0sec-cli 0.21.4 → 0.22.0

package/0.js

@@ -3,8 +3,9 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   Command,
+  launchConfiguredWorkbench,
   runStartupUpdate
-} from "./chunks/chunk-CL5KAUM6.js";
+} from "./chunks/chunk-7UFUALR2.js";
 import {
   resolveEngagement,
   setHerdrSink
@@ -15,67 +16,64 @@ import {
   installProcessPresentationStreamBridge,
   maybeLoadCodexAuth,
   presentationEventBus
-} from "./chunks/chunk-YPOA3W4O.js";
-import {
-  source_default
-} from "./chunks/chunk-HLFS6WV2.js";
+} from "./chunks/chunk-YIQSGNAA.js";
 import {
   createHerdrEventSink,
   maybeSubscribeOperationalEventSink
-} from "./chunks/chunk-FAH6V4QM.js";
-import "./chunks/chunk-RF5QGKLR.js";
-import "./chunks/chunk-Y5H6E24H.js";
-import "./chunks/chunk-GVD6SJGH.js";
+} from "./chunks/chunk-EGZGZFAH.js";
+import "./chunks/chunk-LYUAM3TG.js";
+import {
+  source_default
+} from "./chunks/chunk-HLFS6WV2.js";
 import "./chunks/chunk-QCUFBVIZ.js";
-import "./chunks/chunk-2WSXFFJZ.js";
-import "./chunks/chunk-G34QP2XW.js";
+import "./chunks/chunk-RSIUX3RW.js";
+import "./chunks/chunk-TM74SSHC.js";
 import "./chunks/chunk-2WNCI664.js";
-import "./chunks/chunk-Z3IKZX3X.js";
+import "./chunks/chunk-23DG5YKS.js";
 import "./chunks/chunk-DQTNI3KY.js";
-import "./chunks/chunk-YA4PUM4H.js";
-import "./chunks/chunk-O6SD4A36.js";
-import "./chunks/chunk-TF46UWFU.js";
+import "./chunks/chunk-VMRRNRMR.js";
+import "./chunks/chunk-DM5C5L5D.js";
+import "./chunks/chunk-RRD4XXPU.js";
+import "./chunks/chunk-HUNAPTKV.js";
 import "./chunks/chunk-AZ7L3HFD.js";
-import "./chunks/chunk-YHWWF4QY.js";
-import "./chunks/chunk-E2UOY5PJ.js";
-import {
-  analyticsPipeline,
-  configureRunContributionsFromEnvironment
-} from "./chunks/chunk-ANDKY54G.js";
-import "./chunks/chunk-CAJJRUTV.js";
+import "./chunks/chunk-UU7PQP6N.js";
+import "./chunks/chunk-UV5QWZGE.js";
+import "./chunks/chunk-SJBCK2EI.js";
 import "./chunks/chunk-K2PWUPUI.js";
-import "./chunks/chunk-SBMB4OL3.js";
+import "./chunks/chunk-TZFIAMWZ.js";
 import "./chunks/chunk-2OQOQ2FZ.js";
 import "./chunks/chunk-UEX7PFSE.js";
-import "./chunks/chunk-5T6D5BVY.js";
-import "./chunks/chunk-GIQKESMN.js";
-import "./chunks/chunk-PD2BBBKT.js";
-import "./chunks/chunk-WF5W75WY.js";
-import "./chunks/chunk-QZVG3BG4.js";
-import "./chunks/chunk-SQCBHFWN.js";
-import "./chunks/chunk-NDJU5ZZ7.js";
-import "./chunks/chunk-ER3SUMYJ.js";
+import "./chunks/chunk-OAYUPGF6.js";
+import "./chunks/chunk-XFCTUKXR.js";
+import "./chunks/chunk-HR2TU42B.js";
 import {
+  analyticsPipeline,
+  configureRunContributionsFromEnvironment,
   eventBus,
-  maybeSubscribeCloudEventSink,
   presentationEventSink
-} from "./chunks/chunk-CXKDWFNO.js";
+} from "./chunks/chunk-RE5EZDG2.js";
+import "./chunks/chunk-SQCBHFWN.js";
+import "./chunks/chunk-GVD6SJGH.js";
+import "./chunks/chunk-5MWAG3FT.js";
+import "./chunks/chunk-W6UWZFKL.js";
 import "./chunks/chunk-FHC2B7LN.js";
-import "./chunks/chunk-P6YG6TEZ.js";
+import "./chunks/chunk-DKSCN2AB.js";
 import "./chunks/chunk-UFHN6RIU.js";
-import "./chunks/chunk-WZISK5VC.js";
-import "./chunks/chunk-VOAXLO4A.js";
-import "./chunks/chunk-W4JOXE4N.js";
-import "./chunks/chunk-WPQLBN4S.js";
+import "./chunks/chunk-VNRY6AWF.js";
+import "./chunks/chunk-TO35Y326.js";
+import "./chunks/chunk-IXT64DV5.js";
+import "./chunks/chunk-UELXHK2Y.js";
+import "./chunks/chunk-LPTRPRZR.js";
 import "./chunks/chunk-V36HVTUL.js";
 import "./chunks/chunk-4VGLO2YS.js";
 import "./chunks/chunk-6YNKRUMC.js";
-import "./chunks/chunk-CGHCEN7W.js";
-import "./chunks/chunk-HPQZHOIU.js";
-import "./chunks/chunk-BACXRTQ4.js";
+import "./chunks/chunk-7DEHG7YT.js";
+import "./chunks/chunk-5IBCBQEH.js";
+import "./chunks/chunk-IO7R7WBM.js";
+import "./chunks/chunk-2GV4HQKE.js";
 import {
   VERSION
-} from "./chunks/chunk-PC6RCKQV.js";
+} from "./chunks/chunk-76KSBWOQ.js";
 import "./chunks/chunk-VIT5ALXF.js";
 import "./chunks/chunk-VCSFCHAJ.js";
 
@@ -101,7 +99,7 @@ import { fileURLToPath } from "node:url";
 var BYPASS_ENV = "ZERO_ALLOW_STALE_SOURCE_DIST";
 function currentBuildCommit() {
   if (true) {
-    return "27671f61aa4861a39c52482b3f65603deb8fbee8";
+    return "b6570dfd5d65a2c97a14cfb1432c4f7b975fb411";
   }
   return void 0;
 }
@@ -187,10 +185,18 @@ function enforceSourceDistFreshness(opts = {}) {
 }
 
 // packages/cli/src/index.ts
+try {
+  const workbenchExitCode = await launchConfiguredWorkbench(process.argv.slice(2));
+  if (workbenchExitCode !== void 0) process.exit(workbenchExitCode);
+} catch (error) {
+  process.stderr.write(`[0] ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exit(125);
+}
+var isWorkbenchManagement = process.argv[2] === "workbench" || process.argv[2] === "config";
 installConsolePresentationBridge();
 installProcessPresentationStreamBridge();
-maybeLoadCodexAuth();
-maybeSubscribeCloudEventSink();
+if (!isWorkbenchManagement) maybeLoadCodexAuth();
 try {
   getSettings();
 } catch {
@@ -207,9 +213,9 @@ var herdrSink = createHerdrEventSink();
 if (herdrSink) eventBus.subscribe(herdrSink);
 setHerdrSink(herdrSink);
 enforceSourceDistFreshness({ entryUrl: import.meta.url });
-await runStartupUpdate(VERSION);
+if (!isWorkbenchManagement) await runStartupUpdate(VERSION);
 async function buildProgram() {
-  const c = await import("./chunks/commands-WF5RG4I2.js");
+  const c = await import("./chunks/commands-NEI7L3QA.js");
   const program = new Command();
   program.name("0").description("Open-source multi-model security research harness").version(VERSION).enablePositionalOptions();
   c.registerScanCommand(program);
@@ -220,8 +226,6 @@ async function buildProgram() {
   c.registerSecureCommand(program);
   c.registerReviewCommand(program);
   c.registerFixCommand(program);
-  c.registerConnectCommand(program);
-  c.registerGuideCommand(program);
   c.registerAuditCommand(program);
   c.registerDoctorCommand(program);
   c.registerDashboardCommand(program);
@@ -249,8 +253,6 @@ async function buildProgram() {
   c.registerUpgradeCommand(program);
   c.registerDepsCommand(program);
   c.registerH1Command(program);
-  c.registerAuthCommand(program);
-  c.registerHostedCommand(program);
   c.registerIntelCommand(program);
   c.registerReconCommand(program);
   c.registerConsoleCommand(program);
@@ -270,16 +272,14 @@ async function buildProgram() {
   c.registerThemeCommand(program);
   c.registerEvolveCommand(program);
   c.registerConfigCommand(program);
-  c.registerServiceCommand(program);
-  c.registerProjectSetupCommand(program);
-  c.registerAuditSkillsCommand(program);
+  c.registerWorkbenchCommand(program);
   c.registerHackstoreCommand(program);
   return program;
 }
 async function showInteractiveMenu() {
   const { isBunRuntime } = await import("./chunks/runtime-XFWJTBUO.js");
   if (isBunRuntime()) {
-    const { showOpenTuiHome } = await import("./chunks/run-CBGE6DRQ.js");
+    const { showOpenTuiHome } = await import("./chunks/run-U3XU4CTC.js");
     await showOpenTuiHome();
     return;
   }
@@ -302,7 +302,7 @@ process.once("beforeExit", () => {
   });
 });
 var userArgs = process.argv.slice(2);
-var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "connect", "guide", "review", "fix", "audit", "deps", "doctor", "dashboard", "tui", "watch", "orchestrate", "db", "mcp-server", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "auth", "login", "models", "balance", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "service", "project", "skills", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "evolve", "hackstore", "hack", "store", "help"];
+var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "review", "fix", "audit", "deps", "doctor", "dashboard", "tui", "watch", "orchestrate", "db", "mcp-server", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "workbench", "evolve", "hackstore", "hack", "store", "help"];
 if (userArgs.length === 0) {
   showInteractiveMenu().catch((err) => {
     console.error(source_default.red(err instanceof Error ? err.message : String(err)));

package/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://0.security/">
-    <img src="assets/readme-cover.png" alt="Software already builds software. Now it can secure itself, too." width="100%">
+    <img src="assets/readme-cover.png" alt="0security terminal security research workflow" width="100%">
   </a>
 </p>
 
@@ -13,13 +13,12 @@
 
 <p align="center">
   <strong>The open-source, self-evolving, multi-model harness for security research.</strong><br/>
-  <sub>The Swiss Applied AI &amp; Cybersecurity Research Lab</sub><br/>
+  <sub>Backed by Y Combinator · The Swiss Applied AI &amp; Cybersecurity Research Lab</sub><br/>
   <a href="https://0.security/">0.security</a> ·
   <a href="https://docs.0.security/">Documentation</a> ·
   <a href="https://github.com/0sec-labs/foxguard">FoxGuard</a>
 </p>
 
-
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-1A1815?style=flat-square&labelColor=1A1815" alt="License: MIT OR Apache-2.0"></a>
   <a href="https://github.com/0sec-labs/0/releases/latest"><img src="https://img.shields.io/github/v/release/0sec-labs/0?style=flat-square&labelColor=1A1815&color=1A1815" alt="Latest release"></a>
@@ -30,88 +29,74 @@
   <img src="assets/security-cycle-diagram.webp" alt="Zero studies, finds, fixes, reports, and improves." width="100%">
 </p>
 
+## Security research, in your workspace
 
-## The harness behind our research breakthroughs.
-
-Find novel vulnerabilities in the deepest layers of software. Explore our
-[public disclosures and upstream fixes](https://0.security/research/#disclosures),
-including research in the Linux kernel.
+0 is an open-source, multi-model harness for investigating software security:
+read code, run tools, investigate findings and review proposed fixes.
+Built by the Swiss Applied AI & Cybersecurity Research Lab, it supports our
+[public disclosures and upstream fixes](https://0.security/research/#disclosures).
 
 ## Get started
 
-### Docs for your agent
-
-Copy this prompt into your coding agent:
-
-> Set up the 0.security harness using https://0.security/harness/setup.md and read https://0.security/llms.txt for the documentation index. Confirm my targets and scope before testing, and ask before changing files.
-
-### Quick install
+Install on Apple Silicon macOS or x64/ARM64 Linux, then open 0:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash
+export PATH="$HOME/.0/bin:$PATH"
 0
 ```
 
-Bring your model access and configure connections in the terminal. Run locally
-or through the CLI in CI/CD, inspect findings and verification results, and
-export reports as JSON, Markdown or SARIF.
-
-[Setup guide](https://0.security/harness/setup.md) ·
-[Research workflows](https://docs.0.security/research-workflows/) ·
-[Documentation](https://docs.0.security/)
-
-## Built for security research
 
-- **Open research.** Benchmark-led agent design and A/B-tested attack strategies,
-  with public findings that others can inspect.
-- **Extensible tools.** Use the in-house security linter, connect your own tools,
-  and let agents write and run tools for the investigation.
-- **Adaptive agents.** Delegate focused investigations to subagents with fresh
-  context and bounded budgets, then collect their findings. See the
-  [agent loop](https://docs.0.security/agent-loop/) and
-  [worker monitoring](https://docs.0.security/console/#monitoring-subagents).
-- **Multi-model harness.** Bring the models you prefer into one security workflow.
-  Combine deterministic steps with adaptive investigations.
-- **Evaluated self-improvement.** Propose changes, evaluate them, and select better
-  versions for future runs. Learn more about the
-  [improvement plane](https://docs.0.security/improvement-plane/).
 
-### Available on 0.security
+## Work locally, extend deliberately
 
-**Optimized Model Routing: The best LLM for each step**
+- Describe an authorized repository and investigation goal in chat, or use
+  `0 review ./authorized-repo` for a source review.
+- Review findings and proposed changes.
+  Follow the [research workflows](https://docs.0.security/research-workflows/)
+  for deeper investigations.
+- Connect your tools through [MCP and integrations](https://docs.0.security/integrations/).
+  Browse `/hackstore`, or [build and locally install an extension](https://docs.0.security/hackstore/).
+  Community plugins run as local processes; review them before enabling.
 
-The managed service adds model routing, non-public frontier cyber models,
-a purpose-built attack runtime and a curated offensive toolchain. These hosted
-capabilities are separate from running the open-source harness with your own
-model access. [Explore 0.security](https://0.security/).
+## Why 0?
 
-## Make software secure itself.
+Use the models you want. Bring the tools you need. Make the workflow your own.
+0 brings security investigations and fixes into one terminal workspace, with
+focused agents and an extensible toolchain. The harness is open source and
+runs under your control.
 
-The world's best security should belong to everyone. Software already writes
-itself; we believe it should secure itself, too. Our goal is security that
-finds and fixes vulnerabilities as software changes, so people can focus on
-what they want to create.
+## Guides
 
-Research comes first. Public disclosures, upstream fixes and reproducible
-results let people check our work. Open tools let them question it, extend it
-and build something better. Self-securing software is the future we're working
-toward.
+- [Quick start and installation](https://docs.0.security/getting-started/)
+- [Models and provider connections](https://docs.0.security/api-keys/)
+- [Console, sessions and agents](https://docs.0.security/console/)
+- [Plugins and Hackstore publishing](https://docs.0.security/hackstore/)
+- [Scope and authorization](https://docs.0.security/scope/)
+- [GitHub Actions](https://docs.0.security/ci/github-action/)
+- [Troubleshooting](https://docs.0.security/troubleshooting/)
 
-[Read our manifesto](https://0.security/about/) ·
-[Explore our research](https://0.security/research/)
+## Status and safety
 
-## Status
+This is a **research preview**, not a guarantee of coverage or correctness.
+Review results and generated fixes before applying them. Tool making and
+[evaluated self-improvement](https://docs.0.security/improvement-plane/) are research workflows.
 
-This is a research preview. Coverage and verification depth vary by workflow;
-inspect the evidence and review generated fixes before applying them.
-Tool making and evaluated self-improvement are developing research workflows.
-Only test systems you own or are authorized to assess.
+Only test systems you own or are authorized to assess. The optional
+[scope plugin](https://docs.0.security/scope/) is disabled by default:
+enable it explicitly with `0 plugin enable scope` and configure your boundaries.
+The default console uses YOLO mode; use `0 console --mode standard` for
 
-## Contributing
+## Contributing and license
 
-Read [CONTRIBUTING.md](CONTRIBUTING.md) to build and extend the harness.
+Build and extend the harness with [CONTRIBUTING.md](CONTRIBUTING.md).
 Report security issues through [SECURITY.md](SECURITY.md).
+Licensed under [MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
 
-## License
+## Acknowledgments
 
-[MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
+Thanks to the teams behind [OpenTUI](https://github.com/anomalyco/opentui),
+[Bun](https://bun.sh/) and [React](https://react.dev/) for the interface stack,
+and [Models.dev](https://models.dev/) and [LiteLLM](https://github.com/BerriAI/litellm)
+for model metadata and pricing estimates. Thank you to everyone contributing
+code, reporting bugs and sharing ideas.

package/chunks/{adapt-loop-IGBRQAXO.js → adapt-loop-7I57LXXR.js}

@@ -5,10 +5,10 @@ import {
   adaptAndVerify,
   applyUnifiedDiff,
   renderAdaptationPrompt
-} from "./chunk-RF5QGKLR.js";
-import "./chunk-CAJJRUTV.js";
-import "./chunk-5T6D5BVY.js";
-import "./chunk-PC6RCKQV.js";
+} from "./chunk-RRD4XXPU.js";
+import "./chunk-OAYUPGF6.js";
+import "./chunk-XFCTUKXR.js";
+import "./chunk-76KSBWOQ.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{artifact-scraper-LNQJUORS.js → artifact-scraper-PYZ3RU3O.js}

@@ -14,8 +14,8 @@ import {
   parseUbuntuTracker,
   scoreCodeCandidate,
   scoreRepoCandidate
-} from "./chunk-WPQLBN4S.js";
-import "./chunk-PC6RCKQV.js";
+} from "./chunk-LPTRPRZR.js";
+import "./chunk-76KSBWOQ.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{assumption-mining-4MJTP6H5.js → assumption-mining-MFLF43IR.js}

@@ -24,29 +24,29 @@ import {
   scoreDualViewWeaponizability,
   storeAssumptionModel,
   subjectSelfEnforces
-} from "./chunk-YHWWF4QY.js";
+} from "./chunk-UU7PQP6N.js";
 import {
   composeGate,
   makeSkepticVerifier
-} from "./chunk-E2UOY5PJ.js";
-import "./chunk-ANDKY54G.js";
-import "./chunk-CAJJRUTV.js";
+} from "./chunk-UV5QWZGE.js";
+import "./chunk-SJBCK2EI.js";
 import "./chunk-K2PWUPUI.js";
-import "./chunk-SBMB4OL3.js";
+import "./chunk-TZFIAMWZ.js";
 import "./chunk-2OQOQ2FZ.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-5T6D5BVY.js";
-import "./chunk-PD2BBBKT.js";
-import "./chunk-QZVG3BG4.js";
-import "./chunk-NDJU5ZZ7.js";
-import "./chunk-ER3SUMYJ.js";
-import "./chunk-CXKDWFNO.js";
-import "./chunk-WZISK5VC.js";
-import "./chunk-W4JOXE4N.js";
+import "./chunk-OAYUPGF6.js";
+import "./chunk-XFCTUKXR.js";
+import "./chunk-RE5EZDG2.js";
+import "./chunk-5MWAG3FT.js";
+import "./chunk-W6UWZFKL.js";
+import "./chunk-VNRY6AWF.js";
+import "./chunk-IXT64DV5.js";
+import "./chunk-UELXHK2Y.js";
 import "./chunk-4VGLO2YS.js";
-import "./chunk-CGHCEN7W.js";
-import "./chunk-BACXRTQ4.js";
-import "./chunk-PC6RCKQV.js";
+import "./chunk-7DEHG7YT.js";
+import "./chunk-5IBCBQEH.js";
+import "./chunk-2GV4HQKE.js";
+import "./chunk-76KSBWOQ.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{chunk-Z3IKZX3X.js → chunk-23DG5YKS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   allowlistedChildEnv
-} from "./chunk-QZVG3BG4.js";
+} from "./chunk-5IBCBQEH.js";
 
 // packages/core/dist/stages/npm-detectors/osv-lookup.js
 var DEFAULT_ENDPOINT = "https://api.osv.dev/v1/querybatch";