0sec-cli 0.23.0 → 0.24.0

package/chunks/chunk-JSTLXPJS.js

@@ -0,0 +1,284 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  inspectLensRegistry,
+  lastGreen,
+  loadLedger,
+  loadManifest,
+  makeFinderLensProbe,
+  retireArchetype,
+  runLensSynthesisLoop
+} from "./chunk-V5I5GAQH.js";
+import {
+  harvestMissesFromLedgerEntry,
+  mergeHarvestedMisses
+} from "./chunk-A3EKBUEM.js";
+
+// packages/cli/src/commands/lens-synth.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseFixtures(value, label) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
+  return value.map((entry, i) => {
+    if (!isRecord(entry)) throw new Error(`${label}[${i}] must be an object`);
+    const id = entry.id;
+    const path = entry.path;
+    if (typeof id !== "string" || id.trim() === "") throw new Error(`${label}[${i}].id must be a non-empty string`);
+    if (typeof path !== "string" || path.trim() === "") throw new Error(`${label}[${i}].path must be a non-empty string`);
+    const fixture = { id, path };
+    if (typeof entry.note === "string") fixture.note = entry.note;
+    if (typeof entry.expectedCwe === "string") fixture.expectedCwe = entry.expectedCwe;
+    if (typeof entry.expectedFile === "string") fixture.expectedFile = entry.expectedFile;
+    if (typeof entry.expectedLine === "number" && Number.isFinite(entry.expectedLine)) {
+      fixture.expectedLine = entry.expectedLine;
+    }
+    if (Array.isArray(entry.expectedRange) && entry.expectedRange.length === 2 && typeof entry.expectedRange[0] === "number" && typeof entry.expectedRange[1] === "number") {
+      fixture.expectedRange = [entry.expectedRange[0], entry.expectedRange[1]];
+    }
+    if (typeof entry.contentDigest === "string") fixture.contentDigest = entry.contentDigest;
+    if (typeof entry.cleanProvenance === "string") fixture.cleanProvenance = entry.cleanProvenance;
+    return fixture;
+  });
+}
+function parseMissInputFile(raw) {
+  if (!isRecord(raw)) throw new Error("miss-input must be a JSON object");
+  const missesRaw = isRecord(raw.misses) ? raw.misses : {};
+  const corpusRaw = isRecord(raw.corpus) ? raw.corpus : {};
+  const misses = {
+    ...Array.isArray(missesRaw.confirmedMisses) ? { confirmedMisses: missesRaw.confirmedMisses } : {},
+    ...Array.isArray(missesRaw.incompleteCoverage) ? { incompleteCoverage: missesRaw.incompleteCoverage } : {},
+    ...Array.isArray(missesRaw.curatedCandidates) ? { curatedCandidates: missesRaw.curatedCandidates } : {}
+  };
+  const heldOutFixtures = parseFixtures(corpusRaw.heldOut, "corpus.heldOut");
+  const corpus = {
+    positives: parseFixtures(corpusRaw.positives, "corpus.positives"),
+    negativeControls: parseFixtures(corpusRaw.negativeControls, "corpus.negativeControls"),
+    ...heldOutFixtures.length > 0 ? { heldOut: heldOutFixtures } : {},
+    ...typeof corpusRaw.baselineDigest === "string" ? { baselineDigest: corpusRaw.baselineDigest } : {}
+  };
+  if (corpus.positives.length === 0) {
+    throw new Error("corpus.positives must contain at least one fixture (the seeded miss) \u2014 the loop is fail-closed without it");
+  }
+  if (corpus.negativeControls.length === 0) {
+    throw new Error("corpus.negativeControls must contain at least one fixture \u2014 the loop cannot measure FP regression without it");
+  }
+  if (!corpus.heldOut || corpus.heldOut.length === 0) {
+    throw new Error("corpus.heldOut must contain at least one fixture \u2014 held-out positives are required to demonstrate generalisation beyond development misses");
+  }
+  return { misses, corpus };
+}
+async function harvestBenchMisses(fromBench, manifestPath) {
+  const ledger = await loadLedger(resolve(fromBench));
+  const entry = lastGreen(ledger) ?? ledger.entries[ledger.entries.length - 1];
+  if (!entry) throw new Error(`--from-bench: ledger ${fromBench} has no entries to harvest`);
+  const manifest = await loadManifest(resolve(manifestPath));
+  const result = harvestMissesFromLedgerEntry(entry, manifest);
+  return { misses: result.misses, result };
+}
+function trialCount(value) {
+  const count = value ?? 2;
+  if (!Number.isSafeInteger(count) || count < 2 || count > 10) throw new Error("--trials must be an integer between 2 and 10");
+  return count;
+}
+async function runLensSynthesisInput(input, opts, deps = {}) {
+  const trials = trialCount(opts.trials);
+  const log = deps.log ?? (() => {
+  });
+  const probe = deps.probe ?? makeFinderLensProbe({ log });
+  return runLensSynthesisLoop(input, {
+    ...deps.model ? { model: deps.model } : {},
+    ...opts.model ? { modelId: opts.model } : {},
+    probe,
+    ...opts.registry ? { registryPath: resolve(opts.registry) } : {},
+    maxRegistrations: opts.maxRegister ?? 1,
+    dryRun: !opts.promote,
+    trials,
+    ...opts.signal ? { signal: opts.signal } : {},
+    log
+  });
+}
+async function runLensSynthCommand(opts, deps = {}) {
+  const raw = JSON.parse(readFileSync(resolve(opts.missInput), "utf8"));
+  let input = parseMissInputFile(raw);
+  if (opts.fromBench) {
+    if (!opts.manifest) throw new Error("--from-bench requires --manifest");
+    const { misses } = await harvestBenchMisses(opts.fromBench, opts.manifest);
+    input = { ...input, misses: mergeHarvestedMisses(input.misses, misses) };
+    deps.log?.(`[lens-synth] harvested ${misses.length} bench miss(es) from ${opts.fromBench}`);
+  }
+  return runLensSynthesisInput(input, opts, deps);
+}
+async function watchLensSynthCommand(opts, deps = {}) {
+  const inputPath = resolve(opts.missInput);
+  const log = deps.log ?? (() => {
+  });
+  const requestedInterval = opts.pollIntervalMs ?? 2e3;
+  const pollIntervalMs = Number.isFinite(requestedInterval) ? Math.max(100, Math.floor(requestedInterval)) : 2e3;
+  const sleep = deps.sleep ?? ((milliseconds) => new Promise((done) => setTimeout(done, milliseconds)));
+  let previousRevision;
+  while (!deps.signal?.aborted) {
+    try {
+      const bytes = readFileSync(inputPath);
+      const revision = createHash("sha256").update(bytes).digest("hex");
+      if (revision !== previousRevision) {
+        previousRevision = revision;
+        const input = parseMissInputFile(JSON.parse(bytes.toString("utf8")));
+        const result = await runLensSynthesisInput(input, opts, deps);
+        deps.onResult?.(result);
+      }
+    } catch (cause) {
+      const error = cause instanceof Error ? cause : new Error(String(cause));
+      const revision = `error:${error.name}:${error.message}`;
+      if (revision !== previousRevision) {
+        previousRevision = revision;
+        if (deps.onError) deps.onError(error);
+        else log(`[lens-synth] input revision rejected: ${error.message}`);
+      }
+    }
+    if (deps.signal?.aborted) return;
+    const signal = deps.signal;
+    if (!signal) {
+      await sleep(pollIntervalMs);
+      continue;
+    }
+    if (signal.aborted) return;
+    await new Promise((resume) => {
+      const onAbort = () => {
+        signal.removeEventListener("abort", onAbort);
+        resume();
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      void sleep(pollIntervalMs).then(() => {
+        signal.removeEventListener("abort", onAbort);
+        resume();
+      });
+    });
+  }
+}
+function formatLensSynthResult(result, dryRun) {
+  const lines = [
+    `captured ${result.candidatesCaptured} miss candidate(s) \u2192 ${result.clusters} cluster(s) \u2192 ${result.synthesized.length} synthesized`
+  ];
+  for (const validation of result.validations) {
+    lines.push(`  validate ${validation.lensId}: ${validation.passed ? "CHAMPION" : "rejected"} \u2014 ${validation.reason}`);
+  }
+  if (dryRun) {
+    lines.push(`dry-run: ${result.validations.filter((validation) => validation.passed).length} champion(s) would register (nothing written)`);
+  } else {
+    lines.push(
+      result.registered.length > 0 ? `REGISTERED ${result.registered.length} lens(es): ${result.registered.map((registered) => registered.uid).join(", ")}` : "registered 0 lenses"
+    );
+  }
+  for (const rejected of result.rejected) lines.push(`  rejected ${rejected.id}: ${rejected.reason}`);
+  for (const warning of result.warnings) lines.push(`  warning: ${warning}`);
+  return lines.join("\n");
+}
+function formatLensRegistryStatus(status) {
+  const lines = [
+    `registry: ${status.path}`,
+    `state: ${status.valid ? "valid" : "INVALID"}`,
+    `exists: ${status.exists ? "yes" : "no"}`,
+    `active lenses: ${status.activeLensCount}`,
+    `ledger entries: ${status.ledgerEntries}`,
+    `unbound archetypes: ${status.unboundArchetypes}`
+  ];
+  if (status.error) lines.push(`error: ${status.error}`);
+  return lines.join("\n");
+}
+function registerLensSynthCommand(program) {
+  program.command("lens-synth").description("Improve appsec detection coverage from curated missed findings").option("--miss-input <path>", "curated miss-input JSON ({ misses, corpus })").option("--registry <path>", "durable overlay path (default: ~/.0/lenses/appsec-archetypes.json)").option("--max-register <n>", "cap promoted champions per input revision", (value) => Number.parseInt(value, 10)).option("-m, --model <id>", "synthesis model override").option("--promote", "persist a validated champion to the durable overlay", false).option("--trials <n>", "repeated validation trials (2\u201310; default 2)", Number).option("--from-bench <ledger>", "harvest the champion's false-negatives from a benchmark ledger into the curated misses (requires --manifest)").option("--manifest <path>", "bench manifest path (ground-truth vuln class + sink); required with --from-bench").option("--watch", "poll the miss-input and process each new content revision", false).option("--poll-interval <ms>", "watch polling interval (minimum 100ms)", "2000").option("--status", "show the active durable overlay and promotion ledger", false).option("--rollback <lens-id>", "retire one previously promoted overlay lens").option("--json", "print machine-readable output", false).action(async (opts) => {
+    try {
+      const registry = opts.registry ? resolve(opts.registry) : void 0;
+      if (opts.status && opts.rollback) throw new Error("--status and --rollback cannot be combined");
+      if (opts.status) {
+        const status = inspectLensRegistry(registry);
+        process.stdout.write(opts.json ? `${JSON.stringify(status, null, 2)}
+` : `${formatLensRegistryStatus(status)}
+`);
+        if (!status.valid) process.exitCode = 3;
+        return;
+      }
+      if (opts.rollback) {
+        const outcome = retireArchetype(String(opts.rollback), { ...registry ? { registryPath: registry } : {} });
+        process.stdout.write(
+          opts.json ? `${JSON.stringify(outcome, null, 2)}
+` : outcome.retired ? `RETIRED ${outcome.id} from ${outcome.registryPath}
+` : `not retired ${outcome.id}: ${outcome.reason ?? "unknown reason"}
+`
+        );
+        if (!outcome.retired) process.exitCode = 3;
+        return;
+      }
+      if (!opts.missInput) throw new Error("--miss-input is required unless --status or --rollback is used");
+      if (opts.maxRegister !== void 0 && (!Number.isInteger(opts.maxRegister) || opts.maxRegister < 0)) {
+        throw new Error("--max-register must be a non-negative integer");
+      }
+      if (opts.fromBench && !opts.manifest) throw new Error("--from-bench requires --manifest");
+      if (opts.fromBench && opts.watch) throw new Error("--from-bench cannot be combined with --watch");
+      const pollIntervalMs = Number.parseInt(opts.pollInterval ?? "2000", 10);
+      if (!Number.isInteger(pollIntervalMs) || pollIntervalMs < 100) {
+        throw new Error("--poll-interval must be an integer of at least 100ms");
+      }
+      const request = {
+        missInput: String(opts.missInput),
+        ...registry ? { registry } : {},
+        ...opts.maxRegister !== void 0 ? { maxRegister: opts.maxRegister } : {},
+        ...opts.model ? { model: String(opts.model) } : {},
+        promote: Boolean(opts.promote),
+        trials: trialCount(opts.trials),
+        ...opts.fromBench ? { fromBench: String(opts.fromBench) } : {},
+        ...opts.manifest ? { manifest: resolve(String(opts.manifest)) } : {}
+      };
+      const printResult = (result) => {
+        process.stdout.write(
+          opts.json ? `${JSON.stringify(result, null, 2)}
+` : `${formatLensSynthResult(result, !opts.promote)}
+`
+        );
+      };
+      const log = (message) => {
+        process.stderr.write(`${message}
+`);
+      };
+      if (!opts.watch) {
+        printResult(await runLensSynthCommand(request, { log }));
+        return;
+      }
+      const controller = new AbortController();
+      const stop = () => controller.abort();
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+      try {
+        await watchLensSynthCommand(
+          { ...request, pollIntervalMs },
+          {
+            log,
+            signal: controller.signal,
+            onResult: printResult,
+            onError: (error) => process.stderr.write(`lens-synth watch: ${error.message}
+`)
+          }
+        );
+      } finally {
+        process.off("SIGINT", stop);
+        process.off("SIGTERM", stop);
+      }
+    } catch (error) {
+      process.stderr.write(`lens-synth: ${error instanceof Error ? error.message : String(error)}
+`);
+      process.exitCode = 3;
+    }
+  });
+}
+
+export {
+  runLensSynthesisInput,
+  watchLensSynthCommand,
+  registerLensSynthCommand
+};

package/chunks/{chunk-K55B4OH4.js → chunk-O3ADFN2A.js}

@@ -5,7 +5,7 @@ import {
   CODEX_CLIENT_VERSION,
   CODEX_PROTOCOL_HEADERS,
   getChatGptCodexAccessToken
-} from "./chunk-BF5FIK7H.js";
+} from "./chunk-EYBMTELO.js";
 
 // packages/core/dist/runtime/codex-models.js
 import { createHash } from "node:crypto";

package/chunks/chunk-O7Q2G2KW.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  fitTuiText,
+  fitTuiUrl
+} from "./chunk-AV5BF4V7.js";
+import {
+  parseImpactAssessment
+} from "./chunk-V5I5GAQH.js";
+import {
+  restoreFindingReviewFields
+} from "./chunk-RCHAFSWS.js";
+import {
+  compareFindingsByBusinessPriority,
+  getFindingPriority
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/tui/findings-data.ts
+function formatDuration(ms) {
+  if (!ms || ms <= 0) return "-";
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+function parseSummary(summary) {
+  if (!summary) return {};
+  try {
+    return JSON.parse(summary);
+  } catch {
+    return {};
+  }
+}
+function findingRowPriority(row) {
+  return getFindingPriority({ severity: row.severity, impactAssessment: parseJsonColumn(row.impactAssessment) });
+}
+function compareFindingRowsByBusinessPriority(a, b) {
+  return compareFindingsByBusinessPriority(
+    { severity: a.severity, cvssScore: a.cvssScore ?? void 0, impactAssessment: parseJsonColumn(a.impactAssessment) },
+    { severity: b.severity, cvssScore: b.cvssScore ?? void 0, impactAssessment: parseJsonColumn(b.impactAssessment) }
+  ) || b.timestamp - a.timestamp;
+}
+function parseJsonColumn(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+function findingFromRow(row) {
+  const impactAssessment = parseJsonColumn(row.impactAssessment) === void 0 ? void 0 : parseImpactAssessment(row.impactAssessment) ?? void 0;
+  const record = {
+    id: row.id,
+    templateId: row.templateId,
+    title: row.title,
+    description: row.description,
+    severity: row.severity,
+    cvssScore: row.cvssScore ?? void 0,
+    cvssVector: row.cvssVector ?? void 0,
+    category: row.category,
+    status: row.status,
+    fingerprint: row.fingerprint ?? void 0,
+    triageStatus: row.triageStatus ?? void 0,
+    timestamp: row.timestamp,
+    evidence: {
+      request: row.evidenceRequest,
+      response: row.evidenceResponse,
+      analysis: row.evidenceAnalysis ?? void 0
+    },
+    verificationSpec: parseJsonColumn(row.verificationSpec),
+    impactAssessment,
+    ...restoreFindingReviewFields(row)
+  };
+  return record;
+}
+function isNativeRuntime(runtime) {
+  return typeof runtime?.executeNative === "function";
+}
+function cycleChoice(items, current, delta) {
+  const index = items.indexOf(current);
+  const next = index < 0 ? 0 : (index + delta + items.length) % items.length;
+  return items[next];
+}
+function describeEventPayload(payload) {
+  try {
+    const parsed = JSON.parse(payload);
+    if (typeof parsed.summary === "string") return fitTuiText(parsed.summary, 120);
+    if (typeof parsed.message === "string") return fitTuiText(parsed.message, 120);
+    if (typeof parsed.error === "string") return fitTuiText(parsed.error, 120);
+    if (typeof parsed.action === "string") return fitTuiText(parsed.action, 120);
+    if (typeof parsed.target === "string") return fitTuiUrl(parsed.target, 120);
+  } catch {
+  }
+  return fitTuiText(payload, 120);
+}
+function describeFindingsFilters(options) {
+  const filters = [
+    options.scan ? `scan:${options.scan}` : null,
+    options.severity ? `severity:${options.severity}` : null,
+    options.category ? `category:${options.category}` : null,
+    options.status ? `status:${options.status}` : null,
+    options.triage ? `triage:${options.triage}` : null
+  ].filter(Boolean);
+  return filters.length > 0 ? filters.join(" \xB7 ") : "all findings";
+}
+
+export {
+  formatDuration,
+  parseSummary,
+  findingRowPriority,
+  compareFindingRowsByBusinessPriority,
+  findingFromRow,
+  isNativeRuntime,
+  cycleChoice,
+  describeEventPayload,
+  describeFindingsFilters
+};