0sec-cli 0.21.4 → 0.22.0

package/chunks/{chunk-VOAXLO4A.js → chunk-TO35Y326.js}

@@ -4,10 +4,12 @@ const require = __0CreateRequire(import.meta.url);
 import {
   analyzeFindingForKnownMarkers,
   detectKnownMarkers,
-  extractFileRefs,
-  redactSensitiveHeaders,
   require_dist
-} from "./chunk-W4JOXE4N.js";
+} from "./chunk-IXT64DV5.js";
+import {
+  extractFileRefs,
+  redactSensitiveHeaders
+} from "./chunk-UELXHK2Y.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";
@@ -380,720 +382,6 @@ function extractSiblingFix(finding, options) {
   };
 }
 
-// packages/core/dist/disclose/poc-runtime.js
-import { spawn } from "node:child_process";
-var MAX_CAPTURE_BYTES = 1024 * 1024;
-var DEFAULT_STEP_TIMEOUT_MS = 3e4;
-var PERSONA_HEADER = "X-0-Persona";
-var TRUNCATION_MARKER = "\n\u2026[truncated at 1MiB]";
-var DEFAULT_RPS_PER_HOST = 2;
-var MAX_REDIRECT_HOPS = 5;
-var hostBuckets = /* @__PURE__ */ new Map();
-function getOrInitBucket(host, rps) {
-  let bucket = hostBuckets.get(host);
-  if (!bucket) {
-    bucket = {
-      tokens: rps,
-      // full bucket on first use
-      refillRatePerMs: rps / 1e3,
-      capacity: rps,
-      lastRefill: Date.now(),
-      retryUntil: 0
-    };
-    hostBuckets.set(host, bucket);
-  }
-  return bucket;
-}
-function refill(bucket) {
-  const now = Date.now();
-  const elapsed = now - bucket.lastRefill;
-  if (elapsed > 0) {
-    bucket.tokens = Math.min(bucket.capacity, bucket.tokens + elapsed * bucket.refillRatePerMs);
-    bucket.lastRefill = now;
-  }
-}
-async function acquireHostToken(host, rps) {
-  const bucket = getOrInitBucket(host, rps);
-  while (Date.now() < bucket.retryUntil) {
-    const waitMs = bucket.retryUntil - Date.now();
-    await sleep(Math.min(waitMs, 1e3));
-  }
-  while (true) {
-    refill(bucket);
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      return;
-    }
-    const tokensNeeded = 1 - bucket.tokens;
-    const waitMs = Math.max(1, Math.ceil(tokensNeeded / bucket.refillRatePerMs));
-    await sleep(waitMs);
-  }
-}
-function markHostRateLimited(host, retryAfterHeader) {
-  const bucket = hostBuckets.get(host);
-  if (!bucket)
-    return;
-  const parsed = retryAfterHeader ? parseInt(retryAfterHeader, 10) : NaN;
-  const retryAfterMs = Number.isFinite(parsed) && parsed > 0 ? parsed * 1e3 : 0;
-  bucket.retryUntil = Date.now() + Math.max(retryAfterMs, 6e4);
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-function normalizeHostForMatch(value) {
-  const trimmed = value.trim().toLowerCase();
-  if (trimmed.startsWith("[")) {
-    const end = trimmed.indexOf("]");
-    return end === -1 ? trimmed : trimmed.slice(1, end);
-  }
-  if ((trimmed.match(/:/g) ?? []).length >= 2)
-    return trimmed;
-  return trimmed.replace(/:\d+$/, "");
-}
-function hostMatchesAllowlist(host, allowlist) {
-  if (!allowlist || allowlist.length === 0)
-    return true;
-  const target = normalizeHostForMatch(host);
-  for (const raw of allowlist) {
-    const pattern = normalizeHostForMatch(raw);
-    if (!pattern)
-      continue;
-    if (pattern.startsWith("*.")) {
-      const suffix = pattern.slice(1);
-      if (target.endsWith(suffix) && target.length > suffix.length)
-        return true;
-    } else if (target === pattern) {
-      return true;
-    }
-  }
-  return false;
-}
-function scopeRequiredResult(step, target, start) {
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0)
-    return void 0;
-  return {
-    stepId: step.id,
-    kind: "errored",
-    durationMs: Date.now() - start,
-    error: "PoC reverify requires a non-empty scope allowlist"
-  };
-}
-function extractUrlsFromShellCommand(cmd) {
-  const matches = cmd.match(/https?:\/\/[^\s'"]+/g);
-  return matches ?? [];
-}
-function dockerRegistryHost(image) {
-  const separator = image.indexOf("/");
-  if (separator === -1)
-    return void 0;
-  const firstSegment = image.slice(0, separator);
-  return firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost" ? firstSegment : void 0;
-}
-var deps = { spawn, fetch: globalThis.fetch };
-function setRuntimeDeps(overrides) {
-  const previous = deps;
-  deps = { ...previous, ...overrides };
-  return () => {
-    deps = previous;
-  };
-}
-async function executePocSteps(finding, target) {
-  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const steps = [];
-  const graph = finding.pocSteps ?? [];
-  for (const step of graph) {
-    const result = await executeStep(step, target);
-    steps.push(result);
-    if (result.kind === "errored" && step.kind !== "verify") {
-      for (let i = graph.indexOf(step) + 1; i < graph.length; i++) {
-        steps.push({
-          stepId: graph[i].id,
-          kind: "skipped",
-          durationMs: 0,
-          error: "skipped: an earlier step errored"
-        });
-      }
-      break;
-    }
-  }
-  const endedAt = (/* @__PURE__ */ new Date()).toISOString();
-  return {
-    findingId: finding.id,
-    startedAt,
-    endedAt,
-    steps,
-    overallVerdict: aggregateVerdict(graph, steps)
-  };
-}
-async function executeStep(step, target) {
-  const start = Date.now();
-  if (target.allowProcessActions === false && (step.action.type === "shell" || step.action.type === "docker")) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `PoC ${step.action.type} actions require an isolated execution environment`
-    };
-  }
-  try {
-    switch (step.action.type) {
-      case "shell":
-        return await runShellStep(step, step.action, target, start);
-      case "http":
-        return await runHttpStep(step, step.action, target, start);
-      case "docker":
-        return await runDockerStep(step, step.action, target, start);
-      case "note":
-        return {
-          stepId: step.id,
-          kind: "skipped",
-          durationMs: Date.now() - start
-        };
-      default: {
-        const _exhaustive = step.action;
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `unknown action type: ${JSON.stringify(_exhaustive)}`
-        };
-      }
-    }
-  } catch (err) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: errMessage(err)
-    };
-  }
-}
-async function runShellStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0) {
-    for (const u of extractUrlsFromShellCommand(action.cmd)) {
-      let host;
-      try {
-        host = new URL(u).host;
-      } catch {
-        continue;
-      }
-      if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `out-of-scope url in shell cmd: ${u} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-    }
-  }
-  const env = { ...process.env, ...target.env ?? {} };
-  const cwd = action.cwd ?? target.cwd;
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const spawned = await spawnAndCapture("/bin/sh", ["-c", action.cmd], { env, cwd, timeoutMs });
-  return finaliseProcessStep(step, spawned, start);
-}
-async function runDockerStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  const registryHost = dockerRegistryHost(action.image);
-  if (registryHost && !hostMatchesAllowlist(registryHost, target.scopeAllowlist)) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `out-of-scope docker registry: ${registryHost} (allowlist: ${target.scopeAllowlist.join(", ")})`
-    };
-  }
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0) {
-    const dockerTokens = [action.image, ...action.args].join(" ");
-    for (const u of extractUrlsFromShellCommand(dockerTokens)) {
-      let host;
-      try {
-        host = new URL(u).host;
-      } catch {
-        continue;
-      }
-      if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `out-of-scope url in docker action: ${u} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-    }
-  }
-  const env = { ...process.env, ...target.env ?? {} };
-  const cwd = target.cwd;
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const spawned = await spawnAndCapture("docker", ["run", "--rm", ...action.args, action.image], { env, cwd, timeoutMs });
-  return finaliseProcessStep(step, spawned, start);
-}
-async function runHttpStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  const url = resolveUrl(action.url, target.baseUrl);
-  if (!url) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `http step has a relative url (${action.url}) but no target.baseUrl was provided`
-    };
-  }
-  let host;
-  try {
-    host = new URL(url).host;
-  } catch {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `http step url is not a valid URL: ${url}`
-    };
-  }
-  if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `out-of-scope host: ${host} (allowlist: ${target.scopeAllowlist.join(", ")})`
-    };
-  }
-  const rps = target.rpsPerHost ?? DEFAULT_RPS_PER_HOST;
-  await acquireHostToken(host, rps);
-  const headers = mergePersonaHeaders(action.headers ?? {}, target);
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
-  let finalResponse;
-  let body = "";
-  let currentUrl = url;
-  let redirectCount = 0;
-  try {
-    while (true) {
-      finalResponse = await deps.fetch(currentUrl, {
-        method: action.method,
-        headers,
-        body: action.body,
-        signal: ac.signal,
-        redirect: "manual"
-      });
-      const status = finalResponse.status;
-      const isRedirect = [301, 302, 303, 307, 308].includes(status);
-      if (!isRedirect) {
-        body = await readBodyCapped(finalResponse);
-        if (status === 429) {
-          const retryAfter = finalResponse.headers.get("retry-after");
-          markHostRateLimited(host, retryAfter);
-        }
-        break;
-      }
-      redirectCount++;
-      if (redirectCount > MAX_REDIRECT_HOPS) {
-        try {
-          finalResponse.body?.cancel();
-        } catch {
-        }
-        clearTimeout(timer);
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `too many redirects (exceeded ${MAX_REDIRECT_HOPS} hops)`
-        };
-      }
-      const location = finalResponse.headers.get("location");
-      if (!location) {
-        body = await readBodyCapped(finalResponse);
-        break;
-      }
-      const nextUrlStr = new URL(location, currentUrl).toString();
-      const nextHost = new URL(nextUrlStr).host;
-      if (!hostMatchesAllowlist(nextHost, target.scopeAllowlist)) {
-        try {
-          finalResponse.body?.cancel();
-        } catch {
-        }
-        clearTimeout(timer);
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `redirect to out-of-scope host: ${nextHost} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-      try {
-        finalResponse.body?.cancel();
-      } catch {
-      }
-      currentUrl = nextUrlStr;
-    }
-  } catch (err) {
-    clearTimeout(timer);
-    const aborted = ac.signal.aborted;
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: aborted ? `timeout after ${timeoutMs}ms` : errMessage(err)
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-  const verdict = evaluateExpect(step.expect, {
-    status: finalResponse.status,
-    body
-  });
-  return {
-    stepId: step.id,
-    kind: verdict.kind,
-    observedStatus: finalResponse.status,
-    observedResponseBody: body,
-    durationMs: Date.now() - start,
-    ...verdict.error ? { error: verdict.error } : {}
-  };
-}
-function resolveUrl(stepUrl, baseUrl) {
-  try {
-    new URL(stepUrl);
-    return stepUrl;
-  } catch {
-  }
-  if (!baseUrl)
-    return null;
-  try {
-    return new URL(stepUrl, baseUrl).toString();
-  } catch {
-    return null;
-  }
-}
-function mergePersonaHeaders(stepHeaders, target) {
-  const merged = {};
-  let personaName;
-  for (const [k, v] of Object.entries(stepHeaders)) {
-    if (k.toLowerCase() === PERSONA_HEADER.toLowerCase()) {
-      personaName = v;
-      continue;
-    }
-    merged[k] = v;
-  }
-  if (!personaName)
-    return merged;
-  const persona = target.personas?.[personaName];
-  if (!persona)
-    return merged;
-  if (persona.headers) {
-    for (const [k, v] of Object.entries(persona.headers)) {
-      if (!(k in merged))
-        merged[k] = v;
-    }
-  }
-  if (persona.cookies && !("cookie" in lowerKeys(merged))) {
-    merged["Cookie"] = persona.cookies;
-  }
-  return merged;
-}
-function lowerKeys(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj))
-    out[k.toLowerCase()] = v;
-  return out;
-}
-async function readBodyCapped(response) {
-  if (!response.body)
-    return "";
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder("utf-8", { fatal: false });
-  let captured = "";
-  let truncated = false;
-  while (true) {
-    const { value, done } = await reader.read();
-    if (done)
-      break;
-    if (value) {
-      const chunk = decoder.decode(value, { stream: true });
-      if (captured.length + chunk.length > MAX_CAPTURE_BYTES) {
-        captured += chunk.slice(0, MAX_CAPTURE_BYTES - captured.length);
-        truncated = true;
-        try {
-          await reader.cancel();
-        } catch {
-        }
-        break;
-      }
-      captured += chunk;
-    }
-  }
-  return truncated ? captured + TRUNCATION_MARKER : captured;
-}
-function spawnAndCapture(cmd, args, opts) {
-  return new Promise((resolveP) => {
-    let child;
-    try {
-      child = deps.spawn(cmd, args, {
-        env: opts.env,
-        cwd: opts.cwd,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-    } catch (err) {
-      resolveP({
-        exitCode: null,
-        stdout: "",
-        stderr: "",
-        timedOut: false,
-        error: errMessage(err)
-      });
-      return;
-    }
-    let stdout = "";
-    let stderr = "";
-    let stdoutTruncated = false;
-    let stderrTruncated = false;
-    let timedOut = false;
-    let settled = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      try {
-        child.kill("SIGKILL");
-      } catch {
-      }
-    }, opts.timeoutMs);
-    child.stdout?.on("data", (chunk) => {
-      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      if (stdout.length + s.length > MAX_CAPTURE_BYTES) {
-        if (!stdoutTruncated) {
-          stdout += s.slice(0, MAX_CAPTURE_BYTES - stdout.length);
-          stdoutTruncated = true;
-        }
-        return;
-      }
-      stdout += s;
-    });
-    child.stderr?.on("data", (chunk) => {
-      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      if (stderr.length + s.length > MAX_CAPTURE_BYTES) {
-        if (!stderrTruncated) {
-          stderr += s.slice(0, MAX_CAPTURE_BYTES - stderr.length);
-          stderrTruncated = true;
-        }
-        return;
-      }
-      stderr += s;
-    });
-    const settle = (exit, errorMsg) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      resolveP({
-        exitCode: exit,
-        stdout: stdoutTruncated ? stdout + TRUNCATION_MARKER : stdout,
-        stderr: stderrTruncated ? stderr + TRUNCATION_MARKER : stderr,
-        timedOut,
-        error: errorMsg
-      });
-    };
-    child.on("error", (err) => {
-      settle(null, errMessage(err));
-    });
-    child.on("close", (code) => {
-      settle(code);
-    });
-  });
-}
-function finaliseProcessStep(step, spawned, start) {
-  const durationMs = Date.now() - start;
-  if (spawned.timedOut) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      observedStdout: spawned.stdout,
-      observedStderr: spawned.stderr,
-      durationMs,
-      error: `timeout after ${durationMs}ms`
-    };
-  }
-  if (spawned.error && spawned.exitCode === null) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      observedStdout: spawned.stdout,
-      observedStderr: spawned.stderr,
-      durationMs,
-      error: spawned.error
-    };
-  }
-  const verdict = evaluateExpect(step.expect, {
-    exitCode: spawned.exitCode,
-    stdout: spawned.stdout
-  });
-  const result = {
-    stepId: step.id,
-    kind: verdict.kind,
-    observedStdout: spawned.stdout,
-    observedStderr: spawned.stderr,
-    durationMs
-  };
-  if (spawned.exitCode !== null)
-    result.observedExit = spawned.exitCode;
-  if (verdict.error)
-    result.error = verdict.error;
-  return result;
-}
-function evaluateExpect(expect, obs) {
-  if (!expect) {
-    return { kind: "passed" };
-  }
-  switch (expect.type) {
-    case "exit-zero": {
-      if (obs.exitCode === 0)
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected exit-zero, got exitCode=${String(obs.exitCode ?? "unknown")}`
-      };
-    }
-    case "http-status": {
-      const wanted = Array.isArray(expect.status) ? expect.status : [expect.status];
-      if (typeof obs.status === "number" && wanted.includes(obs.status)) {
-        return { kind: "passed" };
-      }
-      return {
-        kind: "failed",
-        error: `expected http-status in [${wanted.join(",")}], got ${String(obs.status ?? "no-response")}`
-      };
-    }
-    case "body-contains": {
-      const haystack = obs.body ?? obs.stdout ?? "";
-      if (haystack.includes(expect.text))
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected body-contains '${expect.text}', not found in observed output`
-      };
-    }
-    case "body-matches": {
-      const haystack = obs.body ?? obs.stdout ?? "";
-      let re;
-      try {
-        re = new RegExp(expect.pattern);
-      } catch (err) {
-        return { kind: "errored", error: `invalid regex: ${errMessage(err)}` };
-      }
-      if (re.test(haystack))
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected body-matches /${expect.pattern}/, no match in observed output`
-      };
-    }
-    case "file-exists": {
-      return {
-        kind: "errored",
-        error: "file-exists predicate cannot be evaluated against a network target; rewrite as a shell action with `[ -e <path> ]`"
-      };
-    }
-    default: {
-      const _exhaustive = expect;
-      return {
-        kind: "errored",
-        error: `unknown expect type: ${JSON.stringify(_exhaustive)}`
-      };
-    }
-  }
-}
-function aggregateVerdict(graph, steps) {
-  if (graph.length === 0) {
-    return "could_not_run";
-  }
-  const byId = new Map(steps.map((s) => [s.stepId, s]));
-  let reachedExploitOrVerify = false;
-  for (const step of graph) {
-    const result = byId.get(step.id);
-    if (!result)
-      continue;
-    if (step.kind === "exploit" || step.kind === "verify") {
-      reachedExploitOrVerify = true;
-    }
-    if (result.kind === "errored" && (step.kind === "setup" || step.kind === "auth" || step.kind === "prerequisite")) {
-      return "could_not_run";
-    }
-  }
-  const verifySteps = graph.filter((s) => s.kind === "verify");
-  if (verifySteps.length > 0) {
-    let anyFailed = false;
-    let anyErrored = false;
-    let allPassed = true;
-    for (const v of verifySteps) {
-      const result = byId.get(v.id);
-      if (!result || result.kind === "skipped") {
-        allPassed = false;
-        anyErrored = true;
-        continue;
-      }
-      if (result.kind === "failed") {
-        anyFailed = true;
-        allPassed = false;
-      } else if (result.kind === "errored") {
-        anyErrored = true;
-        allPassed = false;
-      }
-    }
-    if (allPassed)
-      return "exploit_still_works";
-    if (anyFailed)
-      return "exploit_broken";
-    if (anyErrored)
-      return "could_not_run";
-  }
-  const exploitSteps = graph.filter((s) => s.kind === "exploit");
-  if (exploitSteps.length > 0) {
-    let anyFailed = false;
-    let anyErrored = false;
-    let allPassed = true;
-    for (const e of exploitSteps) {
-      const result = byId.get(e.id);
-      if (!result || result.kind === "skipped") {
-        allPassed = false;
-        anyErrored = true;
-        continue;
-      }
-      if (result.kind === "failed") {
-        anyFailed = true;
-        allPassed = false;
-      } else if (result.kind === "errored") {
-        anyErrored = true;
-        allPassed = false;
-      }
-    }
-    if (allPassed)
-      return "exploit_still_works";
-    if (anyFailed)
-      return "exploit_broken";
-    if (anyErrored)
-      return "could_not_run";
-  }
-  return reachedExploitOrVerify ? "exploit_still_works" : "could_not_run";
-}
-function errMessage(err) {
-  if (err instanceof Error)
-    return err.message;
-  if (typeof err === "string")
-    return err;
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
-}
-
 // packages/core/dist/disclose/bundle.js
 function decideFilingState(inputs) {
   const { patchStatus, behaviouralReport, dropFixed, keepUnrun, emptyPoc } = inputs;
@@ -1972,10 +1260,6 @@ export {
   composeStepSession,
   renderExploitScreenshot,
   extractSiblingFix,
-  MAX_CAPTURE_BYTES,
-  DEFAULT_STEP_TIMEOUT_MS,
-  setRuntimeDeps,
-  executePocSteps,
   decideFilingState,
   dropSlug,
   droppedFilename,