0sec-cli 0.22.1 → 0.22.4

package/chunks/{chunk-XA2O4WXA.js → chunk-6WQDXWQC.js}

@@ -8,10 +8,10 @@ import {
   parsePatch,
   readEvolutionArtifact,
   resolveScopedPath
-} from "./chunk-OHHCGDJ2.js";
+} from "./chunk-CF3MNS3O.js";
 import {
   homeStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-6KFB6AYN.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -19,6 +19,7 @@ import {
 // packages/core/dist/fix/source-fix.js
 import { execFile } from "node:child_process";
 import { mkdtemp, readFile, realpath, rm, writeFile } from "node:fs/promises";
+import { constants, closeSync, fstatSync, fsyncSync, ftruncateSync, lstatSync, openSync, readFileSync, writeSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
@@ -850,6 +851,7 @@ async function runSourceFix(options) {
   try {
     options.signal?.throwIfAborted();
     const candidateWorktree = await createCandidateWorktree(options.repoRoot);
+    options.onProgress?.({ stage: "preparing-candidate" });
     worktree = candidateWorktree;
     const sourceHint = sourcePathHint(options.finding);
     if (!sourceHint) {
@@ -858,8 +860,9 @@ async function runSourceFix(options) {
     const repoRoot = await realpath(options.repoRoot);
     const sourceAbsolutePath = resolveScopedPath(repoRoot, sourceHint);
     const sourceFile = relativeSourcePath(repoRoot, sourceAbsolutePath);
-    const source = await readFile(resolveScopedPath(candidateWorktree.root, sourceFile), "utf8");
-    if (Buffer.byteLength(source) > MAX_SOURCE_BYTES) {
+    const sourceBytes = await readFile(resolveScopedPath(candidateWorktree.root, sourceFile));
+    const source = sourceBytes.toString("utf8");
+    if (sourceBytes.length > MAX_SOURCE_BYTES) {
       return failureResult(options.finding, "precondition_failed", attempts, `source file exceeds ${MAX_SOURCE_BYTES} byte remediation limit`, { sourceFile });
     }
     const precondition = await evaluateVerificationSpec(options.finding.verificationSpec, candidateWorktree.root);
@@ -871,6 +874,7 @@ async function runSourceFix(options) {
     const testTimeoutMs = options.testTimeoutMs ?? 3e5;
     for (let attempt = 1; attempt <= maxAttempts; attempt++) {
       options.signal?.throwIfAborted();
+      options.onProgress?.({ stage: "generating", attempt });
       const response = await options.runtime.executeNative("Generate a narrowly-scoped, testable source fix. Never claim success without using propose_fix.", messages, [proposeFixTool], void 0, options.signal);
       options.signal?.throwIfAborted();
       if (response.cancelled)
@@ -880,6 +884,7 @@ async function runSourceFix(options) {
       if (!proposalResult.proposal) {
         const reason = proposalResult.error ?? "model did not submit a valid propose_fix tool call";
         attempts.push({ attempt, reason });
+        options.onProgress?.({ stage: "attempt-rejected", attempt, reason });
         if (proposalResult.toolUseId) {
           appendToolFeedback(messages, proposalResult.toolUseId, `${reason}. Submit a valid propose_fix payload.`);
         } else {
@@ -896,21 +901,28 @@ async function runSourceFix(options) {
       } catch (error) {
         const reason = `patch rejected: ${errorMessage(error)}`;
         attempts.push({ attempt, reason });
+        options.onProgress?.({ stage: "attempt-rejected", attempt, reason });
         await resetCandidate(candidateWorktree.root);
         appendToolFeedback(messages, proposalResult.toolUseId, `${reason}
 Produce a different minimal patch.`);
         continue;
       }
       const generatedDiff = await git(candidateWorktree.root, ["diff", "--no-ext-diff", "--binary", "HEAD", "--"]);
-      const postcondition = await evaluateVerificationSpec(options.finding.verificationSpec, candidateWorktree.root);
+      options.onProgress?.({ stage: "source-recheck", attempt });
+      let postcondition = await evaluateVerificationSpec(options.finding.verificationSpec, candidateWorktree.root);
+      const generatedSourceTransition = hasSemanticFixSignal(postcondition);
+      options.onProgress?.({ stage: "regression-start", attempt });
       const test = await runTestCommand(testCommand, candidateWorktree.root, testTimeoutMs, options.signal);
+      options.onProgress?.({ stage: "regression-completed", attempt, test });
+      postcondition = await evaluateVerificationSpec(options.finding.verificationSpec, candidateWorktree.root);
       lastCandidate = { sourceFile, precondition, postcondition, test, diff: generatedDiff, patch: proposal.patch, rationale: proposal.rationale };
       options.signal?.throwIfAborted();
       const testedDiff = await git(candidateWorktree.root, ["diff", "--no-ext-diff", "--binary", "HEAD", "--"]);
       const changedByTest = generatedDiff !== testedDiff || !generatedDiff;
-      if (changedByTest || !hasSemanticFixSignal(postcondition) || test.exitCode !== 0 || test.timedOut) {
-        const reason = changedByTest ? "regression command changed the generated source diff, or the patch contains no change" : !hasSemanticFixSignal(postcondition) ? "patch did not produce a valid semantic transition out of the vulnerable-source contract" : test.timedOut ? "post-patch test command timed out" : `post-patch test command exited ${test.exitCode ?? "without an exit code"}`;
+      if (changedByTest || !generatedSourceTransition || !hasSemanticFixSignal(postcondition) || test.exitCode !== 0 || test.timedOut) {
+        const reason = changedByTest ? "regression command changed the generated source diff, or the patch contains no change" : !generatedSourceTransition || !hasSemanticFixSignal(postcondition) ? "patch did not produce a valid semantic transition out of the vulnerable-source contract" : test.timedOut ? "post-patch test command timed out" : `post-patch test command exited ${test.exitCode ?? "without an exit code"}`;
         attempts.push({ attempt, reason });
+        options.onProgress?.({ stage: "attempt-rejected", attempt, reason });
         await resetCandidate(candidateWorktree.root);
         const verificationDetail = postcondition.failedPredicates.map((predicate) => predicate.reason).join("; ").slice(0, 2e3);
         appendToolFeedback(messages, proposalResult.toolUseId, `${reason}. Verification detail: ${verificationDetail || "none"}
@@ -959,7 +971,9 @@ Produce a different minimal patch.`);
             candidate: structuredClone(candidate),
             sourceFile,
             diff: generatedDiff,
-            testCommand
+            testCommand,
+            originalSource: sourceBytes,
+            reviewedSource: await readFile(resolveScopedPath(candidateWorktree.root, sourceFile))
           });
         return result;
       }
@@ -1006,11 +1020,141 @@ Produce a different minimal patch.`);
     }
   }
 }
+async function assertOriginalBaseline(verified) {
+  const root = verified.candidate.repoRoot;
+  if (await git(root, ["rev-parse", "HEAD"]) !== verified.candidate.baseCommit) {
+    throw new Error("original repository HEAD changed after preparation; regenerate the fix");
+  }
+  if (await git(root, ["status", "--porcelain=v1", "--untracked-files=all"])) {
+    throw new Error("original repository contains concurrent changes; refusing source-fix execution");
+  }
+}
+async function assertRetainedCandidate(verified) {
+  const cwd = verified.candidate.worktree;
+  if (await git(cwd, ["rev-parse", "HEAD"]) !== (verified.commit ?? verified.candidate.baseCommit)) {
+    throw new Error("candidate HEAD changed after verification; regenerate the fix");
+  }
+  if (await git(cwd, ["diff", "--no-ext-diff", "--binary", verified.candidate.baseCommit, "--"]) !== verified.diff) {
+    throw new Error("candidate changed after review; regenerate the fix");
+  }
+  if (!(await readFile(resolveScopedPath(cwd, verified.sourceFile))).equals(verified.reviewedSource)) {
+    throw new Error("candidate source bytes differ from the validated source change");
+  }
+  if (verified.commit && await git(cwd, ["status", "--porcelain=v1", "--untracked-files=no"])) {
+    throw new Error("candidate contains concurrent tracked changes; refusing source-fix execution");
+  }
+}
+async function verifySourceFixCandidate(result, options = {}) {
+  const verified = verifiedCandidates.get(result);
+  if (!verified || result.status !== "validated_candidate" || verified.applied) {
+    throw new Error("only an unapplied, retained, process-verified candidate can be re-tested");
+  }
+  verified.verificationFailed = true;
+  try {
+    options.signal?.throwIfAborted();
+    await assertOriginalBaseline(verified);
+    await assertRetainedCandidate(verified);
+    const precondition = await evaluateVerificationSpec(verified.finding.verificationSpec, verified.candidate.repoRoot);
+    if (!precondition.passed)
+      throw new Error("original source no longer reproduces the finding's verified contract");
+    const postcondition = await evaluateVerificationSpec(verified.finding.verificationSpec, verified.candidate.worktree);
+    if (!hasSemanticFixSignal(postcondition))
+      throw new Error("candidate no longer makes a valid semantic transition out of the vulnerable-source contract");
+    const test = await runTestCommand(verified.testCommand, verified.candidate.worktree, options.testTimeoutMs ?? 3e5, options.signal);
+    options.signal?.throwIfAborted();
+    if (test.exitCode !== 0 || test.timedOut) {
+      return { ...result, status: "not_fixed", precondition, postcondition, test, error: "candidate regression command failed" };
+    }
+    await assertRetainedCandidate(verified);
+    await assertOriginalBaseline(verified);
+    const finalPostcondition = await evaluateVerificationSpec(verified.finding.verificationSpec, verified.candidate.worktree);
+    if (!hasSemanticFixSignal(finalPostcondition))
+      throw new Error("candidate source contract changed during the regression command");
+    verified.verificationFailed = false;
+    return { ...result, precondition, postcondition: finalPostcondition, test, error: void 0 };
+  } catch (error) {
+    return { ...result, status: "not_fixed", error: errorMessage(error) };
+  }
+}
+async function applySourceFixCandidate(result, options) {
+  if (options.approval !== "apply-to-repository")
+    throw new Error("explicit repository application approval is required");
+  const verified = verifiedCandidates.get(result);
+  if (!verified || verified.verificationFailed || verified.applied) {
+    throw new Error("candidate is missing, failed its latest verification, or was already applied");
+  }
+  const refreshed = await verifySourceFixCandidate(result, options);
+  if (refreshed.status !== "validated_candidate")
+    throw new Error(refreshed.error ?? "candidate re-verification failed");
+  const source = resolveScopedPath(verified.candidate.repoRoot, verified.sourceFile);
+  const candidateSource = resolveScopedPath(verified.candidate.worktree, verified.sourceFile);
+  const original = await readFile(source);
+  if (!original.equals(verified.originalSource))
+    throw new Error("original source differs from the reviewed baseline");
+  const replacement = await readFile(candidateSource);
+  if (!replacement.equals(verified.reviewedSource))
+    throw new Error("candidate source changed after review");
+  const initial = lstatSync(source);
+  if (!initial.isFile() || initial.isSymbolicLink())
+    throw new Error("reviewed source is no longer a regular file");
+  await assertOriginalBaseline(verified);
+  options.signal?.throwIfAborted();
+  const fd = openSync(source, constants.O_RDWR | constants.O_NOFOLLOW);
+  let applicationError;
+  try {
+    const current = fstatSync(fd);
+    const pathState = lstatSync(source);
+    if (current.ino !== initial.ino || current.dev !== initial.dev || pathState.ino !== current.ino || pathState.dev !== current.dev || current.mtimeMs !== initial.mtimeMs || !readFileSync(fd).equals(original)) {
+      throw new Error("source changed concurrently after review; refusing to overwrite user work");
+    }
+    options.signal?.throwIfAborted();
+    verified.applied = true;
+    verified.verificationFailed = true;
+    let offset = 0;
+    while (offset < replacement.length) {
+      const written = writeSync(fd, replacement, offset, replacement.length - offset, offset);
+      if (written === 0)
+        throw new Error("source write made no progress; repository preserved without rollback");
+      offset += written;
+    }
+    ftruncateSync(fd, replacement.length);
+    fsyncSync(fd);
+  } catch (error) {
+    if (!verified.applied)
+      throw error;
+    applicationError = errorMessage(error);
+  } finally {
+    closeSync(fd);
+  }
+  if (applicationError) {
+    return {
+      ...refreshed,
+      status: "error",
+      applied: true,
+      error: `Source application encountered an error; repository preserved without rollback: ${applicationError}`
+    };
+  }
+  const postcondition = await evaluateVerificationSpec(verified.finding.verificationSpec, verified.candidate.repoRoot);
+  if (!hasSemanticFixSignal(postcondition)) {
+    verified.verificationFailed = true;
+    return {
+      ...refreshed,
+      status: "error",
+      applied: true,
+      postcondition,
+      error: "reviewed source was applied but its re-check failed; repository preserved without rollback"
+    };
+  }
+  verified.verificationFailed = false;
+  return { ...refreshed, status: "applied_and_retested", applied: true, postcondition };
+}
 async function planSourceFixPublication(result, options = {}) {
   const verified = verifiedCandidates.get(result);
   if (!verified || result.status !== "validated_candidate") {
     throw new Error("only a retained, verified source-fix candidate can publish");
   }
+  if (verified.verificationFailed)
+    throw new Error("candidate failed its latest verification; re-verify before publication");
   if (verified.prUrl)
     throw new Error(`draft PR already created: ${verified.prUrl}`);
   if (verified.plan)
@@ -1050,6 +1194,9 @@ async function publishSourceFixDraftPR(result, options) {
     return (await client.run(args, { cwd })).stdout.trim();
   };
   options.signal?.throwIfAborted();
+  await assertRetainedCandidate(verified);
+  if (verified.verificationFailed)
+    throw new Error("candidate failed its latest verification; refusing publication");
   if (await run(["remote", "get-url", "--push", "origin"]) !== plan.remote) {
     throw new Error("origin changed after review; refusing publication");
   }
@@ -1067,6 +1214,7 @@ async function publishSourceFixDraftPR(result, options) {
     throw new Error("published candidate has new tracked changes; refusing publication");
   }
   const spec = verified.finding.verificationSpec;
+  verified.verificationFailed = true;
   const sourceCheck = await evaluateVerificationSpec(spec, cwd);
   if (!hasSemanticFixSignal(sourceCheck))
     throw new Error("candidate no longer passes the source fix re-check");
@@ -1077,6 +1225,10 @@ async function publishSourceFixDraftPR(result, options) {
   if (await run(["diff", "--no-ext-diff", "--binary", verified.candidate.baseCommit, "--"]) !== verified.diff) {
     throw new Error("publication regression command changed the reviewed source diff");
   }
+  const testedSourceCheck = await evaluateVerificationSpec(spec, cwd);
+  if (!hasSemanticFixSignal(testedSourceCheck))
+    throw new Error("candidate source contract changed during publication regression");
+  verified.verificationFailed = false;
   const remoteBase = await run(["ls-remote", "--heads", plan.remote, `refs/heads/${plan.baseBranch}`]);
   if (remoteBase.split(/\s+/)[0] !== verified.candidate.baseCommit) {
     throw new Error("remote base differs from the verified baseline; update the checkout and regenerate the fix");
@@ -1140,7 +1292,7 @@ ${verified.finding.evidence.request}` : "",
 // packages/core/dist/fix/source-fix-inputs.js
 import { execFile as execFile2 } from "node:child_process";
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
-import { closeSync, fsyncSync, openSync, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { closeSync as closeSync2, fsyncSync as fsyncSync2, openSync as openSync2, realpathSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { realpath as realpath2, stat } from "node:fs/promises";
 import { join, resolve as resolve2 } from "node:path";
 import { promisify as promisify2 } from "node:util";
@@ -1180,19 +1332,19 @@ function saveSourceFixProjectInputs(inputs, homeDir) {
   const key = createHash("sha256").update(canonicalRoot).digest("hex");
   const temporary = join(directory, `.inputs-${randomUUID2()}.tmp`);
   try {
-    const fd = openSync(temporary, "wx", 384);
+    const fd = openSync2(temporary, "wx", 384);
     try {
       writeFileSync(fd, JSON.stringify(record));
-      fsyncSync(fd);
+      fsyncSync2(fd);
     } finally {
-      closeSync(fd);
+      closeSync2(fd);
     }
     renameSync(temporary, join(directory, `${key}.json`));
-    const directoryFd = openSync(directory, "r");
+    const directoryFd = openSync2(directory, "r");
     try {
-      fsyncSync(directoryFd);
+      fsyncSync2(directoryFd);
     } finally {
-      closeSync(directoryFd);
+      closeSync2(directoryFd);
     }
   } finally {
     try {
@@ -1220,6 +1372,8 @@ export {
   buildHypothesesMarkdown,
   emitFindingsAsPRs,
   runSourceFix,
+  verifySourceFixCandidate,
+  applySourceFixCandidate,
   planSourceFixPublication,
   publishSourceFixDraftPR,
   resolveSourceFixRepository,