0sec-cli 0.23.0 → 0.24.1

package/chunks/{chunk-WIYNYNL2.js → chunk-6XMFCVJS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-BF5FIK7H.js";
+} from "./chunk-IJ6UPW3H.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/chunk-7UHAXEOV.js

@@ -0,0 +1,289 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  spinnerGlyph
+} from "./chunk-OOMBOLAF.js";
+import {
+  loadLayeredSettings
+} from "./chunk-X2IPO5JO.js";
+import {
+  homeStateDir
+} from "./chunk-GXXX7AGH.js";
+
+// packages/cli/src/utils/update-check.ts
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+
+// packages/cli/src/utils/terminal-progress.ts
+function terminalProgress(label, output = process.stderr, reduceMotion = false) {
+  const animated = Boolean(output.isTTY && process.env["TERM"] !== "dumb");
+  const started = Date.now();
+  let frame = 0;
+  let stage = label;
+  let finished = false;
+  const clean = (text) => text.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x1f\x7f-\x9f]/g, " ").trim();
+  const paint = () => {
+    const elapsed = Math.floor((Date.now() - started) / 1e3);
+    const line = `${spinnerGlyph(frame++, { reduceMotion })} ${stage} \xB7 ${elapsed}s`;
+    output.write(`\r\x1B[2K${Array.from(line).slice(0, Math.max(12, (output.columns ?? 80) - 1)).join("")}`);
+  };
+  if (animated) paint();
+  else output.write(`${clean(label)}\u2026
+`);
+  const timer = animated && !reduceMotion ? setInterval(paint, 120) : void 0;
+  timer?.unref();
+  return {
+    update(text) {
+      if (finished) return;
+      stage = clean(text) || label;
+      if (animated) paint();
+    },
+    finish(text) {
+      if (finished) return;
+      finished = true;
+      clearInterval(timer);
+      if (animated) output.write("\r\x1B[2K");
+      if (text) output.write(`${clean(text)}
+`);
+    }
+  };
+}
+
+// packages/cli/src/utils/update-check.ts
+var REPO = "0sec-labs/0";
+var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 4e3;
+var INSTALL_TIMEOUT_MS = 12e4;
+function parseVersion(value) {
+  if (value.length > 128) return null;
+  const match = /^v?(0|[1-9]\d*)(?:\.(0|[1-9]\d*)(?:\.(0|[1-9]\d*))?)?(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value);
+  if (!match) return null;
+  const parts = [Number(match[1]), Number(match[2] ?? 0), Number(match[3] ?? 0)];
+  if (!parts.every(Number.isSafeInteger)) return null;
+  const prerelease = match[4]?.split(".") ?? [];
+  if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part.startsWith("0"))) return null;
+  return { parts, prerelease, complete: match[3] !== void 0 };
+}
+function compareVersions(a, b) {
+  const left = parseVersion(a);
+  const right = parseVersion(b);
+  if (!left || !right) return 0;
+  for (let i = 0; i < 3; i++) {
+    if (left.parts[i] !== right.parts[i]) return left.parts[i] < right.parts[i] ? -1 : 1;
+  }
+  if (!left.prerelease.length || !right.prerelease.length) {
+    return left.prerelease.length ? -1 : right.prerelease.length ? 1 : 0;
+  }
+  for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+    const l = left.prerelease[i];
+    const r = right.prerelease[i];
+    if (l === void 0) return -1;
+    if (r === void 0) return 1;
+    if (l === r) continue;
+    const ln = /^\d+$/.test(l);
+    const rn = /^\d+$/.test(r);
+    if (ln !== rn) return ln ? -1 : 1;
+    if (ln && l.length !== r.length) return l.length < r.length ? -1 : 1;
+    return l < r ? -1 : 1;
+  }
+  return 0;
+}
+function disabled(value) {
+  return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
+}
+function shouldRunCheck(env = process.env, isTty = Boolean(process.stdout.isTTY), policy) {
+  if (!isTty || disabled(env.CI) || disabled(env["ZERO_OFFLINE"]) || disabled(env["ZERO_NO_UPDATE_CHECK"])) return false;
+  if (policy !== void 0) return policy !== "off";
+  return env["ZERO_UPDATE_CHECK"] === "1";
+}
+function recent(timestamp, now) {
+  const age = now - Date.parse(timestamp ?? "");
+  return Number.isFinite(age) && age >= 0 && age < CHECK_INTERVAL_MS;
+}
+function readCache() {
+  try {
+    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+    const value = raw;
+    if (typeof value.lastCheckedAt !== "string") return null;
+    return {
+      lastCheckedAt: value.lastCheckedAt,
+      latestVersion: typeof value.latestVersion === "string" ? value.latestVersion : void 0,
+      lastInstallAttemptAt: typeof value.lastInstallAttemptAt === "string" ? value.lastInstallAttemptAt : void 0,
+      lastInstallTag: typeof value.lastInstallTag === "string" ? value.lastInstallTag : void 0
+    };
+  } catch {
+    return null;
+  }
+}
+function writeCache(cache) {
+  try {
+    mkdirSync(homeStateDir(), { recursive: true });
+    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+  } catch {
+  }
+}
+async function fetchLatestTag() {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  try {
+    const response = await fetch(`https://api.github.com/repos/${REPO}/releases/latest`, {
+      headers: { Accept: "application/vnd.github+json", "User-Agent": "@0/cli/update-check" },
+      signal: controller.signal
+    });
+    if (!response.ok) return null;
+    const data = await response.json();
+    if (typeof data.tag_name !== "string" || data.prerelease === true || data.draft === true) return null;
+    const version = parseVersion(data.tag_name);
+    return version?.complete && version.prerelease.length === 0 ? data.tag_name : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var installInProgress = false;
+var attemptedAutomaticTags = /* @__PURE__ */ new Set();
+async function performAutoUpdate(options = {}) {
+  if (process.platform === "win32") return { success: false, installed: false, error: "Automatic installation is unavailable on Windows; download a release from https://github.com/0sec-labs/0/releases/latest." };
+  if (disabled(process.env["ZERO_OFFLINE"]) || disabled(process.env["ZERO_NO_UPDATE_CHECK"])) {
+    return { success: false, installed: false, error: "Updates are disabled by the current offline/update policy." };
+  }
+  if (installInProgress) return { success: false, installed: false, error: "An update is already in progress." };
+  installInProgress = true;
+  try {
+    const tag = options.version ?? await fetchLatestTag();
+    const version = tag ? parseVersion(tag) : null;
+    if (!tag || !version?.complete) return { success: false, installed: false, error: "Could not resolve a valid release tag." };
+    const normalizedTag = tag.startsWith("v") ? tag : `v${tag}`;
+    const env = { ...process.env, RELEASE_BASE_URL: `https://github.com/${REPO}/releases/download/${normalizedTag}` };
+    const installDir = options.installDir ?? process.env["ZERO_INSTALL_DIR"];
+    if (installDir !== void 0) env.INSTALL_DIR = installDir;
+    const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? Math.min(options.timeoutMs, INSTALL_TIMEOUT_MS) : INSTALL_TIMEOUT_MS;
+    return await new Promise((resolve) => {
+      const interactive = Boolean(process.stderr.isTTY && process.env["TERM"] !== "dumb");
+      const progress = interactive ? terminalProgress(`Updating 0 to ${normalizedTag}`, process.stderr, loadLayeredSettings().settings.reduceMotion) : void 0;
+      const child = spawn("bash", ["-o", "pipefail", "-c", `curl -fsSL --connect-timeout 10 --max-time 30 "${INSTALL_URL}" | bash`], {
+        stdio: interactive ? ["inherit", "pipe", "pipe"] : "inherit",
+        env,
+        detached: true
+      });
+      let details = "";
+      let pendingLine = "";
+      const report = (chunk) => {
+        const text = chunk.toString("utf8");
+        details = (details + text).slice(-16384);
+        const lines = (pendingLine + text).split(/[\r\n]/);
+        pendingLine = lines.pop().slice(-2048);
+        const stage = lines.filter((line) => line.trim()).at(-1);
+        if (stage) progress?.update(stage);
+      };
+      child.stdout?.on("data", report);
+      child.stderr?.on("data", report);
+      let timedOut = false;
+      let settled = false;
+      let parentSignal;
+      let killTimer;
+      const finish = (result) => {
+        if (settled) return;
+        settled = true;
+        progress?.finish(result.success ? `\u2713 Installed ${normalizedTag}` : result.signal ? "Update cancelled." : "Update failed.");
+        if (interactive && details && (!result.success || /0 installer:|Could not update/.test(details))) process.stderr.write(details.endsWith("\n") ? details : `${details}
+`);
+        clearTimeout(timer);
+        clearTimeout(killTimer);
+        process.removeListener("SIGINT", onInterrupt);
+        process.removeListener("SIGTERM", onTerminate);
+        resolve(result);
+      };
+      const terminate = (signal) => {
+        if (child.pid === void 0) return;
+        try {
+          process.kill(-child.pid, signal);
+        } catch {
+        }
+      };
+      const interrupt = (signal) => {
+        if (parentSignal || settled) return;
+        parentSignal = signal;
+        clearTimeout(timer);
+        terminate(signal);
+        clearTimeout(killTimer);
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        }, 1e3);
+      };
+      const onInterrupt = () => interrupt("SIGINT");
+      const onTerminate = () => interrupt("SIGTERM");
+      const timer = setTimeout(() => {
+        timedOut = true;
+        terminate("SIGTERM");
+        killTimer = setTimeout(() => {
+          terminate("SIGKILL");
+          finish({ success: false, installed: false, exitCode: 1, error: `Installer exceeded its ${timeoutMs}ms deadline.` });
+        }, 1e3);
+      }, timeoutMs);
+      process.on("SIGINT", onInterrupt);
+      process.on("SIGTERM", onTerminate);
+      child.once("error", (error) => finish({ success: false, installed: false, exitCode: 1, error: `Could not start the installer: ${error.message}. Ensure bash and curl are available.` }));
+      child.once("close", (code, signal) => {
+        if (timedOut || parentSignal) return;
+        if (signal) finish({ success: false, installed: false, signal, error: `Installer stopped by ${signal}.` });
+        else if (code === 0) finish({ success: true, installed: true, installedVersion: normalizedTag, exitCode: 0 });
+        else finish({ success: false, installed: false, exitCode: code ?? 1, error: `Installer exited with code ${code ?? 1}.` });
+      });
+    });
+  } catch (error) {
+    return { success: false, installed: false, exitCode: 1, error: error instanceof Error ? error.message : "Update failed." };
+  } finally {
+    installInProgress = false;
+  }
+}
+async function maybeNotifyUpdate(currentVersion, options = {}) {
+  const policy = options.policy;
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), policy) || !parseVersion(currentVersion)) return;
+  const now = Date.now();
+  let cache = readCache();
+  if (!cache || !recent(cache.lastCheckedAt, now)) {
+    const tag2 = await fetchLatestTag();
+    cache = { ...cache, lastCheckedAt: new Date(now).toISOString(), latestVersion: tag2 ?? cache?.latestVersion };
+    writeCache(cache);
+  }
+  const tag = cache.latestVersion;
+  const candidate = tag ? parseVersion(tag) : null;
+  if (!tag || !candidate?.complete || candidate.prerelease.length > 0 || compareVersions(tag, currentVersion) <= 0) return;
+  if (policy !== "automatic") {
+    process.stderr.write(`[0] Update available: ${currentVersion} \u2192 ${tag}. Run 0 upgrade.
+`);
+    return;
+  }
+  if (attemptedAutomaticTags.has(tag) || cache.lastInstallTag === tag && recent(cache.lastInstallAttemptAt, now)) return;
+  attemptedAutomaticTags.add(tag);
+  writeCache({ ...cache, lastInstallTag: tag, lastInstallAttemptAt: new Date(now).toISOString() });
+  if (!process.stderr.isTTY || process.env["TERM"] === "dumb") process.stderr.write(`[0] Updating to ${tag} before starting 0\u2026
+`);
+  const result = await performAutoUpdate({ version: tag });
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.stderr.write(result.success ? `[0] Installed ${result.installedVersion}. This process is still ${currentVersion}; restart to use the update.
+` : `[0] Update not installed: ${result.error ?? "unknown error"} Continuing with ${currentVersion}.
+`);
+}
+async function runStartupUpdate(version) {
+  if (!shouldRunCheck(process.env, Boolean(process.stdout.isTTY), "notify")) return;
+  const { settings, sources } = loadLayeredSettings();
+  const policy = sources.updatePolicy === "global" ? settings.updatePolicy : void 0;
+  if (policy === "automatic") await maybeNotifyUpdate(version, { policy });
+  else if (policy !== "off") void maybeNotifyUpdate(version, { policy });
+}
+
+export {
+  performAutoUpdate,
+  runStartupUpdate
+};

package/chunks/{chunk-CP6HANBE.js → chunk-BD7WULFS.js}

@@ -3,13 +3,14 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-A5QO7N3S.js";
+} from "./chunk-5PFRE522.js";
 import {
+  compareFindingsByBusinessPriority,
   estimateCost,
   modelProvider,
   splitCost,
   validateScanPlan
-} from "./chunk-LTEE2JWK.js";
+} from "./chunk-GXXX7AGH.js";
 
 // packages/core/dist/agent/cost-ledger.js
 var recordedResults = /* @__PURE__ */ new WeakMap();
@@ -307,7 +308,7 @@ async function executeScanPlan(options) {
     await Promise.all(Array.from({ length: concurrency }, worker));
     const fulfilled = reports.filter((report2) => report2 !== void 0);
     const report = { ...fulfilled[0] ?? options.emptyReport() };
-    report.findings = reports.flatMap((current, index) => current?.findings.map((finding) => ({ ...finding, runIndex: index + 1 })) ?? []);
+    report.findings = reports.flatMap((current, index) => current?.findings.map((finding) => ({ ...finding, runIndex: index + 1 })) ?? []).sort(compareFindingsByBusinessPriority);
     const keys = ["totalAttacks", "totalFindings", "critical", "high", "medium", "low", "info"];
     report.summary = Object.fromEntries(keys.map((key) => [key, fulfilled.reduce((sum, current) => sum + current.summary[key], 0)]));
     const incomplete = attempts.filter((attempt) => attempt.status !== "completed");