0sec-cli 0.22.1 → 0.23.0

package/chunks/{chunk-IFME676H.js → chunk-UZUELPFW.js}

@@ -3,19 +3,23 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   ProcessRuntime
-} from "./chunk-W6UWZFKL.js";
+} from "./chunk-O6KPVYOI.js";
 import {
   LlmApiRuntime
-} from "./chunk-AV2LG2L7.js";
+} from "./chunk-BF5FIK7H.js";
+import {
+  readCacheUsage
+} from "./chunk-RS4MAN3Q.js";
 
 // packages/core/dist/runtime/cli-native.js
 import { spawn } from "node:child_process";
-var CliNativeRuntime = class {
+var CliNativeRuntime = class _CliNativeRuntime {
   type;
   config;
   command;
   /** Populated from the first turn's stream-json `system` event. */
   sessionId;
+  observedModel;
   constructor(config) {
     if (config.type === "api") {
       throw new Error("CliNativeRuntime does not support type=api. Use LlmApiRuntime instead.");
@@ -31,6 +35,18 @@ var CliNativeRuntime = class {
   resetSession() {
     this.sessionId = void 0;
   }
+  resolvedModel() {
+    return this.observedModel ?? this.config.model ?? "unknown";
+  }
+  async forkForSubagent(timeout, selection) {
+    const pin = selection?.role && Object.hasOwn(this.config.agentModels ?? {}, selection.role) ? this.config.agentModels?.[selection.role] : void 0;
+    const parentModel = this.observedModel ?? this.config.model;
+    const model = this.config.singleModel ? parentModel : selection?.model ?? (pin && pin !== "auto" ? pin : parentModel);
+    if (model !== parentModel && !Object.values(this.config.agentModels ?? {}).some((approved) => approved !== "auto" && approved === model)) {
+      throw new Error(`Model '${model}' was not approved for this CLI runtime.`);
+    }
+    return new _CliNativeRuntime({ ...this.config, timeout, model });
+  }
   async isAvailable() {
     return new Promise((resolve) => {
       const proc = spawn(this.command, ["--version"], {
@@ -52,8 +68,10 @@ var CliNativeRuntime = class {
       });
     });
   }
-  async executeNative(system, messages, _tools, callbacks) {
+  async executeNative(system, messages, _tools, callbacks, signal) {
     const start = Date.now();
+    if (signal?.aborted)
+      return { content: [], stopReason: "error", durationMs: 0, cancelled: true, error: "CLI execution cancelled." };
     if (this.type !== "claude") {
       return {
         content: [{ type: "text", text: "" }],
@@ -72,6 +90,8 @@ var CliNativeRuntime = class {
       };
     }
     const args = ["-p", promptText, "--verbose", "--output-format", "stream-json"];
+    if (this.config.model)
+      args.push("--model", this.config.model);
     if (this.sessionId) {
       args.push("--resume", this.sessionId);
     } else if (system && system.trim().length > 0) {
@@ -88,7 +108,8 @@ var CliNativeRuntime = class {
       const proc = spawn(this.command, args, {
         cwd: this.config.cwd ?? process.cwd(),
         env: { ...process.env, ...this.config.env },
-        stdio: ["ignore", "pipe", "pipe"]
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32"
       });
       proc.stdout?.on("data", (chunk) => {
         stdoutBuf += chunk.toString("utf-8");
@@ -127,6 +148,8 @@ var CliNativeRuntime = class {
                 callbacks?.onUsage?.(partial);
             }
           }
+          if (typeof event.message?.model === "string")
+            this.observedModel = event.message.model;
           if (event.type === "result") {
             sawAssistantEnd = true;
             stopReason = mapClaudeStopReason(event.stop_reason ?? event.subtype);
@@ -139,13 +162,38 @@ var CliNativeRuntime = class {
       proc.stderr?.on("data", (chunk) => {
         stderrBuf += chunk.toString("utf-8");
       });
+      let killTimer;
+      const terminate = () => {
+        if (proc.pid && process.platform !== "win32") {
+          try {
+            process.kill(-proc.pid, "SIGTERM");
+          } catch {
+            proc.kill("SIGTERM");
+          }
+        } else
+          proc.kill("SIGTERM");
+        killTimer ??= setTimeout(() => {
+          if (proc.pid && process.platform !== "win32") {
+            try {
+              process.kill(-proc.pid, "SIGKILL");
+            } catch {
+              proc.kill("SIGKILL");
+            }
+          } else
+            proc.kill("SIGKILL");
+        }, 1e3);
+      };
       const timer = setTimeout(() => {
         timedOut = true;
-        proc.kill("SIGTERM");
-        setTimeout(() => proc.kill("SIGKILL"), 5e3).unref();
+        terminate();
       }, this.config.timeout || 6e5);
+      signal?.addEventListener("abort", terminate, { once: true });
+      if (signal?.aborted)
+        terminate();
       proc.on("error", (err) => {
         clearTimeout(timer);
+        clearTimeout(killTimer);
+        signal?.removeEventListener("abort", terminate);
         this.sessionId = void 0;
         resolve({
           content: [{ type: "text", text: "" }],
@@ -156,6 +204,13 @@ var CliNativeRuntime = class {
       });
       proc.on("close", (code) => {
         clearTimeout(timer);
+        clearTimeout(killTimer);
+        signal?.removeEventListener("abort", terminate);
+        if (signal?.aborted) {
+          this.sessionId = void 0;
+          resolve({ content, stopReason: "error", usage, durationMs: Date.now() - start, cancelled: true, error: "CLI execution cancelled." });
+          return;
+        }
         if (timedOut) {
           this.sessionId = void 0;
           resolve({
@@ -257,8 +312,11 @@ function tryParseJson(line) {
 function readUsage(u) {
   const input = num(u.input_tokens) ?? num(u.prompt_tokens);
   const output = num(u.output_tokens) ?? num(u.completion_tokens);
-  if (input === void 0 && output === void 0)
+  if (input === void 0 && output === void 0 && num(u.cache_read_input_tokens) === void 0 && num(u.cache_creation_input_tokens) === void 0)
     return void 0;
+  if (u.input_tokens !== void 0 || u.cache_read_input_tokens !== void 0 || u.cache_creation_input_tokens !== void 0) {
+    return readCacheUsage({ ...u, input_tokens: input ?? 0, output_tokens: output ?? 0 });
+  }
   return { inputTokens: input ?? 0, outputTokens: output ?? 0 };
 }
 function num(v) {
@@ -540,7 +598,7 @@ var OllamaRuntime = class {
     }
   }
   /** Legacy text-in/text-out path. Used by stages that haven't migrated to NativeRuntime. */
-  async execute(prompt, _context) {
+  async execute(prompt, context) {
     const start = Date.now();
     try {
       const body = {
@@ -549,7 +607,7 @@ var OllamaRuntime = class {
         stream: false,
         options: { temperature: this.temperature }
       };
-      const res = await this.postChat(body);
+      const res = await this.postChat(body, context?.signal);
       const usage = readUsage2(res);
       return {
         output: res.message.content,
@@ -569,7 +627,7 @@ var OllamaRuntime = class {
       };
     }
   }
-  async executeNative(system, messages, tools, callbacks) {
+  async executeNative(system, messages, tools, callbacks, signal) {
     const start = Date.now();
     const useStream = this.stream;
     try {
@@ -580,7 +638,7 @@ var OllamaRuntime = class {
         stream: useStream,
         options: { temperature: this.temperature }
       };
-      const aggregate = useStream ? await this.streamChat(body, callbacks) : await this.postChat(body);
+      const aggregate = useStream ? await this.streamChat(body, callbacks, signal) : await this.postChat(body, signal);
       const usage = readUsage2(aggregate);
       if (callbacks?.onUsage && usage)
         callbacks.onUsage(usage);
@@ -609,19 +667,21 @@ var OllamaRuntime = class {
         content: [{ type: "text", text: "" }],
         stopReason: "error",
         durationMs: Date.now() - start,
-        error: msg
+        error: msg,
+        ...signal?.aborted ? { cancelled: true } : {}
       };
     }
   }
-  async postChat(body) {
+  async postChat(body, signal) {
     const ctl = new AbortController();
     const timer = setTimeout(() => ctl.abort(), this.timeout);
     try {
+      signal?.throwIfAborted();
       const res = await this.fetchImpl(`${this.host}/api/chat`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
-        signal: ctl.signal
+        signal: signal ? AbortSignal.any([ctl.signal, signal]) : ctl.signal
       });
       if (!res.ok) {
         const text = await res.text().catch(() => "");
@@ -648,15 +708,16 @@ var OllamaRuntime = class {
    *    the synthetic `OllamaChatResponse` so the rest of `executeNative`
    *    can keep its non-streaming-shape codepath.
    */
-  async streamChat(body, callbacks) {
+  async streamChat(body, callbacks, signal) {
     const ctl = new AbortController();
     const timer = setTimeout(() => ctl.abort(), this.timeout);
     try {
+      signal?.throwIfAborted();
       const res = await this.fetchImpl(`${this.host}/api/chat`, {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: JSON.stringify(body),
-        signal: ctl.signal
+        signal: signal ? AbortSignal.any([ctl.signal, signal]) : ctl.signal
       });
       if (!res.ok) {
         const text = await res.text().catch(() => "");
@@ -806,7 +867,7 @@ function pickRuntimeForStage(stage, availableRuntimes) {
   return first.done ? "claude" : first.value;
 }
 async function detectAvailableRuntimes() {
-  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-N245QIQG.js");
+  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-MJYJ2K5E.js");
   const available = /* @__PURE__ */ new Set();
   const checks = RUNTIME_REGISTRY.map(async (info) => {
     const rt = new ProcessRuntime2({ type: info.type, timeout: 5e3 });

package/chunks/{chunk-TV27OWIW.js → chunk-V2BWXPZP.js}

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  agenticScan
-} from "./chunk-LGCASF2C.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
+import {
+  agenticScan
+} from "./chunk-4HGGNBKK.js";
 import {
   runAgentLoop
-} from "./chunk-5BTJMINS.js";
+} from "./chunk-P7KDN5PK.js";
 import {
   getToolsForRole
-} from "./chunk-HHPWRY2M.js";
+} from "./chunk-EH2WTNY7.js";
 import {
   createRuntime
-} from "./chunk-IFME676H.js";
+} from "./chunk-UZUELPFW.js";
 import {
   osecDB
-} from "./chunk-VWITLWXB.js";
+} from "./chunk-T7ZEVY5G.js";
 import {
   LlmApiRuntime
-} from "./chunk-AV2LG2L7.js";
+} from "./chunk-BF5FIK7H.js";
 
 // packages/cli/src/commands/orchestrate.ts
 import { randomUUID } from "node:crypto";
@@ -483,7 +483,7 @@ async function runFamilyCandidate(candidate, opts) {
   }
 }
 function registerOrchestrateCommand(program) {
-  program.command("orchestrate").description("Run the autonomous verification worker against persisted queued case work").option("--db-path <path>", "Path to SQLite database").option("--limit <n>", "Maximum queued cases to claim per pass", "1").option("--runtime <runtime>", "Runtime override: auto, claude, codex, gemini, api").option("--timeout <ms>", "Request timeout in milliseconds", "30000").option("--api-key <key>", "API key for LLM provider").option("-m, --model <model>", "LLM model to use").option("--watch", "Run as a persistent daemon loop", false).option("--poll-interval <ms>", "Idle poll interval for watch mode", "5000").option("--label <name>", "Operator-facing worker label").action(async (opts) => {
+  program.command("orchestrate").description("Run the verification worker against queued cases").option("--db-path <path>", "Path to SQLite database").option("--limit <n>", "Maximum queued cases to claim per pass", "1").option("--runtime <runtime>", "Runtime override: auto, claude, codex, gemini, api").option("--timeout <ms>", "Request timeout in milliseconds", "30000").option("--api-key <key>", "API key for LLM provider").option("-m, --model <model>", "LLM model to use").option("--watch", "Run as a persistent daemon loop", false).option("--poll-interval <ms>", "Idle poll interval for watch mode", "5000").option("--label <name>", "Operator-facing worker label").action(async (opts) => {
     const workerId = `orchestrator:${randomUUID()}`;
     const label = opts.label?.trim() || `${hostname()}:${process.pid}`;
     const limit = Math.max(1, parseInt(opts.limit ?? "1", 10));

package/chunks/chunk-VDOWARMJ.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+
+// packages/cli/src/herdr-state.ts
+var sink = null;
+function setHerdrSink(next) {
+  sink = next;
+}
+function reportOperatorGate(blocked) {
+  if (!sink) return;
+  try {
+    if (blocked) sink.reportBlocked();
+    else sink.reportWorking();
+  } catch {
+  }
+}
+function withSink(fn) {
+  if (!sink) return;
+  try {
+    fn(sink);
+  } catch {
+  }
+}
+function reportHerdrModel(model, provider) {
+  withSink((s) => s.setModel(model, provider));
+}
+function reportHerdrContextPercent(percent) {
+  withSink((s) => s.setContextPercent(percent));
+}
+function reportHerdrTarget(target) {
+  withSink((s) => s.setTarget(target));
+}
+function reportHerdrObjective(objective) {
+  withSink((s) => s.setObjective(objective));
+}
+function reportHerdrActivity(activity) {
+  withSink((s) => s.setActivity(activity));
+}
+function reportHerdrCompaction() {
+  withSink((s) => s.reportCompacting());
+}
+function reportHerdrSession(ref) {
+  withSink((s) => s.reportSession(ref));
+}
+function reportHerdrSessionClose() {
+  withSink((s) => {
+    void s.release();
+  });
+}
+
+export {
+  setHerdrSink,
+  reportOperatorGate,
+  reportHerdrModel,
+  reportHerdrContextPercent,
+  reportHerdrTarget,
+  reportHerdrObjective,
+  reportHerdrActivity,
+  reportHerdrCompaction,
+  reportHerdrSession,
+  reportHerdrSessionClose
+};

package/chunks/{chunk-XDKB2P5X.js → chunk-W5VNCB57.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/cve/artifact-scraper.js
 import { createHash } from "node:crypto";

package/chunks/{chunk-4G7OVYJX.js → chunk-WIYNYNL2.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-AV2LG2L7.js";
+} from "./chunk-BF5FIK7H.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";