0sec-cli 0.22.4 → 0.24.0

package/chunks/{chunk-CPCHLL6A.js → chunk-YJU7QACE.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   scanExecutionTimeout
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-YYOQADBB.js";
 
 // packages/core/dist/shared-analysis.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-YED25PA4.js → chunk-YORL5S5V.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/agent/journal/types.js
 var JOURNAL_SCHEMA_VERSION = 1;

package/chunks/{chunk-YAZARMJY.js → chunk-YYOQADBB.js}

@@ -3,13 +3,14 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-4ZYYX5GY.js";
+} from "./chunk-52AWIBCT.js";
 import {
+  compareFindingsByBusinessPriority,
   estimateCost,
   modelProvider,
   splitCost,
   validateScanPlan
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/agent/cost-ledger.js
 var recordedResults = /* @__PURE__ */ new WeakMap();
@@ -307,7 +308,7 @@ async function executeScanPlan(options) {
     await Promise.all(Array.from({ length: concurrency }, worker));
     const fulfilled = reports.filter((report2) => report2 !== void 0);
     const report = { ...fulfilled[0] ?? options.emptyReport() };
-    report.findings = reports.flatMap((current, index) => current?.findings.map((finding) => ({ ...finding, runIndex: index + 1 })) ?? []);
+    report.findings = reports.flatMap((current, index) => current?.findings.map((finding) => ({ ...finding, runIndex: index + 1 })) ?? []).sort(compareFindingsByBusinessPriority);
     const keys = ["totalAttacks", "totalFindings", "critical", "high", "medium", "low", "info"];
     report.summary = Object.fromEntries(keys.map((key) => [key, fulfilled.reduce((sum, current) => sum + current.summary[key], 0)]));
     const incomplete = attempts.filter((attempt) => attempt.status !== "completed");

package/chunks/chunk-ZPFBQ3SD.js

@@ -0,0 +1,127 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  BackendIdSchema,
+  requireBackendCapability
+} from "./chunk-RZR2XXAK.js";
+import {
+  external_exports
+} from "./chunk-VIT5ALXF.js";
+
+// packages/cli/src/remote-workflow-runtime.ts
+var executionSchema = external_exports.object({ id: external_exports.string().min(1).max(160), status: external_exports.enum(["queued", "running", "completed", "failed", "cancelled", "interrupted"]) }).passthrough();
+async function readJson(response) {
+  const maximum = 16 * 1024 * 1024;
+  const chunks = [];
+  let bytes = 0;
+  if (response.body) {
+    const reader = response.body.getReader();
+    try {
+      while (true) {
+        const next = await reader.read();
+        if (next.done) break;
+        bytes += next.value.byteLength;
+        if (bytes > maximum) throw new Error("Workflow backend response exceeds 16 MiB.");
+        chunks.push(next.value);
+      }
+    } finally {
+      await reader.cancel().catch(() => {
+      });
+      reader.releaseLock();
+    }
+  }
+  let value;
+  try {
+    value = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw new Error(`Workflow backend returned invalid JSON (HTTP ${response.status}).`);
+  }
+  if (!response.ok) {
+    const error = value && typeof value === "object" && "error" in value ? value.error : void 0;
+    throw new Error(typeof error === "string" ? error.slice(0, 4096) : `Workflow backend request failed (HTTP ${response.status}).`);
+  }
+  return value;
+}
+async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
+  if (options.engineUrl && (options.backendId || options.configPath)) throw new Error("--engine-url cannot be combined with a registered backend.");
+  if (Boolean(options.engineUrl) !== Boolean(options.engineTokenEnv)) throw new Error("Direct engine attachment requires both --engine-url and --engine-token-env.");
+  const backendId = BackendIdSchema.parse(options.backendId ?? (options.engineUrl ? "attached-engine" : void 0));
+  const registry = suppliedRegistry ?? new (await import("./backend-connections-QE4NASAK.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
+  try {
+    const connection = await registry.handshake(backendId);
+    if (connection.backend.transport !== "http") throw new Error("Select a registered remote HTTP backend; local execution cannot use this transport.");
+    requireBackendCapability(connection.backend, "workflow-engine");
+  } catch (error) {
+    if (!suppliedRegistry) registry.dispose?.();
+    throw error;
+  }
+  let disposed = false;
+  const active = /* @__PURE__ */ new Set();
+  const invoke = async (name, args = {}) => {
+    if (disposed) throw new Error("Remote workflow client is closed.");
+    const abort = new AbortController();
+    active.add(abort);
+    const timeout = setTimeout(() => abort.abort(new Error("Workflow backend request timed out.")), 3e4);
+    try {
+      return await readJson(await registry.request(backendId, "/api/workflow-engine/call", { method: "POST", body: { name, args }, signal: abort.signal }));
+    } finally {
+      clearTimeout(timeout);
+      active.delete(abort);
+    }
+  };
+  if (options.sessionId !== void 0) {
+    try {
+      external_exports.string().trim().min(1).max(160).parse(options.sessionId);
+      const session = await invoke("attach_session", { sessionId: options.sessionId });
+      if (!session) throw new Error("The selected engine session no longer exists.");
+    } catch (error) {
+      if (!suppliedRegistry) registry.dispose?.();
+      throw error;
+    }
+  }
+  return {
+    getCapabilities: () => invoke("get_capabilities"),
+    resumeScan: (request) => invoke("resume_scan", request),
+    listSessions: () => invoke("list_sessions"),
+    createSession: (config) => invoke("create_session", config ? { config } : {}),
+    attachSession: (sessionId) => invoke("attach_session", { sessionId }),
+    getSessionEvents: (sessionId, after) => invoke("get_session_events", { sessionId, ...after !== void 0 ? { after } : {} }),
+    getSession: (sessionId) => invoke("get_session", { sessionId }),
+    sendMessage: (sessionId, text) => invoke("send_message", { sessionId, text }),
+    continueSession: (sessionId, text) => invoke("continue_session", { sessionId, ...text !== void 0 ? { text } : {} }),
+    cancelSession: (sessionId) => invoke("cancel_session", { sessionId }),
+    resolveDecision: (sessionId, decisionId, response) => invoke("resolve_decision", { sessionId, decisionId, response }),
+    listSavedSessions: () => invoke("list_saved_sessions"),
+    resumeSession: (savedSessionId) => invoke("resume_session", { savedSessionId }),
+    listTemplates: () => invoke("list_templates"),
+    getTemplate: (id) => invoke("get_template", { id }),
+    listWorkflows: () => invoke("list_workflows"),
+    listRuns: () => invoke("list_runs"),
+    getWorkflow: (id) => invoke("get_workflow", { id }),
+    saveWorkflow: (definition, expectedRevision) => invoke("save_workflow", { definition, ...expectedRevision !== void 0 ? { expectedRevision } : {} }),
+    startAssessment: async (request) => executionSchema.parse(await invoke("start_assessment", { ...options.sessionId ? { sessionId: options.sessionId } : {}, ...request })),
+    startRun: async (request) => {
+      if (request.model !== void 0) throw new Error("The selected backend owns its configured model connection.");
+      const { model: _model, ...args } = request;
+      return executionSchema.parse(await invoke("start_run", { ...options.sessionId ? { sessionId: options.sessionId } : {}, ...args }));
+    },
+    getRun: async (id) => {
+      const result = await invoke("get_run", { runId: id });
+      return result === null ? null : executionSchema.parse(result);
+    },
+    getRunResults: (id, page = {}) => invoke("get_run_results", { runId: id, ...page }),
+    cancelRun: (id) => invoke("cancel_run", { runId: id }),
+    dispose: async () => {
+      if (disposed) return;
+      disposed = true;
+      for (const abort of active) abort.abort();
+      active.clear();
+      if (!suppliedRegistry) registry.dispose?.();
+    }
+  };
+}
+
+export {
+  createRemoteWorkflowRuntime
+};

package/chunks/{codex-models-Z43V3427.js → codex-models-FQPCWRPC.js}

@@ -5,15 +5,15 @@ import {
   CodexCatalogRefreshError,
   loadCodexModelCatalog,
   parseCodexModels
-} from "./chunk-G2BE2FC7.js";
-import "./chunk-QVIRWJ45.js";
-import "./chunk-2WWAPKAW.js";
+} from "./chunk-O3ADFN2A.js";
+import "./chunk-EYBMTELO.js";
+import "./chunk-BIJPMYFA.js";
+import "./chunk-52AWIBCT.js";
 import "./chunk-RS4MAN3Q.js";
-import "./chunk-UELXHK2Y.js";
-import "./chunk-4ZYYX5GY.js";
-import "./chunk-C6JPA32H.js";
+import "./chunk-IK27KMVV.js";
+import "./chunk-RBOMXUYL.js";
 import "./chunk-5IBCBQEH.js";
-import "./chunk-6KFB6AYN.js";
+import "./chunk-RZR2XXAK.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {