0sec-cli 0.22.1 → 0.22.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (107) hide show
  1. package/0.js +56 -45
  2. package/README.md +12 -0
  3. package/chunks/{adapt-loop-J6QCZZTB.js → adapt-loop-3CCOWE43.js} +4 -4
  4. package/chunks/{artifact-scraper-MFKT6OI4.js → artifact-scraper-Z4UUIOH3.js} +2 -2
  5. package/chunks/{assumption-mining-646LYSJY.js → assumption-mining-2UAKQB6V.js} +18 -14
  6. package/chunks/{chunk-OHHCGDJ2.js → chunk-2WWAPKAW.js} +126 -1089
  7. package/chunks/{chunk-XDKB2P5X.js → chunk-3BPX75OR.js} +1 -1
  8. package/chunks/chunk-4ZYYX5GY.js +74 -0
  9. package/chunks/{chunk-3E2KALZ5.js → chunk-5JNTMWPK.js} +2 -2
  10. package/chunks/{chunk-CPWA6RWE.js → chunk-5WAJGLCW.js} +3 -3
  11. package/chunks/{chunk-KAU6NLGP.js → chunk-6KFB6AYN.js} +515 -20
  12. package/chunks/{chunk-XA2O4WXA.js → chunk-6WQDXWQC.js} +169 -15
  13. package/chunks/chunk-6YZE552K.js +5603 -0
  14. package/chunks/chunk-BGX53365.js +309 -0
  15. package/chunks/{chunk-X7LAEEUW.js → chunk-C6JPA32H.js} +1 -1
  16. package/chunks/chunk-CF3MNS3O.js +990 -0
  17. package/chunks/{chunk-4VGLO2YS.js → chunk-CPCHLL6A.js} +5 -2
  18. package/chunks/{chunk-ZKQ2I3S2.js → chunk-DPUXXMJW.js} +1 -1
  19. package/chunks/{chunk-XCISCI4T.js → chunk-E3OOBVOK.js} +30 -12
  20. package/chunks/{chunk-4G7OVYJX.js → chunk-E74LXQFY.js} +1 -1
  21. package/chunks/{chunk-OSBPGWTE.js → chunk-ELI3BVIK.js} +3 -3
  22. package/chunks/chunk-FFHRANYC.js +547 -0
  23. package/chunks/{chunk-WSDDGFA6.js → chunk-G2BE2FC7.js} +1 -1
  24. package/chunks/chunk-GQ3DGHWE.js +1659 -0
  25. package/chunks/{chunk-V36HVTUL.js → chunk-GVY3S5E5.js} +21 -18
  26. package/chunks/{chunk-5BTJMINS.js → chunk-H4DH7COV.js} +192 -40
  27. package/chunks/{chunk-HHPWRY2M.js → chunk-H6Q2QAIY.js} +23475 -22747
  28. package/chunks/{chunk-7XCKYNLO.js → chunk-IHPTOTLL.js} +1 -1
  29. package/chunks/chunk-IXAHQICR.js +31 -0
  30. package/chunks/{chunk-TH2LW437.js → chunk-KCA35IL3.js} +2 -190
  31. package/chunks/{chunk-VWITLWXB.js → chunk-L2CCO4KE.js} +282 -34
  32. package/chunks/{chunk-6YNKRUMC.js → chunk-NJLKFC66.js} +321 -5
  33. package/chunks/{chunk-W6UWZFKL.js → chunk-O6KPVYOI.js} +100 -5
  34. package/chunks/{chunk-LGCASF2C.js → chunk-OAS5SAVZ.js} +6767 -2100
  35. package/chunks/chunk-PS5E7LUQ.js +277 -0
  36. package/chunks/{chunk-AV2LG2L7.js → chunk-QVIRWJ45.js} +257 -145
  37. package/chunks/{chunk-TV27OWIW.js → chunk-QWK4R3DB.js} +9 -9
  38. package/chunks/{chunk-WZRVS7SB.js → chunk-RCRTSKQN.js} +1 -1
  39. package/chunks/chunk-RS4MAN3Q.js +73 -0
  40. package/chunks/{chunk-V6GHX34G.js → chunk-RTBZ36BD.js} +8 -274
  41. package/chunks/{chunk-YL6YAGLL.js → chunk-SCWWLABR.js} +1 -1
  42. package/chunks/chunk-VDOWARMJ.js +63 -0
  43. package/chunks/{chunk-IFME676H.js → chunk-WBRGXCU2.js} +79 -18
  44. package/chunks/{chunk-IVQV574Y.js → chunk-WHUAUFSX.js} +1 -1
  45. package/chunks/{chunk-GOEA3NW6.js → chunk-XODDLNBI.js} +1534 -1305
  46. package/chunks/chunk-YAZARMJY.js +355 -0
  47. package/chunks/{chunk-NLH4LMWH.js → chunk-YED25PA4.js} +1 -1
  48. package/chunks/{codex-models-NHQW45SO.js → codex-models-Z43V3427.js} +9 -3
  49. package/chunks/{commands-N6GN5SBF.js → commands-EUGF4FUZ.js} +5842 -4093
  50. package/chunks/{db-5IWEJUYV.js → db-NVAW4WWR.js} +3 -3
  51. package/chunks/{dist-L3XJWWZ6.js → dist-27BNG6WD.js} +193 -112
  52. package/chunks/{dist-FSS7MBDF.js → dist-7RUOKPRJ.js} +12 -2
  53. package/chunks/{dist-KEULE5IQ.js → dist-LNXGATR2.js} +2 -2
  54. package/chunks/{dist-XZB53PS5.js → dist-M2X367VW.js} +2 -2
  55. package/chunks/{dist-BS4CY4RG.js → dist-NG2HT5XU.js} +27 -1
  56. package/chunks/{eval-runner-EMEGF24P.js → eval-runner-6Q3H52SP.js} +13 -9
  57. package/chunks/{exploit-agent-KW4EB7BE.js → exploit-agent-FCCR2HYX.js} +1 -1
  58. package/chunks/{exploit-autoclimb-CXJ2ERRO.js → exploit-autoclimb-X5ZS5FAO.js} +1 -1
  59. package/chunks/{exploit-climb-TJWLY4XC.js → exploit-climb-3JHGEO36.js} +2 -2
  60. package/chunks/{fix-UUKPXCFB.js → fix-NSNPU33B.js} +12 -6
  61. package/chunks/{harness-C5HOKIEV.js → harness-KXQOVIDQ.js} +3 -3
  62. package/chunks/{hunt-scan-KZZ444V2.js → hunt-scan-ELTKGKC4.js} +16 -12
  63. package/chunks/{kernel-primitive-Z77IR7YS.js → kernel-primitive-MT7YZSIG.js} +2 -2
  64. package/chunks/{kernel-vm-runner-JW77P276.js → kernel-vm-runner-YFRHYC6G.js} +2 -2
  65. package/chunks/{native-loop-P6P5GYVJ.js → native-loop-OFJDRHPI.js} +18 -8
  66. package/chunks/orchestrate-DRZ2SVCP.js +62 -0
  67. package/chunks/{prepare-KYHGFWCJ.js → prepare-72GWTRVI.js} +6 -2
  68. package/chunks/{process-N245QIQG.js → process-MJYJ2K5E.js} +2 -1
  69. package/chunks/{run-GAFKBCTN.js → run-WTJCZZHV.js} +1901 -4816
  70. package/chunks/{runtime-H7YBR5IZ.js → runtime-FCKOUB7V.js} +10 -4
  71. package/chunks/{runtime-XFWJTBUO.js → runtime-LCJ4XSKE.js} +5 -1
  72. package/chunks/{scan-stream-BMOCPKQX.js → scan-stream-GT6GKQ3U.js} +7 -1
  73. package/chunks/{scope-QWY4VQZ7.js → scope-E5QZUOOH.js} +2 -2
  74. package/chunks/service-plugins-MSK2EQP6.js +62 -0
  75. package/chunks/{session-store-XIDFGG7K.js → session-store-H3Q7KCYG.js} +6 -4
  76. package/chunks/{variant-candidates-7D4F5E4H.js → variant-candidates-SZKDCOLK.js} +9 -3
  77. package/chunks/{web-recon-prepass-VXXBPDAV.js → web-recon-prepass-IO3GXQMW.js} +11 -6
  78. package/dashboard/apple-touch-icon.png +0 -0
  79. package/dashboard/assets/operations-BvB5Qpmk.css +1 -0
  80. package/dashboard/assets/operations-D8Ii01SV.js +114 -0
  81. package/dashboard/assets/zero-peek-Dzm3MT3X.png +0 -0
  82. package/dashboard/favicon.ico +0 -0
  83. package/dashboard/favicon.svg +10 -0
  84. package/dashboard/index.html +5 -3
  85. package/package.json +1 -1
  86. package/chunks/chunk-6GHSR47F.js +0 -147
  87. package/chunks/chunk-BCSRRQG5.js +0 -3514
  88. package/chunks/chunk-BOUGKEKA.js +0 -193
  89. package/chunks/chunk-GHWODZMR.js +0 -16
  90. package/chunks/orchestrate-DWWUT5RC.js +0 -58
  91. package/dashboard/assets/bot-Bg1Tp9_d.js +0 -1
  92. package/dashboard/assets/dist-B_dDCPbu.js +0 -1
  93. package/dashboard/assets/findings-page-mayGhNx6.js +0 -5
  94. package/dashboard/assets/format--susmHX7.js +0 -1
  95. package/dashboard/assets/input-TuVPR3Zl.js +0 -1
  96. package/dashboard/assets/jsx-runtime-MGseXjj5.js +0 -3
  97. package/dashboard/assets/live-page-HWWHX99U.js +0 -1
  98. package/dashboard/assets/meta-tile-ckHo-w7k.js +0 -1
  99. package/dashboard/assets/operations-BxZ0OoXO.js +0 -10
  100. package/dashboard/assets/operations-CMFVrXEe.css +0 -2
  101. package/dashboard/assets/operations-app-D3d35rgo.js +0 -46
  102. package/dashboard/assets/overview-page-W_4IteEr.js +0 -1
  103. package/dashboard/assets/page-header-Bw9AJgBV.js +0 -1
  104. package/dashboard/assets/scans-page-CgzVXHnn.js +0 -1
  105. package/dashboard/assets/siren-KQj8QAnJ.js +0 -1
  106. package/dashboard/assets/table-8EDklulN.js +0 -1
  107. package/dashboard/assets/tabs-CFHPOwg8.js +0 -1
@@ -763,6 +763,7 @@ var string = (params) => {
763
763
  const regex = params ? `[\\s\\S]{${params?.minimum ?? 0},${params?.maximum ?? ""}}` : `[\\s\\S]*`;
764
764
  return new RegExp(`^${regex}$`);
765
765
  };
766
+ var bigint = /^\d+n?$/;
766
767
  var integer = /^\d+$/;
767
768
  var number = /^-?\d+(?:\.\d+)?/i;
768
769
  var boolean = /true|false/i;
@@ -1340,11 +1341,11 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
1340
1341
  inst._zod.check = (payload) => {
1341
1342
  try {
1342
1343
  const orig = payload.value;
1343
- const url = new URL(orig);
1344
- const href = url.href;
1344
+ const url2 = new URL(orig);
1345
+ const href = url2.href;
1345
1346
  if (def.hostname) {
1346
1347
  def.hostname.lastIndex = 0;
1347
- if (!def.hostname.test(url.hostname)) {
1348
+ if (!def.hostname.test(url2.hostname)) {
1348
1349
  payload.issues.push({
1349
1350
  code: "invalid_format",
1350
1351
  format: "url",
@@ -1358,7 +1359,7 @@ var $ZodURL = /* @__PURE__ */ $constructor("$ZodURL", (inst, def) => {
1358
1359
  }
1359
1360
  if (def.protocol) {
1360
1361
  def.protocol.lastIndex = 0;
1361
- if (!def.protocol.test(url.protocol.endsWith(":") ? url.protocol.slice(0, -1) : url.protocol)) {
1362
+ if (!def.protocol.test(url2.protocol.endsWith(":") ? url2.protocol.slice(0, -1) : url2.protocol)) {
1362
1363
  payload.issues.push({
1363
1364
  code: "invalid_format",
1364
1365
  format: "url",
@@ -1631,6 +1632,26 @@ var $ZodBoolean = /* @__PURE__ */ $constructor("$ZodBoolean", (inst, def) => {
1631
1632
  return payload;
1632
1633
  };
1633
1634
  });
1635
+ var $ZodBigInt = /* @__PURE__ */ $constructor("$ZodBigInt", (inst, def) => {
1636
+ $ZodType.init(inst, def);
1637
+ inst._zod.pattern = bigint;
1638
+ inst._zod.parse = (payload, _ctx) => {
1639
+ if (def.coerce)
1640
+ try {
1641
+ payload.value = BigInt(payload.value);
1642
+ } catch (_) {
1643
+ }
1644
+ if (typeof payload.value === "bigint")
1645
+ return payload;
1646
+ payload.issues.push({
1647
+ expected: "bigint",
1648
+ code: "invalid_type",
1649
+ input: payload.value,
1650
+ inst
1651
+ });
1652
+ return payload;
1653
+ };
1654
+ });
1634
1655
  var $ZodNull = /* @__PURE__ */ $constructor("$ZodNull", (inst, def) => {
1635
1656
  $ZodType.init(inst, def);
1636
1657
  inst._zod.pattern = _null;
@@ -1668,6 +1689,30 @@ var $ZodNever = /* @__PURE__ */ $constructor("$ZodNever", (inst, def) => {
1668
1689
  return payload;
1669
1690
  };
1670
1691
  });
1692
+ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
1693
+ $ZodType.init(inst, def);
1694
+ inst._zod.parse = (payload, _ctx) => {
1695
+ if (def.coerce) {
1696
+ try {
1697
+ payload.value = new Date(payload.value);
1698
+ } catch (_err) {
1699
+ }
1700
+ }
1701
+ const input = payload.value;
1702
+ const isDate = input instanceof Date;
1703
+ const isValidDate = isDate && !Number.isNaN(input.getTime());
1704
+ if (isValidDate)
1705
+ return payload;
1706
+ payload.issues.push({
1707
+ expected: "date",
1708
+ code: "invalid_type",
1709
+ input,
1710
+ ...isDate ? { received: "Invalid Date" } : {},
1711
+ inst
1712
+ });
1713
+ return payload;
1714
+ };
1715
+ });
1671
1716
  function handleArrayResult(result, final, index) {
1672
1717
  if (result.issues.length) {
1673
1718
  final.issues.push(...prefixIssues(index, result.issues));
@@ -2507,6 +2552,13 @@ function _string(Class2, params) {
2507
2552
  ...normalizeParams(params)
2508
2553
  });
2509
2554
  }
2555
+ function _coercedString(Class2, params) {
2556
+ return new Class2({
2557
+ type: "string",
2558
+ coerce: true,
2559
+ ...normalizeParams(params)
2560
+ });
2561
+ }
2510
2562
  function _email(Class2, params) {
2511
2563
  return new Class2({
2512
2564
  type: "string",
@@ -2751,6 +2803,14 @@ function _number(Class2, params) {
2751
2803
  ...normalizeParams(params)
2752
2804
  });
2753
2805
  }
2806
+ function _coercedNumber(Class2, params) {
2807
+ return new Class2({
2808
+ type: "number",
2809
+ coerce: true,
2810
+ checks: [],
2811
+ ...normalizeParams(params)
2812
+ });
2813
+ }
2754
2814
  function _int(Class2, params) {
2755
2815
  return new Class2({
2756
2816
  type: "number",
@@ -2766,6 +2826,20 @@ function _boolean(Class2, params) {
2766
2826
  ...normalizeParams(params)
2767
2827
  });
2768
2828
  }
2829
+ function _coercedBoolean(Class2, params) {
2830
+ return new Class2({
2831
+ type: "boolean",
2832
+ coerce: true,
2833
+ ...normalizeParams(params)
2834
+ });
2835
+ }
2836
+ function _coercedBigint(Class2, params) {
2837
+ return new Class2({
2838
+ type: "bigint",
2839
+ coerce: true,
2840
+ ...normalizeParams(params)
2841
+ });
2842
+ }
2769
2843
  function _null2(Class2, params) {
2770
2844
  return new Class2({
2771
2845
  type: "null",
@@ -2788,6 +2862,13 @@ function _never(Class2, params) {
2788
2862
  ...normalizeParams(params)
2789
2863
  });
2790
2864
  }
2865
+ function _coercedDate(Class2, params) {
2866
+ return new Class2({
2867
+ type: "date",
2868
+ coerce: true,
2869
+ ...normalizeParams(params)
2870
+ });
2871
+ }
2791
2872
  function _lt(value, params) {
2792
2873
  return new $ZodCheckLessThan({
2793
2874
  check: "less_than",
@@ -3935,6 +4016,9 @@ var ZodURL = /* @__PURE__ */ $constructor("ZodURL", (inst, def) => {
3935
4016
  $ZodURL.init(inst, def);
3936
4017
  ZodStringFormat.init(inst, def);
3937
4018
  });
4019
+ function url(params) {
4020
+ return _url(ZodURL, params);
4021
+ }
3938
4022
  var ZodEmoji = /* @__PURE__ */ $constructor("ZodEmoji", (inst, def) => {
3939
4023
  $ZodEmoji.init(inst, def);
3940
4024
  ZodStringFormat.init(inst, def);
@@ -4037,6 +4121,27 @@ var ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
4037
4121
  function boolean2(params) {
4038
4122
  return _boolean(ZodBoolean, params);
4039
4123
  }
4124
+ var ZodBigInt = /* @__PURE__ */ $constructor("ZodBigInt", (inst, def) => {
4125
+ $ZodBigInt.init(inst, def);
4126
+ ZodType.init(inst, def);
4127
+ inst.gte = (value, params) => inst.check(_gte(value, params));
4128
+ inst.min = (value, params) => inst.check(_gte(value, params));
4129
+ inst.gt = (value, params) => inst.check(_gt(value, params));
4130
+ inst.gte = (value, params) => inst.check(_gte(value, params));
4131
+ inst.min = (value, params) => inst.check(_gte(value, params));
4132
+ inst.lt = (value, params) => inst.check(_lt(value, params));
4133
+ inst.lte = (value, params) => inst.check(_lte(value, params));
4134
+ inst.max = (value, params) => inst.check(_lte(value, params));
4135
+ inst.positive = (params) => inst.check(_gt(BigInt(0), params));
4136
+ inst.negative = (params) => inst.check(_lt(BigInt(0), params));
4137
+ inst.nonpositive = (params) => inst.check(_lte(BigInt(0), params));
4138
+ inst.nonnegative = (params) => inst.check(_gte(BigInt(0), params));
4139
+ inst.multipleOf = (value, params) => inst.check(_multipleOf(value, params));
4140
+ const bag = inst._zod.bag;
4141
+ inst.minValue = bag.minimum ?? null;
4142
+ inst.maxValue = bag.maximum ?? null;
4143
+ inst.format = bag.format ?? null;
4144
+ });
4040
4145
  var ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
4041
4146
  $ZodNull.init(inst, def);
4042
4147
  ZodType.init(inst, def);
@@ -4065,6 +4170,15 @@ var ZodNever = /* @__PURE__ */ $constructor("ZodNever", (inst, def) => {
4065
4170
  function never(params) {
4066
4171
  return _never(ZodNever, params);
4067
4172
  }
4173
+ var ZodDate = /* @__PURE__ */ $constructor("ZodDate", (inst, def) => {
4174
+ $ZodDate.init(inst, def);
4175
+ ZodType.init(inst, def);
4176
+ inst.min = (value, params) => inst.check(_gte(value, params));
4177
+ inst.max = (value, params) => inst.check(_lte(value, params));
4178
+ const c = inst._zod.bag;
4179
+ inst.minDate = c.minimum ? new Date(c.minimum) : null;
4180
+ inst.maxDate = c.maximum ? new Date(c.maximum) : null;
4181
+ });
4068
4182
  var ZodArray = /* @__PURE__ */ $constructor("ZodArray", (inst, def) => {
4069
4183
  $ZodArray.init(inst, def);
4070
4184
  ZodType.init(inst, def);
@@ -4434,7 +4548,197 @@ function preprocess(fn, schema) {
4434
4548
  return pipe(transform(fn), schema);
4435
4549
  }
4436
4550
 
4551
+ // node_modules/.pnpm/eventsource-parser@3.0.8/node_modules/eventsource-parser/dist/index.js
4552
+ var ParseError = class extends Error {
4553
+ constructor(message, options) {
4554
+ super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
4555
+ }
4556
+ };
4557
+ var LF = 10;
4558
+ var CR = 13;
4559
+ var SPACE = 32;
4560
+ function noop(_arg) {
4561
+ }
4562
+ function createParser(callbacks) {
4563
+ if (typeof callbacks == "function")
4564
+ throw new TypeError(
4565
+ "`callbacks` must be an object, got a function instead. Did you mean `{onEvent: fn}`?"
4566
+ );
4567
+ const { onEvent = noop, onError = noop, onRetry = noop, onComment } = callbacks, pendingFragments = [];
4568
+ let isFirstChunk = true, id, data = "", dataLines = 0, eventType;
4569
+ function feed(chunk) {
4570
+ if (isFirstChunk && (isFirstChunk = false, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
4571
+ const trailing2 = processLines(chunk);
4572
+ trailing2 !== "" && pendingFragments.push(trailing2);
4573
+ return;
4574
+ }
4575
+ if (chunk.indexOf(`
4576
+ `) === -1 && chunk.indexOf("\r") === -1) {
4577
+ pendingFragments.push(chunk);
4578
+ return;
4579
+ }
4580
+ pendingFragments.push(chunk);
4581
+ const input = pendingFragments.join("");
4582
+ pendingFragments.length = 0;
4583
+ const trailing = processLines(input);
4584
+ trailing !== "" && pendingFragments.push(trailing);
4585
+ }
4586
+ function processLines(chunk) {
4587
+ let searchIndex = 0;
4588
+ if (chunk.indexOf("\r") === -1) {
4589
+ let lfIndex = chunk.indexOf(`
4590
+ `, searchIndex);
4591
+ for (; lfIndex !== -1; ) {
4592
+ if (searchIndex === lfIndex) {
4593
+ dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
4594
+ `, searchIndex);
4595
+ continue;
4596
+ }
4597
+ const firstCharCode = chunk.charCodeAt(searchIndex);
4598
+ if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
4599
+ const valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
4600
+ if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
4601
+ onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
4602
+ `, searchIndex);
4603
+ continue;
4604
+ }
4605
+ data = dataLines === 0 ? value : `${data}
4606
+ ${value}`, dataLines++;
4607
+ } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
4608
+ chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
4609
+ lfIndex
4610
+ ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
4611
+ searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
4612
+ `, searchIndex);
4613
+ }
4614
+ return chunk.slice(searchIndex);
4615
+ }
4616
+ for (; searchIndex < chunk.length; ) {
4617
+ const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
4618
+ `, searchIndex);
4619
+ let lineEnd = -1;
4620
+ if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
4621
+ break;
4622
+ parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
4623
+ }
4624
+ return chunk.slice(searchIndex);
4625
+ }
4626
+ function parseLine(chunk, start, end) {
4627
+ if (start === end) {
4628
+ dispatchEvent();
4629
+ return;
4630
+ }
4631
+ const firstCharCode = chunk.charCodeAt(start);
4632
+ if (isDataPrefix(chunk, start, firstCharCode)) {
4633
+ const valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
4634
+ data = dataLines === 0 ? value2 : `${data}
4635
+ ${value2}`, dataLines++;
4636
+ return;
4637
+ }
4638
+ if (isEventPrefix(chunk, start, firstCharCode)) {
4639
+ eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
4640
+ return;
4641
+ }
4642
+ if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
4643
+ const value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
4644
+ id = value2.includes("\0") ? void 0 : value2;
4645
+ return;
4646
+ }
4647
+ if (firstCharCode === 58) {
4648
+ if (onComment) {
4649
+ const line2 = chunk.slice(start, end);
4650
+ onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
4651
+ }
4652
+ return;
4653
+ }
4654
+ const line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
4655
+ if (fieldSeparatorIndex === -1) {
4656
+ processField(line, "", line);
4657
+ return;
4658
+ }
4659
+ const field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
4660
+ processField(field, value, line);
4661
+ }
4662
+ function processField(field, value, line) {
4663
+ switch (field) {
4664
+ case "event":
4665
+ eventType = value || void 0;
4666
+ break;
4667
+ case "data":
4668
+ data = dataLines === 0 ? value : `${data}
4669
+ ${value}`, dataLines++;
4670
+ break;
4671
+ case "id":
4672
+ id = value.includes("\0") ? void 0 : value;
4673
+ break;
4674
+ case "retry":
4675
+ /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
4676
+ new ParseError(`Invalid \`retry\` value: "${value}"`, {
4677
+ type: "invalid-retry",
4678
+ value,
4679
+ line
4680
+ })
4681
+ );
4682
+ break;
4683
+ default:
4684
+ onError(
4685
+ new ParseError(
4686
+ `Unknown field "${field.length > 20 ? `${field.slice(0, 20)}\u2026` : field}"`,
4687
+ { type: "unknown-field", field, value, line }
4688
+ )
4689
+ );
4690
+ break;
4691
+ }
4692
+ }
4693
+ function dispatchEvent() {
4694
+ dataLines > 0 && onEvent({
4695
+ id,
4696
+ event: eventType,
4697
+ data
4698
+ }), id = void 0, data = "", dataLines = 0, eventType = void 0;
4699
+ }
4700
+ function reset(options = {}) {
4701
+ if (options.consume && pendingFragments.length > 0) {
4702
+ const incompleteLine = pendingFragments.join("");
4703
+ parseLine(incompleteLine, 0, incompleteLine.length);
4704
+ }
4705
+ isFirstChunk = true, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0;
4706
+ }
4707
+ return { feed, reset };
4708
+ }
4709
+ function isDataPrefix(chunk, i, firstCharCode) {
4710
+ return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
4711
+ }
4712
+ function isEventPrefix(chunk, i, firstCharCode) {
4713
+ return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
4714
+ }
4715
+
4716
+ // node_modules/.pnpm/eventsource-parser@3.0.8/node_modules/eventsource-parser/dist/stream.js
4717
+ var EventSourceParserStream = class extends TransformStream {
4718
+ constructor({ onError, onRetry, onComment } = {}) {
4719
+ let parser;
4720
+ super({
4721
+ start(controller) {
4722
+ parser = createParser({
4723
+ onEvent: (event) => {
4724
+ controller.enqueue(event);
4725
+ },
4726
+ onError(error) {
4727
+ onError === "terminate" ? controller.error(error) : typeof onError == "function" && onError(error);
4728
+ },
4729
+ onRetry,
4730
+ onComment
4731
+ });
4732
+ },
4733
+ transform(chunk) {
4734
+ parser.feed(chunk);
4735
+ }
4736
+ });
4737
+ }
4738
+ };
4739
+
4437
4740
  export {
4741
+ NEVER,
4438
4742
  $constructor,
4439
4743
  config,
4440
4744
  joinValues,
@@ -4447,16 +4751,27 @@ export {
4447
4751
  safeParseAsync,
4448
4752
  $ZodType,
4449
4753
  $ZodObject,
4754
+ _coercedString,
4755
+ _coercedNumber,
4756
+ _coercedBoolean,
4757
+ _coercedBigint,
4758
+ _coercedDate,
4450
4759
  toJSONSchema,
4451
4760
  iso_exports,
4452
4761
  safeParseAsync2,
4762
+ ZodString,
4453
4763
  string2 as string,
4764
+ url,
4765
+ ZodNumber,
4454
4766
  number2 as number,
4767
+ ZodBoolean,
4455
4768
  boolean2 as boolean,
4769
+ ZodBigInt,
4456
4770
  _null3 as _null,
4457
4771
  any,
4458
4772
  unknown,
4459
4773
  never,
4774
+ ZodDate,
4460
4775
  array,
4461
4776
  object,
4462
4777
  looseObject,
@@ -4470,5 +4785,6 @@ export {
4470
4785
  lazy,
4471
4786
  custom,
4472
4787
  _instanceof,
4473
- preprocess
4788
+ preprocess,
4789
+ EventSourceParserStream
4474
4790
  };
@@ -1,12 +1,28 @@
1
1
  #!/usr/bin/env node
2
2
  import { createRequire as __0CreateRequire } from "node:module";
3
3
  const require = __0CreateRequire(import.meta.url);
4
+ import {
5
+ readCacheUsage
6
+ } from "./chunk-RS4MAN3Q.js";
4
7
 
5
8
  // packages/core/dist/runtime/process.js
6
9
  import { spawn } from "node:child_process";
7
10
  import { tmpdir } from "node:os";
8
11
  import { join, resolve } from "node:path";
9
12
  import { writeFileSync } from "node:fs";
13
+ function readGeminiUsage(raw) {
14
+ if (!raw || typeof raw !== "object")
15
+ return void 0;
16
+ const stats = raw;
17
+ if (typeof stats.input_tokens !== "number" || typeof stats.output_tokens !== "number")
18
+ return void 0;
19
+ const outputTokens = typeof stats.total_tokens === "number" ? Math.max(stats.output_tokens, stats.total_tokens - stats.input_tokens) : stats.output_tokens;
20
+ return {
21
+ inputTokens: stats.input_tokens,
22
+ outputTokens,
23
+ ...typeof stats.cached === "number" ? { cachedInputTokens: stats.cached } : {}
24
+ };
25
+ }
10
26
  var dim = (text) => `\x1B[2m${text}\x1B[0m`;
11
27
  function formatToolDetail(input) {
12
28
  const inp = input;
@@ -95,13 +111,20 @@ var ProcessRuntime = class {
95
111
  type;
96
112
  config;
97
113
  command;
114
+ observedModel;
98
115
  constructor(config) {
99
116
  this.type = config.type;
100
117
  this.config = config;
101
118
  this.command = RUNTIME_COMMANDS[config.type] ?? config.type;
102
119
  }
120
+ resolvedModel() {
121
+ return this.observedModel ?? this.config.model ?? "unknown";
122
+ }
103
123
  async execute(prompt, context) {
104
124
  const start = Date.now();
125
+ if (context?.signal?.aborted) {
126
+ return { output: "", exitCode: null, timedOut: false, durationMs: 0, error: "Runtime execution cancelled." };
127
+ }
105
128
  const args = this.buildArgs(prompt, context);
106
129
  const env = this.buildEnv(context);
107
130
  const onToolCall = this.config.onToolCall;
@@ -110,13 +133,18 @@ var ProcessRuntime = class {
110
133
  let stderr = "";
111
134
  let resultText = "";
112
135
  let timedOut = false;
136
+ let usage;
137
+ let usageByModel;
138
+ let runtimeError;
139
+ let streamBuffer = "";
113
140
  const isJsonStream = args.includes("stream-json") || args.includes("--json");
114
141
  let proc;
115
142
  try {
116
143
  proc = spawn(this.command, args, {
117
144
  cwd: this.config.cwd ?? process.cwd(),
118
145
  env: { ...process.env, ...env },
119
- stdio: ["ignore", "pipe", "pipe"]
146
+ stdio: ["ignore", "pipe", "pipe"],
147
+ detached: process.platform !== "win32"
120
148
  });
121
149
  } catch (err) {
122
150
  resolve2({
@@ -132,11 +160,20 @@ var ProcessRuntime = class {
132
160
  const text = chunk.toString();
133
161
  stdout += text;
134
162
  if (isJsonStream) {
135
- for (const line of text.split("\n")) {
163
+ streamBuffer += text;
164
+ let newline = streamBuffer.indexOf("\n");
165
+ while (newline >= 0) {
166
+ const line = streamBuffer.slice(0, newline);
167
+ streamBuffer = streamBuffer.slice(newline + 1);
168
+ newline = streamBuffer.indexOf("\n");
136
169
  if (!line.trim())
137
170
  continue;
138
171
  try {
139
172
  const event = JSON.parse(line);
173
+ if (typeof event.message?.model === "string")
174
+ this.observedModel = event.message.model;
175
+ if (event.type === "init" && typeof event.model === "string")
176
+ this.observedModel = event.model;
140
177
  if (event.type === "assistant" && event.message?.content) {
141
178
  for (const block of event.message.content) {
142
179
  if (block.type === "text") {
@@ -148,6 +185,8 @@ var ProcessRuntime = class {
148
185
  }
149
186
  } else if (event.type === "result") {
150
187
  resultText = event.result || resultText;
188
+ if (event.usage)
189
+ usage = readCacheUsage(event.usage);
151
190
  }
152
191
  if (event.type === "item.started" && event.item?.type === "command_execution") {
153
192
  showToolCall(onToolCall, "shell", { command: event.item.command });
@@ -159,6 +198,29 @@ var ProcessRuntime = class {
159
198
  } else if (event.item.type === "command_execution" && event.item.command) {
160
199
  }
161
200
  }
201
+ if (event.type === "turn.completed" && event.usage) {
202
+ usage = { inputTokens: Number(event.usage.input_tokens ?? 0), outputTokens: Number(event.usage.output_tokens ?? 0) };
203
+ }
204
+ if (this.type === "gemini") {
205
+ if (event.type === "message" && event.role === "assistant" && typeof event.content === "string") {
206
+ resultText += event.content;
207
+ this.config.onThinking?.(event.content);
208
+ } else if (event.type === "tool_use") {
209
+ showToolCall(onToolCall, event.tool_name, event.parameters);
210
+ } else if (event.type === "result") {
211
+ usage = readGeminiUsage(event.stats);
212
+ if (event.stats?.models && typeof event.stats.models === "object") {
213
+ usageByModel = [];
214
+ for (const [model, stats] of Object.entries(event.stats.models)) {
215
+ const measured = readGeminiUsage(stats);
216
+ if (measured)
217
+ usageByModel.push({ model, usage: measured });
218
+ }
219
+ }
220
+ if (event.status === "error")
221
+ runtimeError = event.error?.message ?? "Gemini CLI returned an error result.";
222
+ }
223
+ }
162
224
  } catch {
163
225
  }
164
226
  }
@@ -172,24 +234,53 @@ var ProcessRuntime = class {
172
234
  stderr += "\n[0] Subprocess killed: MCP tools require interactive approval. Use --runtime api instead.";
173
235
  }
174
236
  });
237
+ let killTimer;
238
+ const terminate = () => {
239
+ if (proc.pid && process.platform !== "win32") {
240
+ try {
241
+ process.kill(-proc.pid, "SIGTERM");
242
+ } catch {
243
+ proc.kill("SIGTERM");
244
+ }
245
+ } else
246
+ proc.kill("SIGTERM");
247
+ killTimer ??= setTimeout(() => {
248
+ if (proc.pid && process.platform !== "win32") {
249
+ try {
250
+ process.kill(-proc.pid, "SIGKILL");
251
+ } catch {
252
+ proc.kill("SIGKILL");
253
+ }
254
+ } else
255
+ proc.kill("SIGKILL");
256
+ }, 1e3);
257
+ };
175
258
  const timer = setTimeout(() => {
176
259
  timedOut = true;
177
- proc.kill("SIGTERM");
178
- setTimeout(() => proc.kill("SIGKILL"), 5e3);
260
+ terminate();
179
261
  }, this.config.timeout);
262
+ context?.signal?.addEventListener("abort", terminate, { once: true });
263
+ if (context?.signal?.aborted)
264
+ terminate();
180
265
  proc.on("close", (code) => {
181
266
  clearTimeout(timer);
267
+ clearTimeout(killTimer);
268
+ context?.signal?.removeEventListener("abort", terminate);
182
269
  const output = isJsonStream ? (resultText || stdout).trim() : stdout.trim();
183
270
  resolve2({
184
271
  output,
185
272
  exitCode: code,
186
273
  timedOut,
274
+ usage,
275
+ usageByModel,
187
276
  durationMs: Date.now() - start,
188
- error: code !== 0 ? stderr.trim() || void 0 : void 0
277
+ error: context?.signal?.aborted ? "Runtime execution cancelled." : runtimeError ?? (code !== 0 ? stderr.trim() || void 0 : void 0)
189
278
  });
190
279
  });
191
280
  proc.on("error", (err) => {
192
281
  clearTimeout(timer);
282
+ clearTimeout(killTimer);
283
+ context?.signal?.removeEventListener("abort", terminate);
193
284
  resolve2({
194
285
  output: "",
195
286
  exitCode: 1,
@@ -227,6 +318,8 @@ var ProcessRuntime = class {
227
318
  switch (this.type) {
228
319
  case "claude": {
229
320
  const args = ["-p", prompt, "--verbose", "--output-format", "stream-json"];
321
+ if (this.config.model)
322
+ args.push("--model", this.config.model);
230
323
  if (context?.mcp?.enableTargetTools && context.target && context.scanId) {
231
324
  args.push("--mcp-config", buildClaudeMcpConfig(context), "--dangerously-skip-permissions");
232
325
  }
@@ -260,6 +353,8 @@ var ProcessRuntime = class {
260
353
  }
261
354
  case "gemini": {
262
355
  const args = ["-p", prompt, "--output-format", "stream-json"];
356
+ if (this.config.model)
357
+ args.push("--model", this.config.model);
263
358
  return args;
264
359
  }
265
360
  default: