0sec-cli 0.22.1 → 0.22.4

package/chunks/chunk-YAZARMJY.js

@@ -0,0 +1,355 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  eventBus
+} from "./chunk-4ZYYX5GY.js";
+import {
+  estimateCost,
+  modelProvider,
+  splitCost,
+  validateScanPlan
+} from "./chunk-6KFB6AYN.js";
+
+// packages/core/dist/agent/cost-ledger.js
+var recordedResults = /* @__PURE__ */ new WeakMap();
+function addRuntimeUsage(ledger, result, model) {
+  if (!ledger || recordedResults.get(result) === ledger || !result.usage && !result.usageByModel?.length)
+    return;
+  if (result.usageByModel?.length) {
+    for (const bucket of result.usageByModel)
+      ledger.add(bucket.usage, bucket.model);
+  } else if (result.usage)
+    ledger.add(result.usage, model);
+  recordedResults.set(result, ledger);
+}
+var ScanCostLedger = class _ScanCostLedger {
+  parent;
+  inputTokens = 0;
+  outputTokens = 0;
+  cachedInputTokens = 0;
+  cacheWriteTokens = 0;
+  perModel = /* @__PURE__ */ new Map();
+  listeners = /* @__PURE__ */ new Set();
+  unpricedUsage = false;
+  markUnpricedUsage() {
+    if (this.unpricedUsage)
+      return;
+    this.unpricedUsage = true;
+    this.parent?.markUnpricedUsage();
+    for (const listener of this.listeners)
+      listener();
+  }
+  hasUnpricedUsage() {
+    return this.unpricedUsage;
+  }
+  constructor(parent) {
+    this.parent = parent;
+  }
+  /** Isolated attribution, with the same root budget for every concurrent run. */
+  fork() {
+    return new _ScanCostLedger(this);
+  }
+  onSpend(listener) {
+    const root = this.parent ?? this;
+    if (root !== this)
+      return root.onSpend(listener);
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  /** Spend attributable to this run, not its siblings or earlier attempts. */
+  runCostUsd() {
+    return this.costBreakdown()?.costUsd ?? 0;
+  }
+  /**
+   * Fold one turn's token usage into the cumulative total. `model` (the
+   * session's pricing model) keys the per-model buckets the cost_breakdown
+   * is derived from; sessions without a model pick land in "unknown".
+   */
+  add(usage, model) {
+    this.inputTokens += usage.inputTokens;
+    this.outputTokens += usage.outputTokens;
+    this.cachedInputTokens += usage.cachedInputTokens ?? 0;
+    this.cacheWriteTokens += usage.cacheWriteTokens ?? 0;
+    const key = model ?? "unknown";
+    const bucket = this.perModel.get(key) ?? { inputTokens: 0, outputTokens: 0, cachedInputTokens: 0, cacheWriteTokens: 0 };
+    bucket.inputTokens += usage.inputTokens;
+    bucket.outputTokens += usage.outputTokens;
+    bucket.cachedInputTokens += usage.cachedInputTokens ?? 0;
+    bucket.cacheWriteTokens += usage.cacheWriteTokens ?? 0;
+    this.perModel.set(key, bucket);
+    this.parent?.add(usage, model);
+    for (const listener of this.listeners)
+      listener();
+  }
+  /** Cumulative estimated cost (USD) across every contributing session. */
+  costUsd(model) {
+    return estimateCost({
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      cachedInputTokens: this.cachedInputTokens,
+      cacheWriteTokens: this.cacheWriteTokens
+    }, model);
+  }
+  /** Exact cumulative spend derived from the per-model buckets. */
+  totalCostUsd() {
+    return this.parent?.totalCostUsd() ?? this.runCostUsd();
+  }
+  /** Cumulative usage for the final cloud cost_update event. */
+  tokenUsage() {
+    return {
+      inputTokens: this.inputTokens,
+      outputTokens: this.outputTokens,
+      cachedInputTokens: this.cachedInputTokens,
+      ...this.cacheWriteTokens > 0 ? { cacheWriteTokens: this.cacheWriteTokens } : {}
+    };
+  }
+  /**
+   * The model every contributing session used, when they all agree (and it
+   * is a real model id, not the "unknown" bucket). Undefined for multi-model
+   * runs and for runs whose sessions never named one — the caller then
+   * leaves the model field to its own resolution.
+   */
+  soleModel() {
+    if (this.perModel.size !== 1)
+      return void 0;
+    const [key] = this.perModel.keys();
+    return key === "unknown" ? void 0 : key;
+  }
+  /**
+   * Aggregate the recorded usage into the cloud's per-(provider, model)
+   * cost_breakdown shape — the same aggregation agentic-scanner's
+   * emitScanCompleted applies to its per-stage tally, sourced here from the
+   * true cross-session cumulative. Zero-usage buckets are skipped so the
+   * breakdown stays honest. Returns null when nothing was recorded at all,
+   * so callers omit cost_usd / cost_breakdown rather than emit a
+   * misleading $0.
+   */
+  costBreakdown() {
+    const acc = /* @__PURE__ */ new Map();
+    for (const [model, usage] of this.perModel) {
+      if (usage.inputTokens === 0 && usage.outputTokens === 0 && usage.cachedInputTokens === 0 && usage.cacheWriteTokens === 0) {
+        continue;
+      }
+      const priced = model === "unknown" ? void 0 : model;
+      const provider = modelProvider(priced);
+      const key = `${provider}${model}`;
+      const split = splitCost(usage, priced);
+      const existing = acc.get(key);
+      if (existing) {
+        existing.cost_in += split.cost_in;
+        existing.cost_out += split.cost_out;
+        if (split.cost_cache_read !== void 0) {
+          existing.cost_cache_read = (existing.cost_cache_read ?? 0) + split.cost_cache_read;
+        }
+      } else {
+        acc.set(key, {
+          provider,
+          model,
+          cost_in: split.cost_in,
+          cost_out: split.cost_out,
+          ...split.cost_cache_read !== void 0 ? { cost_cache_read: split.cost_cache_read } : {}
+        });
+      }
+    }
+    if (acc.size === 0)
+      return null;
+    const breakdown = Array.from(acc.values());
+    const costUsd = breakdown.reduce((sum, e) => sum + e.cost_in + e.cost_out + (e.cost_cache_read ?? 0), 0);
+    return { costUsd, breakdown };
+  }
+};
+
+// packages/core/dist/scan-plan.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var executionBudget = new AsyncLocalStorage();
+function scanExecutionSignal() {
+  return executionBudget.getStore()?.signal;
+}
+function scanExecutionTimeout(requestedMs) {
+  const budget = executionBudget.getStore();
+  if (!budget)
+    return requestedMs;
+  budget.signal.throwIfAborted();
+  const remainingMs = budget.deadline - Date.now();
+  if (remainingMs <= 0)
+    throw new ScanBudgetError("time_cap_exceeded", "Scan plan wall-clock limit reached before dispatch.");
+  return Math.min(requestedMs, remainingMs);
+}
+var ScanBudgetError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+    this.name = "ScanBudgetError";
+  }
+};
+function scanGoalPrompt(plan) {
+  if (!plan)
+    return "";
+  const objective = plan.goal === "known-vulnerabilities" ? "Investigate known vulnerabilities: identify exact component versions, match published advisories/CVEs, and reproduce applicability. Prioritize existing advisory and dependency-audit leads; do not spend this run on speculative novel vulnerability hunting." : plan.goal === "misconfigurations" ? "Investigate security misconfigurations: prioritize exposed services/debug features, unsafe defaults, authentication/authorization configuration, secrets, permissions and deployment trust boundaries. Demonstrate the configured exposure rather than claiming hypothetical vulnerabilities." : "Investigate unknown vulnerabilities: prioritize previously unreported logic, authorization, injection and memory-safety flaws. Use known advisories as context, but do not treat a known CVE match alone as completion of this objective.";
+  const depth = plan.depth === "quick" ? "Use a focused quick pass: highest-risk surfaces first, minimal non-destructive probes and one independent reproduction per credible lead." : plan.depth === "default" ? "Use a standard pass: cover the relevant attack surfaces and independently reproduce credible leads before reporting." : "Use a deep pass: trace trust boundaries and adjacent variants, investigate alternate paths and independently reproduce credible leads within the shared limits.";
+  return `
+
+## Operator scan execution policy
+${objective}
+${depth}
+The shared wall-clock and spend limits include discovery, investigation, verification, reporting and all descendants. Preserve partial evidence when a limit interrupts work.
+`;
+}
+function budgetNativeRuntime(runtime, ledger, signal, ceiling, plan) {
+  return {
+    type: runtime.type,
+    outputTokenLimit: runtime.outputTokenLimit,
+    isAvailable: () => runtime.isAvailable(),
+    resolvedModel: runtime.resolvedModel?.bind(runtime),
+    resolvedProvider: runtime.resolvedProvider?.bind(runtime),
+    resolvedPricingModel: runtime.resolvedPricingModel?.bind(runtime),
+    accessibleModels: runtime.accessibleModels?.bind(runtime),
+    reconfigure: runtime.reconfigure?.bind(runtime),
+    forkForSubagent: runtime.forkForSubagent ? async (timeout, selection) => budgetNativeRuntime(await runtime.forkForSubagent(timeout, selection), ledger, signal, ceiling, plan) : void 0,
+    async executeNative(system, messages, tools, callbacks, callSignal) {
+      const effectiveSignal = signal && callSignal ? AbortSignal.any([signal, callSignal]) : signal ?? callSignal;
+      effectiveSignal?.throwIfAborted();
+      if (ceiling !== void 0 && ledger.totalCostUsd() >= ceiling) {
+        throw new ScanBudgetError("cost_ceiling_exceeded", "Shared scan cost ceiling exhausted before model dispatch.");
+      }
+      let reportedUsage;
+      const result = await runtime.executeNative(system + scanGoalPrompt(plan), messages, tools, {
+        ...callbacks,
+        onUsage: (usage) => {
+          reportedUsage = usage;
+          callbacks?.onUsage?.(usage);
+        }
+      }, effectiveSignal);
+      if (!result.usage && reportedUsage)
+        result.usage = reportedUsage;
+      addRuntimeUsage(ledger, result, runtime.resolvedPricingModel?.() ?? runtime.resolvedModel?.());
+      if (plan && !result.usage) {
+        ledger.markUnpricedUsage();
+        throw new ScanBudgetError("failed", "Runtime did not report usage; cannot safely continue a cost-bounded scan plan.");
+      }
+      return result;
+    }
+  };
+}
+async function executeScanPlan(options) {
+  const { plan } = options;
+  validateScanPlan(plan);
+  const ledger = (options.ledger ?? new ScanCostLedger()).fork();
+  const ceiling = Math.min(options.costCeilingUsd ?? plan.costCapUsd, plan.costCapUsd);
+  const startedAt = Date.now();
+  const controller = new AbortController();
+  const signal = options.signal ? AbortSignal.any([controller.signal, options.signal]) : controller.signal;
+  const timer = setTimeout(() => controller.abort(new ScanBudgetError("time_cap_exceeded", "Scan plan wall-clock limit reached.")), plan.timeCapMs);
+  const unsubscribe = ledger.onSpend(() => {
+    if (ledger.hasUnpricedUsage() && !controller.signal.aborted) {
+      controller.abort(new ScanBudgetError("failed", "Runtime did not report usage; plan spend is unknown."));
+    }
+    if (ledger.totalCostUsd() >= ceiling && !controller.signal.aborted) {
+      controller.abort(new ScanBudgetError("cost_ceiling_exceeded", "Scan plan shared cost ceiling reached."));
+    }
+  });
+  const attempts = Array.from({ length: plan.runCount }, (_, index) => ({
+    runIndex: index + 1,
+    status: "rejected",
+    durationMs: 0,
+    costUsd: 0
+  }));
+  const reports = new Array(plan.runCount);
+  let next = 0;
+  const stopStatus = () => {
+    if (ledger.totalCostUsd() >= ceiling)
+      return "cost_ceiling_exceeded";
+    if (ledger.hasUnpricedUsage())
+      return "failed";
+    if (Date.now() - startedAt >= plan.timeCapMs)
+      return "time_cap_exceeded";
+    if (signal.aborted)
+      return signal.reason instanceof ScanBudgetError ? signal.reason.status : "cancelled";
+    return void 0;
+  };
+  const worker = async () => {
+    while (next < plan.runCount) {
+      const index = next++;
+      const attempt = attempts[index];
+      const stopped = stopStatus();
+      if (stopped) {
+        attempt.status = stopped;
+        attempt.error = "Attempt not dispatched: shared scan plan limit or cancellation.";
+        options.onAttempt?.({ runIndex: attempt.runIndex, phase: "settled", outcome: { ...attempt } });
+        continue;
+      }
+      const runLedger = ledger.fork();
+      const runStartedAt = Date.now();
+      const remainingMs = plan.timeCapMs - (runStartedAt - startedAt);
+      options.onAttempt?.({ runIndex: attempt.runIndex, phase: "started" });
+      try {
+        const report = await executionBudget.run({ signal, deadline: startedAt + plan.timeCapMs }, () => options.dispatch({ runIndex: index + 1, plan: { ...plan, runCount: 1, timeCapMs: remainingMs }, ledger: runLedger, signal, costCeilingUsd: ceiling }));
+        reports[index] = report;
+        attempt.status = report.costCeilingExceeded ? "cost_ceiling_exceeded" : report.exitReason === "time_cap_exceeded" ? "time_cap_exceeded" : report.exitReason === "cancelled" ? "cancelled" : report.researchFailed || report.executionSuccessful === false || report.exitReason === "failed" ? "failed" : stopStatus() ?? "completed";
+        if (attempt.status !== "completed")
+          attempt.error = report.error;
+      } catch (error) {
+        attempt.status = error instanceof ScanBudgetError ? error.status : stopStatus() ?? "rejected";
+        attempt.error = error instanceof Error ? error.message : String(error);
+      } finally {
+        attempt.durationMs = Date.now() - runStartedAt;
+        attempt.costUsd = runLedger.hasUnpricedUsage() ? void 0 : runLedger.runCostUsd();
+        options.onAttempt?.({ runIndex: attempt.runIndex, phase: "settled", outcome: { ...attempt } });
+      }
+    }
+  };
+  try {
+    const concurrency = plan.executionMode === "parallel" ? Math.min(3, plan.runCount) : 1;
+    await Promise.all(Array.from({ length: concurrency }, worker));
+    const fulfilled = reports.filter((report2) => report2 !== void 0);
+    const report = { ...fulfilled[0] ?? options.emptyReport() };
+    report.findings = reports.flatMap((current, index) => current?.findings.map((finding) => ({ ...finding, runIndex: index + 1 })) ?? []);
+    const keys = ["totalAttacks", "totalFindings", "critical", "high", "medium", "low", "info"];
+    report.summary = Object.fromEntries(keys.map((key) => [key, fulfilled.reduce((sum, current) => sum + current.summary[key], 0)]));
+    const incomplete = attempts.filter((attempt) => attempt.status !== "completed");
+    report.warnings = [...fulfilled.flatMap((current) => current.warnings), ...incomplete.map((attempt) => ({ stage: "report", message: `Run ${attempt.runIndex}/${plan.runCount}: ${attempt.status}${attempt.error ? ` \u2014 ${attempt.error}` : ""}. Findings are partial.` }))];
+    report.startedAt = new Date(startedAt).toISOString();
+    report.completedAt = (/* @__PURE__ */ new Date()).toISOString();
+    report.durationMs = Date.now() - startedAt;
+    report.plan = plan;
+    report.plannedRuns = plan.runCount;
+    report.completedRuns = attempts.filter((attempt) => attempt.status === "completed").length;
+    report.attempts = attempts;
+    report.estimatedCostUsd = ledger.hasUnpricedUsage() ? void 0 : ledger.runCostUsd();
+    report.usage = ledger.tokenUsage();
+    report.executionSuccessful = incomplete.length === 0;
+    report.costCeilingExceeded = attempts.some((attempt) => attempt.status === "cost_ceiling_exceeded");
+    report.researchFailed = attempts.some((attempt) => attempt.status === "failed" || attempt.status === "rejected");
+    report.error = incomplete.length ? incomplete.find((attempt) => attempt.error)?.error ?? `Scan plan interrupted: ${incomplete[0].status}.` : void 0;
+    report.exitReason = report.costCeilingExceeded ? "cost_ceiling_exceeded" : attempts.some((attempt) => attempt.status === "time_cap_exceeded") ? "time_cap_exceeded" : attempts.some((attempt) => attempt.status === "cancelled") ? "cancelled" : incomplete.length ? "partial" : "completed";
+    if (options.emitTerminalEvent !== false) {
+      const cost = ledger.hasUnpricedUsage() ? null : ledger.costBreakdown();
+      eventBus.emit("scan_completed", {
+        exit_reason: report.costCeilingExceeded ? "cost_exceeded" : incomplete.length ? "failed" : "completed",
+        duration_ms: report.durationMs,
+        findings_count: report.findings.length,
+        summary: `Scan plan ${report.completedRuns}/${plan.runCount} completed; ${report.exitReason}.`,
+        ...cost ? { cost_usd: cost.costUsd, cost_breakdown: cost.breakdown } : {}
+      });
+    }
+    return report;
+  } finally {
+    clearTimeout(timer);
+    unsubscribe();
+  }
+}
+
+export {
+  addRuntimeUsage,
+  ScanCostLedger,
+  scanExecutionSignal,
+  scanExecutionTimeout,
+  ScanBudgetError,
+  scanGoalPrompt,
+  budgetNativeRuntime,
+  executeScanPlan
+};

package/chunks/{chunk-NLH4LMWH.js → chunk-YED25PA4.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-6KFB6AYN.js";
 
 // packages/core/dist/agent/journal/types.js
 var JOURNAL_SCHEMA_VERSION = 1;

package/chunks/{codex-models-NHQW45SO.js → codex-models-Z43V3427.js}

@@ -5,9 +5,15 @@ import {
   CodexCatalogRefreshError,
   loadCodexModelCatalog,
   parseCodexModels
-} from "./chunk-WSDDGFA6.js";
-import "./chunk-AV2LG2L7.js";
-import "./chunk-KAU6NLGP.js";
+} from "./chunk-G2BE2FC7.js";
+import "./chunk-QVIRWJ45.js";
+import "./chunk-2WWAPKAW.js";
+import "./chunk-RS4MAN3Q.js";
+import "./chunk-UELXHK2Y.js";
+import "./chunk-4ZYYX5GY.js";
+import "./chunk-C6JPA32H.js";
+import "./chunk-5IBCBQEH.js";
+import "./chunk-6KFB6AYN.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {