0sec-cli 0.21.4 → 0.22.1

package/chunks/chunk-CGHCEN7W.js

@@ -1,169 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-
-// packages/core/dist/scope/scope.js
-import { readFileSync } from "node:fs";
-import { isIP } from "node:net";
-var ScopePolicy = class _ScopePolicy {
-  inScope;
-  outOfScope;
-  /**
-   * Original JSON the policy was constructed from. Exposed read-only so
-   * downstream features (0#216 attribution headers) can pull their
-   * own optional blocks out of the same file without re-reading it.
-   */
-  raw;
-  constructor(json) {
-    this.inScope = (json.in_scope ?? []).map(parseRule);
-    this.outOfScope = (json.out_of_scope ?? []).map(parseRule);
-    this.raw = json;
-  }
-  /**
-   * Load a policy from a JSON file on disk.
-   *
-   * Bubbles up the underlying ENOENT/JSON-parse error to the caller; the
-   * scan CLI is responsible for translating these into a user-facing
-   * "scope file not found / malformed" message and exiting non-zero before
-   * the agent ever boots.
-   */
-  static fromJsonFile(path) {
-    const raw = readFileSync(path, "utf-8");
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      throw new Error(`Scope file ${path} is not valid JSON: ${msg}`);
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error(`Scope file ${path} must be a JSON object with in_scope/out_of_scope arrays`);
-    }
-    return _ScopePolicy.fromJson(parsed);
-  }
-  static fromJson(obj) {
-    return new _ScopePolicy(obj);
-  }
-  /**
-   * Decide whether a URL is allowed by this policy.
-   *
-   * The contract used by every call site:
-   *   - allowed=true  → URL is in scope, callers may proceed.
-   *   - allowed=false → URL is out of scope; callers MUST surface this as
-   *                     a hard error (`ToolResult.error`), not a warning.
-   *
-   * `reason` is human-readable and meant to be embedded in the error
-   * message returned to the agent so it can self-correct.
-   */
-  match(url) {
-    let host;
-    try {
-      host = normalizeScopeHostname(new URL(url).hostname);
-    } catch {
-      return { allowed: false, reason: `out-of-scope: not a valid URL (${url})` };
-    }
-    const denyHit = this.outOfScope.find((rule) => matches(rule, host));
-    if (denyHit) {
-      return { allowed: false, reason: `out-of-scope: host '${host}' matches deny rule '${denyHit.raw}'` };
-    }
-    if (this.inScope.length === 0) {
-      return { allowed: false, reason: `out-of-scope: host '${host}' (no in_scope rules defined)` };
-    }
-    const allowHit = this.inScope.find((rule) => matches(rule, host));
-    if (allowHit) {
-      return { allowed: true, reason: `in-scope: host '${host}' matches '${allowHit.raw}'` };
-    }
-    return { allowed: false, reason: `out-of-scope: host '${host}' did not match any in_scope rule` };
-  }
-};
-function extractUrls(text) {
-  const re = /https?:\/\/[^\s'"`<>|]+/gi;
-  const out = [];
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    let url = m[0];
-    while (url.length > 0 && /[.,;:)\]}]$/.test(url)) {
-      url = url.slice(0, -1);
-    }
-    if (url.length > 0)
-      out.push(url);
-  }
-  return out;
-}
-function loadScope(path) {
-  return ScopePolicy.fromJsonFile(path);
-}
-function matchUrl(url, policy) {
-  return policy.match(url);
-}
-function normalizeScopeHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/\.+$/, "");
-  const address = normalized.startsWith("[") && normalized.endsWith("]") ? normalized.slice(1, -1) : normalized;
-  return isIP(address) === 6 ? new URL(`http://[${address}]/`).hostname : normalized;
-}
-function parseRule(raw) {
-  if (typeof raw !== "string" || raw.trim().length === 0) {
-    throw new Error(`Invalid scope rule: ${JSON.stringify(raw)} (must be a non-empty string)`);
-  }
-  const rule = raw.trim().toLowerCase();
-  if (rule.includes("/")) {
-    const parts = rule.split("/");
-    if (parts.length !== 2) {
-      throw new Error(`Invalid CIDR '${raw}': expected exactly one '/'`);
-    }
-    const [ip, prefixStr] = parts;
-    if (!/^\d+$/.test(prefixStr)) {
-      throw new Error(`Invalid CIDR prefix in '${raw}': must be a non-negative integer 0-32`);
-    }
-    const prefix = Number(prefixStr);
-    if (prefix < 0 || prefix > 32) {
-      throw new Error(`Invalid CIDR prefix in '${raw}': must be 0-32`);
-    }
-    if (isIP(ip) !== 4) {
-      throw new Error(`Invalid CIDR '${raw}': only IPv4 CIDR is supported`);
-    }
-    return { raw, kind: "cidr", cidr: { network: ipv4ToInt(ip), prefix } };
-  }
-  if (rule.startsWith("*.")) {
-    const suffix = normalizeScopeHostname(rule.slice(2));
-    if (suffix.length === 0 || suffix.includes("*")) {
-      throw new Error(`Invalid wildcard rule '${raw}': must be of the form '*.domain.tld'`);
-    }
-    return { raw, kind: "wildcard", suffix };
-  }
-  if (rule.includes("*")) {
-    throw new Error(`Invalid scope rule '${raw}': only leading '*.' wildcards are supported`);
-  }
-  return { raw, kind: "exact", host: normalizeScopeHostname(rule) };
-}
-function matches(rule, host) {
-  switch (rule.kind) {
-    case "exact":
-      return rule.host === host;
-    case "wildcard": {
-      const suffix = "." + rule.suffix;
-      return host !== rule.suffix && host.endsWith(suffix);
-    }
-    case "cidr": {
-      if (isIP(host) !== 4)
-        return false;
-      const { network, prefix } = rule.cidr;
-      if (prefix === 0)
-        return true;
-      const mask = prefix === 32 ? 4294967295 : ~((1 << 32 - prefix) - 1) >>> 0;
-      return (ipv4ToInt(host) & mask) >>> 0 === (network & mask) >>> 0;
-    }
-  }
-}
-function ipv4ToInt(ip) {
-  const parts = ip.split(".").map((p) => Number(p));
-  return (parts[0] << 24 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
-}
-
-export {
-  ScopePolicy,
-  extractUrls,
-  loadScope,
-  matchUrl,
-  normalizeScopeHostname
-};

package/chunks/chunk-CXKDWFNO.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  createPresentationEvent
-} from "./chunk-PC6RCKQV.js";
-
-// packages/core/dist/events/bus.js
-function presentationEventSink(sink, options = {}) {
-  let sequence = 0;
-  const source = options.source ?? "core";
-  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  return {
-    emit(type, payload) {
-      const scanId = typeof payload["scan_id"] === "string" ? payload["scan_id"] : typeof payload["scanId"] === "string" ? payload["scanId"] : void 0;
-      const sessionId = typeof payload["session_id"] === "string" ? payload["session_id"] : typeof payload["sessionId"] === "string" ? payload["sessionId"] : void 0;
-      sink.emit(createPresentationEvent({
-        source,
-        sequence: ++sequence,
-        at: now(),
-        eventType: type,
-        payload,
-        ...scanId ? { scanId } : {},
-        ...sessionId ? { sessionId } : {}
-      }));
-    }
-  };
-}
-var EventBus = class {
-  sinks = [];
-  /** Subscribe a sink. Returns an unsubscribe function. */
-  subscribe(sink) {
-    this.sinks.push(sink);
-    return () => {
-      const idx = this.sinks.indexOf(sink);
-      if (idx >= 0)
-        this.sinks.splice(idx, 1);
-    };
-  }
-  /** Remove every subscriber — primarily useful in tests. */
-  clear() {
-    this.sinks = [];
-  }
-  /** Returns a read-only snapshot of the current sinks (for tests). */
-  get size() {
-    return this.sinks.length;
-  }
-  /**
-   * Fan out a single event to every subscribed sink. Exceptions thrown by
-   * any sink are swallowed — one misbehaving consumer must never abort a
-   * scan. Diagnostic is written to stderr so the failure is visible.
-   */
-  emit(type, payload) {
-    const snapshot = this.sinks.slice();
-    for (const sink of snapshot) {
-      try {
-        sink.emit(type, payload);
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        try {
-          process.stderr.write(`[0 event-bus] sink threw on ${type}: ${msg}
-`);
-        } catch {
-        }
-      }
-    }
-  }
-};
-var eventBus = new EventBus();
-var cloudEventSink = {
-  emit(type, payload) {
-    const prefix = `ZERO_EVENT_${type.toUpperCase()}`;
-    let line;
-    try {
-      line = `${prefix} ${JSON.stringify(payload)}`;
-    } catch {
-      line = `${prefix} {"_unserializable":true}`;
-    }
-    process.stdout.write(line + "\n");
-  }
-};
-var cloudSinkSubscribed = false;
-function maybeSubscribeCloudEventSink() {
-  if (cloudSinkSubscribed)
-    return;
-  const flag = process.env["ZERO_CLOUD_EVENTS"];
-  if (flag && flag !== "0" && flag.toLowerCase() !== "false") {
-    eventBus.subscribe(cloudEventSink);
-    cloudSinkSubscribed = true;
-  }
-}
-function isCloudEventSinkActive() {
-  return cloudSinkSubscribed;
-}
-
-export {
-  presentationEventSink,
-  eventBus,
-  cloudEventSink,
-  maybeSubscribeCloudEventSink,
-  isCloudEventSinkActive
-};