0sec-cli 0.22.1 → 0.23.0

package/0.js

@@ -3,77 +3,88 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   Command,
-  launchConfiguredWorkbench,
   runStartupUpdate
-} from "./chunks/chunk-V6GHX34G.js";
+} from "./chunks/chunk-OLSKXTQZ.js";
 import {
-  resolveEngagement,
   setHerdrSink
-} from "./chunks/chunk-6GHSR47F.js";
+} from "./chunks/chunk-VDOWARMJ.js";
 import {
   getSettings,
   installConsolePresentationBridge,
   installProcessPresentationStreamBridge,
   maybeLoadCodexAuth,
   presentationEventBus
-} from "./chunks/chunk-GOEA3NW6.js";
+} from "./chunks/chunk-3P3XXSIJ.js";
 import {
-  createHerdrEventSink,
-  maybeSubscribeOperationalEventSink
-} from "./chunks/chunk-LGCASF2C.js";
-import "./chunks/chunk-XCISCI4T.js";
+  resolveEngagement
+} from "./chunks/chunk-R35KKJA4.js";
 import {
   source_default
 } from "./chunks/chunk-HLFS6WV2.js";
+import {
+  launchConfiguredWorkbench,
+  remoteBackendClientId
+} from "./chunks/chunk-HFDSIHTE.js";
+import {
+  createHerdrEventSink,
+  maybeSubscribeOperationalEventSink
+} from "./chunks/chunk-4HGGNBKK.js";
+import "./chunks/chunk-QMICC5O2.js";
+import "./chunks/chunk-TPUJZ74W.js";
 import "./chunks/chunk-QCUFBVIZ.js";
-import "./chunks/chunk-3E2KALZ5.js";
-import "./chunks/chunk-TM74SSHC.js";
+import "./chunks/chunk-NX4H6L4M.js";
+import "./chunks/chunk-62ENS6XO.js";
 import "./chunks/chunk-2WNCI664.js";
 import "./chunks/chunk-23DG5YKS.js";
 import "./chunks/chunk-DQTNI3KY.js";
-import "./chunks/chunk-7XCKYNLO.js";
-import "./chunks/chunk-ZKQ2I3S2.js";
-import "./chunks/chunk-CPWA6RWE.js";
-import "./chunks/chunk-4G7OVYJX.js";
+import "./chunks/chunk-XORZUR2H.js";
+import "./chunks/chunk-LVGZGG63.js";
+import "./chunks/chunk-3ZNI7F42.js";
+import "./chunks/chunk-WIYNYNL2.js";
 import "./chunks/chunk-AZ7L3HFD.js";
-import "./chunks/chunk-OSBPGWTE.js";
-import "./chunks/chunk-5BTJMINS.js";
-import "./chunks/chunk-HHPWRY2M.js";
+import "./chunks/chunk-EJH2TNVH.js";
+import "./chunks/chunk-P7KDN5PK.js";
+import "./chunks/chunk-EH2WTNY7.js";
 import "./chunks/chunk-K2PWUPUI.js";
-import "./chunks/chunk-YL6YAGLL.js";
-import "./chunks/chunk-2OQOQ2FZ.js";
+import "./chunks/chunk-JEYIWMGL.js";
+import "./chunks/chunk-Y4HJRUFE.js";
 import "./chunks/chunk-UEX7PFSE.js";
-import "./chunks/chunk-NLH4LMWH.js";
-import "./chunks/chunk-WZRVS7SB.js";
-import "./chunks/chunk-XA2O4WXA.js";
-import {
-  analyticsPipeline,
-  configureRunContributionsFromEnvironment,
-  eventBus,
-  presentationEventSink
-} from "./chunks/chunk-OHHCGDJ2.js";
+import "./chunks/chunk-3E54JYS4.js";
+import "./chunks/chunk-F344NYUN.js";
+import "./chunks/chunk-YYS2H33A.js";
+import "./chunks/chunk-AAA4PRWK.js";
 import "./chunks/chunk-SQCBHFWN.js";
 import "./chunks/chunk-GVD6SJGH.js";
-import "./chunks/chunk-IFME676H.js";
-import "./chunks/chunk-W6UWZFKL.js";
+import "./chunks/chunk-UZUELPFW.js";
+import "./chunks/chunk-O6KPVYOI.js";
 import "./chunks/chunk-FHC2B7LN.js";
 import "./chunks/chunk-DKSCN2AB.js";
 import "./chunks/chunk-UFHN6RIU.js";
-import "./chunks/chunk-VWITLWXB.js";
+import "./chunks/chunk-T7ZEVY5G.js";
 import "./chunks/chunk-TO35Y326.js";
 import "./chunks/chunk-IXT64DV5.js";
+import "./chunks/chunk-W5VNCB57.js";
+import "./chunks/chunk-YAEJAZYW.js";
+import "./chunks/chunk-65H3MRBF.js";
+import "./chunks/chunk-CP6HANBE.js";
+import "./chunks/chunk-NJLKFC66.js";
+import "./chunks/chunk-K55B4OH4.js";
+import "./chunks/chunk-BF5FIK7H.js";
+import {
+  analyticsPipeline,
+  configureRunContributionsFromEnvironment
+} from "./chunks/chunk-NI6QYQSK.js";
+import "./chunks/chunk-RS4MAN3Q.js";
 import "./chunks/chunk-UELXHK2Y.js";
-import "./chunks/chunk-XDKB2P5X.js";
-import "./chunks/chunk-V36HVTUL.js";
-import "./chunks/chunk-4VGLO2YS.js";
-import "./chunks/chunk-6YNKRUMC.js";
-import "./chunks/chunk-X7LAEEUW.js";
+import {
+  eventBus,
+  presentationEventSink
+} from "./chunks/chunk-A5QO7N3S.js";
+import "./chunks/chunk-ITES7BCY.js";
 import "./chunks/chunk-5IBCBQEH.js";
-import "./chunks/chunk-WSDDGFA6.js";
-import "./chunks/chunk-AV2LG2L7.js";
 import {
   VERSION
-} from "./chunks/chunk-KAU6NLGP.js";
+} from "./chunks/chunk-LTEE2JWK.js";
 import "./chunks/chunk-VIT5ALXF.js";
 import "./chunks/chunk-VCSFCHAJ.js";
 
@@ -99,7 +110,7 @@ import { fileURLToPath } from "node:url";
 var BYPASS_ENV = "ZERO_ALLOW_STALE_SOURCE_DIST";
 function currentBuildCommit() {
   if (true) {
-    return "d29fd0b05ad8414024f6f030e31a8155c467ef96";
+    return "8f4d9ec0535d64def1bc2c3fc9c917d4ec220cb4";
   }
   return void 0;
 }
@@ -122,6 +133,9 @@ function sameRealPath(a, b) {
   }
 }
 function checkSourceDistFreshness(opts = {}) {
+  if (false) {
+    return { checked: false, stale: false, reason: "standalone-binary" };
+  }
   const env = opts.env ?? process.env;
   if (env[BYPASS_ENV] === "1") {
     return { checked: false, stale: false, reason: "bypassed" };
@@ -193,10 +207,11 @@ try {
 `);
   process.exit(125);
 }
+var isRemoteBackendClient = Boolean(remoteBackendClientId(process.argv.slice(2)));
 var isWorkbenchManagement = process.argv[2] === "workbench" || process.argv[2] === "config";
 installConsolePresentationBridge();
 installProcessPresentationStreamBridge();
-if (!isWorkbenchManagement) maybeLoadCodexAuth();
+if (!isWorkbenchManagement && !isRemoteBackendClient) maybeLoadCodexAuth();
 try {
   getSettings();
 } catch {
@@ -213,9 +228,9 @@ var herdrSink = createHerdrEventSink();
 if (herdrSink) eventBus.subscribe(herdrSink);
 setHerdrSink(herdrSink);
 enforceSourceDistFreshness({ entryUrl: import.meta.url });
-if (!isWorkbenchManagement) await runStartupUpdate(VERSION);
+if (!isWorkbenchManagement && !isRemoteBackendClient) await runStartupUpdate(VERSION);
 async function buildProgram() {
-  const c = await import("./chunks/commands-N6GN5SBF.js");
+  const c = await import("./chunks/commands-PBDAOZKA.js");
   const program = new Command();
   program.name("0").description("Open-source multi-model security research harness").version(VERSION).enablePositionalOptions();
   c.registerScanCommand(program);
@@ -233,6 +248,7 @@ async function buildProgram() {
   c.registerOrchestrateCommand(program);
   c.registerDbCommand(program);
   c.registerMcpServerCommand(program);
+  c.registerWorkflowCommand(program);
   c.registerTriageCommand(program);
   c.registerEvalCommand(program);
   c.registerBenchCommand(program);
@@ -273,13 +289,14 @@ async function buildProgram() {
   c.registerEvolveCommand(program);
   c.registerConfigCommand(program);
   c.registerWorkbenchCommand(program);
+  c.registerReviewChecksCommand(program);
   c.registerHackstoreCommand(program);
   return program;
 }
 async function showInteractiveMenu() {
-  const { isBunRuntime } = await import("./chunks/runtime-XFWJTBUO.js");
+  const { isBunRuntime } = await import("./chunks/runtime-4TAJFVF7.js");
   if (isBunRuntime()) {
-    const { showOpenTuiHome } = await import("./chunks/run-GAFKBCTN.js");
+    const { showOpenTuiHome } = await import("./chunks/run-VH4OIDKF.js");
     await showOpenTuiHome();
     return;
   }
@@ -302,7 +319,7 @@ process.once("beforeExit", () => {
   });
 });
 var userArgs = process.argv.slice(2);
-var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "review", "fix", "audit", "deps", "doctor", "dashboard", "tui", "watch", "orchestrate", "db", "mcp-server", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "workbench", "evolve", "hackstore", "hack", "store", "help"];
+var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "review", "fix", "audit", "deps", "doctor", "dashboard", "web", "tui", "watch", "orchestrate", "db", "mcp-server", "workflow", "runs", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "workbench", "checks", "evolve", "hackstore", "hack", "store", "help"];
 if (userArgs.length === 0) {
   showInteractiveMenu().catch((err) => {
     console.error(source_default.red(err instanceof Error ? err.message : String(err)));

package/README.md

@@ -12,7 +12,7 @@
 </p>
 
 <p align="center">
-  <strong>The open-source, self-evolving, multi-model harness for security research.</strong><br/>
+  <strong>Open-source security workflows in your browser, terminal, or coding agent.</strong><br/>
   <sub>Backed by Y Combinator · The Swiss Applied AI &amp; Cybersecurity Research Lab</sub><br/>
   <a href="https://0.security/">0.security</a> ·
   <a href="https://docs.0.security/">Documentation</a> ·
@@ -21,82 +21,102 @@
 
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-1A1815?style=flat-square&labelColor=1A1815" alt="License: MIT OR Apache-2.0"></a>
-  <a href="https://github.com/0sec-labs/0/releases/latest"><img src="https://img.shields.io/github/v/release/0sec-labs/0?style=flat-square&labelColor=1A1815&color=1A1815" alt="Latest release"></a>
-  <a href="#status"><img src="https://img.shields.io/badge/status-research%20preview-FD802E?style=flat-square&labelColor=1A1815" alt="Status: research preview"></a>
+  <a href="https://github.com/0sec-labs/0/releases/latest">Latest release</a>
+  <a href="#status-and-safety"><img src="https://img.shields.io/badge/status-research%20preview-FD802E?style=flat-square&labelColor=1A1815" alt="Status: research preview"></a>
 </p>
 
 <p align="center">
-  <img src="assets/security-cycle-diagram.webp" alt="Zero studies, finds, fixes, reports, and improves." width="100%">
+  <img src="assets/zero-manifesto-movement.webp" alt="Zero manifesto movement" width="100%">
 </p>
 
-## Security research, in your workspace
-
-0 is an open-source, multi-model harness for investigating software security:
-read code, run tools, investigate findings and review proposed fixes.
-Built by the Swiss Applied AI & Cybersecurity Research Lab, it supports our
-[public disclosures and upstream fixes](https://0.security/research/#disclosures).
-
 ## Get started
 
-Install on Apple Silicon macOS or x64/ARM64 Linux, then open 0:
+Install on Apple Silicon macOS or x64/ARM64 Linux:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash
 export PATH="$HOME/.0/bin:$PATH"
-0
+0 web
 ```
 
+**Browser:** `0 web` · **Terminal:** `0`
 
+Configure a [model provider](https://docs.0.security/api-keys/) before running AI workflows.
 
-## Work locally, extend deliberately
+## Workflows
 
-- Describe an authorized repository and investigation goal in chat, or use
-  `0 review ./authorized-repo` for a source review.
-- Review findings and proposed changes.
-  Follow the [research workflows](https://docs.0.security/research-workflows/)
-  for deeper investigations.
-- Connect your tools through [MCP and integrations](https://docs.0.security/integrations/).
-  Browse `/hackstore`, or [build and locally install an extension](https://docs.0.security/hackstore/).
-  Community plugins run as local processes; review them before enabling.
+Browser, CLI, and MCP share one workflow runner with retained results.
 
-## Why 0?
+| Work | Built-in templates |
+| --- | --- |
+| Assess | Repositories, dependencies, APIs, web configuration, scoped penetration tests, package behavior, smart contracts, native code |
+| Verify | Findings with replay evidence |
+| Fix | Candidates with regression tests |
+| Research | Security research, deep source investigation |
 
-Use the models you want. Bring the tools you need. Make the workflow your own.
-0 brings security investigations and fixes into one terminal workspace, with
-focused agents and an extensible toolchain. The harness is open source and
-runs under your control.
+Start from 12 templates, customize steps, and run manually or with browser triggers and schedules.
+**Template:** starting point · **Workflow:** reusable steps · **Run:** one execution.
 
-## Guides
+```bash
+0 workflow list --templates
+0 workflow run --template security-research \
+  --target /absolute/path/to/repo --workspace /absolute/path/to/repo \
+  --format json > run.json
+0 runs list
+```
 
-- [Quick start and installation](https://docs.0.security/getting-started/)
-- [Models and provider connections](https://docs.0.security/api-keys/)
-- [Console, sessions and agents](https://docs.0.security/console/)
-- [Plugins and Hackstore publishing](https://docs.0.security/hackstore/)
-- [Scope and authorization](https://docs.0.security/scope/)
-- [GitHub Actions](https://docs.0.security/ci/github-action/)
-- [Troubleshooting](https://docs.0.security/troubleshooting/)
+[Workflow guide: inputs, limits, and results](https://docs.0.security/workflow/).
 
-## Status and safety
+<details>
+  <summary>Preview the web app</summary>
 
-This is a **research preview**, not a guarantee of coverage or correctness.
-Review results and generated fixes before applying them. Tool making and
-[evaluated self-improvement](https://docs.0.security/improvement-plane/) are research workflows.
+![Customer API security review in the Zero web app](assets/screenshots/web-chat.jpg)
 
-Only test systems you own or are authorized to assess. The optional
-[scope plugin](https://docs.0.security/scope/) is disabled by default:
-enable it explicitly with `0 plugin enable scope` and configure your boundaries.
-The default console uses YOLO mode; use `0 console --mode standard` for
+![Customer API security workflow in the Zero web app](assets/screenshots/web-workflow.jpg)
 
-## Contributing and license
+</details>
 
-Build and extend the harness with [CONTRIBUTING.md](CONTRIBUTING.md).
-Report security issues through [SECURITY.md](SECURITY.md).
-Licensed under [MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
+## Use 0 from another agent
+
+Use the CLI commands above, or **MCP** to discover templates, create workflows, and manage runs:
+
+```bash
+0 mcp-server --workflows --workspace /absolute/path/to/repo
+```
+
+Local MCP requires an explicitly selected host-local execution profile.
+For a registered remote engine, use `0 mcp-server --workflows --backend production`.
+0's model provider is separate from the connecting agent's session.
 
-## Acknowledgments
+Browser chat's **Connect an external agent** copies a setup prompt.
+See [MCP setup and individual tools](https://docs.0.security/integrations/) or
+[local and remote engines](https://docs.0.security/engine-connections/).
+
+## Plugins
+
+Connect GitHub, Elastic, Semgrep, Snyk, Linear, Jira, Cloudflare, Slack, and Teams
+through [plugins and MCP](https://docs.0.security/integrations/).
+
+More guides: [installation](https://docs.0.security/getting-started/) ·
+[GitHub Actions](https://docs.0.security/ci/github-action/) ·
+[plugin development](https://docs.0.security/hackstore/) ·
+[troubleshooting](https://docs.0.security/troubleshooting/).
+
+## Development
+
+Install dependencies, run `npm run dev`, and open the printed browser address.
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Status and safety
+
+**Research preview.** Assess authorized systems and review findings and fixes.
+The terminal defaults to YOLO; use `0 console --mode standard` for confirmations.
+The optional [scope plugin](https://docs.0.security/scope/) enforces target boundaries.
+
+Report vulnerabilities through [SECURITY.md](SECURITY.md).
+Licensed under [MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
 
-Thanks to the teams behind [OpenTUI](https://github.com/anomalyco/opentui),
-[Bun](https://bun.sh/) and [React](https://react.dev/) for the interface stack,
-and [Models.dev](https://models.dev/) and [LiteLLM](https://github.com/BerriAI/litellm)
-for model metadata and pricing estimates. Thank you to everyone contributing
-code, reporting bugs and sharing ideas.
+[Public disclosures and upstream fixes](https://0.security/research/#disclosures).
+Thanks to [OpenTUI](https://github.com/anomalyco/opentui), [Bun](https://bun.sh/),
+[React](https://react.dev/), [Models.dev](https://models.dev/),
+[LiteLLM](https://github.com/BerriAI/litellm), and our contributors.

package/chunks/{adapt-loop-J6QCZZTB.js → adapt-loop-V3JFWOKC.js}

@@ -5,10 +5,10 @@ import {
   adaptAndVerify,
   applyUnifiedDiff,
   renderAdaptationPrompt
-} from "./chunk-CPWA6RWE.js";
-import "./chunk-NLH4LMWH.js";
-import "./chunk-WZRVS7SB.js";
-import "./chunk-KAU6NLGP.js";
+} from "./chunk-3ZNI7F42.js";
+import "./chunk-3E54JYS4.js";
+import "./chunk-F344NYUN.js";
+import "./chunk-LTEE2JWK.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{artifact-scraper-MFKT6OI4.js → artifact-scraper-NYKUF2M5.js}

@@ -14,8 +14,8 @@ import {
   parseUbuntuTracker,
   scoreCodeCandidate,
   scoreRepoCandidate
-} from "./chunk-XDKB2P5X.js";
-import "./chunk-KAU6NLGP.js";
+} from "./chunk-W5VNCB57.js";
+import "./chunk-LTEE2JWK.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{assumption-mining-646LYSJY.js → assumption-mining-ZX3YVWEH.js}

@@ -24,29 +24,33 @@ import {
   scoreDualViewWeaponizability,
   storeAssumptionModel,
   subjectSelfEnforces
-} from "./chunk-OSBPGWTE.js";
+} from "./chunk-EJH2TNVH.js";
 import {
   composeGate,
   makeSkepticVerifier
-} from "./chunk-5BTJMINS.js";
-import "./chunk-HHPWRY2M.js";
+} from "./chunk-P7KDN5PK.js";
+import "./chunk-EH2WTNY7.js";
 import "./chunk-K2PWUPUI.js";
-import "./chunk-YL6YAGLL.js";
-import "./chunk-2OQOQ2FZ.js";
+import "./chunk-JEYIWMGL.js";
+import "./chunk-Y4HJRUFE.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-NLH4LMWH.js";
-import "./chunk-WZRVS7SB.js";
-import "./chunk-OHHCGDJ2.js";
-import "./chunk-IFME676H.js";
-import "./chunk-W6UWZFKL.js";
-import "./chunk-VWITLWXB.js";
+import "./chunk-3E54JYS4.js";
+import "./chunk-F344NYUN.js";
+import "./chunk-AAA4PRWK.js";
+import "./chunk-UZUELPFW.js";
+import "./chunk-O6KPVYOI.js";
+import "./chunk-T7ZEVY5G.js";
 import "./chunk-IXT64DV5.js";
+import "./chunk-65H3MRBF.js";
+import "./chunk-CP6HANBE.js";
+import "./chunk-BF5FIK7H.js";
+import "./chunk-NI6QYQSK.js";
+import "./chunk-RS4MAN3Q.js";
 import "./chunk-UELXHK2Y.js";
-import "./chunk-4VGLO2YS.js";
-import "./chunk-X7LAEEUW.js";
+import "./chunk-A5QO7N3S.js";
+import "./chunk-ITES7BCY.js";
 import "./chunk-5IBCBQEH.js";
-import "./chunk-AV2LG2L7.js";
-import "./chunk-KAU6NLGP.js";
+import "./chunk-LTEE2JWK.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/backend-connections-H52NIVH2.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  BackendConnectionError,
+  BackendConnectionRegistry,
+  backendBearerFromEnv,
+  createBackendHandshake,
+  handleBackendConnectionRequest,
+  loadBackendConnectionConfig
+} from "./chunk-WYNZFNMF.js";
+import "./chunk-T7ZEVY5G.js";
+import "./chunk-LTEE2JWK.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  BackendConnectionError,
+  BackendConnectionRegistry,
+  backendBearerFromEnv,
+  createBackendHandshake,
+  handleBackendConnectionRequest,
+  loadBackendConnectionConfig
+};

package/chunks/{chunk-NLH4LMWH.js → chunk-3E54JYS4.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/agent/journal/types.js
 var JOURNAL_SCHEMA_VERSION = 1;