0sec-cli 0.22.4 → 0.24.0

package/chunks/chunk-SGILXLR3.js

@@ -0,0 +1,289 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  spinnerGlyph
+} from "./chunk-GNR3APR6.js";
+import {
+  loadLayeredSettings
+} from "./chunk-QEA2VHBD.js";
+import {
+  homeStateDir
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/utils/update-check.ts
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+
+// packages/cli/src/utils/terminal-progress.ts
+function terminalProgress(label, output = process.stderr, reduceMotion = false) {
+  const animated = Boolean(output.isTTY && process.env["TERM"] !== "dumb");
+  const started = Date.now();
+  let frame = 0;
+  let stage = label;
+  let finished = false;
+  const clean = (text) => text.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x1f\x7f-\x9f]/g, " ").trim();
+  const paint = () => {
+    const elapsed = Math.floor((Date.now() - started) / 1e3);
+    const line = `${spinnerGlyph(frame++, { reduceMotion })} ${stage} \xB7 ${elapsed}s`;
+    output.write(`\r\x1B[2K${Array.from(line).slice(0, Math.max(12, (output.columns ?? 80) - 1)).join("")}`);
+  };
+  if (animated) paint();
+  else output.write(`${clean(label)}\u2026
+`);
+  const timer = animated && !reduceMotion ? setInterval(paint, 120) : void 0;
+  timer?.unref();
+  return {
+    update(text) {
+      if (finished) return;
+      stage = clean(text) || label;
+      if (animated) paint();
+    },
+    finish(text) {
+      if (finished) return;
+      finished = true;
+      clearInterval(timer);
+      if (animated) output.write("\r\x1B[2K");
+      if (text) output.write(`${clean(text)}
+`);
+    }
+  };
+}
+
+// packages/cli/src/utils/update-check.ts
+var REPO = "0sec-labs/0";
+var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 4e3;
+var INSTALL_TIMEOUT_MS = 12e4;
+function parseVersion(value) {
+  if (value.length > 128) return null;
+  const match = /^v?(0|[1-9]\d*)(?:\.(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?)?(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value);
+  if (!match) return null;
+  const parts = [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)];
+  if (!parts.every(Number.isSafeInteger)) return null;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) return null;
+  return { parts, prerelease, complete: match[3] !== void 0 };
+}
+function compareVersions(a, b) {
+  const left = parseVersion(a);
+  const right = parseVersion(b);
+  if (!left || !right) return 0;
+  for (let i = 0; i < 3; i++) {
+    if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
+  }
+  if (!left.prerelease.length || !right.prerelease.length) {
+    return left.prerelease.length ? -1 : right.prerelease.length ? 1 : 0;
+  }
+  for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+    const l = left.prerelease[i];
+    const r = right.prerelease[i];
+    if (l === void 0) return -1;
+    if (r === void 0) return 1;
+    if (l === r) continue;
+    const ln = /^\d+$/.test(l);
+    const rn = /^\d+$/.test(r);
+    if (ln !== rn) return ln ? -1 : 1;
+    if (ln && l.length !== r.length) return l.length < r.length ? -1 : 1;
+    return l < r ? -1 : 1;
+  }
+  return 0;
+}
+function disabled(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function shouldRunCheck(env = process.env, isTty = Boolean(process.stdout.isTTY), policy) {
+  if (!isTty || disabled(env.CI) || disabled(env["ZERO_OFFLINE"]) || disabled(env["ZERO_NO_UPDATE_CHECK"])) return false;
+  if (policy !== void 0) return policy !== "off";
+  return env["ZERO_UPDATE_CHECK"] === "1";
+}
+function recent(timestamp, now) {
+  const age = now - Date.parse(timestamp ?? "");
+  return Number.isFinite(age) && age >= 0 && age < CHECK_INTERVAL_MS;
+}
+function readCache() {
+  try {
+    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const value = raw;
+    if (typeof value.lastCheckedAt !== "string") return null;
+    return {
+      lastCheckedAt: value.lastCheckedAt,
+      latestVersion: typeof value.latestVersion === "string" ? value.latestVersion : void 0,
+      lastInstallAttemptAt: typeof value.lastInstallAttemptAt === "string" ? value.lastInstallAttemptAt : void 0,
+      lastInstallTag: typeof value.lastInstallTag === "string" ? value.lastInstallTag : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function writeCache(cache) {
+  try {
+    mkdirSync(homeStateDir(), { recursive: true });
+    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+  } catch {
+  }
+}
+async function fetchLatestTag() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "@0/cli/update-check" },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (typeof data.tag_name !== "string" || data.prerelease === true || data.draft === true) return null;
+    const version = parseVersion(data.tag_name);
+    return version?.complete && version.prerelease.length === 0 ? data.tag_name : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var installInProgress = false;
+var attemptedAutomaticTags = /* @__PURE__ */ new Set();
+async function performAutoUpdate(options = {}) {
+  if (process.platform === "win32") return { success: false, installed: false, error: "Automatic installation is unavailable on Windows; download a release from https://github.com/0sec-labs/0/releases/latest." };
+  if (disabled(process.env["ZERO_OFFLINE"]) || disabled(process.env["ZERO_NO_UPDATE_CHECK"])) {
+    return { success: false, installed: false, error: "Updates are disabled by the current offline/update policy." };
+  }
+  if (installInProgress) return { success: false, installed: false, error: "An update is already in progress." };
+  installInProgress = true;
+  try {
+    const tag = options.version ?? await fetchLatestTag();
+    const version = tag ? parseVersion(tag) : null;
+    if (!tag || !version?.complete) return { success: false, installed: false, error: "Could not resolve a valid release tag." };
+    const normalizedTag = tag.startsWith("v") ? tag : `v${tag}`;
+    const env = { ...process.env, RELEASE_BASE_URL: `https://github.com/${REPO}/releases/download/${normalizedTag}` };
+    const installDir = options.installDir ?? process.env["ZERO_INSTALL_DIR"];
+    if (installDir !== void 0) env.INSTALL_DIR = installDir;
+    const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? Math.min(options.timeoutMs, INSTALL_TIMEOUT_MS) : INSTALL_TIMEOUT_MS;
+    return await new Promise((resolve) => {
+      const interactive = Boolean(process.stderr.isTTY && process.env["TERM"] !== "dumb");
+      const progress = interactive ? terminalProgress(`Updating 0 to ${normalizedTag}`, process.stderr, loadLayeredSettings().settings.reduceMotion) : void 0;
+      const child = spawn("bash", ["-o", "pipefail", "-c", `curl -fsSL --connect-timeout 10 --max-time 30 "${INSTALL_URL}" | bash`], {
+        stdio: interactive ? ["inherit", "pipe", "pipe"] : "inherit",
+        env,
+        detached: true
+      });
+      let details = "";
+      let pendingLine = "";
+      const report = (chunk) => {
+        const text = chunk.toString("utf8");
+        details = (details + text).slice(-16384);
+        const lines = (pendingLine + text).split(/[\r\n]/);
+        pendingLine = lines.pop().slice(-2048);
+        const stage = lines.filter((line) => line.trim()).at(-1);
+        if (stage) progress?.update(stage);
+      };
+      child.stdout?.on("data", report);
+      child.stderr?.on("data", report);
+      let timedOut = false;
+      let settled = false;
+      let parentSignal;
+      let killTimer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        progress?.finish(result.success ? `\u2713 Installed ${normalizedTag}` : result.signal ? "Update cancelled." : "Update failed.");
+        if (interactive && details && (!result.success || /0 installer:|Could not update/.test(details))) process.stderr.write(details.endsWith("\n") ? details : `${details}
+`);
+        clearTimeout(timer);
+        clearTimeout(killTimer);
+        process.removeListener("SIGINT", onInterrupt);
+        process.removeListener("SIGTERM", onTerminate);
+        resolve(result);
+      };
+      const terminate = (signal) => {
+        if (child.pid === void 0) return;
+        try {
+          process.kill(-child.pid, signal);
+        } catch {
+        }
+      };
+      const interrupt = (signal) => {
+        if (parentSignal || settled) return;
+        parentSignal = signal;
+        clearTimeout(timer);
+        terminate(signal);
+        clearTimeout(killTimer);
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        }, 1e3);
+      };
+      const onInterrupt = () => interrupt("SIGINT");
+      const onTerminate = () => interrupt("SIGTERM");
+      const timer = setTimeout(() => {
+        timedOut = true;
+        terminate("SIGTERM");
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, exitCode: 1, error: `Installer exceeded its ${timeoutMs}ms deadline.` });
+        }, 1e3);
+      }, timeoutMs);
+      process.on("SIGINT", onInterrupt);
+      process.on("SIGTERM", onTerminate);
+      child.once("error", (error) => finish({ success: false, installed: false, exitCode: 1, error: `Could not start the installer: ${error.message}. Ensure bash and curl are available.` }));
+      child.once("close", (code, signal) => {
+        if (timedOut || parentSignal) return;
+        if (signal) finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        else if (code === 0) finish({ success: true, installed: true, installedVersion: normalizedTag, exitCode: 0 });
+        else finish({ success: false, installed: false, exitCode: code ?? 1, error: `Installer exited with code ${code ?? 1}.` });
+      });
+    });
+  } catch (error) {
+    return { success: false, installed: false, exitCode: 1, error: error instanceof Error ? error.message : "Update failed." };
+  } finally {
+    installInProgress = false;
+  }
+}
+async function maybeNotifyUpdate(currentVersion, options = {}) {
+  const policy = options.policy;
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), policy) || !parseVersion(currentVersion)) return;
+  const now = Date.now();
+  let cache = readCache();
+  if (!cache || !recent(cache.lastCheckedAt, now)) {
+    const tag2 = await fetchLatestTag();
+    cache = { ...cache, lastCheckedAt: new Date(now).toISOString(), latestVersion: tag2 ?? cache?.latestVersion };
+    writeCache(cache);
+  }
+  const tag = cache.latestVersion;
+  const candidate = tag ? parseVersion(tag) : null;
+  if (!tag || !candidate?.complete || candidate.prerelease.length > 0 || compareVersions(tag, currentVersion) <= 0) return;
+  if (policy !== "automatic") {
+    process.stderr.write(`[0] Update available: ${currentVersion} \u2192 ${tag}. Run 0 upgrade.
+`);
+    return;
+  }
+  if (attemptedAutomaticTags.has(tag) || cache.lastInstallTag === tag && recent(cache.lastInstallAttemptAt, now)) return;
+  attemptedAutomaticTags.add(tag);
+  writeCache({ ...cache, lastInstallTag: tag, lastInstallAttemptAt: new Date(now).toISOString() });
+  if (!process.stderr.isTTY || process.env["TERM"] === "dumb") process.stderr.write(`[0] Updating to ${tag} before starting 0\u2026
+`);
+  const result = await performAutoUpdate({ version: tag });
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.stderr.write(result.success ? `[0] Installed ${result.installedVersion}. This process is still ${currentVersion}; restart to use the update.
+` : `[0] Update not installed: ${result.error ?? "unknown error"} Continuing with ${currentVersion}.
+`);
+}
+async function runStartupUpdate(version) {
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), "notify")) return;
+  const { settings, sources } = loadLayeredSettings();
+  const policy = sources.updatePolicy === "global" ? settings.updatePolicy : void 0;
+  if (policy === "automatic") await maybeNotifyUpdate(version, { policy });
+  else if (policy !== "off") void maybeNotifyUpdate(version, { policy });
+}
+
+export {
+  performAutoUpdate,
+  runStartupUpdate
+};

package/chunks/{chunk-E3OOBVOK.js → chunk-TOAAYJVN.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-SCWWLABR.js";
+} from "./chunk-CIMN2AO6.js";
 import {
   scanExecutionSignal
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-YYOQADBB.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {

package/chunks/chunk-TOFIGQ63.js

@@ -0,0 +1,83 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  executeWorkflow
+} from "./chunk-V5I5GAQH.js";
+import {
+  SecurityWorkflowStore
+} from "./chunk-RCHAFSWS.js";
+
+// packages/cli/src/managed-operation.ts
+async function executeManagedOperation(options, dependencies = { store: (path) => new SecurityWorkflowStore(path) }) {
+  const costCapUsd = options.costCapUsd ?? 1e3;
+  const workflow = {
+    id: `cli-${options.type}`,
+    revision: 1,
+    name: options.name,
+    instructions: "",
+    target: options.target,
+    nodes: [
+      { id: "start", type: "trigger", label: "Start", enabled: true },
+      {
+        id: "operation",
+        type: options.type,
+        label: options.name,
+        enabled: true,
+        ...options.type === "fix" ? { fix: { mode: options.fixMode ?? "candidate" } } : {},
+        plan: {
+          goal: "unknown-vulnerabilities",
+          depth: "default",
+          runCount: 1,
+          executionMode: "sequential",
+          timeCapMs: Math.min(options.timeCapMs, 864e5),
+          costCapUsd: Math.min(costCapUsd, 1e3)
+        }
+      }
+    ],
+    edges: [{ source: "start", target: "operation" }]
+  };
+  const store = dependencies.store(options.controlDbPath);
+  let id;
+  let value;
+  let produced = false;
+  let engineStatus = "completed";
+  try {
+    id = store.createExecutionFromSnapshot(workflow, "cli").id;
+    store.updateExecution(id, { status: "running", nodeResults: { start: { status: "completed" }, operation: { status: "running" } } });
+    const result = await executeWorkflow({
+      workflow,
+      inputs: options.inputs,
+      signal: options.signal,
+      timeCapMs: options.timeCapMs,
+      costCapUsd,
+      executors: { [options.type]: async (context) => {
+        value = await options.execute(context);
+        produced = true;
+        engineStatus = options.status?.(value) ?? "completed";
+        return { status: engineStatus, ...options.reports ? { reports: options.reports(value) } : {}, outputs: [{ kind: options.type === "fix" ? "source-fix-result" : options.type === "verify" ? "verification-result" : `${options.type}-result`, value: options.output ? options.output(value) : value }] };
+      } }
+    });
+    const nodeResults = Object.fromEntries(Object.entries(result.nodeResults).map(([nodeId, node]) => [nodeId, { status: node.status, ...node.error ? { error: node.error.slice(0, 16e3) } : {} }]));
+    try {
+      store.saveExecutionResults(id, result);
+    } catch (error) {
+      const message = `Run ${result.status}, but result retention failed: ${error instanceof Error ? error.message : String(error)}`;
+      store.updateExecution(id, { status: result.status, nodeResults, error: message.slice(0, 16e3) });
+      throw new Error(message);
+    }
+    store.updateExecution(id, { status: result.status, nodeResults, ...result.error ? { error: result.error.slice(0, 16e3) } : {} });
+    if (!produced || result.status !== "completed" && engineStatus === "completed") throw new Error(result.error ?? "Operation did not complete.");
+    return value;
+  } catch (error) {
+    const current = id ? store.getExecution(id) : void 0;
+    if (id && (current?.status === "queued" || current?.status === "running")) store.updateExecution(id, { status: "failed", error: (error instanceof Error ? error.message : String(error)).slice(0, 16e3) });
+    throw error;
+  } finally {
+    store.close();
+  }
+}
+
+export {
+  executeManagedOperation
+};

package/chunks/{chunk-QWK4R3DB.js → chunk-TTDFBFNZ.js}

@@ -6,22 +6,22 @@ import {
 } from "./chunk-HLFS6WV2.js";
 import {
   agenticScan
-} from "./chunk-OAS5SAVZ.js";
+} from "./chunk-V5I5GAQH.js";
 import {
   runAgentLoop
-} from "./chunk-H4DH7COV.js";
+} from "./chunk-CSPF47S3.js";
 import {
   getToolsForRole
-} from "./chunk-H6Q2QAIY.js";
+} from "./chunk-A3EKBUEM.js";
 import {
   createRuntime
-} from "./chunk-WBRGXCU2.js";
+} from "./chunk-EXTN4SQV.js";
 import {
   osecDB
-} from "./chunk-L2CCO4KE.js";
+} from "./chunk-RCHAFSWS.js";
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-EYBMTELO.js";
 
 // packages/cli/src/commands/orchestrate.ts
 import { randomUUID } from "node:crypto";