0sec-cli 0.23.0 → 0.24.1

package/chunks/{chunk-QMICC5O2.js → chunk-BOBIAHKA.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-JEYIWMGL.js";
+} from "./chunk-X2ZMSRTP.js";
 import {
   scanExecutionSignal
-} from "./chunk-CP6HANBE.js";
+} from "./chunk-BD7WULFS.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {

package/chunks/{chunk-VDOWARMJ.js → chunk-BPU6M42R.js}

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  connectionConfigEnvPatch,
+  credentialEnvPatch,
+  loadCredentials
+} from "./chunk-LMP2T4G2.js";
 
 // packages/cli/src/herdr-state.ts
 var sink = null;
@@ -49,6 +54,14 @@ function reportHerdrSessionClose() {
   });
 }
 
+// packages/cli/src/connection-env.ts
+function savedConnectionEnvPatch(env, homeDir) {
+  return {
+    ...connectionConfigEnvPatch(env, homeDir),
+    ...credentialEnvPatch(loadCredentials(homeDir), env)
+  };
+}
+
 export {
   setHerdrSink,
   reportOperatorGate,
@@ -59,5 +72,6 @@ export {
   reportHerdrActivity,
   reportHerdrCompaction,
   reportHerdrSession,
-  reportHerdrSessionClose
+  reportHerdrSessionClose,
+  savedConnectionEnvPatch
 };

package/chunks/{chunk-UELXHK2Y.js → chunk-CGBDEST2.js}

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  getFindingPriority
+} from "./chunk-GXXX7AGH.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {
@@ -273,6 +276,8 @@ function prForSeverity(severity) {
 }
 function metricsForReachability(tier) {
   switch (tier) {
+    case "unknown":
+      return void 0;
     case "remote-unauth":
       return { av: "N", pr: "N", ui: "N" };
     case "remote-auth":
@@ -295,7 +300,7 @@ function suggestCvss(finding) {
   }
   const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
   const ac = "L";
-  const assessed = finding.impactAssessment ? metricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const assessed = finding.impactAssessment && getFindingPriority(finding).assessed ? metricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
   const av = assessed?.av ?? "N";
   const pr = assessed?.pr ?? prForSeverity(finding.severity);
   const ui = assessed?.ui ?? "N";
@@ -991,6 +996,8 @@ function scoreCvss4Vector(vector) {
 }
 function cvss4MetricsForReachability(tier) {
   switch (tier) {
+    case "unknown":
+      return void 0;
     case "remote-unauth":
       return { AV: "N", AT: "N", PR: "N", UI: "N" };
     case "remote-auth":
@@ -1009,7 +1016,7 @@ function cvss4MetricsForReachability(tier) {
 }
 function suggestCvss4(finding) {
   const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
-  const assessed = finding.impactAssessment ? cvss4MetricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const assessed = finding.impactAssessment && getFindingPriority(finding).assessed ? cvss4MetricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
   const AV = assessed?.AV ?? "N";
   const AT = assessed?.AT ?? "N";
   const pr31 = assessed ? assessed.PR : prForSeverity(finding.severity);
@@ -1348,6 +1355,8 @@ function redactAuthHeaders(text) {
 }
 function reachabilityLabel(tier) {
   switch (tier) {
+    case "unknown":
+      return "not established by the available evidence";
     case "remote-unauth":
       return "remote, unauthenticated \u2014 reachable over the network with no credentials";
     case "remote-auth":
@@ -1366,6 +1375,8 @@ function reachabilityLabel(tier) {
 }
 function weaponizabilityLabel(w) {
   switch (w) {
+    case "unknown":
+      return "attacker gains not established by the available evidence";
     case "rce":
       return "remote code execution";
     case "lpe-to-root":
@@ -1471,7 +1482,7 @@ ${ctx.siblingFix.snippet}
   out.push(`**${severity}** \u2014 ${cvss.vector} (~${cvss.score.toFixed(1)})`, "");
   out.push(`_CVSS source: ${cvssSource}._`, "");
   const impactAssessment = finding.impactAssessment;
-  if (impactAssessment) {
+  if (impactAssessment && getFindingPriority(finding).assessed) {
     out.push("# Impact", "");
     out.push(`**Attacker gains:** ${weaponizabilityLabel(impactAssessment.weaponizability)}`, "");
     out.push(`**Attack prerequisites:** ${reachabilityLabel(impactAssessment.reachability_tier)}`, "");
@@ -1568,7 +1579,7 @@ function buildAffectedLine(finding, ctx) {
 }
 function buildImpactNarrative(finding) {
   const a = finding.impactAssessment;
-  if (!a) {
+  if (!a || !getFindingPriority(finding).assessed) {
     return `This ${finding.category.replace(/-/g, " ")} issue is rated **${severityHeading(finding.severity)}**. ` + finding.description.trim();
   }
   const parts = [];
@@ -1581,7 +1592,7 @@ function buildImpactNarrative(finding) {
 }
 function buildAttackScenario(finding) {
   const a = finding.impactAssessment;
-  if (!a)
+  if (!a || !getFindingPriority(finding).assessed)
     return "";
   return `1. Attacker position: ${reachabilityLabel(a.reachability_tier)}.
 2. Trigger the ${finding.category.replace(/-/g, " ")} condition described above.

package/chunks/{remote-workflow-runtime-RGQ5ECMN.js → chunk-CJRZSWII.js}

@@ -4,11 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   BackendIdSchema,
   requireBackendCapability
-} from "./chunk-LTEE2JWK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
 
 // packages/cli/src/remote-workflow-runtime.ts
 var executionSchema = external_exports.object({ id: external_exports.string().min(1).max(160), status: external_exports.enum(["queued", "running", "completed", "failed", "cancelled", "interrupted"]) }).passthrough();
@@ -45,11 +44,18 @@ async function readJson(response) {
   return value;
 }
 async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
-  const backendId = BackendIdSchema.parse(options.backendId);
-  const registry = suppliedRegistry ?? new (await import("./backend-connections-H52NIVH2.js")).BackendConnectionRegistry({ configPath: options.configPath });
-  const connection = await registry.handshake(backendId);
-  if (connection.backend.transport !== "http") throw new Error("Select a registered remote HTTP backend; local execution cannot use this transport.");
-  requireBackendCapability(connection.backend, "workflow-engine");
+  if (options.engineUrl && (options.backendId || options.configPath)) throw new Error("--engine-url cannot be combined with a registered backend.");
+  if (Boolean(options.engineUrl) !== Boolean(options.engineTokenEnv)) throw new Error("Direct engine attachment requires both --engine-url and --engine-token-env.");
+  const backendId = BackendIdSchema.parse(options.backendId ?? (options.engineUrl ? "attached-engine" : void 0));
+  const registry = suppliedRegistry ?? new (await import("./backend-connections-ACIXNYZN.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
+  try {
+    const connection = await registry.handshake(backendId);
+    if (connection.backend.transport !== "http") throw new Error("Select a registered remote HTTP backend; local execution cannot use this transport.");
+    requireBackendCapability(connection.backend, "workflow-engine");
+  } catch (error) {
+    if (!suppliedRegistry) registry.dispose?.();
+    throw error;
+  }
   let disposed = false;
   const active = /* @__PURE__ */ new Set();
   const invoke = async (name, args = {}) => {
@@ -64,17 +70,41 @@ async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
       active.delete(abort);
     }
   };
+  if (options.sessionId !== void 0) {
+    try {
+      external_exports.string().trim().min(1).max(160).parse(options.sessionId);
+      const session = await invoke("attach_session", { sessionId: options.sessionId });
+      if (!session) throw new Error("The selected engine session no longer exists.");
+    } catch (error) {
+      if (!suppliedRegistry) registry.dispose?.();
+      throw error;
+    }
+  }
   return {
+    getCapabilities: () => invoke("get_capabilities"),
+    resumeScan: (request) => invoke("resume_scan", request),
+    listSessions: () => invoke("list_sessions"),
+    createSession: (config) => invoke("create_session", config ? { config } : {}),
+    attachSession: (sessionId) => invoke("attach_session", { sessionId }),
+    getSessionEvents: (sessionId, after) => invoke("get_session_events", { sessionId, ...after !== void 0 ? { after } : {} }),
+    getSession: (sessionId) => invoke("get_session", { sessionId }),
+    sendMessage: (sessionId, text) => invoke("send_message", { sessionId, text }),
+    continueSession: (sessionId, text) => invoke("continue_session", { sessionId, ...text !== void 0 ? { text } : {} }),
+    cancelSession: (sessionId) => invoke("cancel_session", { sessionId }),
+    resolveDecision: (sessionId, decisionId, response) => invoke("resolve_decision", { sessionId, decisionId, response }),
+    listSavedSessions: () => invoke("list_saved_sessions"),
+    resumeSession: (savedSessionId) => invoke("resume_session", { savedSessionId }),
     listTemplates: () => invoke("list_templates"),
     getTemplate: (id) => invoke("get_template", { id }),
     listWorkflows: () => invoke("list_workflows"),
     listRuns: () => invoke("list_runs"),
     getWorkflow: (id) => invoke("get_workflow", { id }),
     saveWorkflow: (definition, expectedRevision) => invoke("save_workflow", { definition, ...expectedRevision !== void 0 ? { expectedRevision } : {} }),
+    startAssessment: async (request) => executionSchema.parse(await invoke("start_assessment", { ...options.sessionId ? { sessionId: options.sessionId } : {}, ...request })),
     startRun: async (request) => {
       if (request.model !== void 0) throw new Error("The selected backend owns its configured model connection.");
       const { model: _model, ...args } = request;
-      return executionSchema.parse(await invoke("start_run", args));
+      return executionSchema.parse(await invoke("start_run", { ...options.sessionId ? { sessionId: options.sessionId } : {}, ...args }));
     },
     getRun: async (id) => {
       const result = await invoke("get_run", { runId: id });
@@ -91,6 +121,7 @@ async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
     }
   };
 }
+
 export {
   createRemoteWorkflowRuntime
 };