0sec-cli 0.22.4 → 0.23.0

package/chunks/chunk-PIR6BNE7.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  executeWorkflow
+} from "./chunk-4HGGNBKK.js";
+import {
+  SecurityWorkflowStore
+} from "./chunk-T7ZEVY5G.js";
+
+// packages/cli/src/managed-operation.ts
+async function executeManagedOperation(options, dependencies = { store: (path) => new SecurityWorkflowStore(path) }) {
+  const costCapUsd = options.costCapUsd ?? 1e3;
+  const workflow = {
+    id: `cli-${options.type}`,
+    revision: 1,
+    name: options.name,
+    instructions: "",
+    target: options.target,
+    nodes: [
+      { id: "start", type: "trigger", label: "Start", enabled: true },
+      {
+        id: "operation",
+        type: options.type,
+        label: options.name,
+        enabled: true,
+        ...options.type === "fix" ? { fix: { mode: options.fixMode ?? "candidate" } } : {},
+        plan: {
+          goal: "unknown-vulnerabilities",
+          depth: "default",
+          runCount: 1,
+          executionMode: "sequential",
+          timeCapMs: Math.min(options.timeCapMs, 864e5),
+          costCapUsd: Math.min(costCapUsd, 1e3)
+        }
+      }
+    ],
+    edges: [{ source: "start", target: "operation" }]
+  };
+  const store = dependencies.store(options.controlDbPath);
+  let id;
+  let value;
+  let produced = false;
+  let engineStatus = "completed";
+  try {
+    id = store.createExecutionFromSnapshot(workflow, "cli").id;
+    store.updateExecution(id, { status: "running", nodeResults: { start: { status: "completed" }, operation: { status: "running" } } });
+    const result = await executeWorkflow({
+      workflow,
+      inputs: options.inputs,
+      signal: options.signal,
+      timeCapMs: options.timeCapMs,
+      costCapUsd,
+      executors: { [options.type]: async (context) => {
+        value = await options.execute(context);
+        produced = true;
+        engineStatus = options.status?.(value) ?? "completed";
+        return { status: engineStatus, ...options.reports ? { reports: options.reports(value) } : {}, outputs: [{ kind: options.type === "fix" ? "source-fix-result" : options.type === "verify" ? "verification-result" : `${options.type}-result`, value: options.output ? options.output(value) : value }] };
+      } }
+    });
+    const nodeResults = Object.fromEntries(Object.entries(result.nodeResults).map(([nodeId, node]) => [nodeId, { status: node.status, ...node.error ? { error: node.error.slice(0, 16e3) } : {} }]));
+    try {
+      store.saveExecutionResults(id, result);
+    } catch (error) {
+      const message = `Run ${result.status}, but result retention failed: ${error instanceof Error ? error.message : String(error)}`;
+      store.updateExecution(id, { status: result.status, nodeResults, error: message.slice(0, 16e3) });
+      throw new Error(message);
+    }
+    store.updateExecution(id, { status: result.status, nodeResults, ...result.error ? { error: result.error.slice(0, 16e3) } : {} });
+    if (!produced || result.status !== "completed" && engineStatus === "completed") throw new Error(result.error ?? "Operation did not complete.");
+    return value;
+  } catch (error) {
+    const current = id ? store.getExecution(id) : void 0;
+    if (id && (current?.status === "queued" || current?.status === "running")) store.updateExecution(id, { status: "failed", error: (error instanceof Error ? error.message : String(error)).slice(0, 16e3) });
+    throw error;
+  } finally {
+    store.close();
+  }
+}
+
+export {
+  executeManagedOperation
+};

package/chunks/{chunk-E3OOBVOK.js → chunk-QMICC5O2.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-SCWWLABR.js";
+} from "./chunk-JEYIWMGL.js";
 import {
   scanExecutionSignal
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-CP6HANBE.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {

package/chunks/chunk-R35KKJA4.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath
+} from "./chunk-YAEJAZYW.js";
+
+// packages/cli/src/engagement-plan.ts
+var PACKAGE_PREFIXES = {
+  "npm:": { ecosystem: "npm", targetType: "npm-package" },
+  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
+  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
+  "oci:": { ecosystem: "oci", targetType: "oci-image" }
+};
+function resolveEngagement(rawTarget) {
+  const raw = rawTarget.trim();
+  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
+  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
+    if (!raw.startsWith(prefix)) continue;
+    const target = raw.slice(prefix.length).trim();
+    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
+    return {
+      ok: true,
+      plan: {
+        kind: "package",
+        target,
+        targetType: packagePlan.targetType,
+        ecosystem: packagePlan.ecosystem,
+        label: `${packagePlan.ecosystem} package ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("source:")) {
+    const target = raw.slice("source:".length).trim();
+    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: expandHomePath(target),
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: raw,
+        targetType: "source-code",
+        label: `source review ${raw}`
+      }
+    };
+  }
+  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "web",
+        target: raw,
+        targetType: "url",
+        label: `web target ${raw}`
+      }
+    };
+  }
+  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
+    const target = expandHomePath(raw);
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target,
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  return {
+    ok: false,
+    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
+  };
+}
+
+export {
+  resolveEngagement
+};

package/chunks/{chunk-L2CCO4KE.js → chunk-T7ZEVY5G.js}

@@ -5,7 +5,7 @@ import {
   homeStateDir,
   parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -2639,6 +2639,7 @@ var SecurityWorkflowStore = class {
       CREATE TABLE IF NOT EXISTS workflow_executions (id TEXT PRIMARY KEY, workflow_id TEXT NOT NULL, workflow_revision INTEGER NOT NULL, session_id TEXT NOT NULL, status TEXT NOT NULL, execution_json TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL);
       CREATE INDEX IF NOT EXISTS workflow_executions_workflow ON workflow_executions(workflow_id, created_at);
       CREATE INDEX IF NOT EXISTS workflow_executions_session ON workflow_executions(session_id, created_at);`);
+    this.#db.exec("CREATE TABLE IF NOT EXISTS workflow_execution_results (execution_id TEXT PRIMARY KEY, result_json TEXT NOT NULL);");
   }
   list() {
     return this.#db.prepare("SELECT definition_json FROM workflow_definitions ORDER BY updated_at DESC, id").all().map((row) => JSON.parse(String(row.definition_json)));
@@ -2695,10 +2696,34 @@ var SecurityWorkflowStore = class {
       return execution;
     })();
   }
+  /** Execute a pinned template without implicitly saving a reusable definition. */
+  createExecutionFromSnapshot(value, sessionId) {
+    if (!sessionId || sessionId.length > 128)
+      throw new SecurityWorkflowStoreError("Invalid execution owner.", 400);
+    const input = parseSecurityWorkflowInput(value);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const workflow = { ...input, id: input.id ?? randomUUID3(), revision: input.revision ?? 1, createdAt: now, updatedAt: now };
+    const execution = { id: randomUUID3(), workflowId: workflow.id, workflowRevision: workflow.revision, workflow, sessionId, ownerPid: process.pid, runnerInstanceId: this.#runnerInstanceId, status: "queued", nodeResults: {}, createdAt: now, updatedAt: now };
+    this.#db.prepare("INSERT INTO workflow_executions (id, workflow_id, workflow_revision, session_id, status, execution_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)").run(execution.id, execution.workflowId, execution.workflowRevision, sessionId, execution.status, JSON.stringify(execution), now, now);
+    return execution;
+  }
   getExecution(id) {
     const row = this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE id = ?").all(id)[0];
     return row ? JSON.parse(String(row.execution_json)) : null;
   }
+  /** Retain structured evidence independently of process-local job memory. */
+  saveExecutionResults(id, result) {
+    if (!this.getExecution(id))
+      throw new SecurityWorkflowStoreError("Execution not found.", 404);
+    const json = JSON.stringify(result);
+    if (json === void 0 || Buffer.byteLength(json, "utf8") > 16 * 1024 * 1024)
+      throw new SecurityWorkflowStoreError("Workflow results must be valid JSON of at most 16 MiB.", 400);
+    this.#db.prepare("INSERT INTO workflow_execution_results (execution_id, result_json) VALUES (?, ?) ON CONFLICT(execution_id) DO UPDATE SET result_json = excluded.result_json").run(id, json);
+  }
+  getExecutionResults(id) {
+    const row = this.#db.prepare("SELECT result_json FROM workflow_execution_results WHERE execution_id = ?").all(id)[0];
+    return row ? JSON.parse(String(row.result_json)) : null;
+  }
   listExecutions(workflowId, sessionId) {
     return this.#db.prepare("SELECT execution_json FROM workflow_executions WHERE (? IS NULL OR workflow_id = ?) AND (? IS NULL OR session_id = ?) ORDER BY created_at DESC, id LIMIT 200").all(workflowId ?? null, workflowId ?? null, sessionId ?? null, sessionId ?? null).map((row) => JSON.parse(String(row.execution_json)));
   }

package/chunks/{chunk-IXAHQICR.js → chunk-TPUJZ74W.js}

@@ -3,14 +3,18 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   VERSION
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/cli/src/tui/runtime.ts
+function getReleaseChannel(env = process.env) {
+  if (env["ZERO_DEV_SOURCE_ROOT"]?.trim() || env["NODE_ENV"] === "development") return "dev";
+  return true ? "beta" : "dev";
+}
 function getRuntimeMetadata() {
   const bun = isBunRuntime();
   return {
     cliVersion: VERSION,
-    releaseChannel: process.env["ZERO_DEV_SOURCE_ROOT"]?.trim() ? "dev" : "beta",
+    releaseChannel: getReleaseChannel(),
     engine: bun ? "Bun" : "Node.js",
     engineVersion: bun ? process.versions.bun ?? "unknown" : process.version,
     platform: process.platform,
@@ -25,6 +29,7 @@ function canUseOpenTui() {
 }
 
 export {
+  getReleaseChannel,
   getRuntimeMetadata,
   isBunRuntime,
   canUseOpenTui

package/chunks/{chunk-WBRGXCU2.js → chunk-UZUELPFW.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-O6KPVYOI.js";
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-BF5FIK7H.js";
 import {
   readCacheUsage
 } from "./chunk-RS4MAN3Q.js";

package/chunks/{chunk-QWK4R3DB.js → chunk-V2BWXPZP.js}

@@ -6,22 +6,22 @@ import {
 } from "./chunk-HLFS6WV2.js";
 import {
   agenticScan
-} from "./chunk-OAS5SAVZ.js";
+} from "./chunk-4HGGNBKK.js";
 import {
   runAgentLoop
-} from "./chunk-H4DH7COV.js";
+} from "./chunk-P7KDN5PK.js";
 import {
   getToolsForRole
-} from "./chunk-H6Q2QAIY.js";
+} from "./chunk-EH2WTNY7.js";
 import {
   createRuntime
-} from "./chunk-WBRGXCU2.js";
+} from "./chunk-UZUELPFW.js";
 import {
   osecDB
-} from "./chunk-L2CCO4KE.js";
+} from "./chunk-T7ZEVY5G.js";
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-BF5FIK7H.js";
 
 // packages/cli/src/commands/orchestrate.ts
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-3BPX75OR.js → chunk-W5VNCB57.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/cve/artifact-scraper.js
 import { createHash } from "node:crypto";

package/chunks/{chunk-E74LXQFY.js → chunk-WIYNYNL2.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-BF5FIK7H.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";