0sec-cli 0.23.0 → 0.24.0

package/chunks/chunk-GNR3APR6.js

@@ -0,0 +1,295 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  presentationEventBus
+} from "./chunk-FEOPHBMY.js";
+import {
+  createPresentationEvent
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/presentation/process-output.ts
+import { format } from "node:util";
+var streamBridgeSuppressionDepth = 0;
+var activeStreamBridge = null;
+function currentPresentationTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function createProcessPresentationOutput(options = {}) {
+  const stdout = options.stdout ?? { write: process.stdout.write.bind(process.stdout) };
+  const stderr = options.stderr ?? { write: process.stderr.write.bind(process.stderr) };
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const write = (channel, target, text, eventType) => {
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      target.write(text);
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    options.onEvent?.(event);
+    return event;
+  };
+  return {
+    stdout(text, eventType = "output.stdout") {
+      return write("stdout", stdout, text, eventType);
+    },
+    stderr(text, eventType = "output.stderr") {
+      return write("stderr", stderr, text, eventType);
+    }
+  };
+}
+function createConsolePresentationOutput(options = {}) {
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const emit = (channel, text, eventType) => {
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      if (channel === "stdout") {
+        (options.log ?? console.log)(text);
+      } else {
+        (options.error ?? console.error)(text);
+      }
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    options.onEvent?.(event);
+    return event;
+  };
+  return {
+    stdout(text, eventType = "output.stdout") {
+      return emit("stdout", text, eventType);
+    },
+    stderr(text, eventType = "output.stderr") {
+      return emit("stderr", text, eventType);
+    }
+  };
+}
+var consolePresentationOutput = createConsolePresentationOutput({
+  onEvent(event) {
+    presentationEventBus.emit(event);
+  }
+});
+function installConsolePresentationBridge(options = {}) {
+  const target = options.target ?? console;
+  const originals = {
+    log: target.log,
+    info: target.info,
+    warn: target.warn,
+    error: target.error
+  };
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const emit = (method, channel, args, eventType) => {
+    const text = format(...args);
+    if (streamBridgeSuppressionDepth > 0) {
+      originals[method].call(target, text);
+      return;
+    }
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      originals[method].call(target, text);
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    presentationEventBus.emit(event);
+    options.onEvent?.(event);
+  };
+  const bridgedLog = (...args) => emit("log", "stdout", args, "output.console.log");
+  const bridgedInfo = (...args) => emit("info", "stdout", args, "output.console.info");
+  const bridgedWarn = (...args) => emit("warn", "stderr", args, "output.console.warn");
+  const bridgedError = (...args) => emit("error", "stderr", args, "output.console.error");
+  target.log = bridgedLog;
+  target.info = bridgedInfo;
+  target.warn = bridgedWarn;
+  target.error = bridgedError;
+  return {
+    restore() {
+      if (target.log === bridgedLog) target.log = originals.log;
+      if (target.info === bridgedInfo) target.info = originals.info;
+      if (target.warn === bridgedWarn) target.warn = originals.warn;
+      if (target.error === bridgedError) target.error = originals.error;
+    }
+  };
+}
+function installProcessPresentationStreamBridge(options = {}) {
+  if (activeStreamBridge) return activeStreamBridge;
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  let suspended = false;
+  const streams = [];
+  const emit = (channel, chunk, encoding) => {
+    const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? Buffer.from(chunk).toString(typeof encoding === "string" ? encoding : "utf8") : String(chunk ?? "");
+    if (channel === "stdout" && text.startsWith("ZERO_EVENT_")) return;
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType: channel === "stdout" ? "output.stream.stdout" : "output.stream.stderr",
+      payload: { channel, text }
+    });
+    presentationEventBus.emit(event);
+    options.onEvent?.(event);
+  };
+  for (const [channel, stream] of [
+    ["stdout", options.stdout ?? process.stdout],
+    ["stderr", options.stderr ?? process.stderr]
+  ]) {
+    const original = stream.write;
+    const patched = ((chunk, encoding, callback) => {
+      const result = original.call(stream, chunk, encoding, callback);
+      if (!suspended && streamBridgeSuppressionDepth === 0) emit(channel, chunk, encoding);
+      return result;
+    });
+    streams.push({ channel, stream, original, patched });
+  }
+  const bridge = {
+    suspend() {
+      if (suspended) return;
+      suspended = true;
+      for (const item of streams) {
+        if (item.stream.write === item.patched) item.stream.write = item.original;
+      }
+    },
+    resume() {
+      if (!suspended) return;
+      suspended = false;
+      for (const item of streams) {
+        if (item.stream.write === item.original) item.stream.write = item.patched;
+      }
+    },
+    restore() {
+      for (const item of streams) {
+        if (item.stream.write === item.patched) item.stream.write = item.original;
+      }
+      if (activeStreamBridge === bridge) activeStreamBridge = null;
+    }
+  };
+  for (const item of streams) item.stream.write = item.patched;
+  activeStreamBridge = bridge;
+  return bridge;
+}
+function suspendProcessPresentationStreamBridge() {
+  activeStreamBridge?.suspend();
+}
+function resumeProcessPresentationStreamBridge() {
+  activeStreamBridge?.resume();
+}
+var processPresentationOutput = createProcessPresentationOutput({
+  onEvent(event) {
+    presentationEventBus.emit(event);
+  }
+});
+function writePresentationLine(text, eventType = "output.stdout") {
+  return processPresentationOutput.stdout(`${text}
+`, eventType);
+}
+
+// packages/cli/src/tui/animations.ts
+var UI_ANIMATION_INTERVAL_MS = 70;
+function clamp(x, lo, hi) {
+  if (!Number.isFinite(x)) return lo;
+  return x < lo ? lo : x > hi ? hi : x;
+}
+function clamp01(x) {
+  return clamp(x, 0, 1);
+}
+function smoothstep(t) {
+  const x = clamp01(t);
+  return x * x * (3 - 2 * x);
+}
+function safeFrame(frame) {
+  if (!Number.isFinite(frame)) return 0;
+  const t = Math.trunc(frame);
+  return t < 0 ? 0 : t;
+}
+var SPINNER_PERIOD = 8;
+var TOAST_ENTER_FRAMES = 6;
+var TOAST_HOLD_FRAMES = 28;
+var TOAST_EXIT_FRAMES = 6;
+var TOAST_TOTAL_FRAMES = TOAST_ENTER_FRAMES + TOAST_HOLD_FRAMES + TOAST_EXIT_FRAMES;
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827"];
+function spinnerFrame(frame, opts = {}) {
+  if (opts.reduceMotion) return 0;
+  return safeFrame(frame) % SPINNER_PERIOD;
+}
+function spinnerGlyph(frame, opts = {}) {
+  return SPINNER_FRAMES[spinnerFrame(frame, opts)] ?? SPINNER_FRAMES[0];
+}
+var SHIMMER_TEXT_TAIL = 5;
+var SHIMMER_TEXT_INTERVAL_MS = 80;
+var SHIMMER_TEXT_REST_GAP = 6;
+function shimmerTail(opts) {
+  const t = opts?.tail;
+  if (t === void 0 || !Number.isFinite(t)) return SHIMMER_TEXT_TAIL;
+  return Math.max(1, Math.trunc(t));
+}
+function shimmerRestGap(opts) {
+  const g = opts?.restGap;
+  if (g === void 0 || !Number.isFinite(g)) return SHIMMER_TEXT_REST_GAP;
+  return Math.max(0, Math.trunc(g));
+}
+function shimmerLength(length) {
+  if (!Number.isFinite(length)) return 0;
+  const n = Math.trunc(length);
+  return n < 0 ? 0 : n;
+}
+function shimmerText(length, frame, opts) {
+  const len = shimmerLength(length);
+  if (len <= 0) return [];
+  const out = new Array(len).fill(0);
+  if (opts?.reduceMotion) return out;
+  const tail = shimmerTail(opts);
+  const rest = shimmerRestGap(opts);
+  const period = len + 2 * tail + rest;
+  const sweep = len + 2 * tail;
+  const idx = (safeFrame(frame) % period + period) % period;
+  if (idx >= sweep) return out;
+  const head = idx - tail;
+  for (let offset = -tail; offset <= tail; offset += 1) {
+    const col = head + offset;
+    if (col < 0 || col >= len) continue;
+    const intensity = 1 - smoothstep(Math.abs(offset) / tail);
+    if (intensity > out[col]) out[col] = intensity;
+  }
+  return out;
+}
+
+export {
+  consolePresentationOutput,
+  installConsolePresentationBridge,
+  installProcessPresentationStreamBridge,
+  suspendProcessPresentationStreamBridge,
+  resumeProcessPresentationStreamBridge,
+  processPresentationOutput,
+  writePresentationLine,
+  UI_ANIMATION_INTERVAL_MS,
+  spinnerGlyph,
+  SHIMMER_TEXT_INTERVAL_MS,
+  shimmerText
+};

package/chunks/{chunk-EJH2TNVH.js → chunk-H76JYUPE.js}

@@ -5,13 +5,13 @@ import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-P7KDN5PK.js";
+} from "./chunk-CSPF47S3.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-F344NYUN.js";
+} from "./chunk-DNV3ZMPX.js";
 import {
   LlmApiRuntime
-} from "./chunk-BF5FIK7H.js";
+} from "./chunk-EYBMTELO.js";
 import {
   __commonJS,
   __require,

package/chunks/{chunk-WIYNYNL2.js → chunk-HRBOZBMC.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-BF5FIK7H.js";
+} from "./chunk-EYBMTELO.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-62ENS6XO.js → chunk-IIBNQTOK.js}

@@ -5,7 +5,7 @@ import {
   buildPlaybookInjection,
   parseSanitizerLog,
   verifyOracleByCategory
-} from "./chunk-Y4HJRUFE.js";
+} from "./chunk-YERUDEXT.js";
 import {
   allowlistedChildEnv
 } from "./chunk-5IBCBQEH.js";
@@ -558,6 +558,7 @@ async function runCLoop(opts, ctx) {
   ctx.log(`[userspace-fuzz] compiling Tier-2 harness: ${compile_command}`);
   const compileRes = await runChild("sh", ["-c", compile_command], sourceRoot, ctx.timeoutMs);
   if (compileRes.signalled || /error:|fatal error:/i.test(compileRes.output)) {
+    ctx.toolingMissing.push("tier2-harness-compile");
     ctx.log(`[userspace-fuzz] Tier-2 harness failed to compile:
 ${compileRes.output.slice(-2e3)}`);
     return finish(crashes, iterations, sourceRoot, ctx, "tier2");
@@ -1317,7 +1318,7 @@ async function adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTu
       oracle: oracleKind
     };
   }
-  if (isOracleInfraError(oracleResult.reason)) {
+  if (oracleResult.inconclusive || isOracleInfraError(oracleResult.reason)) {
     return {
       hasPov: false,
       povArtifact: submitted.artifact || null,

package/chunks/{chunk-UELXHK2Y.js → chunk-IK27KMVV.js}

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  getFindingPriority
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {
@@ -273,6 +276,8 @@ function prForSeverity(severity) {
 }
 function metricsForReachability(tier) {
   switch (tier) {
+    case "unknown":
+      return void 0;
     case "remote-unauth":
       return { av: "N", pr: "N", ui: "N" };
     case "remote-auth":
@@ -295,7 +300,7 @@ function suggestCvss(finding) {
   }
   const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
   const ac = "L";
-  const assessed = finding.impactAssessment ? metricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const assessed = finding.impactAssessment && getFindingPriority(finding).assessed ? metricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
   const av = assessed?.av ?? "N";
   const pr = assessed?.pr ?? prForSeverity(finding.severity);
   const ui = assessed?.ui ?? "N";
@@ -991,6 +996,8 @@ function scoreCvss4Vector(vector) {
 }
 function cvss4MetricsForReachability(tier) {
   switch (tier) {
+    case "unknown":
+      return void 0;
     case "remote-unauth":
       return { AV: "N", AT: "N", PR: "N", UI: "N" };
     case "remote-auth":
@@ -1009,7 +1016,7 @@ function cvss4MetricsForReachability(tier) {
 }
 function suggestCvss4(finding) {
   const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
-  const assessed = finding.impactAssessment ? cvss4MetricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const assessed = finding.impactAssessment && getFindingPriority(finding).assessed ? cvss4MetricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
   const AV = assessed?.AV ?? "N";
   const AT = assessed?.AT ?? "N";
   const pr31 = assessed ? assessed.PR : prForSeverity(finding.severity);
@@ -1348,6 +1355,8 @@ function redactAuthHeaders(text) {
 }
 function reachabilityLabel(tier) {
   switch (tier) {
+    case "unknown":
+      return "not established by the available evidence";
     case "remote-unauth":
       return "remote, unauthenticated \u2014 reachable over the network with no credentials";
     case "remote-auth":
@@ -1366,6 +1375,8 @@ function reachabilityLabel(tier) {
 }
 function weaponizabilityLabel(w) {
   switch (w) {
+    case "unknown":
+      return "attacker gains not established by the available evidence";
     case "rce":
       return "remote code execution";
     case "lpe-to-root":
@@ -1471,7 +1482,7 @@ ${ctx.siblingFix.snippet}
   out.push(`**${severity}** \u2014 ${cvss.vector} (~${cvss.score.toFixed(1)})`, "");
   out.push(`_CVSS source: ${cvssSource}._`, "");
   const impactAssessment = finding.impactAssessment;
-  if (impactAssessment) {
+  if (impactAssessment && getFindingPriority(finding).assessed) {
     out.push("# Impact", "");
     out.push(`**Attacker gains:** ${weaponizabilityLabel(impactAssessment.weaponizability)}`, "");
     out.push(`**Attack prerequisites:** ${reachabilityLabel(impactAssessment.reachability_tier)}`, "");
@@ -1568,7 +1579,7 @@ function buildAffectedLine(finding, ctx) {
 }
 function buildImpactNarrative(finding) {
   const a = finding.impactAssessment;
-  if (!a) {
+  if (!a || !getFindingPriority(finding).assessed) {
     return `This ${finding.category.replace(/-/g, " ")} issue is rated **${severityHeading(finding.severity)}**. ` + finding.description.trim();
   }
   const parts = [];
@@ -1581,7 +1592,7 @@ function buildImpactNarrative(finding) {
 }
 function buildAttackScenario(finding) {
   const a = finding.impactAssessment;
-  if (!a)
+  if (!a || !getFindingPriority(finding).assessed)
     return "";
   return `1. Attacker position: ${reachabilityLabel(a.reachability_tier)}.
 2. Trigger the ${finding.category.replace(/-/g, " ")} condition described above.

package/chunks/{chunk-O6Z4XPOM.js → chunk-J6G73WYF.js}

@@ -8,7 +8,7 @@ import {
   osecDB,
   repairOsecDatabase,
   resetOsecDatabase
-} from "./chunk-T7ZEVY5G.js";
+} from "./chunk-RCHAFSWS.js";
 
 // packages/cli/src/commands/db.ts
 import { randomUUID } from "node:crypto";