0sec-cli 0.21.4 → 0.22.0

package/chunks/{chunk-YHWWF4QY.js → chunk-UU7PQP6N.js}

@@ -5,13 +5,13 @@ import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-E2UOY5PJ.js";
+} from "./chunk-UV5QWZGE.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-5T6D5BVY.js";
+} from "./chunk-XFCTUKXR.js";
 import {
   LlmApiRuntime
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-2GV4HQKE.js";
 import {
   __commonJS,
   __require,

package/chunks/{chunk-E2UOY5PJ.js → chunk-UV5QWZGE.js}

@@ -5,46 +5,46 @@ import {
   BUDGET_WARNING_HARD,
   BUDGET_WARNING_SOFT,
   ToolExecutor,
-  analyticsPipeline,
   buildToolCallLogEntry,
   buildToolCallsPayload,
   computeBudgetWarningTurns,
   formatJitSkillsInstruction,
-  getCloudSinkConfig,
   getToolsForRole,
   newCorrelationId,
   parseFindingsFromCliOutput,
-  postFinding,
   registerSignalCleanup,
-  reportUnsupportedContributionMode,
   runNativeAgentLoop,
   toolCallPreview
-} from "./chunk-ANDKY54G.js";
+} from "./chunk-SJBCK2EI.js";
 import {
   WafDetector
-} from "./chunk-SBMB4OL3.js";
+} from "./chunk-TZFIAMWZ.js";
 import {
   RECIPE_LIBRARY
 } from "./chunk-UEX7PFSE.js";
+import {
+  analyticsPipeline,
+  reportUnsupportedContributionMode
+} from "./chunk-RE5EZDG2.js";
 import {
   createRuntime,
   detectAvailableRuntimes,
   pickRuntimeForStage
-} from "./chunk-NDJU5ZZ7.js";
+} from "./chunk-5MWAG3FT.js";
 import {
   osecDB
-} from "./chunk-WZISK5VC.js";
+} from "./chunk-VNRY6AWF.js";
 import {
   CLI_RUNTIME_TYPES
 } from "./chunk-4VGLO2YS.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-2GV4HQKE.js";
 import {
   estimateCost,
   modelProvider
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-76KSBWOQ.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -3919,59 +3919,6 @@ function persistSession(db, state, config, sessionId, status) {
   });
 }
 
-// packages/core/dist/agent/cloud-inbox.js
-var POLL_MS = 3e3;
-function startCloudInboxPoller(config) {
-  const buffer = [];
-  let stopped = false;
-  const headers = {
-    "X-0-Scan-Id": config.scanId
-  };
-  if (config.token)
-    headers["Authorization"] = `Bearer ${config.token}`;
-  const url = `${config.sinkUrl.replace(/\/+$/, "")}/scans/${encodeURIComponent(config.scanId)}/inbox`;
-  const poll = async () => {
-    if (stopped)
-      return;
-    try {
-      const res = await fetch(url, { headers });
-      if (!res.ok)
-        return;
-      const rows = await res.json();
-      if (!Array.isArray(rows))
-        return;
-      for (const r of rows) {
-        if (r.role === "human" && typeof r.body === "string" && r.body.trim().length > 0) {
-          const prefix = r.kind === "approval" ? "[Operator approval]" : "[Operator steer]";
-          buffer.push(`${prefix}: ${r.body.trim()}`);
-        }
-      }
-    } catch {
-    }
-  };
-  const handle = setInterval(() => void poll(), POLL_MS);
-  if (typeof handle.unref === "function") {
-    handle.unref();
-  }
-  return {
-    drain() {
-      if (buffer.length === 0)
-        return [];
-      return buffer.splice(0, buffer.length);
-    },
-    stop() {
-      stopped = true;
-      clearInterval(handle);
-    }
-  };
-}
-function maybeStartCloudInboxPoller() {
-  const cfg = getCloudSinkConfig();
-  if (!cfg)
-    return null;
-  return startCloudInboxPoller(cfg);
-}
-
 // packages/core/dist/secure/project-context.js
 import { createHash as createHash2 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -4207,7 +4154,7 @@ async function runAnalysisAgent(opts) {
       },
       required: ["findings", "summary"]
     };
-    const { ProcessRuntime } = await import("./process-PNMC36JI.js");
+    const { ProcessRuntime } = await import("./process-N245QIQG.js");
     const codexHome = runtimeType === "codex" && isEphemeralScope(scopePath) ? createEphemeralCodexHome() : void 0;
     const cliRuntime = new ProcessRuntime({
       type: runtimeType,
@@ -4316,7 +4263,6 @@ async function runAnalysisAgent(opts) {
     if (supportsNative) {
       const turnBudget = getMaxTurns(role, config.depth, "native", purpose);
       const maxTurns2 = Math.min(opts.maxTurns ?? turnBudget, opts.singleAgent ? 20 : turnBudget);
-      const cloudInbox = maybeStartCloudInboxPoller();
       const agentState2 = await runNativeAgentLoop({
         config: {
           role,
@@ -4329,7 +4275,7 @@ async function runAnalysisAgent(opts) {
           target,
           scanId,
           scopePath,
-          codebaseLearning: !!getCloudSinkConfig() && scopedSourceAudit && purpose === "research",
+          codebaseLearning: scopedSourceAudit && purpose === "research",
           sessionId,
           costCeilingUsd: config.costCeilingUsd,
           costModel: config.model,
@@ -4337,7 +4283,6 @@ async function runAnalysisAgent(opts) {
         },
         runtime: apiRuntime,
         db,
-        getPendingUserMessages: cloudInbox?.drain,
         onFindingSaved: (finding) => {
           if (purpose === "verify" && opts.singleAgent)
             return;
@@ -4346,7 +4291,6 @@ async function runAnalysisAgent(opts) {
             message: `[${finding.severity}] ${finding.title}`,
             data: finding
           });
-          void postFinding(finding, getCloudSinkConfig());
           try {
             analyticsPipeline.recordFinding({
               severity: finding.severity,
@@ -4477,7 +4421,6 @@ async function runAnalysisAgent(opts) {
         message: `[${finding.severity}] ${finding.title}`,
         data: finding
       });
-      void postFinding(finding, getCloudSinkConfig());
       try {
         analyticsPipeline.recordFinding({
           severity: finding.severity,
@@ -5908,7 +5851,6 @@ export {
   describeRefuterChoice,
   scoreGeometry,
   runAgentLoop,
-  maybeStartCloudInboxPoller,
   prepareProjectContext,
   PROJECT_OBSERVATION_PROMPT,
   captureProjectSuggestions,

package/chunks/{chunk-YA4PUM4H.js → chunk-VMRRNRMR.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-UEX7PFSE.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-5T6D5BVY.js";
+} from "./chunk-XFCTUKXR.js";
 
 // packages/core/dist/kernel/exploit/harness.js
 import { existsSync } from "node:fs";

package/chunks/{chunk-WZISK5VC.js → chunk-VNRY6AWF.js}

@@ -4,7 +4,7 @@ const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir,
   runStateDir
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-76KSBWOQ.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -409,6 +409,12 @@ var findings = sqliteTable("findings", {
    * `verificationSpec`: the blob is read and written whole.
    */
   verificationResult: text("verificationResult"),
+  /**
+   * JSON-stringified safe code-only source-verification summary. NULL when
+   * no scoped source workspace/spec was available or data is unusable; it
+   * never carries canonical replay status.
+   */
+  sourceVerification: text("sourceVerification"),
   /**
    * JSON-stringified Finding["reviewAnnotation"] — the scoped source
    * reference (`path` + line range, optional suggestion / knownMarker)
@@ -873,6 +879,9 @@ var osecDB = class {
     if (!colNames.has("reviewAnnotation")) {
       this.sqlite.exec("ALTER TABLE findings ADD COLUMN reviewAnnotation TEXT");
     }
+    if (!colNames.has("sourceVerification")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN sourceVerification TEXT");
+    }
     this.sqlite.exec("UPDATE findings SET fingerprint = id WHERE fingerprint IS NULL OR fingerprint = ''");
     this.sqlite.exec("UPDATE findings SET triageStatus = 'new' WHERE triageStatus IS NULL OR triageStatus = ''");
     this.sqlite.exec(`
@@ -1364,6 +1373,7 @@ var osecDB = class {
     const semanticDedupeJson = finding.semanticDedupe ? JSON.stringify(finding.semanticDedupe) : null;
     const verificationResultJson = serializeFindingVerificationResult(finding.verification_result);
     const reviewAnnotationJson = serializeFindingReviewAnnotation(finding.reviewAnnotation);
+    const sourceVerificationJson = serializeFindingSourceVerification(finding.sourceVerification);
     const candidateFindingRank = finding.findingRank;
     const findingRank = typeof candidateFindingRank === "number" && Number.isSafeInteger(candidateFindingRank) && candidateFindingRank > 0 ? candidateFindingRank : null;
     const derivedEvidence = deriveEvidenceFromPocSteps(finding);
@@ -1400,6 +1410,7 @@ var osecDB = class {
       findingRank,
       verificationResult: verificationResultJson,
       reviewAnnotation: reviewAnnotationJson,
+      sourceVerification: sourceVerificationJson,
       timestamp: finding.timestamp
     }).onConflictDoUpdate({
       target: findings.id,
@@ -1431,6 +1442,7 @@ var osecDB = class {
         findingRank,
         verificationResult: verificationResultJson,
         reviewAnnotation: reviewAnnotationJson,
+        sourceVerification: sourceVerificationJson,
         timestamp: finding.timestamp
       }
     }).run();
@@ -1440,11 +1452,10 @@ var osecDB = class {
     return this.db.select().from(findings).where(eq(findings.id, findingId)).get();
   }
   /**
-   * Read path for the two source-fix gate fields. Returns the hydrated
-   * `verification_result` / `reviewAnnotation` for a finding, with each key
-   * omitted when the finding has none (including rows written before the
-   * columns existed). Callers building a `Finding` spread this over the row:
-   * `{ ...mapped, ...db.getFindingReviewFields(id) }`.
+   * Read path for the persisted `verification_result`, `reviewAnnotation`,
+   * and `sourceVerification` fields. The first two retain their existing
+   * source-fix gate semantics; a source-only check is never replay evidence.
+   * Each key is omitted when absent, including for pre-migration rows.
    */
   getFindingReviewFields(findingId) {
     return restoreFindingReviewFields(this.getFinding(findingId));
@@ -2169,6 +2180,38 @@ function parseFindingReviewAnnotation(value) {
     return void 0;
   return parsed;
 }
+function parseFindingSourceVerification(value) {
+  const parsed = parseJsonObjectColumn(value);
+  if (!parsed)
+    return void 0;
+  const status = parsed.status;
+  const totalPredicates = parsed.totalPredicates;
+  const matchedPredicates = parsed.matchedPredicates;
+  const notMatchedPredicates = parsed.notMatchedPredicates;
+  const inconclusivePredicates = parsed.inconclusivePredicates;
+  const behaviorPending = parsed.behaviorPending;
+  if (status !== "matched" && status !== "not_confirmed" && status !== "inconclusive" || typeof totalPredicates !== "number" || !Number.isSafeInteger(totalPredicates) || totalPredicates < 0 || typeof matchedPredicates !== "number" || !Number.isSafeInteger(matchedPredicates) || matchedPredicates < 0 || typeof notMatchedPredicates !== "number" || !Number.isSafeInteger(notMatchedPredicates) || notMatchedPredicates < 0 || typeof inconclusivePredicates !== "number" || !Number.isSafeInteger(inconclusivePredicates) || inconclusivePredicates < 0 || typeof behaviorPending !== "boolean") {
+    return void 0;
+  }
+  const countSum = matchedPredicates + notMatchedPredicates + inconclusivePredicates;
+  if (!Number.isSafeInteger(countSum) || countSum !== totalPredicates)
+    return void 0;
+  if (status === "matched" && (totalPredicates === 0 || matchedPredicates !== totalPredicates || notMatchedPredicates !== 0 || inconclusivePredicates !== 0) || status === "not_confirmed" && (notMatchedPredicates === 0 || inconclusivePredicates !== 0) || status === "inconclusive" && inconclusivePredicates === 0 && totalPredicates !== 0) {
+    return void 0;
+  }
+  return {
+    status,
+    totalPredicates,
+    matchedPredicates,
+    notMatchedPredicates,
+    inconclusivePredicates,
+    behaviorPending
+  };
+}
+function serializeFindingSourceVerification(value) {
+  const usable = parseFindingSourceVerification(value);
+  return usable ? JSON.stringify(usable) : null;
+}
 function serializeFindingVerificationResult(value) {
   const usable = parseFindingVerificationResult(value);
   return usable ? JSON.stringify(usable) : null;
@@ -2182,9 +2225,11 @@ function restoreFindingReviewFields(row) {
     return {};
   const verificationResult = parseFindingVerificationResult(row.verificationResult);
   const reviewAnnotation = parseFindingReviewAnnotation(row.reviewAnnotation);
+  const sourceVerification = parseFindingSourceVerification(row.sourceVerification);
   return {
     ...verificationResult ? { verification_result: verificationResult } : {},
-    ...reviewAnnotation ? { reviewAnnotation } : {}
+    ...reviewAnnotation ? { reviewAnnotation } : {},
+    ...sourceVerification ? { sourceVerification } : {}
   };
 }
 function deriveEvidenceFromPocSteps(finding) {
@@ -2278,6 +2323,7 @@ CREATE TABLE IF NOT EXISTS findings (
   findingRank INTEGER,
   verificationResult TEXT,
   reviewAnnotation TEXT,
+  sourceVerification TEXT,
   timestamp INTEGER NOT NULL
 );
 

package/chunks/{chunk-ER3SUMYJ.js → chunk-W6UWZFKL.js}

@@ -1,10 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  eventBus,
-  isCloudEventSinkActive
-} from "./chunk-CXKDWFNO.js";
 
 // packages/core/dist/runtime/process.js
 import { spawn } from "node:child_process";
@@ -76,21 +72,6 @@ function buildOsecMcpCommandArgs(context) {
   }
   return args;
 }
-function numericField(obj, key) {
-  const v = obj[key];
-  if (typeof v === "number" && Number.isFinite(v))
-    return v;
-  if (typeof v === "string" && /^\d+$/.test(v))
-    return Number(v);
-  return void 0;
-}
-function safeJsonStringify(v) {
-  try {
-    return JSON.stringify(v) ?? "";
-  } catch {
-    return "(unserialisable)";
-  }
-}
 function buildClaudeMcpConfig(context) {
   return JSON.stringify({
     mcpServers: {
@@ -124,180 +105,6 @@ var ProcessRuntime = class {
     const args = this.buildArgs(prompt, context);
     const env = this.buildEnv(context);
     const onToolCall = this.config.onToolCall;
-    const scanId = context?.scanId;
-    const emitScanEvents = this.type === "codex" && isCloudEventSinkActive();
-    const maxTurnsHint = 40;
-    let turnNumber = 0;
-    let toolCallSeq = 0;
-    let deltaSeq = 0;
-    let turnStartedAt = 0;
-    const toolCallStartedAt = /* @__PURE__ */ new Map();
-    const seenSequenceNumbers = /* @__PURE__ */ new Set();
-    const isSeenSequence = (event) => {
-      const seq = event.sequence_number;
-      if (typeof seq !== "number" && typeof seq !== "string")
-        return false;
-      const key = `${event.type ?? "?"}|${seq}`;
-      if (seenSequenceNumbers.has(key))
-        return true;
-      seenSequenceNumbers.add(key);
-      return false;
-    };
-    const emitCodexCloudEvents = (event) => {
-      if (isSeenSequence(event))
-        return;
-      const eventType = typeof event.type === "string" ? event.type : "";
-      switch (eventType) {
-        case "thread.started": {
-          eventBus.emit("llm_planner_invoked", {
-            turn: 0,
-            model: this.config.model,
-            role: "attack"
-          });
-          return;
-        }
-        case "turn.started": {
-          turnNumber += 1;
-          turnStartedAt = Date.now();
-          deltaSeq = 0;
-          eventBus.emit("agent_turn_started", {
-            turn: turnNumber,
-            max_turns: maxTurnsHint,
-            role: "attack"
-          });
-          eventBus.emit("llm_planner_invoked", {
-            turn: turnNumber,
-            model: this.config.model,
-            role: "attack"
-          });
-          return;
-        }
-        case "turn.completed": {
-          const usage = event.usage ?? {};
-          const inputTokens = numericField(usage, "input_tokens");
-          const cachedInputTokens = numericField(usage, "cached_input_tokens");
-          const outputTokens = numericField(usage, "output_tokens");
-          const reasoningTokens = numericField(usage, "reasoning_output_tokens");
-          const durationMs = turnStartedAt > 0 ? Date.now() - turnStartedAt : 0;
-          eventBus.emit("agent_turn_completed", {
-            turn: turnNumber,
-            duration_ms: durationMs,
-            reason: "continue",
-            role: "attack"
-          });
-          eventBus.emit("cost_update", {
-            turn: turnNumber,
-            cost_usd: 0,
-            input_tokens: inputTokens,
-            output_tokens: outputTokens,
-            token_input: inputTokens,
-            token_output: outputTokens,
-            cached_input_tokens: cachedInputTokens,
-            reasoning_output_tokens: reasoningTokens
-          });
-          return;
-        }
-        case "item.started": {
-          const item = event.item ?? {};
-          const itemType = typeof item.type === "string" ? item.type : "";
-          if (itemType === "command_execution" && typeof item.command === "string") {
-            toolCallSeq += 1;
-            toolCallStartedAt.set(toolCallSeq, Date.now());
-            eventBus.emit("tool_call_started", {
-              tool: "shell",
-              turn: turnNumber,
-              args_preview: item.command.slice(0, 200),
-              ts: Date.now()
-            });
-          } else if (itemType === "mcp_tool_call") {
-            toolCallSeq += 1;
-            toolCallStartedAt.set(toolCallSeq, Date.now());
-            const server = typeof item.server === "string" ? item.server : "?";
-            const tool = typeof item.tool === "string" ? item.tool : "?";
-            const argsRaw = item.arguments ?? {};
-            const argsPreview = typeof argsRaw === "string" ? argsRaw : safeJsonStringify(argsRaw);
-            eventBus.emit("tool_call_started", {
-              tool: `${server}__${tool}`,
-              turn: turnNumber,
-              args_preview: argsPreview.slice(0, 200),
-              ts: Date.now()
-            });
-          }
-          return;
-        }
-        case "item.completed": {
-          const item = event.item ?? {};
-          const itemType = typeof item.type === "string" ? item.type : "";
-          if (itemType === "command_execution") {
-            const startedAt = toolCallStartedAt.get(toolCallSeq);
-            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
-            toolCallStartedAt.delete(toolCallSeq);
-            eventBus.emit("tool_call_completed", {
-              tool: "shell",
-              turn: turnNumber,
-              duration_ms: durationMs,
-              status: "ok",
-              ts: Date.now()
-            });
-          } else if (itemType === "mcp_tool_call") {
-            const startedAt = toolCallStartedAt.get(toolCallSeq);
-            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
-            toolCallStartedAt.delete(toolCallSeq);
-            const server = typeof item.server === "string" ? item.server : "?";
-            const tool = typeof item.tool === "string" ? item.tool : "?";
-            const status = item.status === "success" || item.status === "completed" ? "ok" : "error";
-            const errorMsg = status === "error" ? typeof item.error === "string" ? item.error : safeJsonStringify(item.error ?? null) : void 0;
-            eventBus.emit("tool_call_completed", {
-              tool: `${server}__${tool}`,
-              turn: turnNumber,
-              duration_ms: durationMs,
-              status,
-              ...errorMsg ? { error: errorMsg.slice(0, 400) } : {},
-              ts: Date.now()
-            });
-          } else if (itemType === "function_call" || itemType === "tool_call") {
-            toolCallSeq += 1;
-            const toolName = typeof item.tool_name === "string" && item.tool_name || typeof item.name === "string" && item.name || "mcp_tool";
-            const argsField = item.arguments ?? item.input ?? "";
-            const detail = typeof argsField === "string" ? argsField : safeJsonStringify(argsField);
-            eventBus.emit("tool_call_started", {
-              tool: toolName,
-              turn: turnNumber,
-              args_preview: detail.slice(0, 200),
-              ts: Date.now()
-            });
-            eventBus.emit("tool_call_completed", {
-              tool: toolName,
-              turn: turnNumber,
-              duration_ms: 0,
-              status: "ok",
-              ts: Date.now()
-            });
-          } else if (itemType === "reasoning") {
-            const reasoningText = typeof item.text === "string" && item.text || typeof item.summary === "string" && item.summary || "";
-            if (reasoningText.length > 0) {
-              eventBus.emit("reasoning_summary", {
-                turn: turnNumber,
-                summary: reasoningText.slice(0, 2e3)
-              });
-            }
-          } else if (itemType === "agent_message") {
-            const messageText = typeof item.text === "string" ? item.text : "";
-            if (messageText.length > 0) {
-              deltaSeq += 1;
-              eventBus.emit("delta", {
-                turn: turnNumber,
-                scope: "assistant_response",
-                text: messageText.slice(0, 2e3),
-                seq: deltaSeq,
-                role: "attack"
-              });
-            }
-          }
-          return;
-        }
-      }
-    };
     return new Promise((resolve2) => {
       let stdout = "";
       let stderr = "";
@@ -352,8 +159,6 @@ var ProcessRuntime = class {
                 } else if (event.item.type === "command_execution" && event.item.command) {
                 }
               }
-              if (emitScanEvents)
-                emitCodexCloudEvents(event);
             } catch {
             }
           }

package/chunks/{chunk-5T6D5BVY.js → chunk-XFCTUKXR.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-76KSBWOQ.js";
 
 // packages/core/dist/triage/kernel-vm-runner.js
 import { execFileSync, spawn } from "node:child_process";