0sec-cli 0.22.0 → 0.22.4

package/chunks/chunk-PS5E7LUQ.js

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  createWorkbenchConsoleSession,
+  currentWorkbenchAssets,
+  loadGlobalSettings,
+  loadWorkbenchConfig,
+  resolveWorkbenchGuestSettings,
+  workbenchConfigPath,
+  workbenchNetworkEnabled
+} from "./chunk-XODDLNBI.js";
+import {
+  createWorkbenchProviderBroker
+} from "./chunk-OAS5SAVZ.js";
+import {
+  osecDB
+} from "./chunk-L2CCO4KE.js";
+import {
+  isAdmittedSmolvmWorkbench
+} from "./chunk-2WWAPKAW.js";
+import {
+  SERVICE_PLUGIN_CATALOG,
+  findingSchema,
+  homeStateDir
+} from "./chunk-6KFB6AYN.js";
+
+// packages/cli/src/web/service-plugins.ts
+import { constants, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// packages/cli/src/console-execution.ts
+import { existsSync, realpathSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+function consoleExecutionProfile(homeDir) {
+  if (process.platform === "linux" && isAdmittedSmolvmWorkbench()) return "local";
+  return loadGlobalSettings(homeDir, { requireExecutionProfile: existsSync(workbenchConfigPath(homeDir)) }).executionProfile;
+}
+function createIsolatedConsoleSession(config, options = {}) {
+  if (consoleExecutionProfile(options.homeDir) !== "smolvm") return void 0;
+  const workbench = loadWorkbenchConfig(options.homeDir);
+  if (!workbench) throw new Error("SmolVM is selected but no workbench is configured. Run 0 workbench setup --image <approved archive>. Host fallback is refused.");
+  const requestedWorkspace = options.workspaceRoot ?? config.workspaceRoot;
+  if (workbench.workspaceRoot && requestedWorkspace && realpathSync(workbench.workspaceRoot) !== realpathSync(requestedWorkspace)) throw new Error("This chat folder differs from the configured SmolVM workspace grant. Start a chat in the granted folder or explicitly reconfigure the workbench before execution.");
+  if (config.pluginHost || config.mcpHost) throw new Error("Host plugin and MCP resources cannot be forwarded into SmolVM. Configure tools inside the approved guest image.");
+  const runtime = config.runtime;
+  const provider = runtime.resolvedProvider?.();
+  const model = runtime.resolvedModel?.() ?? config.costModel;
+  if (provider !== "chatgpt-codex" || !model) throw new Error("The isolated console currently requires the brokered chatgpt-codex provider and an explicit resolved model. Host fallback is refused.");
+  if (!workbench.providers.includes(provider)) throw new Error("The selected provider is not granted to this workbench. Configure an explicit chatgpt-codex provider grant.");
+  const routing = runtime.modelSelection?.();
+  const models = [.../* @__PURE__ */ new Set([model, ...Object.values(routing?.agentModels ?? {}).filter((value) => value !== "auto")])];
+  if (!runtime.workbenchCredentialResolver) throw new Error("The selected runtime cannot bind its account to the host provider broker.");
+  const broker = createWorkbenchProviderBroker({ provider, models, resolveCredentials: runtime.workbenchCredentialResolver() });
+  const { runtime: _runtime, ...guestConfig } = config;
+  const scanId = config.scanId ?? `console-${randomUUID()}`;
+  try {
+    return createWorkbenchConsoleSession({
+      config: { ...guestConfig, scanId, workspaceRoot: realpathSync(workbench.workspaceRoot ?? options.workspaceRoot ?? config.workspaceRoot ?? process.cwd()) },
+      workbench,
+      selection: { provider, model, contextWindowTokens: config.contextWindowTokens, ...routing },
+      provider: { ...broker.grant, request: broker.request, close: broker.close },
+      pluginHomeDir: options.homeDir,
+      assets: currentWorkbenchAssets(),
+      guestSettings: resolveWorkbenchGuestSettings(loadGlobalSettings(options.homeDir)),
+      network: workbenchNetworkEnabled(),
+      onExecution: options.onExecution,
+      onFindings: (findings, completion) => {
+        const validated = findings.map((finding) => findingSchema.parse(finding));
+        const db = new osecDB(options.dbPath);
+        try {
+          if (!db.getScan(scanId)) db.createScan({ target: config.target ?? "", depth: "default", format: "terminal", runtime: "api" }, scanId);
+          for (const finding of validated) db.saveFinding(scanId, finding);
+          if (!completion?.outcome || completion.outcome.stopReason === "error") db.failScan(scanId, completion?.outcome?.error ?? "Guest turn ended before a complete outcome was saved");
+          else db.completeScan(scanId, { source: "console", execution: "smolvm", stopReason: completion.outcome.stopReason });
+        } finally {
+          db.close();
+        }
+      }
+    });
+  } catch (error) {
+    void broker.close();
+    throw error;
+  }
+}
+
+// packages/cli/src/web/service-plugins.ts
+var ServicePluginError = class extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+var invalid = (message = "Invalid plugin configuration.") => new ServicePluginError(400, "invalid_configuration", message);
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid();
+  return value;
+}
+function descriptor(id) {
+  const plugin = SERVICE_PLUGIN_CATALOG.find((item) => item.id === id);
+  if (!plugin) throw new ServicePluginError(404, "unknown_plugin", "Plugin does not exist.");
+  return plugin;
+}
+function validateFields(id, value, previous = {}) {
+  const plugin = descriptor(id);
+  const supplied = object(value);
+  if (Object.keys(supplied).some((key) => !plugin.fields.some((field) => field.key === key))) throw invalid();
+  const result = {};
+  for (const field of plugin.fields) {
+    const suppliedValue = supplied[field.key];
+    const raw = (suppliedValue === void 0 || field.type === "secret" && suppliedValue === "") && field.type === "secret" ? previous[field.key] : suppliedValue;
+    if (raw === void 0 || raw === "") {
+      if (field.required) throw invalid(`Enter ${field.label}.`);
+      continue;
+    }
+    if (typeof raw !== "string" || raw.length > 8192 || /[\x00-\x1f\x7f]/.test(raw)) throw invalid();
+    const text = raw.trim();
+    if (!text) {
+      if (field.required) throw invalid(`Enter ${field.label}.`);
+      continue;
+    }
+    if (field.type === "url") {
+      let url;
+      try {
+        url = new URL(text);
+      } catch {
+        throw invalid("Enter a valid service URL.");
+      }
+      if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) throw invalid("Use HTTPS, or localhost HTTP, without credentials or query parameters.");
+      result[field.key] = url.href.replace(/\/$/, "");
+    } else result[field.key] = text;
+  }
+  return result;
+}
+function assertRegular(path, directory = false) {
+  try {
+    const stat = lstatSync(path);
+    if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile())) throw new Error("Unsafe plugin configuration path.");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+function readStore(homeDir) {
+  const directory = homeStateDir(homeDir);
+  assertRegular(directory, true);
+  const path = join(directory, "service-plugins.json");
+  assertRegular(path);
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  } catch (error) {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.size > 1048576) throw new Error("Invalid plugin configuration file.");
+    const raw = JSON.parse(readFileSync(fd, "utf8"));
+    if (!Array.isArray(raw)) throw new Error("Invalid plugin configuration file.");
+    const ids = /* @__PURE__ */ new Set();
+    return raw.map((value) => {
+      const row = object(value);
+      if (typeof row.id !== "string" || ids.has(row.id) || typeof row.enabled !== "boolean" || typeof row.testedAt !== "string" || row.testedAt.length > 64 || !Array.isArray(row.tools) || row.tools.length > 512) throw invalid();
+      ids.add(row.id);
+      const fields = validateFields(row.id, row.fields);
+      const tools = row.tools.map((value2) => {
+        const tool = object(value2);
+        if (typeof tool.name !== "string" || tool.name.length > 256 || typeof tool.description !== "string" || tool.description.length > 16384) throw invalid();
+        return { name: tool.name, description: tool.description };
+      });
+      return { id: row.id, enabled: row.enabled, fields, testedAt: row.testedAt, tools };
+    });
+  } finally {
+    closeSync(fd);
+  }
+}
+function saveStore(rows, homeDir) {
+  const serialized = JSON.stringify(rows) + "\n";
+  if (Buffer.byteLength(serialized, "utf8") > 1048576) throw new Error("Plugin configuration is too large.");
+  const directory = homeStateDir(homeDir);
+  assertRegular(directory, true);
+  mkdirSync(directory, { recursive: true, mode: 448 });
+  chmodSync(directory, 448);
+  const path = join(directory, "service-plugins.json");
+  assertRegular(path);
+  const temporary = join(directory, `.service-plugins-${randomUUID2()}.tmp`);
+  try {
+    writeFileSync(temporary, serialized, { mode: 384, flag: "wx" });
+    renameSync(temporary, path);
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+}
+function loadServicePluginConnections(homeDir) {
+  return readStore(homeDir).map(({ id, enabled, fields }) => ({ id, enabled, fields }));
+}
+var ServicePluginServices = class {
+  #options;
+  #pending = Promise.resolve();
+  constructor(options = {}) {
+    this.#options = options;
+  }
+  #view() {
+    const rows = readStore(this.#options.homeDir);
+    const secrets = rows.flatMap((row) => descriptor(row.id).fields.filter((field) => field.type === "secret").map((field) => row.fields[field.key])).filter((value) => Boolean(value));
+    const redact = (text) => secrets.reduce((result, secret) => result.split(secret).join("[redacted]"), text);
+    return { executionProfile: consoleExecutionProfile(), items: SERVICE_PLUGIN_CATALOG.map((plugin) => {
+      const row = rows.find((item) => item.id === plugin.id);
+      const values = Object.fromEntries(plugin.fields.filter((field) => field.type !== "secret").flatMap((field) => row?.fields[field.key] ? [[field.key, redact(row.fields[field.key])]] : []));
+      const tools = row?.tools.map((tool) => ({ name: redact(tool.name), description: redact(tool.description) })) ?? [];
+      return { ...plugin, configured: Boolean(row), enabled: row?.enabled ?? false, tools, values, testedAt: row?.testedAt ?? null };
+    }) };
+  }
+  async #probe(connection) {
+    try {
+      const probe = this.#options.probe ?? (await import("./dist-27BNG6WD.js")).testServicePluginConnection;
+      const result = await probe(connection);
+      if (!Array.isArray(result.tools) || result.tools.length > 512 || result.tools.some((tool) => typeof tool.name !== "string" || tool.name.length > 256 || typeof tool.description !== "string" || tool.description.length > 16384)) throw new Error("Invalid tool catalog.");
+      const configurations = [...readStore(this.#options.homeDir), connection];
+      const secrets = configurations.flatMap((row) => descriptor(row.id).fields.filter((field) => field.type === "secret").map((field) => row.fields[field.key])).filter((value) => Boolean(value));
+      const redact = (text) => secrets.reduce((result2, secret) => result2.split(secret).join("[redacted]"), text).replace(/(https?:\/\/)[^\s/@]+:[^\s/@]+@/g, "$1[redacted]@");
+      return { tools: result.tools.map(({ name, description }) => ({ name: redact(name), description: redact(description) })) };
+    } catch {
+      throw new ServicePluginError(409, "connection_failed", "Could not connect. Check the service URL and credentials.");
+    }
+  }
+  async #handle(path, method, input) {
+    if (path === "service-plugins" && method === "GET") return this.#view();
+    const match = /^service-plugins\/([a-z0-9-]+)(\/connect)?$/.exec(path);
+    if (!match) throw new ServicePluginError(405, "method_not_allowed", "Unsupported plugin operation.");
+    const id = match[1];
+    descriptor(id);
+    const rows = readStore(this.#options.homeDir);
+    const previous = rows.find((row) => row.id === id);
+    let next;
+    if (match[2] && method === "POST") {
+      const body = object(input);
+      if (body.approved !== true) throw new ServicePluginError(400, "approval_required", "Confirm connecting this plugin.");
+      const connection = { id, enabled: true, fields: validateFields(id, body.fields, previous?.fields) };
+      const result = await this.#probe(connection);
+      next = { ...connection, ...result, testedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    } else if (!match[2] && method === "PATCH") {
+      const body = object(input);
+      if (typeof body.enabled !== "boolean") throw invalid();
+      if (!previous) throw new ServicePluginError(409, "not_connected", "Connect this plugin first.");
+      next = { ...previous, enabled: body.enabled };
+      if (body.enabled) next = { ...next, ...await this.#probe(next), testedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    } else if (!match[2] && method === "DELETE") {
+    } else throw new ServicePluginError(405, "method_not_allowed", "Unsupported plugin operation.");
+    saveStore([...rows.filter((row) => row.id !== id), ...next ? [next] : []], this.#options.homeDir);
+    return this.#view();
+  }
+  async handle(path, method, input) {
+    if (!/^service-plugins(?:\/|$)/.test(path)) return null;
+    const operation = async () => {
+      try {
+        return { status: 200, data: await this.#handle(path, method, input) };
+      } catch (error) {
+        return { status: error instanceof ServicePluginError ? error.status : 500, data: { code: error instanceof ServicePluginError ? error.code : "configuration_unavailable", error: error instanceof ServicePluginError ? error.message : "Plugin configuration could not be read or saved." } };
+      }
+    };
+    const result = this.#pending.then(operation, operation);
+    this.#pending = result;
+    return result;
+  }
+};
+
+export {
+  consoleExecutionProfile,
+  createIsolatedConsoleSession,
+  loadServicePluginConnections,
+  ServicePluginServices
+};