0sec-cli 0.22.1 → 0.23.0

package/chunks/{chunk-V6GHX34G.js → chunk-OLSKXTQZ.js}

@@ -2,30 +2,11 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
-  FEEDBACK_OPT_OUT_ENV,
-  PROVIDERS,
-  accountEnvPatch,
-  loadAccountStore,
-  loadGlobalSettings,
-  loadLayeredSettings,
-  maybeLoadCodexAuth,
-  normalizeSettings,
-  saveSettings,
-  submissionBlockedReason
-} from "./chunk-GOEA3NW6.js";
-import {
-  runSmolvmWorkbench
-} from "./chunk-LGCASF2C.js";
-import {
-  ANALYTICS_LEVEL_ENV,
-  getSmolvmWorkbenchStatus,
-  isAdmittedSmolvmWorkbench,
-  levelAtLeast,
-  resolveAnalyticsLevel
-} from "./chunk-OHHCGDJ2.js";
+  loadLayeredSettings
+} from "./chunk-HFDSIHTE.js";
 import {
   homeStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-LTEE2JWK.js";
 import {
   __commonJS,
   __require,
@@ -3042,247 +3023,9 @@ var {
   Help
 } = import_index.default;
 
-// packages/cli/src/workbench.ts
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join } from "node:path";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
-var WORKBENCH_INNER_ARGUMENT = "--workbench-inner";
-function workbenchConfigPath(home = process.env.HOME || homedir()) {
-  return join(homeStateDir(home), "workbench.json");
-}
-function defaultWorkbenchStateRoot(home = process.env.HOME || homedir()) {
-  return join(homeStateDir(home), "workbench");
-}
-function positiveInteger(value, maximum) {
-  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= maximum;
-}
-function isPinnedWorkbenchImageReference(value) {
-  return typeof value === "string" && /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/.test(value) && !value.slice(0, value.indexOf("@")).slice(value.lastIndexOf("/") + 1).includes(":");
-}
-function normalizeWorkbenchConfig(raw) {
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("Invalid workbench operator choices.");
-  const config = raw;
-  const approvedImages = [];
-  if (config.approvedImages !== void 0) {
-    if (!Array.isArray(config.approvedImages)) throw new Error("Invalid workbench sandbox image catalog.");
-    const references = /* @__PURE__ */ new Set();
-    for (const rawImage of config.approvedImages) {
-      if (typeof rawImage !== "object" || rawImage === null || Array.isArray(rawImage)) throw new Error("Invalid workbench sandbox image catalog.");
-      const image = rawImage;
-      if (!isPinnedWorkbenchImageReference(image.reference) || typeof image.archive !== "string" || !isAbsolute(image.archive) || typeof image.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(image.digest) || references.has(image.reference)) throw new Error("Sandbox image grants require unique immutable repository@sha256 references and approved local archives.");
-      references.add(image.reference);
-      approvedImages.push({ reference: image.reference, archive: image.archive, digest: image.digest });
-    }
-  }
-  if (config.schemaVersion !== 1 || typeof config.image !== "string" || !isAbsolute(config.image) || typeof config.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(config.imageDigest) || typeof config.stateRoot !== "string" || !isAbsolute(config.stateRoot) || config.workspaceRoot !== void 0 && (typeof config.workspaceRoot !== "string" || !isAbsolute(config.workspaceRoot)) || !Array.isArray(config.providers) || config.providers.some((id) => typeof id !== "string" || !PROVIDERS.some((provider) => provider.id === id)) || typeof config.github !== "boolean" || !positiveInteger(config.cpus, 64) || !positiveInteger(config.memoryMb, 262144) || !positiveInteger(config.storageGb, 1024)) {
-    throw new Error("Invalid workbench operator choices.");
-  }
-  return {
-    schemaVersion: 1,
-    image: config.image,
-    imageDigest: config.imageDigest,
-    stateRoot: config.stateRoot,
-    ...config.workspaceRoot === void 0 ? {} : { workspaceRoot: config.workspaceRoot },
-    providers: [...new Set(config.providers)],
-    github: config.github,
-    cpus: config.cpus,
-    memoryMb: config.memoryMb,
-    storageGb: config.storageGb,
-    ...approvedImages.length ? { approvedImages } : {}
-  };
-}
-function loadWorkbenchConfig(home) {
-  const file = workbenchConfigPath(home);
-  if (!existsSync(file)) return void 0;
-  try {
-    const stat = lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()) {
-      throw new Error("Workbench configuration must be an operator-owned, private regular file (mode 0600).");
-    }
-    return normalizeWorkbenchConfig(JSON.parse(readFileSync(file, "utf8")));
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("Workbench configuration must")) throw error;
-    throw new Error(`Unreadable or invalid workbench configuration at ${file}. Repair the operator choices before setup or launch; no profile fallback is allowed.`);
-  }
-}
-function saveWorkbenchConfig(config, home) {
-  const path = workbenchConfigPath(home);
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  const temporary = `${path}.${process.pid}.tmp`;
-  writeFileSync(temporary, `${JSON.stringify(normalizeWorkbenchConfig(config), null, 2)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-  renameSync(temporary, path);
-  chmodSync(path, 384);
-}
-var PROVIDER_CONFIGURATION = {
-  "chatgpt-codex": ["ZERO_CHATGPT_ACCOUNT_ID", "ZERO_CHATGPT_BASE_URL"],
-  deepseek: ["DEEPSEEK_BASE_URL"],
-  openrouter: ["OPENROUTER_BASE_URL"],
-  azure: ["AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_API_VERSION", "AZURE_OPENAI_DEPLOYMENT", "OPENAI_BASE_URL"],
-  openai: ["OPENAI_BASE_URL"],
-  "z-ai": ["Z_AI_BASE_URL"],
-  kimi: ["KIMI_BASE_URL"],
-  qwen: ["QWEN_BASE_URL"],
-  xai: ["XAI_BASE_URL"],
-  opencode: ["OPENCODE_BASE_URL"],
-  copilot: ["COPILOT_BASE_URL"],
-  google: ["GOOGLE_CLOUD_PROJECT", "ZERO_GEMINI_PROJECT"],
-  anthropic: ["ANTHROPIC_BASE_URL"]
-};
-function selectedWorkbenchEnvironment(config, env, accounts) {
-  const selected = { version: 2, providers: {} };
-  const result = {};
-  for (const id of config.providers) {
-    const provider = PROVIDERS.find((candidate) => candidate.id === id);
-    if (!provider) throw new Error(`Unknown workbench provider grant: ${id}`);
-    const account = accounts.providers[id];
-    if (account) selected.providers[id] = account;
-    for (const name of [...provider.envVars, ...PROVIDER_CONFIGURATION[id] ?? []]) {
-      const value = env[name];
-      if (value?.trim()) result[name] = value;
-    }
-  }
-  Object.assign(result, accountEnvPatch(selected, result));
-  if (config.github) {
-    const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
-    if (token) result.GH_TOKEN = token;
-  }
-  for (const name of ["TERM", "COLORTERM", "NO_COLOR", "LANG", "LC_ALL"]) {
-    const value = env[name];
-    if (value !== void 0) result[name] = value;
-  }
-  return result;
-}
-async function integrationEnvironment(config, home) {
-  const accounts = config.providers.length ? loadAccountStore(home) : { version: 2, providers: {} };
-  const environment = selectedWorkbenchEnvironment(config, process.env, accounts);
-  if (config.providers.includes("chatgpt-codex")) {
-    const codexEnvironment = {
-      ...environment,
-      ZERO_CHATGPT_AUTH_FILE: process.env.ZERO_CHATGPT_AUTH_FILE,
-      ZERO_CODEX_AUTH_JSON_PATH: process.env.ZERO_CODEX_AUTH_JSON_PATH
-    };
-    maybeLoadCodexAuth({ env: codexEnvironment, home });
-    for (const name of ["ZERO_CHATGPT_ACCESS_TOKEN", "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
-      const value = codexEnvironment[name];
-      if (value) environment[name] = value;
-    }
-  }
-  if (config.github && !environment.GH_TOKEN) {
-    try {
-      const { stdout } = await execFileAsync("gh", ["auth", "token"], { encoding: "utf8", timeout: 1e4, maxBuffer: 65536 });
-      if (stdout.trim()) environment.GH_TOKEN = stdout.trim();
-    } catch {
-      throw new Error("GitHub grant is enabled but no token is available. Connect gh on the host or run 0 workbench setup --no-github.");
-    }
-  }
-  return environment;
-}
-function resolveWorkbenchGuestSettings(settings, env = process.env) {
-  const privacy = { [ANALYTICS_LEVEL_ENV]: env[ANALYTICS_LEVEL_ENV] ?? settings.analyticsLevel };
-  for (const name of FEEDBACK_OPT_OUT_ENV) privacy[name] = env[name];
-  const environmentLevel = resolveAnalyticsLevel(privacy);
-  return normalizeSettings({
-    ...settings,
-    executionProfile: "local",
-    updatePolicy: "off",
-    analyticsLevel: levelAtLeast(environmentLevel, settings.analyticsLevel) ? settings.analyticsLevel : environmentLevel,
-    diagnosticReporting: submissionBlockedReason(privacy, { allowCloud: false }) === "opt-out" ? "off" : settings.diagnosticReporting
-  });
-}
-function workbenchNetworkEnabled(env = process.env) {
-  return submissionBlockedReason({ ZERO_OFFLINE: env.ZERO_OFFLINE }, { allowCloud: false }) !== "opt-out";
-}
-async function launchConfiguredWorkbench(args) {
-  const home = process.env.HOME || homedir();
-  if (args[0] === WORKBENCH_INNER_ARGUMENT) {
-    if (process.platform !== "linux" || !isAdmittedSmolvmWorkbench()) {
-      throw new Error("Missing authenticated SmolVM broker admission; refusing internal invocation.");
-    }
-    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    return void 0;
-  }
-  if (process.platform === "linux" && isAdmittedSmolvmWorkbench()) return void 0;
-  if (args[0] === "workbench" || args[0] === "config") return void 0;
-  const hostSettings = loadGlobalSettings(home, { requireExecutionProfile: existsSync(workbenchConfigPath(home)) });
-  if (hostSettings.executionProfile !== "smolvm") return void 0;
-  const config = loadWorkbenchConfig(home);
-  if (!config) throw new Error("SmolVM profile is selected but no workbench is configured. Run 0 workbench setup --image <approved-archive>.");
-  const workspaceRoot = realpathSync(config.workspaceRoot ?? process.cwd());
-  if (!lstatSync(workspaceRoot).isDirectory()) throw new Error("The configured workbench workspace is not a directory.");
-  const status = await getSmolvmWorkbenchStatus({ stateRoot: config.stateRoot, image: config.image });
-  if (status.retainedRuns.length) throw new Error("SmolVM has retained admission from an unproven cleanup. Resolve it before launching another workbench.");
-  if (!status.platformSupported || !status.runtimeReady || !status.imageApproved) {
-    throw new Error(status.error ?? "SmolVM runtime or approved image is unavailable. Run 0 workbench setup; host fallback is refused.");
-  }
-  const environment = await integrationEnvironment(config, home);
-  const network = workbenchNetworkEnabled();
-  if (!network) environment.ZERO_OFFLINE = "1";
-  const guestState = join(config.stateRoot, "guest-state");
-  mkdirSync(guestState, { recursive: true, mode: 448 });
-  if (!lstatSync(guestState).isDirectory() || lstatSync(guestState).isSymbolicLink()) throw new Error("Workbench guest-state must be a real private directory.");
-  const settingsFile = join(guestState, "tui-settings.json");
-  const temporarySettings = `${settingsFile}.${process.pid}.tmp`;
-  writeFileSync(temporarySettings, `${JSON.stringify(resolveWorkbenchGuestSettings(hostSettings), null, 2)}
-`, { mode: 384, flag: "wx" });
-  renameSync(temporarySettings, settingsFile);
-  const controller = new AbortController();
-  let signalCode;
-  const interrupt = () => {
-    signalCode = 130;
-    controller.abort();
-  };
-  const terminate = () => {
-    signalCode = 143;
-    controller.abort();
-  };
-  const hangup = () => {
-    signalCode = 129;
-    controller.abort();
-  };
-  process.once("SIGINT", interrupt);
-  process.once("SIGTERM", terminate);
-  process.once("SIGHUP", hangup);
-  let result;
-  try {
-    result = await runSmolvmWorkbench({
-      image: config.image,
-      workspaceRoot,
-      stateRoot: config.stateRoot,
-      command: ["/usr/local/bin/0", WORKBENCH_INNER_ARGUMENT, ...args],
-      environment,
-      network,
-      tty: !!process.stdin.isTTY && !!process.stdout.isTTY,
-      cpus: config.cpus,
-      memoryMb: config.memoryMb,
-      storageGb: config.storageGb,
-      signal: controller.signal,
-      approvedImages: config.approvedImages ?? []
-    });
-  } finally {
-    process.removeListener("SIGINT", interrupt);
-    process.removeListener("SIGTERM", terminate);
-    process.removeListener("SIGHUP", hangup);
-  }
-  if (result.cleanupFailed) {
-    process.stderr.write("[0] SmolVM cleanup could not be proven. Workbench admission/state is retained; host execution is refused.\n");
-    return 125;
-  }
-  if (result.error) process.stderr.write(`[0] ${result.error}
-`);
-  if (result.timedOut) return 124;
-  return signalCode ?? result.exitCode ?? 125;
-}
-function selectWorkbenchProfile(profile, home) {
-  if (!saveSettings({ ...loadGlobalSettings(home), executionProfile: profile }, home)) throw new Error("Could not persist the operator execution profile.");
-}
-
 // packages/cli/src/utils/update-check.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
 import { spawn } from "node:child_process";
 var REPO = "0sec-labs/0";
 var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
@@ -3337,7 +3080,7 @@ function recent(timestamp, now) {
 }
 function readCache() {
   try {
-    const raw = JSON.parse(readFileSync2(join2(homeStateDir(), "last-update-check"), "utf8"));
+    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
     const value = raw;
     if (typeof value.lastCheckedAt !== "string") return null;
@@ -3353,8 +3096,8 @@ function readCache() {
 }
 function writeCache(cache) {
   try {
-    mkdirSync2(homeStateDir(), { recursive: true });
-    writeFileSync2(join2(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+    mkdirSync(homeStateDir(), { recursive: true });
+    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
   } catch {
   }
 }
@@ -3502,15 +3245,6 @@ export {
   InvalidArgumentError,
   Command,
   Option,
-  workbenchConfigPath,
-  defaultWorkbenchStateRoot,
-  isPinnedWorkbenchImageReference,
-  loadWorkbenchConfig,
-  saveWorkbenchConfig,
-  resolveWorkbenchGuestSettings,
-  workbenchNetworkEnabled,
-  launchConfiguredWorkbench,
-  selectWorkbenchProfile,
   performAutoUpdate,
   runStartupUpdate
 };