0sec-cli 0.18.0 → 0.22.0

package/chunks/adapt-loop-SMH6V4PD.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  adaptAndVerify,
-  applyUnifiedDiff,
-  renderAdaptationPrompt
-} from "./chunk-ASUR522M.js";
-import "./chunk-3KPWWJCI.js";
-import "./chunk-UCYRA73C.js";
-import "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
-export {
-  adaptAndVerify,
-  applyUnifiedDiff,
-  renderAdaptationPrompt
-};

package/chunks/appsec-catalog-CBWHGTEL.js

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  activeAppsecLensRegistryPath,
-  appsecArchetypeDigest,
-  appsecArchetypeToFinderLens,
-  appsecArchetypesPath,
-  appsecLensLedgerEntryDigest,
-  appsecUserArchetypesPath,
-  loadAppsecArchetypes,
-  loadAppsecFinderLenses
-} from "./chunk-QI233I24.js";
-import "./chunk-IR537GON.js";
-export {
-  activeAppsecLensRegistryPath,
-  appsecArchetypeDigest,
-  appsecArchetypeToFinderLens,
-  appsecArchetypesPath,
-  appsecLensLedgerEntryDigest,
-  appsecUserArchetypesPath,
-  loadAppsecArchetypes,
-  loadAppsecFinderLenses
-};

package/chunks/chunk-242TMK6G.js

@@ -1,110 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  estimateCost,
-  modelProvider,
-  splitCost
-} from "./chunk-6L26OBWI.js";
-
-// packages/core/dist/agent/cost-ledger.js
-var ScanCostLedger = class {
-  inputTokens = 0;
-  outputTokens = 0;
-  cachedInputTokens = 0;
-  perModel = /* @__PURE__ */ new Map();
-  /**
-   * Fold one turn's token usage into the cumulative total. `model` (the
-   * session's pricing model) keys the per-model buckets the cost_breakdown
-   * is derived from; sessions without a model pick land in "unknown".
-   */
-  add(usage, model) {
-    this.inputTokens += usage.inputTokens;
-    this.outputTokens += usage.outputTokens;
-    this.cachedInputTokens += usage.cachedInputTokens ?? 0;
-    const key = model ?? "unknown";
-    const bucket = this.perModel.get(key) ?? { inputTokens: 0, outputTokens: 0, cachedInputTokens: 0 };
-    bucket.inputTokens += usage.inputTokens;
-    bucket.outputTokens += usage.outputTokens;
-    bucket.cachedInputTokens += usage.cachedInputTokens ?? 0;
-    this.perModel.set(key, bucket);
-  }
-  /** Cumulative estimated cost (USD) across every contributing session. */
-  costUsd(model) {
-    return estimateCost({
-      inputTokens: this.inputTokens,
-      outputTokens: this.outputTokens,
-      cachedInputTokens: this.cachedInputTokens
-    }, model);
-  }
-  /** Exact cumulative spend derived from the per-model buckets. */
-  totalCostUsd() {
-    return this.costBreakdown()?.costUsd ?? 0;
-  }
-  /** Cumulative usage for the final cloud cost_update event. */
-  tokenUsage() {
-    return {
-      inputTokens: this.inputTokens,
-      outputTokens: this.outputTokens,
-      cachedInputTokens: this.cachedInputTokens
-    };
-  }
-  /**
-   * The model every contributing session used, when they all agree (and it
-   * is a real model id, not the "unknown" bucket). Undefined for multi-model
-   * runs and for runs whose sessions never named one — the caller then
-   * leaves the model field to its own resolution.
-   */
-  soleModel() {
-    if (this.perModel.size !== 1)
-      return void 0;
-    const [key] = this.perModel.keys();
-    return key === "unknown" ? void 0 : key;
-  }
-  /**
-   * Aggregate the recorded usage into the cloud's per-(provider, model)
-   * cost_breakdown shape — the same aggregation agentic-scanner's
-   * emitScanCompleted applies to its per-stage tally, sourced here from the
-   * true cross-session cumulative. Zero-usage buckets are skipped so the
-   * breakdown stays honest. Returns null when nothing was recorded at all,
-   * so callers omit cost_usd / cost_breakdown rather than emit a
-   * misleading $0.
-   */
-  costBreakdown() {
-    const acc = /* @__PURE__ */ new Map();
-    for (const [model, usage] of this.perModel) {
-      if (usage.inputTokens === 0 && usage.outputTokens === 0 && usage.cachedInputTokens === 0) {
-        continue;
-      }
-      const priced = model === "unknown" ? void 0 : model;
-      const provider = modelProvider(priced);
-      const key = `${provider}${model}`;
-      const split = splitCost(usage, priced);
-      const existing = acc.get(key);
-      if (existing) {
-        existing.cost_in += split.cost_in;
-        existing.cost_out += split.cost_out;
-        if (split.cost_cache_read !== void 0) {
-          existing.cost_cache_read = (existing.cost_cache_read ?? 0) + split.cost_cache_read;
-        }
-      } else {
-        acc.set(key, {
-          provider,
-          model,
-          cost_in: split.cost_in,
-          cost_out: split.cost_out,
-          ...split.cost_cache_read !== void 0 ? { cost_cache_read: split.cost_cache_read } : {}
-        });
-      }
-    }
-    if (acc.size === 0)
-      return null;
-    const breakdown = Array.from(acc.values());
-    const costUsd = breakdown.reduce((sum, e) => sum + e.cost_in + e.cost_out + (e.cost_cache_read ?? 0), 0);
-    return { costUsd, breakdown };
-  }
-};
-
-export {
-  ScanCostLedger
-};

package/chunks/chunk-57ZENEX2.js

@@ -1,169 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-
-// packages/core/dist/scope/scope.js
-import { readFileSync } from "node:fs";
-import { isIP } from "node:net";
-var ScopePolicy = class _ScopePolicy {
-  inScope;
-  outOfScope;
-  /**
-   * Original JSON the policy was constructed from. Exposed read-only so
-   * downstream features (0sec#216 attribution headers) can pull their
-   * own optional blocks out of the same file without re-reading it.
-   */
-  raw;
-  constructor(json) {
-    this.inScope = (json.in_scope ?? []).map(parseRule);
-    this.outOfScope = (json.out_of_scope ?? []).map(parseRule);
-    this.raw = json;
-  }
-  /**
-   * Load a policy from a JSON file on disk.
-   *
-   * Bubbles up the underlying ENOENT/JSON-parse error to the caller; the
-   * scan CLI is responsible for translating these into a user-facing
-   * "scope file not found / malformed" message and exiting non-zero before
-   * the agent ever boots.
-   */
-  static fromJsonFile(path) {
-    const raw = readFileSync(path, "utf-8");
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      throw new Error(`Scope file ${path} is not valid JSON: ${msg}`);
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error(`Scope file ${path} must be a JSON object with in_scope/out_of_scope arrays`);
-    }
-    return _ScopePolicy.fromJson(parsed);
-  }
-  static fromJson(obj) {
-    return new _ScopePolicy(obj);
-  }
-  /**
-   * Decide whether a URL is allowed by this policy.
-   *
-   * The contract used by every call site:
-   *   - allowed=true  → URL is in scope, callers may proceed.
-   *   - allowed=false → URL is out of scope; callers MUST surface this as
-   *                     a hard error (`ToolResult.error`), not a warning.
-   *
-   * `reason` is human-readable and meant to be embedded in the error
-   * message returned to the agent so it can self-correct.
-   */
-  match(url) {
-    let host;
-    try {
-      host = normalizeScopeHostname(new URL(url).hostname);
-    } catch {
-      return { allowed: false, reason: `out-of-scope: not a valid URL (${url})` };
-    }
-    const denyHit = this.outOfScope.find((rule) => matches(rule, host));
-    if (denyHit) {
-      return { allowed: false, reason: `out-of-scope: host '${host}' matches deny rule '${denyHit.raw}'` };
-    }
-    if (this.inScope.length === 0) {
-      return { allowed: false, reason: `out-of-scope: host '${host}' (no in_scope rules defined)` };
-    }
-    const allowHit = this.inScope.find((rule) => matches(rule, host));
-    if (allowHit) {
-      return { allowed: true, reason: `in-scope: host '${host}' matches '${allowHit.raw}'` };
-    }
-    return { allowed: false, reason: `out-of-scope: host '${host}' did not match any in_scope rule` };
-  }
-};
-function extractUrls(text) {
-  const re = /https?:\/\/[^\s'"`<>|]+/gi;
-  const out = [];
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    let url = m[0];
-    while (url.length > 0 && /[.,;:)\]}]$/.test(url)) {
-      url = url.slice(0, -1);
-    }
-    if (url.length > 0)
-      out.push(url);
-  }
-  return out;
-}
-function loadScope(path) {
-  return ScopePolicy.fromJsonFile(path);
-}
-function matchUrl(url, policy) {
-  return policy.match(url);
-}
-function normalizeScopeHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/\.+$/, "");
-  const address = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
-  return isIP(address) === 6 ? new URL(`http://[${address}]/`).hostname : normalized;
-}
-function parseRule(raw) {
-  if (typeof raw !== "string" || raw.trim().length === 0) {
-    throw new Error(`Invalid scope rule: ${JSON.stringify(raw)} (must be a non-empty string)`);
-  }
-  const rule = raw.trim().toLowerCase();
-  if (rule.includes("/")) {
-    const parts = rule.split("/");
-    if (parts.length !== 2) {
-      throw new Error(`Invalid CIDR '${raw}': expected exactly one '/'`);
-    }
-    const [ip, prefixStr] = parts;
-    if (!/^\d+$/.test(prefixStr)) {
-      throw new Error(`Invalid CIDR prefix in '${raw}': must be a non-negative integer 0-32`);
-    }
-    const prefix = Number(prefixStr);
-    if (prefix < 0 || prefix > 32) {
-      throw new Error(`Invalid CIDR prefix in '${raw}': must be 0-32`);
-    }
-    if (isIP(ip) !== 4) {
-      throw new Error(`Invalid CIDR '${raw}': only IPv4 CIDR is supported`);
-    }
-    return { raw, kind: "cidr", cidr: { network: ipv4ToInt(ip), prefix } };
-  }
-  if (rule.startsWith("*.")) {
-    const suffix = normalizeScopeHostname(rule.slice(2));
-    if (suffix.length === 0 || suffix.includes("*")) {
-      throw new Error(`Invalid wildcard rule '${raw}': must be of the form '*.domain.tld'`);
-    }
-    return { raw, kind: "wildcard", suffix };
-  }
-  if (rule.includes("*")) {
-    throw new Error(`Invalid scope rule '${raw}': only leading '*.' wildcards are supported`);
-  }
-  return { raw, kind: "exact", host: normalizeScopeHostname(rule) };
-}
-function matches(rule, host) {
-  switch (rule.kind) {
-    case "exact":
-      return rule.host === host;
-    case "wildcard": {
-      const suffix = "." + rule.suffix;
-      return host !== rule.suffix && host.endsWith(suffix);
-    }
-    case "cidr": {
-      if (isIP(host) !== 4)
-        return false;
-      const { network, prefix } = rule.cidr;
-      if (prefix === 0)
-        return true;
-      const mask = prefix === 32 ? 4294967295 : ~((1 << 32 - prefix) - 1) >>> 0;
-      return (ipv4ToInt(host) & mask) >>> 0 === (network & mask) >>> 0;
-    }
-  }
-}
-function ipv4ToInt(ip) {
-  const parts = ip.split(".").map((p) => Number(p));
-  return (parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
-}
-
-export {
-  ScopePolicy,
-  extractUrls,
-  loadScope,
-  matchUrl,
-  normalizeScopeHostname
-};

package/chunks/chunk-ADOLI6DT.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  createPresentationEvent
-} from "./chunk-6L26OBWI.js";
-
-// packages/core/dist/events/bus.js
-function presentationEventSink(sink, options = {}) {
-  let sequence = 0;
-  const source = options.source ?? "core";
-  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  return {
-    emit(type, payload) {
-      const scanId = typeof payload["scan_id"] === "string" ? payload["scan_id"] : typeof payload["scanId"] === "string" ? payload["scanId"] : void 0;
-      const sessionId = typeof payload["session_id"] === "string" ? payload["session_id"] : typeof payload["sessionId"] === "string" ? payload["sessionId"] : void 0;
-      sink.emit(createPresentationEvent({
-        source,
-        sequence: ++sequence,
-        at: now(),
-        eventType: type,
-        payload,
-        ...scanId ? { scanId } : {},
-        ...sessionId ? { sessionId } : {}
-      }));
-    }
-  };
-}
-var EventBus = class {
-  sinks = [];
-  /** Subscribe a sink. Returns an unsubscribe function. */
-  subscribe(sink) {
-    this.sinks.push(sink);
-    return () => {
-      const idx = this.sinks.indexOf(sink);
-      if (idx >= 0)
-        this.sinks.splice(idx, 1);
-    };
-  }
-  /** Remove every subscriber — primarily useful in tests. */
-  clear() {
-    this.sinks = [];
-  }
-  /** Returns a read-only snapshot of the current sinks (for tests). */
-  get size() {
-    return this.sinks.length;
-  }
-  /**
-   * Fan out a single event to every subscribed sink. Exceptions thrown by
-   * any sink are swallowed — one misbehaving consumer must never abort a
-   * scan. Diagnostic is written to stderr so the failure is visible.
-   */
-  emit(type, payload) {
-    const snapshot = this.sinks.slice();
-    for (const sink of snapshot) {
-      try {
-        sink.emit(type, payload);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        try {
-          process.stderr.write(`[0sec event-bus] sink threw on ${type}: ${msg}
-`);
-        } catch {
-        }
-      }
-    }
-  }
-};
-var eventBus = new EventBus();
-var cloudEventSink = {
-  emit(type, payload) {
-    const prefix = `0SEC_EVENT_${type.toUpperCase()}`;
-    let line;
-    try {
-      line = `${prefix} ${JSON.stringify(payload)}`;
-    } catch {
-      line = `${prefix} {"_unserializable":true}`;
-    }
-    process.stdout.write(line + "\n");
-  }
-};
-var cloudSinkSubscribed = false;
-function maybeSubscribeCloudEventSink() {
-  if (cloudSinkSubscribed)
-    return;
-  const flag = process.env["0SEC_CLOUD_EVENTS"];
-  if (flag && flag !== "0" && flag.toLowerCase() !== "false") {
-    eventBus.subscribe(cloudEventSink);
-    cloudSinkSubscribed = true;
-  }
-}
-function isCloudEventSinkActive() {
-  return cloudSinkSubscribed;
-}
-
-export {
-  presentationEventSink,
-  eventBus,
-  cloudEventSink,
-  maybeSubscribeCloudEventSink,
-  isCloudEventSinkActive
-};