0sec-cli 0.24.0 → 0.25.0

package/chunks/{chunk-3XLEDCFX.js → chunk-C6ZMPXN2.js}

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  buildShareUrl
+} from "./chunk-ITHDAIRY.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -8,59 +11,14 @@ import {
   formatHtml,
   formatMarkdown,
   formatSarif
-} from "./chunk-5FHFG5P2.js";
+} from "./chunk-AL32F74R.js";
 import {
   compareFindingsByBusinessPriority,
   createAuditReportDocument,
   createReviewReportDocument,
   createScanReportDocument,
   getFindingPriority
-} from "./chunk-RZR2XXAK.js";
-
-// packages/cli/src/utils.ts
-import { gzipSync } from "zlib";
-async function getRuntimeAvailability() {
-  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-AJU25UXA.js");
-  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
-  const hasApiKey = apiRuntimeDiagnostics.valid;
-  const availableRuntimes = [...await detectAvailableRuntimes()];
-  return {
-    hasApiKey,
-    availableRuntimes,
-    apiRuntime: {
-      configured: apiRuntimeDiagnostics.reason !== "missing_key",
-      valid: apiRuntimeDiagnostics.valid,
-      providerLabel: apiRuntimeDiagnostics.providerLabel,
-      error: apiRuntimeDiagnostics.fatalError
-    }
-  };
-}
-async function checkRuntimeAvailability(runtime) {
-  const availability = await getRuntimeAvailability();
-  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
-  if (hasApiKey) return;
-  console.log("");
-  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
-    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
-  }
-  if (runtime === "api") {
-    console.log(source_default.yellow(
-      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
-    ));
-  } else if (availableRuntimes.length > 0) {
-    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
-  } else {
-    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
-  }
-  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
-  console.log("");
-}
-function buildShareUrl(report) {
-  const json = JSON.stringify(report);
-  const compressed = gzipSync(Buffer.from(json, "utf-8"));
-  const b64 = compressed.toString("base64url");
-  return `https://0.security/r#${b64}`;
-}
+} from "./chunk-S3B6HFSM.js";
 
 // packages/cli/src/formatters/terminal.ts
 var SEVERITY_COUNT_COLOR = {
@@ -554,9 +512,6 @@ function formatReviewReport(report, format) {
 
 export {
   renderReplay,
-  getRuntimeAvailability,
-  checkRuntimeAvailability,
-  buildShareUrl,
   TIMELINE_FORMATS,
   isTimelineFormat,
   formatTimeline,

package/chunks/{chunk-4TUR47H5.js → chunk-D4IBEO2K.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   VERSION
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
 
 // packages/cli/src/tui/runtime.ts
 function getReleaseChannel(env = process.env) {

package/chunks/{chunk-EXTN4SQV.js → chunk-DHNYJ2ML.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-O6KPVYOI.js";
 import {
   LlmApiRuntime
-} from "./chunk-EYBMTELO.js";
+} from "./chunk-EIONVEFN.js";
 import {
   readCacheUsage
 } from "./chunk-RS4MAN3Q.js";

package/chunks/{chunk-Y7KV7WV6.js → chunk-DJGJECBV.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-BIJPMYFA.js";
+} from "./chunk-3T5R7P4T.js";
 import {
   isScopeEnforcementEnabled
-} from "./chunk-RBOMXUYL.js";
+} from "./chunk-27SXCYWH.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/bench/improvement-promotion.js
 import { createHash } from "node:crypto";
@@ -184,7 +184,7 @@ function verifyImprovementLedger(entries) {
 // packages/core/dist/improvement/config.js
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, resolve, sep } from "node:path";
 var relativePath = external_exports.string().min(1).max(512).refine((value) => !isAbsolute(value) && !value.includes("\\") && !value.includes("\0") && value !== "." && value.split("/").every((part) => part !== ".." && part !== "" && part !== "."), "must be a normalized relative file or directory path (not the entire workspace)");
 var argv = external_exports.array(external_exports.string().max(8192).refine((value) => !value.includes("\0"))).min(1).max(128).refine((value) => value[0].length > 0, "executable must not be empty");
 var finitePositive = external_exports.number().finite().positive();
@@ -200,11 +200,17 @@ var schema = external_exports.object({
   kind: external_exports.enum(["source", "skill", "router", "lens"]).default("source"),
   command: argv,
   buildCommand: argv.optional(),
+  observationStorePath: external_exports.string().min(1).max(4096).optional(),
   cases: external_exports.array(external_exports.object({
     id: external_exports.string().min(1).max(128),
     lane: external_exports.enum(["development", "held-out", "negative-control"]),
     input: external_exports.unknown(),
-    expected: external_exports.unknown()
+    expected: external_exports.unknown(),
+    curation: external_exports.object({
+      observationId: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      approvalDigest: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/),
+      fixtureDigest: external_exports.string().regex(/^(?:sha256:)?[a-f0-9]{64}$/)
+    }).strict().optional()
   }).strict()).min(3).max(1e3),
   repeats: external_exports.number().int().min(2).max(20).default(3),
   maxIterations: external_exports.number().int().min(1).max(100).default(3),
@@ -229,12 +235,24 @@ var schema = external_exports.object({
     minimumHeldOutLift: finitePositive.max(1).default(DEFAULT_IMPROVEMENT_PROMOTION_POLICY.minimumHeldOutLift),
     maximumNegativeControlFpDelta: external_exports.literal(0).default(0),
     maximumCostMultiplier: finitePositive.max(10).default(DEFAULT_IMPROVEMENT_PROMOTION_POLICY.maximumCostMultiplier)
-  }).strict().default({}),
+  }).strict().prefault({}),
   safety: external_exports.object({
     enabled: external_exports.boolean().default(false),
-    holdoutExposureLimit: external_exports.number().int().min(1).max(1e6)
+    holdoutExposureLimit: external_exports.number().int().min(1).max(1e6),
+    workerModel: external_exports.object({
+      provider: external_exports.string().min(1).max(128),
+      model: external_exports.string().min(1).max(256),
+      maxCostUsdPerExecution: finitePositive.max(1e3)
+    }).strict().optional()
   }).strict().optional(),
-  maxAlternativeParents: external_exports.number().int().min(0).max(10).optional()
+  maxAlternativeParents: external_exports.number().int().min(0).max(10).optional(),
+  retentionPolicy: external_exports.object({
+    profileId: external_exports.string().min(1).max(128),
+    version: external_exports.number().int().min(1),
+    criticalCaseIds: external_exports.array(external_exports.string().min(1).max(128)).min(1).max(128),
+    previousProfileDigest: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+    rotationApprovalRef: external_exports.string().min(1).max(512).optional()
+  }).strict().optional()
 }).strict();
 function canonicalEvolutionJson(value) {
   if (value === null || typeof value === "string" || typeof value === "boolean")
@@ -248,8 +266,27 @@ function canonicalEvolutionJson(value) {
   }
   throw new Error("evolution cases must contain finite JSON values only");
 }
+function physicalProspectivePath(path) {
+  let cursor = path;
+  const suffix = [];
+  while (!existsSync(cursor)) {
+    const parent = dirname(cursor);
+    if (parent === cursor)
+      throw new Error("cannot resolve evolution path authority");
+    suffix.unshift(basename(cursor));
+    cursor = parent;
+  }
+  return resolve(realpathSync(cursor), ...suffix);
+}
 function parseEvolutionConfig(raw, baseDir = process.cwd()) {
   const parsed = schema.parse(raw);
+  if (parsed.safety?.workerModel && !parsed.safety.enabled) {
+    throw new Error("model-backed evolution workers require enabled durable safety accounting");
+  }
+  if (parsed.cases.some((entry) => entry.curation) && !parsed.observationStorePath)
+    throw new Error("curated fixtures require an authoritative observation store");
+  if (parsed.observationStorePath)
+    parsed.observationStorePath = resolve(baseDir, parsed.observationStorePath);
   const admitted = isAdmittedSmolvmWorkbench();
   if (admitted) {
     if (parsed.imageArchive)
@@ -286,6 +323,17 @@ function parseEvolutionConfig(raw, baseDir = process.cwd()) {
       throw new Error(`${lane} requires at least ${parsed.promotionPolicy.minimumCases} distinct cases`);
     }
   }
+  if (parsed.retentionPolicy) {
+    const ids = parsed.retentionPolicy.criticalCaseIds;
+    if (new Set(ids).size !== ids.length)
+      throw new Error("retention panel contains duplicate cases");
+    for (const id of ids) {
+      const fixture = parsed.cases.find((entry) => entry.id === id);
+      if (!fixture || fixture.lane === "development") {
+        throw new Error("retention panel must reference existing sealed held-out or negative-control cases");
+      }
+    }
+  }
   for (const edit of parsed.editablePaths) {
     if (!parsed.sourcePaths.some((source) => edit === source || edit.startsWith(`${source}/`))) {
       throw new Error(`editable path ${edit} is not inside a selected source path`);
@@ -297,6 +345,11 @@ function parseEvolutionConfig(raw, baseDir = process.cwd()) {
     throw new Error("evolution store cannot be the source workspace");
   for (const selected of parsed.sourcePaths) {
     const source = resolve(sourceRoot, selected);
+    const observationStore = parsed.observationStorePath && physicalProspectivePath(parsed.observationStorePath);
+    const physicalSource = observationStore ? physicalProspectivePath(source) : source;
+    if (observationStore && (observationStore === physicalSource || observationStore.startsWith(`${physicalSource}${sep}`))) {
+      throw new Error("private observation queue cannot overlap selected model-readable source paths");
+    }
     if (storePath === source || storePath.startsWith(`${source}/`) || source.startsWith(`${storePath}/`)) {
       throw new Error("evolution store and selected source paths must not overlap");
     }
@@ -624,7 +677,7 @@ async function evaluateVerificationSpec(spec, repoRoot) {
 // packages/core/dist/improvement/artifacts.js
 import { randomUUID } from "node:crypto";
 import { closeSync, constants, fchmodSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync as readFileSync2, realpathSync as realpathSync2, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute as isAbsolute3, join as join2, parse, resolve as resolve3, sep as sep3 } from "node:path";
+import { dirname as dirname2, isAbsolute as isAbsolute3, join as join2, parse, resolve as resolve3, sep as sep3 } from "node:path";
 var MAX_ARTIFACT_BYTES = 128 * 1024 * 1024;
 function hasCode(error, code) {
   return error instanceof Error && "code" in error && error.code === code;
@@ -686,7 +739,7 @@ function ensureEvolutionDirectory(path) {
   return inspectDirectories(path, true);
 }
 function readEvolutionArtifact(path) {
-  inspectDirectories(dirname(path), false);
+  inspectDirectories(dirname2(path), false);
   const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const stat = fstatSync(fd);
@@ -704,7 +757,7 @@ function publishEvolutionArtifact(path, value) {
   const content = canonicalEvolutionJson(value);
   if (Buffer.byteLength(content) > MAX_ARTIFACT_BYTES)
     throw new Error("evolution artifact exceeds retention limit");
-  const directory = ensureEvolutionDirectory(dirname(path));
+  const directory = ensureEvolutionDirectory(dirname2(path));
   const temporary = join2(directory, `.artifact-${randomUUID()}.tmp`);
   const fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
   try {
@@ -737,7 +790,7 @@ function publishEvolutionArtifact(path, value) {
 
 // packages/core/dist/agent/apply-patch.js
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2 } from "node:path";
+import { dirname as dirname3 } from "node:path";
 var BEGIN = "*** Begin Patch";
 var END = "*** End Patch";
 function parsePatch(input) {
@@ -848,7 +901,7 @@ function applyPatchOps(ops, pathResolver) {
       if (!op.overwrite && existsSync2(abs)) {
         throw new Error(`apply_patch: Add File "${op.path}" failed \u2014 file already exists. Use "*** Replace File: ${op.path}" to overwrite.`);
       }
-      mkdirSync2(dirname2(abs), { recursive: true });
+      mkdirSync2(dirname3(abs), { recursive: true });
       writeFileSync2(abs, op.contents, "utf-8");
       applied.push({ kind: "add", path: op.path });
       continue;
@@ -930,9 +983,20 @@ function applyOneHunk(lines, anchorIdx, hunk, logicalPath) {
   return { newLines, consumed: cursor - anchorIdx };
 }
 
+// packages/core/dist/scope/local-source-boundary.js
+import { AsyncLocalStorage } from "node:async_hooks";
+import { realpathSync as realpathSync3 } from "node:fs";
+var boundary = new AsyncLocalStorage();
+function getLocalSourceBoundary() {
+  return boundary.getStore();
+}
+function withLocalSourceBoundary(root, run) {
+  return root === void 0 ? run() : boundary.run(realpathSync3(root), run);
+}
+
 // packages/core/dist/agent/tools/scope-path.js
-import { lstatSync as lstatSync2, realpathSync as realpathSync3 } from "node:fs";
-import { basename, dirname as dirname3, isAbsolute as isAbsolute4, resolve as resolve4, sep as sep4 } from "node:path";
+import { lstatSync as lstatSync2, realpathSync as realpathSync4 } from "node:fs";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, resolve as resolve4, sep as sep4 } from "node:path";
 function pathEntryExists(path) {
   try {
     lstatSync2(path);
@@ -947,26 +1011,33 @@ function canonicalizePath(path) {
   const missingSegments = [];
   let existingPath = path;
   while (!pathEntryExists(existingPath)) {
-    const parent = dirname3(existingPath);
+    const parent = dirname4(existingPath);
     if (parent === existingPath) {
       throw new Error(`Path does not have an existing parent: ${path}`);
     }
-    missingSegments.unshift(basename(existingPath));
+    missingSegments.unshift(basename2(existingPath));
     existingPath = parent;
   }
-  return resolve4(realpathSync3(existingPath), ...missingSegments);
+  return resolve4(realpathSync4(existingPath), ...missingSegments);
 }
 function isScopedPath(scopePath, inputPath) {
-  const root = realpathSync3(scopePath);
+  const root = realpathSync4(scopePath);
   const logicalCandidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(root, inputPath);
   const candidate = canonicalizePath(logicalCandidate);
   return candidate === root || candidate.startsWith(root + sep4);
 }
 function resolveScopedPath(scopePath, inputPath) {
+  const boundary2 = getLocalSourceBoundary();
+  if (boundary2) {
+    const base = scopePath ? realpathSync4(scopePath) : process.cwd();
+    const candidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(base, inputPath);
+    if (!isScopedPath(boundary2, candidate))
+      throw new Error(`Path escapes the approved source folder: ${inputPath}`);
+  }
   if (isScopeEnforcementEnabled() && (!scopePath || !isScopedPath(scopePath, inputPath))) {
     throw new Error(`Path escapes the allowed scope: ${inputPath}`);
   }
-  const root = scopePath ? realpathSync3(scopePath) : process.cwd();
+  const root = scopePath ? realpathSync4(scopePath) : process.cwd();
   const logicalCandidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(root, inputPath);
   return canonicalizePath(logicalCandidate);
 }
@@ -986,5 +1057,7 @@ export {
   evaluateVerificationSpec,
   parsePatch,
   applyPatchOps,
+  getLocalSourceBoundary,
+  withLocalSourceBoundary,
   resolveScopedPath
 };

package/chunks/{chunk-UHUW45S3.js → chunk-DMDWIW3E.js}

@@ -3,19 +3,19 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createRemoteWorkflowRuntime
-} from "./chunk-ZPFBQ3SD.js";
+} from "./chunk-GOUGG7IQ.js";
 import {
   BackendConnectionRegistry
-} from "./chunk-TZRHWP7R.js";
+} from "./chunk-SEWZ76MN.js";
 import {
   resolveOsecDbPath
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-YXTV2FRE.js";
 import {
   homeStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/cli/src/local-engine.ts
 import { createHash, randomUUID } from "node:crypto";