0sec-cli 0.23.0 → 0.24.0

package/chunks/{chunk-W5VNCB57.js → chunk-RD4FKFWR.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-LTEE2JWK.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/cve/artifact-scraper.js
 import { createHash } from "node:crypto";

package/chunks/{chunk-LVGZGG63.js → chunk-RPTO5FY2.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-LTEE2JWK.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-LTEE2JWK.js → chunk-RZR2XXAK.js}

@@ -67,7 +67,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.23.0";
+    return "0.24.0";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -189,6 +189,22 @@ var MANUAL_PRICING = {
   "qwen3.7-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
   "qwen3.6-plus": { input: 0.5, output: 3, cachedInput: 0.05 },
   "qwen3.6-flash": { input: 0.1875, output: 1.125 },
+  // ClinePass reference quota rates, not incremental subscription charges.
+  // https://github.com/cline/cline/blob/main/docs/getting-started/clinepass.mdx
+  // checked 2026-10-05; DeepSeek uses peak rates; Qwen Plus <=256K only.
+  "cline-pass/glm-5.3": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "cline-pass/glm-5.2": { input: 1.4, output: 4.4, cachedInput: 0.26 },
+  "cline-pass/kimi-k3": { input: 3, output: 15, cachedInput: 0.3 },
+  "cline-pass/kimi-k2.7-code": { input: 0.95, output: 4, cachedInput: 0.19 },
+  "cline-pass/kimi-k2.6": { input: 0.95, output: 4, cachedInput: 0.16 },
+  "cline-pass/deepseek-v4-pro": { input: 1.32, output: 3.96, cachedInput: 0.044 },
+  "cline-pass/deepseek-v4-flash": { input: 0.44, output: 1.32, cachedInput: 0.014 },
+  "cline-pass/mimo-v2.5": { input: 0.14, output: 0.28, cachedInput: 28e-4 },
+  "cline-pass/mimo-v2.5-pro": { input: 1.74, output: 3.48, cachedInput: 0.0145 },
+  "cline-pass/minimax-m3": { input: 0.3, output: 1.2, cachedInput: 0.06 },
+  "cline-pass/qwen3.8-max": { input: 2, output: 6, cachedInput: 0.25, cacheWrite: 2.5 },
+  "cline-pass/qwen3.7-max": { input: 2.5, output: 7.5, cachedInput: 0.5, cacheWrite: 3.125 },
+  "cline-pass/qwen3.7-plus": { input: 0.4, output: 1.6, cachedInput: 0.04, cacheWrite: 0.5 },
   // OpenCode Zen free tier (https://opencode.ai/docs/zen/) — zero-rate gateway
   // models; actual spend is $0 while the free period lasts.
   "muse-spark-1.3-contributor-free": { input: 0, output: 0 },
@@ -293,7 +309,9 @@ var MODEL_VENDOR_PREFIXES = [
   "openrouter/",
   "opencode/",
   "xai/",
-  "x-ai/"
+  "x-ai/",
+  "cline/",
+  "cline-pass/"
 ];
 function normalizeModel(model) {
   let key = model;
@@ -313,7 +331,7 @@ function normalizeModel(model) {
 function getRates(model) {
   const key = model ? normalizeModel(model) : "";
   const aliasKey = azureDeploymentPriceKey(key);
-  const rates = (model && Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : void 0) ?? (model ? DISCOVERED_PRICING.get(model) : void 0) ?? (Object.hasOwn(MODEL_PRICING, key) ? MODEL_PRICING[key] : void 0) ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0) ?? DISCOVERED_PRICING.get(key);
+  const rates = (model && Object.hasOwn(MODEL_PRICING, model) ? MODEL_PRICING[model] : void 0) ?? (model ? DISCOVERED_PRICING.get(model) : void 0) ?? (model?.startsWith("cline/") && Object.hasOwn(MODEL_PRICING, model.slice(6)) ? MODEL_PRICING[model.slice(6)] : void 0) ?? (Object.hasOwn(MODEL_PRICING, key) ? MODEL_PRICING[key] : void 0) ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0) ?? DISCOVERED_PRICING.get(key);
   if (!rates) {
     if (model)
       console.warn(`[0] Unknown model for cost estimation: ${model}`);
@@ -336,6 +354,8 @@ function modelProvider(model) {
   if (!model)
     return "unknown";
   const lowered = model.toLowerCase();
+  if (lowered.startsWith("cline/") || lowered.startsWith("cline-pass/"))
+    return "cline";
   if (lowered.startsWith("openai/"))
     return "openai";
   if (lowered.startsWith("azure/"))
@@ -1820,7 +1840,8 @@ var BACKEND_CAPABILITIES = [
   "artifacts",
   "model-connections",
   "process-controls",
-  "operator-services"
+  "operator-services",
+  "learning"
 ];
 var BackendCapabilitySchema = external_exports.enum(BACKEND_CAPABILITIES);
 var BackendIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_.-]*$/).refine((value) => !["__proto__", "constructor", "prototype"].includes(value), "Reserved backend identifier.");
@@ -1918,9 +1939,14 @@ function backendCapabilitiesForApiPath(pathname) {
     return ["workflow-engine"];
   if (parts[0] === "control" && parts.length === 2 && ["recover-stale-workers", "prune-stopped-workers", "reset-database", "start-daemon", "stop-daemon", "launch-run"].includes(parts[1]))
     return ["process-controls"];
-  if (pathname === "/api/dashboard" || parts[0] === "scans" || parts[0] === "finding-family")
+  if (pathname === "/api/dashboard" || parts[0] === "scans" || parts[0] === "finding-family" || pathname === "/api/findings/export")
     add("artifacts");
-  else if (parts[0] === "events" || pathname === "/api/v1/presentation/events")
+  if (parts[0] === "findings" && parts.length === 3 && parts[2] === "impact-assessment")
+    add("artifacts");
+  if (parts[0] === "scans" && parts[2] === "resume") {
+    add("workflows");
+    add("sessions");
+  } else if (parts[0] === "events" || pathname === "/api/v1/presentation/events")
     add("events");
   else if (parts[0] === "console") {
     const family = parts[1];
@@ -1935,7 +1961,9 @@ function backendCapabilitiesForApiPath(pathname) {
         add("model-connections");
       if (["files", "directories", "paths", "workspace", "project"].includes(operation ?? ""))
         add("workspaces");
-    } else if (["workflow-triggers", "workflow-schedules"].includes(family ?? ""))
+    } else if (family === "learning")
+      add("learning");
+    else if (["workflow-triggers", "workflow-schedules"].includes(family ?? ""))
       add("schedules");
     else if (["workflows", "workflow-definitions", "workflow-executions", "workflow-tool-catalog", "fixes"].includes(family ?? "")) {
       add("workflows");
@@ -1958,6 +1986,205 @@ function backendCapabilitiesForApiPath(pathname) {
   return [...capabilities];
 }
 
+// packages/shared/dist/scan-resume.js
+var ScanResumeRequestSchema = external_exports.object({
+  sessionId: external_exports.string().trim().min(1).max(160),
+  approval: external_exports.literal("launch-authorized-run"),
+  branchFromEntry: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).optional(),
+  timeCapMs: external_exports.number().int().positive().max(864e5).optional(),
+  costCapUsd: external_exports.number().finite().positive().max(1e3).optional()
+}).strict();
+function resolvePersistedScanResume(scan) {
+  if (!scan.id || scan.id.startsWith("console-"))
+    throw new Error("Choose a persisted assessment scan, not a console conversation.");
+  const depth = external_exports.enum(["quick", "default", "deep"]).parse(scan.depth);
+  const storedMode = scan.mode ? external_exports.enum(["probe", "deep", "mcp", "web", "http_audit", "llm-ipi"]).parse(scan.mode) : void 0;
+  const raw = external_exports.string().trim().min(1).max(4096).parse(scan.target);
+  let parsed;
+  let impliedMode;
+  if (/^https?:\/\//.test(raw))
+    parsed = { target: raw, targetType: "url", sourceDescription: "url" };
+  else if (raw.startsWith("web:")) {
+    parsed = { target: raw.slice(4), targetType: "web-app", sourceDescription: "web-app" };
+    impliedMode = "web";
+  } else if (raw.startsWith("mcp://")) {
+    parsed = { target: raw, targetType: "url", sourceDescription: "mcp target" };
+    impliedMode = "mcp";
+  } else if (raw.startsWith("scan:"))
+    parsed = { target: raw.slice(5), targetType: "url", sourceDescription: "url" };
+  else if (raw.startsWith("repo:"))
+    parsed = { target: raw.slice(5), targetType: "source-code", sourceDescription: "repository" };
+  else {
+    const match = /^(npm|pypi|cargo|oci):(.+)$/.exec(raw);
+    if (!match)
+      throw new Error(`Resume does not know how to route this persisted target yet: ${raw}`);
+    const ecosystem = match[1];
+    const spec = match[2];
+    const at = spec.lastIndexOf("@");
+    const target = at > 0 ? spec.slice(0, at) : spec;
+    const packageVersion = at > 0 ? spec.slice(at + 1) : void 0;
+    if (!target.trim() || packageVersion === "")
+      throw new Error("Persisted package identity is incomplete.");
+    const types = { npm: "npm-package", pypi: "pypi-package", cargo: "cargo-package", oci: "oci-image" };
+    parsed = { target, targetType: types[ecosystem], ...packageVersion ? { packageVersion } : {}, sourceDescription: `${ecosystem} package` };
+  }
+  if (!parsed.target.trim())
+    throw new Error("Persisted scan target is empty.");
+  const targetType = storedMode === "web" ? "web-app" : parsed.targetType;
+  return { ...parsed, targetType, depth, mode: impliedMode ?? storedMode ?? (targetType === "web-app" ? "web" : "deep") };
+}
+
+// packages/shared/dist/engine-operations.js
+var ENGINE_OPERATION_DEFINITIONS = [
+  { id: "get_capabilities", capability: "operator-services", effect: "read" },
+  { id: "start_assessment", capability: "workflows", effect: "execute" },
+  { id: "attach_session", capability: "sessions", effect: "read" },
+  { id: "get_session_events", capability: "events", effect: "read" },
+  { id: "list_templates", capability: "workflows", effect: "read" },
+  { id: "get_template", capability: "workflows", effect: "read" },
+  { id: "list_workflows", capability: "workflows", effect: "read" },
+  { id: "get_workflow", capability: "workflows", effect: "read" },
+  { id: "save_workflow", capability: "workflows", effect: "write" },
+  { id: "start_run", capability: "workflows", effect: "execute" },
+  { id: "list_runs", capability: "workflows", effect: "read" },
+  { id: "get_run", capability: "workflows", effect: "read" },
+  { id: "get_run_results", capability: "workflows", effect: "read" },
+  { id: "cancel_run", capability: "workflows", effect: "cancel" },
+  { id: "list_sessions", capability: "sessions", effect: "read" },
+  { id: "create_session", capability: "sessions", effect: "write" },
+  { id: "get_session", capability: "sessions", effect: "read" },
+  { id: "send_message", capability: "sessions", effect: "execute" },
+  { id: "continue_session", capability: "sessions", effect: "execute" },
+  { id: "cancel_session", capability: "sessions", effect: "cancel" },
+  { id: "resolve_decision", capability: "approvals", effect: "approve" },
+  { id: "list_saved_sessions", capability: "sessions", effect: "read" },
+  { id: "resume_session", capability: "sessions", effect: "execute" },
+  { id: "resume_scan", capability: "scan-resume", effect: "execute" }
+];
+var ENGINE_REPORT_FORMATS = ["json", "md", "html", "sarif", "pdf"];
+var operationIds = ENGINE_OPERATION_DEFINITIONS.map((operation) => operation.id);
+var OperationIdSchema = external_exports.enum(operationIds);
+var unique = (values) => new Set(values).size === values.length;
+var EngineCapabilityManifestSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  operations: external_exports.array(OperationIdSchema).refine(unique, "Engine operations must be unique"),
+  reportExport: external_exports.object({ formats: external_exports.array(external_exports.enum(ENGINE_REPORT_FORMATS)).refine(unique, "Report formats must be unique") }).strict(),
+  resume: external_exports.object({ session: external_exports.boolean(), scan: external_exports.boolean(), workflow: external_exports.literal(false) }).strict()
+}).strict().superRefine((manifest, context) => {
+  if (manifest.resume.session !== manifest.operations.includes("resume_session") || manifest.resume.scan !== manifest.operations.includes("resume_scan")) {
+    context.addIssue({ code: external_exports.ZodIssueCode.custom, message: "Resume support must match registered operations" });
+  }
+});
+function createEngineCapabilityManifest(options) {
+  return EngineCapabilityManifestSchema.parse({
+    schemaVersion: 1,
+    operations: [...options.operations],
+    reportExport: { formats: [...options.reportFormats ?? []] },
+    resume: { session: options.operations.includes("resume_session"), scan: options.operations.includes("resume_scan"), workflow: false }
+  });
+}
+function requireEngineOperation(manifest, operation) {
+  const valid = EngineCapabilityManifestSchema.parse(manifest);
+  if (!valid.operations.includes(operation))
+    throw new Error(`Engine does not support operation ${operation}.`);
+}
+var ENGINE_COMMAND_COVERAGE = [
+  { id: "assessment", classification: "workflow", cliCommands: ["scan", "review", "audit", "secure"], workflowSteps: ["audit"], templateIds: ["repository-review", "dependency-review", "api-security", "web-configuration", "scoped-penetration-test", "package-behavior", "contract-review", "native-code-review"], chatTools: [], limits: "Target-specific assessment options and admission still apply.", source: "packages/core/src/assessment.ts" },
+  { id: "fix", classification: "workflow", cliCommands: ["fix"], workflowSteps: ["fix"], templateIds: ["fix-candidate"], chatTools: ["generate_fix"], limits: "Chat generation is distinct from workflow candidate validation; applying requires exact live candidate proof and host/request approval.", source: "packages/cli/src/finding-workflow-executors.ts" },
+  { id: "verification", classification: "workflow", cliCommands: ["verify", "replay"], workflowSteps: ["verify"], templateIds: ["finding-verification"], chatTools: ["verify_finding"], limits: "Managed verification uses supported replay runners; CLI kernel verification is not a portable workflow operation.", source: "packages/cli/src/finding-workflow-executors.ts" },
+  { id: "research", classification: "workflow", cliCommands: ["research pipeline", "research mobile", "research linux-matrix"], workflowSteps: ["research"], templateIds: ["security-research"], chatTools: [], limits: "Managed modes pipeline/mobile/linux-matrix require authorized local workspace; pipeline is source-only. linux-matrix imports external evidence and does not execute boots.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "deep-review", classification: "workflow", cliCommands: ["deep-review"], workflowSteps: ["deep-review"], templateIds: ["deep-source-review"], chatTools: [], limits: "Authorized local source workspace and provider prerequisites apply.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "offensive-tools", classification: "chat-tool", cliCommands: ["hunt", "assumption-hunt", "protocol-check", "specdrift", "memsafety", "npm-discovery", "kernel", "cve"], workflowSteps: [], templateIds: [], chatTools: ["variant_hunt", "assumption_hunt", "protocol_conformance", "spec_drift", "safety_eval", "memsafety_fuzz", "npm_dynamic_discovery", "weaponize_kernel", "cve_adapt"], limits: "Tool availability is scope/feature/prerequisite gated. CLI engines and tools have different contracts; no portable specialist workflow executor is registered by this manifest.", source: "packages/core/src/agent/tools/offensive-engines.ts" },
+  { id: "kernel-research", classification: "cli-specialist", cliCommands: ["research linux"], workflowSteps: [], templateIds: [], chatTools: [], limits: "Managed kernel research rejects execution until the VM/build runner supports workflow cancellation and deadlines.", source: "packages/cli/src/workflow-research-executors.ts" },
+  { id: "specialist-cli", classification: "cli-specialist", cliCommands: ["binary", "exploit", "recency-hunt", "lens-synth", "xnu-fuzz", "disclose", "eval", "bench", "ingest"], workflowSteps: [], templateIds: [], chatTools: [], limits: "These CLI contracts are not exposed as portable workflow steps here; model-driven source review is not equivalent to their native proof engines.", source: "packages/cli/src/index.ts" },
+  { id: "maintenance", classification: "cli-maintenance", cliCommands: ["doctor", "db", "upgrade", "config", "plugin", "theme", "login", "logout"], workflowSteps: [], templateIds: [], chatTools: [], limits: "Host maintenance and credential changes are not workflow execution or model-tool grants.", source: "packages/cli/src/index.ts" }
+];
+
+// packages/shared/dist/finding-priority.js
+var ImpactAssessmentSchema = external_exports.object({
+  reachability_tier: external_exports.enum(["remote-unauth", "remote-auth", "proximity-rf", "local-unpriv", "local-priv", "needs-hardware", "needs-host-migration", "unknown"]),
+  blast_radius: external_exports.string().trim().min(1).max(4096),
+  weaponizability: external_exports.enum(["dos-crash", "info-leak", "integrity-tampering", "lpe-to-root", "rce", "unknown"]),
+  business_impact: external_exports.enum(["headline", "notable", "modest", "noise", "unassessed"]),
+  rationale: external_exports.string().trim().min(1).max(8192),
+  assessment_source: external_exports.enum(["model", "provided", "heuristic"]).optional()
+}).strip();
+var UNKNOWN_PRIORITY = {
+  rank: 1.5,
+  label: "Not assessed",
+  assessed: false,
+  rationale: "Business impact has not been assessed. Establish the affected services, customers, data, and operational consequences."
+};
+var PRIORITIES = {
+  headline: { rank: 3, label: "Urgent" },
+  notable: { rank: 2, label: "High" },
+  modest: { rank: 1, label: "Moderate" },
+  noise: { rank: 0, label: "Low" }
+};
+function isHeuristicImpactAssessment(assessment) {
+  return assessment.assessment_source === "heuristic" || /^deterministic fallback derived from severity\s*\+\s*category/i.test(assessment.rationale) || /^heuristic baseline for a /i.test(assessment.blast_radius);
+}
+function getFindingPriority(finding) {
+  const parsed = ImpactAssessmentSchema.safeParse(finding.impactAssessment);
+  if (!parsed.success || parsed.data.business_impact === "unassessed" || isHeuristicImpactAssessment(parsed.data)) {
+    return { ...UNKNOWN_PRIORITY };
+  }
+  const priority = PRIORITIES[parsed.data.business_impact];
+  return { ...priority, assessed: true, rationale: parsed.data.rationale };
+}
+var TECHNICAL_SEVERITY = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+function technicalCvss(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 10 ? value : -1;
+}
+function compareFindingsByBusinessPriority(a, b) {
+  return getFindingPriority(b).rank - getFindingPriority(a).rank || (TECHNICAL_SEVERITY[b.severity?.toLowerCase() ?? ""] ?? -1) - (TECHNICAL_SEVERITY[a.severity?.toLowerCase() ?? ""] ?? -1) || technicalCvss(b.cvssScore) - technicalCvss(a.cvssScore);
+}
+
+// packages/shared/dist/access-milestone.js
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var successfulObservation = (value) => {
+  const item = record(value);
+  return item && typeof item.status === "number" && Number.isInteger(item.status) && item.status >= 200 && item.status < 300 && item.truncated === false && item.field_present === true && (typeof item.json_pointer_value === "string" || item.json_pointer_value === null) ? item : void 0;
+};
+function accessMilestoneFromArtifact(eventType, value, scopeId, evidenceEventId) {
+  const item = record(value);
+  if (eventType !== "tool_artifact" || !item || item.tool !== "access_control_workflow" || item.workflow !== "access_control_workflow" || item.verdict !== "confirmed" || typeof item.owner_identity !== "string" || !item.owner_identity || typeof item.actor_identity !== "string" || !item.actor_identity || item.owner_identity === item.actor_identity || typeof item.expected_state !== "string" || item.expected_state.length > 500 || typeof item.observation_url !== "string" || item.observation_url.length > 8192 || !scopeId || scopeId.length > 512)
+    return null;
+  const before = successfulObservation(item.observation_before);
+  const after = successfulObservation(item.observation_after);
+  if (!before || !after || before.json_pointer_value === item.expected_state || after.json_pointer_value !== item.expected_state || !Array.isArray(item.steps) || item.steps.length === 0 || item.steps.length > 10)
+    return null;
+  if (item.steps.some((value2, index) => {
+    const step = record(value2);
+    return !step || step.step_index !== index || typeof step.url !== "string" || !["GET", "POST", "PUT", "DELETE", "PATCH"].includes(String(step.method)) || typeof step.status !== "number" || !Number.isInteger(step.status) || step.status < 100 || step.status > 599 || step.error !== void 0;
+  }))
+    return null;
+  let asset;
+  try {
+    const url = new URL(item.observation_url);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password)
+      return null;
+    asset = url.origin;
+  } catch {
+    return null;
+  }
+  return {
+    key: JSON.stringify([scopeId, "cross-identity-write", item.observation_url]),
+    asset,
+    status: "conditional",
+    accessClass: "cross-identity-write",
+    headline: "State change confirmed across request contexts",
+    summary: "The observing context saw the declared marker after requests using different configured authentication headers. Authorization impact requires validation. Cleanup was not verified.",
+    cleanup: "unknown",
+    ...evidenceEventId && evidenceEventId.length <= 512 ? { evidenceEventId } : {}
+  };
+}
+function appendAccessMilestone(current, next, limit = 80) {
+  if (current.some((item) => item.milestone.key === next.milestone.key))
+    return [...current];
+  return [...current, next].slice(-Math.max(1, Math.min(80, limit)));
+}
+
 export {
   validateScanPlan,
   defaultRoleFor,
@@ -1992,6 +2219,8 @@ export {
   VerificationAssertionSchema,
   EvidenceArtifactSchema,
   VerificationResultSchema,
+  pocStepActionSchema,
+  pocStepExpectSchema,
   pocStepSchema,
   pocStepArraySchema,
   findingSchema,
@@ -2076,5 +2305,19 @@ export {
   BackendEventCursorSchema,
   BackendApprovalRefSchema,
   assertBackendReference,
-  backendCapabilitiesForApiPath
+  backendCapabilitiesForApiPath,
+  ScanResumeRequestSchema,
+  resolvePersistedScanResume,
+  ENGINE_OPERATION_DEFINITIONS,
+  ENGINE_REPORT_FORMATS,
+  EngineCapabilityManifestSchema,
+  createEngineCapabilityManifest,
+  requireEngineOperation,
+  ENGINE_COMMAND_COVERAGE,
+  ImpactAssessmentSchema,
+  isHeuristicImpactAssessment,
+  getFindingPriority,
+  compareFindingsByBusinessPriority,
+  accessMilestoneFromArtifact,
+  appendAccessMilestone
 };

package/chunks/chunk-SGILXLR3.js

@@ -0,0 +1,289 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  spinnerGlyph
+} from "./chunk-GNR3APR6.js";
+import {
+  loadLayeredSettings
+} from "./chunk-QEA2VHBD.js";
+import {
+  homeStateDir
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/utils/update-check.ts
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+
+// packages/cli/src/utils/terminal-progress.ts
+function terminalProgress(label, output = process.stderr, reduceMotion = false) {
+  const animated = Boolean(output.isTTY && process.env["TERM"] !== "dumb");
+  const started = Date.now();
+  let frame = 0;
+  let stage = label;
+  let finished = false;
+  const clean = (text) => text.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x1f\x7f-\x9f]/g, " ").trim();
+  const paint = () => {
+    const elapsed = Math.floor((Date.now() - started) / 1e3);
+    const line = `${spinnerGlyph(frame++, { reduceMotion })} ${stage} \xB7 ${elapsed}s`;
+    output.write(`\r\x1B[2K${Array.from(line).slice(0, Math.max(12, (output.columns ?? 80) - 1)).join("")}`);
+  };
+  if (animated) paint();
+  else output.write(`${clean(label)}\u2026
+`);
+  const timer = animated && !reduceMotion ? setInterval(paint, 120) : void 0;
+  timer?.unref();
+  return {
+    update(text) {
+      if (finished) return;
+      stage = clean(text) || label;
+      if (animated) paint();
+    },
+    finish(text) {
+      if (finished) return;
+      finished = true;
+      clearInterval(timer);
+      if (animated) output.write("\r\x1B[2K");
+      if (text) output.write(`${clean(text)}
+`);
+    }
+  };
+}
+
+// packages/cli/src/utils/update-check.ts
+var REPO = "0sec-labs/0";
+var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 4e3;
+var INSTALL_TIMEOUT_MS = 12e4;
+function parseVersion(value) {
+  if (value.length > 128) return null;
+  const match = /^v?(0|[1-9]\d*)(?:\.(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?)?(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value);
+  if (!match) return null;
+  const parts = [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)];
+  if (!parts.every(Number.isSafeInteger)) return null;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) return null;
+  return { parts, prerelease, complete: match[3] !== void 0 };
+}
+function compareVersions(a, b) {
+  const left = parseVersion(a);
+  const right = parseVersion(b);
+  if (!left || !right) return 0;
+  for (let i = 0; i < 3; i++) {
+    if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
+  }
+  if (!left.prerelease.length || !right.prerelease.length) {
+    return left.prerelease.length ? -1 : right.prerelease.length ? 1 : 0;
+  }
+  for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+    const l = left.prerelease[i];
+    const r = right.prerelease[i];
+    if (l === void 0) return -1;
+    if (r === void 0) return 1;
+    if (l === r) continue;
+    const ln = /^\d+$/.test(l);
+    const rn = /^\d+$/.test(r);
+    if (ln !== rn) return ln ? -1 : 1;
+    if (ln && l.length !== r.length) return l.length < r.length ? -1 : 1;
+    return l < r ? -1 : 1;
+  }
+  return 0;
+}
+function disabled(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function shouldRunCheck(env = process.env, isTty = Boolean(process.stdout.isTTY), policy) {
+  if (!isTty || disabled(env.CI) || disabled(env["ZERO_OFFLINE"]) || disabled(env["ZERO_NO_UPDATE_CHECK"])) return false;
+  if (policy !== void 0) return policy !== "off";
+  return env["ZERO_UPDATE_CHECK"] === "1";
+}
+function recent(timestamp, now) {
+  const age = now - Date.parse(timestamp ?? "");
+  return Number.isFinite(age) && age >= 0 && age < CHECK_INTERVAL_MS;
+}
+function readCache() {
+  try {
+    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const value = raw;
+    if (typeof value.lastCheckedAt !== "string") return null;
+    return {
+      lastCheckedAt: value.lastCheckedAt,
+      latestVersion: typeof value.latestVersion === "string" ? value.latestVersion : void 0,
+      lastInstallAttemptAt: typeof value.lastInstallAttemptAt === "string" ? value.lastInstallAttemptAt : void 0,
+      lastInstallTag: typeof value.lastInstallTag === "string" ? value.lastInstallTag : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function writeCache(cache) {
+  try {
+    mkdirSync(homeStateDir(), { recursive: true });
+    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+  } catch {
+  }
+}
+async function fetchLatestTag() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "@0/cli/update-check" },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (typeof data.tag_name !== "string" || data.prerelease === true || data.draft === true) return null;
+    const version = parseVersion(data.tag_name);
+    return version?.complete && version.prerelease.length === 0 ? data.tag_name : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var installInProgress = false;
+var attemptedAutomaticTags = /* @__PURE__ */ new Set();
+async function performAutoUpdate(options = {}) {
+  if (process.platform === "win32") return { success: false, installed: false, error: "Automatic installation is unavailable on Windows; download a release from https://github.com/0sec-labs/0/releases/latest." };
+  if (disabled(process.env["ZERO_OFFLINE"]) || disabled(process.env["ZERO_NO_UPDATE_CHECK"])) {
+    return { success: false, installed: false, error: "Updates are disabled by the current offline/update policy." };
+  }
+  if (installInProgress) return { success: false, installed: false, error: "An update is already in progress." };
+  installInProgress = true;
+  try {
+    const tag = options.version ?? await fetchLatestTag();
+    const version = tag ? parseVersion(tag) : null;
+    if (!tag || !version?.complete) return { success: false, installed: false, error: "Could not resolve a valid release tag." };
+    const normalizedTag = tag.startsWith("v") ? tag : `v${tag}`;
+    const env = { ...process.env, RELEASE_BASE_URL: `https://github.com/${REPO}/releases/download/${normalizedTag}` };
+    const installDir = options.installDir ?? process.env["ZERO_INSTALL_DIR"];
+    if (installDir !== void 0) env.INSTALL_DIR = installDir;
+    const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? Math.min(options.timeoutMs, INSTALL_TIMEOUT_MS) : INSTALL_TIMEOUT_MS;
+    return await new Promise((resolve) => {
+      const interactive = Boolean(process.stderr.isTTY && process.env["TERM"] !== "dumb");
+      const progress = interactive ? terminalProgress(`Updating 0 to ${normalizedTag}`, process.stderr, loadLayeredSettings().settings.reduceMotion) : void 0;
+      const child = spawn("bash", ["-o", "pipefail", "-c", `curl -fsSL --connect-timeout 10 --max-time 30 "${INSTALL_URL}" | bash`], {
+        stdio: interactive ? ["inherit", "pipe", "pipe"] : "inherit",
+        env,
+        detached: true
+      });
+      let details = "";
+      let pendingLine = "";
+      const report = (chunk) => {
+        const text = chunk.toString("utf8");
+        details = (details + text).slice(-16384);
+        const lines = (pendingLine + text).split(/[\r\n]/);
+        pendingLine = lines.pop().slice(-2048);
+        const stage = lines.filter((line) => line.trim()).at(-1);
+        if (stage) progress?.update(stage);
+      };
+      child.stdout?.on("data", report);
+      child.stderr?.on("data", report);
+      let timedOut = false;
+      let settled = false;
+      let parentSignal;
+      let killTimer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        progress?.finish(result.success ? `\u2713 Installed ${normalizedTag}` : result.signal ? "Update cancelled." : "Update failed.");
+        if (interactive && details && (!result.success || /0 installer:|Could not update/.test(details))) process.stderr.write(details.endsWith("\n") ? details : `${details}
+`);
+        clearTimeout(timer);
+        clearTimeout(killTimer);
+        process.removeListener("SIGINT", onInterrupt);
+        process.removeListener("SIGTERM", onTerminate);
+        resolve(result);
+      };
+      const terminate = (signal) => {
+        if (child.pid === void 0) return;
+        try {
+          process.kill(-child.pid, signal);
+        } catch {
+        }
+      };
+      const interrupt = (signal) => {
+        if (parentSignal || settled) return;
+        parentSignal = signal;
+        clearTimeout(timer);
+        terminate(signal);
+        clearTimeout(killTimer);
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        }, 1e3);
+      };
+      const onInterrupt = () => interrupt("SIGINT");
+      const onTerminate = () => interrupt("SIGTERM");
+      const timer = setTimeout(() => {
+        timedOut = true;
+        terminate("SIGTERM");
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, exitCode: 1, error: `Installer exceeded its ${timeoutMs}ms deadline.` });
+        }, 1e3);
+      }, timeoutMs);
+      process.on("SIGINT", onInterrupt);
+      process.on("SIGTERM", onTerminate);
+      child.once("error", (error) => finish({ success: false, installed: false, exitCode: 1, error: `Could not start the installer: ${error.message}. Ensure bash and curl are available.` }));
+      child.once("close", (code, signal) => {
+        if (timedOut || parentSignal) return;
+        if (signal) finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        else if (code === 0) finish({ success: true, installed: true, installedVersion: normalizedTag, exitCode: 0 });
+        else finish({ success: false, installed: false, exitCode: code ?? 1, error: `Installer exited with code ${code ?? 1}.` });
+      });
+    });
+  } catch (error) {
+    return { success: false, installed: false, exitCode: 1, error: error instanceof Error ? error.message : "Update failed." };
+  } finally {
+    installInProgress = false;
+  }
+}
+async function maybeNotifyUpdate(currentVersion, options = {}) {
+  const policy = options.policy;
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), policy) || !parseVersion(currentVersion)) return;
+  const now = Date.now();
+  let cache = readCache();
+  if (!cache || !recent(cache.lastCheckedAt, now)) {
+    const tag2 = await fetchLatestTag();
+    cache = { ...cache, lastCheckedAt: new Date(now).toISOString(), latestVersion: tag2 ?? cache?.latestVersion };
+    writeCache(cache);
+  }
+  const tag = cache.latestVersion;
+  const candidate = tag ? parseVersion(tag) : null;
+  if (!tag || !candidate?.complete || candidate.prerelease.length > 0 || compareVersions(tag, currentVersion) <= 0) return;
+  if (policy !== "automatic") {
+    process.stderr.write(`[0] Update available: ${currentVersion} \u2192 ${tag}. Run 0 upgrade.
+`);
+    return;
+  }
+  if (attemptedAutomaticTags.has(tag) || cache.lastInstallTag === tag && recent(cache.lastInstallAttemptAt, now)) return;
+  attemptedAutomaticTags.add(tag);
+  writeCache({ ...cache, lastInstallTag: tag, lastInstallAttemptAt: new Date(now).toISOString() });
+  if (!process.stderr.isTTY || process.env["TERM"] === "dumb") process.stderr.write(`[0] Updating to ${tag} before starting 0\u2026
+`);
+  const result = await performAutoUpdate({ version: tag });
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.stderr.write(result.success ? `[0] Installed ${result.installedVersion}. This process is still ${currentVersion}; restart to use the update.
+` : `[0] Update not installed: ${result.error ?? "unknown error"} Continuing with ${currentVersion}.
+`);
+}
+async function runStartupUpdate(version) {
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), "notify")) return;
+  const { settings, sources } = loadLayeredSettings();
+  const policy = sources.updatePolicy === "global" ? settings.updatePolicy : void 0;
+  if (policy === "automatic") await maybeNotifyUpdate(version, { policy });
+  else if (policy !== "off") void maybeNotifyUpdate(version, { policy });
+}
+
+export {
+  performAutoUpdate,
+  runStartupUpdate
+};

package/chunks/{chunk-QMICC5O2.js → chunk-TOAAYJVN.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-JEYIWMGL.js";
+} from "./chunk-CIMN2AO6.js";
 import {
   scanExecutionSignal
-} from "./chunk-CP6HANBE.js";
+} from "./chunk-YYOQADBB.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {