0sec-cli 0.24.0 → 0.25.0

package/chunks/chunk-HJKJ4NQP.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  installPackageForEcosystem,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath,
+  resolveLocalTargetPath
+} from "./chunk-2J3STRJT.js";
+
+// packages/core/dist/prepare.js
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { join, basename } from "node:path";
+import { randomUUID } from "node:crypto";
+import { tmpdir } from "node:os";
+function detectTargetType(target) {
+  if (target.startsWith("git@") || target.startsWith("git://") || target.endsWith(".git") || target.startsWith("https://github.com/")) {
+    return "source-code";
+  }
+  if (target.startsWith("http://") || target.startsWith("https://")) {
+    return "url";
+  }
+  if (isExplicitLocalTargetPath(target) || isExistingLocalTargetPath(target)) {
+    return "source-code";
+  }
+  if (/^(@[a-z0-9-]+\/)?[a-z0-9][a-z0-9._-]*(@.*)?$/.test(target)) {
+    return "npm-package";
+  }
+  return "source-code";
+}
+function installPackage(ecosystem, packageName, requestedVersion, emit) {
+  return installPackageForEcosystem(ecosystem, packageName, requestedVersion, emit);
+}
+function resolveRepo(repo, emit) {
+  const isUrl = repo.startsWith("https://") || repo.startsWith("http://") || repo.startsWith("git@") || repo.startsWith("git://");
+  if (!isUrl) {
+    const absPath = resolveLocalTargetPath(repo);
+    if (!existsSync(absPath)) {
+      throw new Error(`Repository path not found: ${absPath}`);
+    }
+    return { repoPath: absPath, cloned: false };
+  }
+  const tempDir = join(tmpdir(), `0-review-${randomUUID().slice(0, 8)}`);
+  mkdirSync(tempDir, { recursive: true });
+  emit({
+    type: "stage:start",
+    stage: "discovery",
+    message: `Cloning ${repo}...`
+  });
+  try {
+    execFileSync("git", ["clone", "--depth", "1", repo, `${tempDir}/repo`], {
+      timeout: 12e4,
+      stdio: "pipe"
+    });
+  } catch (err) {
+    rmSync(tempDir, { recursive: true, force: true });
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`Failed to clone ${repo}: ${msg}`);
+  }
+  const repoPath = join(tempDir, "repo");
+  emit({
+    type: "stage:end",
+    stage: "discovery",
+    message: `Cloned ${basename(repo.replace(/\.git$/, ""))}`
+  });
+  return { repoPath, cloned: true, tempDir };
+}
+async function validateUrl(url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 1e4);
+  try {
+    const res = await fetch(url, {
+      method: "HEAD",
+      signal: controller.signal,
+      redirect: "follow"
+    });
+    if (!res.ok) {
+      throw new Error(`URL returned HTTP ${res.status}: ${url}`);
+    }
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`URL unreachable (timeout): ${url}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function prepare(target, type, opts, emit) {
+  switch (type) {
+    case "npm-package": {
+      let packageName = target;
+      let version = opts.packageVersion;
+      const atIdx = target.startsWith("@") ? target.indexOf("@", 1) : target.indexOf("@");
+      if (atIdx > 0) {
+        packageName = target.slice(0, atIdx);
+        version = version ?? target.slice(atIdx + 1);
+      }
+      const pkg = installPackage("npm", packageName, version, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "pypi-package": {
+      const pkg = installPackage("pypi", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "cargo-package": {
+      const pkg = installPackage("cargo", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "oci-image": {
+      const pkg = installPackage("oci", target, opts.packageVersion, emit);
+      return {
+        targetType: type,
+        resolvedTarget: pkg.path,
+        packageInfo: pkg,
+        cleanup: () => {
+          try {
+            rmSync(pkg.tempDir, { recursive: true, force: true });
+          } catch {
+          }
+        }
+      };
+    }
+    case "source-code": {
+      const { repoPath, cloned, tempDir } = resolveRepo(target, emit);
+      return {
+        targetType: type,
+        resolvedTarget: repoPath,
+        repoPath,
+        cleanup: () => {
+          if (cloned && tempDir) {
+            try {
+              rmSync(tempDir, { recursive: true, force: true });
+            } catch {
+            }
+          }
+        }
+      };
+    }
+    case "url":
+    case "web-app": {
+      await validateUrl(target);
+      emit({
+        type: "stage:end",
+        stage: "discovery",
+        message: `URL reachable: ${target}`
+      });
+      return {
+        targetType: type,
+        resolvedTarget: target,
+        cleanup: () => {
+        }
+      };
+    }
+    default: {
+      const _exhaustive = type;
+      throw new Error(`Unknown target type: ${_exhaustive}`);
+    }
+  }
+}
+
+export {
+  detectTargetType,
+  prepare
+};

package/chunks/{chunk-RPTO5FY2.js → chunk-I4VIAQHM.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-A6AZZ6XX.js → chunk-ITEMDJAB.js}

@@ -8,13 +8,13 @@ import {
   parsePatch,
   readEvolutionArtifact,
   resolveScopedPath
-} from "./chunk-Y7KV7WV6.js";
+} from "./chunk-DJGJECBV.js";
 import {
   homeStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/fix/source-fix.js
 import { execFile } from "node:child_process";

package/chunks/chunk-ITHDAIRY.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  source_default
+} from "./chunk-HLFS6WV2.js";
+
+// packages/cli/src/utils.ts
+import { gzipSync } from "zlib";
+async function getRuntimeAvailability() {
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-6RNAVFAY.js");
+  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
+  const hasApiKey = apiRuntimeDiagnostics.valid;
+  const availableRuntimes = [...await detectAvailableRuntimes()];
+  return {
+    hasApiKey,
+    availableRuntimes,
+    apiRuntime: {
+      configured: apiRuntimeDiagnostics.reason !== "missing_key",
+      valid: apiRuntimeDiagnostics.valid,
+      providerLabel: apiRuntimeDiagnostics.providerLabel,
+      error: apiRuntimeDiagnostics.fatalError
+    }
+  };
+}
+async function checkRuntimeAvailability(runtime) {
+  const availability = await getRuntimeAvailability();
+  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
+  if (hasApiKey) return;
+  console.log("");
+  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
+    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
+  }
+  if (runtime === "api") {
+    console.log(source_default.yellow(
+      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
+    ));
+  } else if (availableRuntimes.length > 0) {
+    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
+  } else {
+    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
+  }
+  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
+  console.log("");
+}
+function buildShareUrl(report) {
+  const json = JSON.stringify(report);
+  const compressed = gzipSync(Buffer.from(json, "utf-8"));
+  const b64 = compressed.toString("base64url");
+  return `https://0.security/r#${b64}`;
+}
+
+export {
+  getRuntimeAvailability,
+  checkRuntimeAvailability,
+  buildShareUrl
+};

package/chunks/{chunk-TOFIGQ63.js → chunk-JCRQV4FE.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   executeWorkflow
-} from "./chunk-V5I5GAQH.js";
+} from "./chunk-EEP6GBUO.js";
 import {
   SecurityWorkflowStore
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-YXTV2FRE.js";
 
 // packages/cli/src/managed-operation.ts
 async function executeManagedOperation(options, dependencies = { store: (path) => new SecurityWorkflowStore(path) }) {

package/chunks/{chunk-SQCBHFWN.js → chunk-LWMEJYCP.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   external_exports
-} from "./chunk-VIT5ALXF.js";
+} from "./chunk-5XOYTAOK.js";
 
 // packages/core/dist/protocol/http-conformance.js
 import { randomUUID } from "node:crypto";
@@ -20,7 +20,7 @@ var HTTP_SURFACES = ["method", "header", "status"];
 var httpExerciseSchema = external_exports.object({
   method: external_exports.string().min(1),
   path: external_exports.string().optional(),
-  headers: external_exports.record(external_exports.string()).optional(),
+  headers: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   body: external_exports.string().optional()
 }).strict();
 var conformanceRuleSchema = external_exports.object({

package/chunks/{chunk-52AWIBCT.js → chunk-MY44EZKD.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createPresentationEvent
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
 
 // packages/core/dist/events/bus.js
 function presentationEventSink(sink, options = {}) {

package/chunks/{chunk-SGILXLR3.js → chunk-NBLKIQCW.js}

@@ -2,20 +2,237 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
-  spinnerGlyph
-} from "./chunk-GNR3APR6.js";
+  presentationEventBus
+} from "./chunk-S4DFH2FJ.js";
 import {
   loadLayeredSettings
-} from "./chunk-QEA2VHBD.js";
+} from "./chunk-6TA3CWND.js";
 import {
+  createPresentationEvent,
   homeStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-S3B6HFSM.js";
+
+// packages/cli/src/presentation/process-output.ts
+import { format } from "node:util";
+var streamBridgeSuppressionDepth = 0;
+var activeStreamBridge = null;
+function currentPresentationTimestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function createProcessPresentationOutput(options = {}) {
+  const stdout = options.stdout ?? { write: process.stdout.write.bind(process.stdout) };
+  const stderr = options.stderr ?? { write: process.stderr.write.bind(process.stderr) };
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const write = (channel, target, text, eventType) => {
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      target.write(text);
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    options.onEvent?.(event);
+    return event;
+  };
+  return {
+    stdout(text, eventType = "output.stdout") {
+      return write("stdout", stdout, text, eventType);
+    },
+    stderr(text, eventType = "output.stderr") {
+      return write("stderr", stderr, text, eventType);
+    }
+  };
+}
+function createConsolePresentationOutput(options = {}) {
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const emit = (channel, text, eventType) => {
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      if (channel === "stdout") {
+        (options.log ?? console.log)(text);
+      } else {
+        (options.error ?? console.error)(text);
+      }
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    options.onEvent?.(event);
+    return event;
+  };
+  return {
+    stdout(text, eventType = "output.stdout") {
+      return emit("stdout", text, eventType);
+    },
+    stderr(text, eventType = "output.stderr") {
+      return emit("stderr", text, eventType);
+    }
+  };
+}
+var consolePresentationOutput = createConsolePresentationOutput({
+  onEvent(event) {
+    presentationEventBus.emit(event);
+  }
+});
+function installConsolePresentationBridge(options = {}) {
+  const target = options.target ?? console;
+  const originals = {
+    log: target.log,
+    info: target.info,
+    warn: target.warn,
+    error: target.error
+  };
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  const emit = (method, channel, args, eventType) => {
+    const text = format(...args);
+    if (streamBridgeSuppressionDepth > 0) {
+      originals[method].call(target, text);
+      return;
+    }
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType,
+      payload: { channel, text }
+    });
+    streamBridgeSuppressionDepth += 1;
+    try {
+      originals[method].call(target, text);
+    } finally {
+      streamBridgeSuppressionDepth -= 1;
+    }
+    presentationEventBus.emit(event);
+    options.onEvent?.(event);
+  };
+  const bridgedLog = (...args) => emit("log", "stdout", args, "output.console.log");
+  const bridgedInfo = (...args) => emit("info", "stdout", args, "output.console.info");
+  const bridgedWarn = (...args) => emit("warn", "stderr", args, "output.console.warn");
+  const bridgedError = (...args) => emit("error", "stderr", args, "output.console.error");
+  target.log = bridgedLog;
+  target.info = bridgedInfo;
+  target.warn = bridgedWarn;
+  target.error = bridgedError;
+  return {
+    restore() {
+      if (target.log === bridgedLog) target.log = originals.log;
+      if (target.info === bridgedInfo) target.info = originals.info;
+      if (target.warn === bridgedWarn) target.warn = originals.warn;
+      if (target.error === bridgedError) target.error = originals.error;
+    }
+  };
+}
+function installProcessPresentationStreamBridge(options = {}) {
+  if (activeStreamBridge) return activeStreamBridge;
+  const source = options.source ?? "cli";
+  const now = options.now ?? currentPresentationTimestamp;
+  let sequence = 0;
+  let suspended = false;
+  const streams = [];
+  const emit = (channel, chunk, encoding) => {
+    const text = typeof chunk === "string" ? chunk : chunk instanceof Uint8Array ? Buffer.from(chunk).toString(typeof encoding === "string" ? encoding : "utf8") : String(chunk ?? "");
+    if (channel === "stdout" && text.startsWith("ZERO_EVENT_")) return;
+    const event = createPresentationEvent({
+      source,
+      sequence: ++sequence,
+      at: now(),
+      eventType: channel === "stdout" ? "output.stream.stdout" : "output.stream.stderr",
+      payload: { channel, text }
+    });
+    presentationEventBus.emit(event);
+    options.onEvent?.(event);
+  };
+  for (const [channel, stream] of [
+    ["stdout", options.stdout ?? process.stdout],
+    ["stderr", options.stderr ?? process.stderr]
+  ]) {
+    const original = stream.write;
+    const patched = ((chunk, encoding, callback) => {
+      const result = original.call(stream, chunk, encoding, callback);
+      if (!suspended && streamBridgeSuppressionDepth === 0) emit(channel, chunk, encoding);
+      return result;
+    });
+    streams.push({ channel, stream, original, patched });
+  }
+  const bridge = {
+    suspend() {
+      if (suspended) return;
+      suspended = true;
+      for (const item of streams) {
+        if (item.stream.write === item.patched) item.stream.write = item.original;
+      }
+    },
+    resume() {
+      if (!suspended) return;
+      suspended = false;
+      for (const item of streams) {
+        if (item.stream.write === item.original) item.stream.write = item.patched;
+      }
+    },
+    restore() {
+      for (const item of streams) {
+        if (item.stream.write === item.patched) item.stream.write = item.original;
+      }
+      if (activeStreamBridge === bridge) activeStreamBridge = null;
+    }
+  };
+  for (const item of streams) item.stream.write = item.patched;
+  activeStreamBridge = bridge;
+  return bridge;
+}
+var processPresentationOutput = createProcessPresentationOutput({
+  onEvent(event) {
+    presentationEventBus.emit(event);
+  }
+});
+function writePresentationLine(text, eventType = "output.stdout") {
+  return processPresentationOutput.stdout(`${text}
+`, eventType);
+}
 
 // packages/cli/src/utils/update-check.ts
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 
+// packages/cli/src/tui/animations.ts
+function safeFrame(frame) {
+  if (!Number.isFinite(frame)) return 0;
+  const t = Math.trunc(frame);
+  return t < 0 ? 0 : t;
+}
+var SPINNER_PERIOD = 8;
+var TOAST_ENTER_FRAMES = 6;
+var TOAST_HOLD_FRAMES = 28;
+var TOAST_EXIT_FRAMES = 6;
+var TOAST_TOTAL_FRAMES = TOAST_ENTER_FRAMES + TOAST_HOLD_FRAMES + TOAST_EXIT_FRAMES;
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827"];
+function spinnerFrame(frame, opts = {}) {
+  if (opts.reduceMotion) return 0;
+  return safeFrame(frame) % SPINNER_PERIOD;
+}
+function spinnerGlyph(frame, opts = {}) {
+  return SPINNER_FRAMES[spinnerFrame(frame, opts)] ?? SPINNER_FRAMES[0];
+}
+
 // packages/cli/src/utils/terminal-progress.ts
 function terminalProgress(label, output = process.stderr, reduceMotion = false) {
   const animated = Boolean(output.isTTY && process.env["TERM"] !== "dumb");
@@ -284,6 +501,11 @@ async function runStartupUpdate(version) {
 }
 
 export {
+  consolePresentationOutput,
+  installConsolePresentationBridge,
+  installProcessPresentationStreamBridge,
+  processPresentationOutput,
+  writePresentationLine,
   performAutoUpdate,
   runStartupUpdate
 };

package/chunks/chunk-NO543ZBU.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  expandHomePath,
+  isExistingLocalTargetPath,
+  isExplicitLocalTargetPath
+} from "./chunk-2J3STRJT.js";
+
+// packages/cli/src/engagement-plan.ts
+var PACKAGE_PREFIXES = {
+  "npm:": { ecosystem: "npm", targetType: "npm-package" },
+  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
+  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
+  "oci:": { ecosystem: "oci", targetType: "oci-image" }
+};
+function resolveEngagement(rawTarget) {
+  const raw = rawTarget.trim();
+  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
+  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
+    if (!raw.startsWith(prefix)) continue;
+    const target = raw.slice(prefix.length).trim();
+    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
+    return {
+      ok: true,
+      plan: {
+        kind: "package",
+        target,
+        targetType: packagePlan.targetType,
+        ecosystem: packagePlan.ecosystem,
+        label: `${packagePlan.ecosystem} package ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("source:")) {
+    const target = raw.slice("source:".length).trim();
+    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: expandHomePath(target),
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target: raw,
+        targetType: "source-code",
+        label: `source review ${raw}`
+      }
+    };
+  }
+  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
+    return {
+      ok: true,
+      plan: {
+        kind: "web",
+        target: raw,
+        targetType: "url",
+        label: `web target ${raw}`
+      }
+    };
+  }
+  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
+    const target = expandHomePath(raw);
+    return {
+      ok: true,
+      plan: {
+        kind: "source",
+        target,
+        targetType: "source-code",
+        label: `source review ${target}`
+      }
+    };
+  }
+  return {
+    ok: false,
+    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
+  };
+}
+
+export {
+  resolveEngagement
+};