configuration at ${file}. Repair the operator choices before setup or launch; no profile fallback is allowed.`);
+  }
+}
+function saveWorkbenchConfig(config, home) {
+  const path = workbenchConfigPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(normalizeWorkbenchConfig(config), null, 2)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+  renameSync(temporary, path);
+  chmodSync(path, 384);
+}
+var PROVIDER_CONFIGURATION = {
+  "chatgpt-codex": ["ZERO_CHATGPT_ACCOUNT_ID", "ZERO_CHATGPT_BASE_URL"],
+  deepseek: ["DEEPSEEK_BASE_URL"],
+  openrouter: ["OPENROUTER_BASE_URL"],
+  azure: ["AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_API_VERSION", "AZURE_OPENAI_DEPLOYMENT", "OPENAI_BASE_URL"],
+  openai: ["OPENAI_BASE_URL"],
+  "z-ai": ["Z_AI_BASE_URL"],
+  kimi: ["KIMI_BASE_URL"],
+  qwen: ["QWEN_BASE_URL"],
+  xai: ["XAI_BASE_URL"],
+  opencode: ["OPENCODE_BASE_URL"],
+  copilot: ["COPILOT_BASE_URL"],
+  google: ["GOOGLE_CLOUD_PROJECT", "ZERO_GEMINI_PROJECT"],
+  anthropic: ["ANTHROPIC_BASE_URL"]
+};
+function selectedWorkbenchEnvironment(config, env, accounts) {
+  const selected = { version: 2, providers: {} };
+  const result = {};
+  for (const id of config.providers) {
+    const provider = PROVIDERS.find((candidate) => candidate.id === id);
+    if (!provider) throw new Error(`Unknown workbench provider grant: ${id}`);
+    const account = accounts.providers[id];
+    if (account) selected.providers[id] = account;
+    for (const name of [...provider.envVars, ...PROVIDER_CONFIGURATION[id] ?? []]) {
+      const value = env[name];
+      if (value?.trim()) result[name] = value;
+    }
+  }
+  Object.assign(result, accountEnvPatch(selected, result));
+  if (config.github) {
+    const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
+    if (token) result.GH_TOKEN = token;
+  }
+  for (const name of ["TERM", "COLORTERM", "NO_COLOR", "LANG", "LC_ALL"]) {
+    const value = env[name];
+    if (value !== void 0) result[name] = value;
+  }
+  return result;
+}
+async function integrationEnvironment(config, home) {
+  const accounts = config.providers.length ? loadAccountStore(home) : { version: 2, providers: {} };
+  const environment = selectedWorkbenchEnvironment(config, process.env, accounts);
+  if (config.providers.includes("chatgpt-codex")) {
+    const codexEnvironment = {
+      ...environment,
+      ZERO_CHATGPT_AUTH_FILE: process.env.ZERO_CHATGPT_AUTH_FILE,
+      ZERO_CODEX_AUTH_JSON_PATH: process.env.ZERO_CODEX_AUTH_JSON_PATH
+    };
+    maybeLoadCodexAuth({ env: codexEnvironment, home });
+    for (const name of ["ZERO_CHATGPT_ACCESS_TOKEN", "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
+      const value = codexEnvironment[name];
+      if (value) environment[name] = value;
+    }
+  }
+  if (config.github && !environment.GH_TOKEN) {
+    try {
+      const { stdout } = await execFileAsync("gh", ["auth", "token"], { encoding: "utf8", timeout: 1e4, maxBuffer: 65536 });
+      if (stdout.trim()) environment.GH_TOKEN = stdout.trim();
+    } catch {
+      throw new Error("GitHub grant is enabled but no token is available. Connect gh on the host or run 0 workbench setup --no-github.");
+    }
+  }
+  return environment;
+}
+function resolveWorkbenchGuestSettings(settings, env = process.env) {
+  const privacy = { [ANALYTICS_LEVEL_ENV]: env[ANALYTICS_LEVEL_ENV] ?? settings.analyticsLevel };
+  for (const name of FEEDBACK_OPT_OUT_ENV) privacy[name] = env[name];
+  const environmentLevel = resolveAnalyticsLevel(privacy);
+  return normalizeSettings({
+    ...settings,
+    executionProfile: "local",
+    updatePolicy: "off",
+    analyticsLevel: levelAtLeast(environmentLevel, settings.analyticsLevel) ? settings.analyticsLevel : environmentLevel,
+    diagnosticReporting: submissionBlockedReason(privacy, { allowCloud: false }) === "opt-out" ? "off" : settings.diagnosticReporting
+  });
+}
+function workbenchNetworkEnabled(env = process.env) {
+  return submissionBlockedReason({ ZERO_OFFLINE: env.ZERO_OFFLINE }, { allowCloud: false }) !== "opt-out";
+}
+async function launchConfiguredWorkbench(args) {
+  const home = process.env.HOME || homedir();
+  if (args[0] === WORKBENCH_INNER_ARGUMENT) {
+    if (process.platform !== "linux" || !isAdmittedSmolvmWorkbench()) {
+      throw new Error("Missing authenticated SmolVM broker admission; refusing internal invocation.");
+    }
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    return void 0;
+  }
+  if (process.platform === "linux" && isAdmittedSmolvmWorkbench()) return void 0;
+  if (args[0] === "workbench" || args[0] === "config") return void 0;
+  const hostSettings = loadGlobalSettings(home, { requireExecutionProfile: existsSync(workbenchConfigPath(home)) });
+  if (hostSettings.executionProfile !== "smolvm") return void 0;
+  const config = loadWorkbenchConfig(home);
+  if (!config) throw new Error("SmolVM profile is selected but no workbench is configured. Run 0 workbench setup --image <approved-archive>.");
+  const workspaceRoot = realpathSync(config.workspaceRoot ?? process.cwd());
+  if (!lstatSync(workspaceRoot).isDirectory()) throw new Error("The configured workbench workspace is not a directory.");
+  const status = await getSmolvmWorkbenchStatus({ stateRoot: config.stateRoot, image: config.image });
+  if (status.retainedRuns.length) throw new Error("SmolVM has retained admission from an unproven cleanup. Resolve it before launching another workbench.");
+  if (!status.platformSupported || !status.runtimeReady || !status.imageApproved) {
+    throw new Error(status.error ?? "SmolVM runtime or approved image is unavailable. Run 0 workbench setup; host fallback is refused.");
+  }
+  const environment = await integrationEnvironment(config, home);
+  const network = workbenchNetworkEnabled();
+  if (!network) environment.ZERO_OFFLINE = "1";
+  const guestState = join(config.stateRoot, "guest-state");
+  mkdirSync(guestState, { recursive: true, mode: 448 });
+  if (!lstatSync(guestState).isDirectory() || lstatSync(guestState).isSymbolicLink()) throw new Error("Workbench guest-state must be a real private directory.");
+  const settingsFile = join(guestState, "tui-settings.json");
+  const temporarySettings = `${settingsFile}.${process.pid}.tmp`;
+  writeFileSync(temporarySettings, `${JSON.stringify(resolveWorkbenchGuestSettings(hostSettings), null, 2)}
+`, { mode: 384, flag: "wx" });
+  renameSync(temporarySettings, settingsFile);
+  const controller = new AbortController();
+  let signalCode;
+  const interrupt = () => {
+    signalCode = 130;
+    controller.abort();
+  };
+  const terminate = () => {
+    signalCode = 143;
+    controller.abort();
+  };
+  const hangup = () => {
+    signalCode = 129;
+    controller.abort();
+  };
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", terminate);
+  process.once("SIGHUP", hangup);
+  let result;
+  try {
+    result = await runSmolvmWorkbench({
+      image: config.image,
+      workspaceRoot,
+      stateRoot: config.stateRoot,
+      command: ["/usr/local/bin/0", WORKBENCH_INNER_ARGUMENT, ...args],
+      environment,
+      network,
+      tty: !!process.stdin.isTTY && !!process.stdout.isTTY,
+      cpus: config.cpus,
+      memoryMb: config.memoryMb,
+      storageGb: config.storageGb,
+      signal: controller.signal,
+      approvedImages: config.approvedImages ?? []
+    });
+  } finally {
+    process.removeListener("SIGINT", interrupt);
+    process.removeListener("SIGTERM", terminate);
+    process.removeListener("SIGHUP", hangup);
+  }
+  if (result.cleanupFailed) {
+    process.stderr.write("[0] SmolVM cleanup could not be proven. Workbench admission/state is retained; host execution is refused.\n");
+    return 125;
+  }
+  if (result.error) process.stderr.write(`[0] ${result.error}
+`);
+  if (result.timedOut) return 124;
+  return signalCode ?? result.exitCode ?? 125;
+}
+function selectWorkbenchProfile(profile, home) {
+  if (!saveSettings({ ...loadGlobalSettings(home), executionProfile: profile }, home)) throw new Error("Could not persist the operator execution profile.");
+}
+
 // packages/cli/src/utils/update-check.ts
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 import { spawn } from "node:child_process";
-var REPO = "0sec-labs/0sec";
+var REPO = "0sec-labs/0";
 var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 4e3;
@@ -3070,9 +3327,9 @@ function disabled(value) {
   return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
 }
 function shouldRunCheck(env = process.env, isTty = Boolean(process.stdout.isTTY), policy) {
-  if (!isTty || disabled(env.CI) || disabled(env["0SEC_OFFLINE"]) || disabled(env["0SEC_NO_UPDATE_CHECK"])) return false;
+  if (!isTty || disabled(env.CI) || disabled(env["ZERO_OFFLINE"]) || disabled(env["ZERO_NO_UPDATE_CHECK"])) return false;
   if (policy !== void 0) return policy !== "off";
-  return env["0SEC_UPDATE_CHECK"] === "1";
+  return env["ZERO_UPDATE_CHECK"] === "1";
 }
 function recent(timestamp, now) {
   const age = now - Date.parse(timestamp ?? "");
@@ -3080,7 +3337,7 @@ function recent(timestamp, now) {
 }
 function readCache() {
   try {
-    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
+    const raw = JSON.parse(readFileSync2(join2(homeStateDir(), "last-update-check"), "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
     const value = raw;
     if (typeof value.lastCheckedAt !== "string") return null;
@@ -3096,8 +3353,8 @@ function readCache() {
 }
 function writeCache(cache) {
   try {
-    mkdirSync(homeStateDir(), { recursive: true });
-    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+    mkdirSync2(homeStateDir(), { recursive: true });
+    writeFileSync2(join2(homeStateDir(), "last-update-check"), JSON.stringify(cache));
   } catch {
   }
 }
@@ -3106,7 +3363,7 @@ async function fetchLatestTag() {
   const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
   try {
     const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
-      headers: { Accept: "application/vnd.github+json", "User-Agent": "0sec-cli/update-check" },
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "@0/cli/update-check" },
       signal: controller.signal
     });
     if (!response.ok) return null;
@@ -3123,8 +3380,8 @@ async function fetchLatestTag() {
 var installInProgress = false;
 var attemptedAutomaticTags = /* @__PURE__ */ new Set();
 async function performAutoUpdate(options = {}) {
-  if (process.platform === "win32") return { success: false, installed: false, error: "Automatic installation is unavailable on Windows; download a release from https://github.com/0sec-labs/0sec/releases/latest." };
-  if (disabled(process.env["0SEC_OFFLINE"]) || disabled(process.env["0SEC_NO_UPDATE_CHECK"])) {
+  if (process.platform === "win32") return { success: false, installed: false, error: "Automatic installation is unavailable on Windows; download a release from https://github.com/0sec-labs/0/releases/latest." };
+  if (disabled(process.env["ZERO_OFFLINE"]) || disabled(process.env["ZERO_NO_UPDATE_CHECK"])) {
     return { success: false, installed: false, error: "Updates are disabled by the current offline/update policy." };
   }
   if (installInProgress) return { success: false, installed: false, error: "An update is already in progress." };
@@ -3135,7 +3392,7 @@ async function performAutoUpdate(options = {}) {
     if (!tag || !version?.complete) return { success: false, installed: false, error: "Could not resolve a valid release tag." };
     const normalizedTag = tag.startsWith("v") ? tag : `v${tag}`;
     const env = { ...process.env, RELEASE_BASE_URL: `https://github.com/${REPO}/releases/download/${normalizedTag}` };
-    const installDir = options.installDir ?? process.env["0SEC_INSTALL_DIR"];
+    const installDir = options.installDir ?? process.env["ZERO_INSTALL_DIR"];
     if (installDir !== void 0) env.INSTALL_DIR = installDir;
     const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? Math.min(options.timeoutMs, INSTALL_TIMEOUT_MS) : INSTALL_TIMEOUT_MS;
     return await new Promise((resolve) => {
@@ -3215,22 +3472,22 @@ async function maybeNotifyUpdate(currentVersion, options = {}) {
   const candidate = tag ? parseVersion(tag) : null;
   if (!tag || !candidate?.complete || candidate.prerelease.length > 0 || compareVersions(tag, currentVersion) <= 0) return;
   if (policy !== "automatic") {
-    process.stderr.write(`[0sec] Update available: ${currentVersion} \u2192 ${tag}. Run 0sec upgrade.
+    process.stderr.write(`[0] Update available: ${currentVersion} \u2192 ${tag}. Run 0 upgrade.
 `);
     return;
   }
   if (attemptedAutomaticTags.has(tag) || cache.lastInstallTag === tag && recent(cache.lastInstallAttemptAt, now)) return;
   attemptedAutomaticTags.add(tag);
   writeCache({ ...cache, lastInstallTag: tag, lastInstallAttemptAt: new Date(now).toISOString() });
-  process.stderr.write(`[0sec] Updating to ${tag} before starting the console\u2026
+  process.stderr.write(`[0] Updating to ${tag} before starting the console\u2026
 `);
   const result = await performAutoUpdate({ version: tag });
   if (result.signal) {
     process.kill(process.pid, result.signal);
     return;
   }
-  process.stderr.write(result.success ? `[0sec] Installed ${result.installedVersion}. This process is still ${currentVersion}; restart to use the update.
-` : `[0sec] Update not installed: ${result.error ?? "unknown error"} Continuing with ${currentVersion}.
+  process.stderr.write(result.success ? `[0] Installed ${result.installedVersion}. This process is still ${currentVersion}; restart to use the update.
+` : `[0] Update not installed: ${result.error ?? "unknown error"} Continuing with ${currentVersion}.
 `);
 }
 async function runStartupUpdate(version) {
@@ -3245,6 +3502,15 @@ export {
   InvalidArgumentError,
   Command,
   Option,
+  workbenchConfigPath,
+  defaultWorkbenchStateRoot,
+  isPinnedWorkbenchImageReference,
+  loadWorkbenchConfig,
+  saveWorkbenchConfig,
+  resolveWorkbenchGuestSettings,
+  workbenchNetworkEnabled,
+  launchConfiguredWorkbench,
+  selectWorkbenchProfile,
   performAutoUpdate,
   runStartupUpdate
 };

package/chunks/{chunk-53G27VPS.js → chunk-AZ7L3HFD.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/source-files.js
 import { lstatSync, readdirSync } from "node:fs";
@@ -26,12 +26,17 @@ var DEFAULT_SOURCE_EXTS = /* @__PURE__ */ new Set([
   ".php",
   ".java",
   ".kt",
+  ".swift",
   ".c",
   ".h",
   ".cc",
   ".cpp",
   ".cxx",
   ".hpp",
+  ".cs",
+  ".fs",
+  ".vb",
+  ".lua",
   ".sol"
 ]);
 var SKIP_DIRS = /* @__PURE__ */ new Set([