0sec-cli 0.24.0 → 0.25.0

package/chunks/chunk-JSTLXPJS.js

@@ -1,284 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  inspectLensRegistry,
-  lastGreen,
-  loadLedger,
-  loadManifest,
-  makeFinderLensProbe,
-  retireArchetype,
-  runLensSynthesisLoop
-} from "./chunk-V5I5GAQH.js";
-import {
-  harvestMissesFromLedgerEntry,
-  mergeHarvestedMisses
-} from "./chunk-A3EKBUEM.js";
-
-// packages/cli/src/commands/lens-synth.ts
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function parseFixtures(value, label) {
-  if (value === void 0) return [];
-  if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
-  return value.map((entry, i) => {
-    if (!isRecord(entry)) throw new Error(`${label}[${i}] must be an object`);
-    const id = entry.id;
-    const path = entry.path;
-    if (typeof id !== "string" || id.trim() === "") throw new Error(`${label}[${i}].id must be a non-empty string`);
-    if (typeof path !== "string" || path.trim() === "") throw new Error(`${label}[${i}].path must be a non-empty string`);
-    const fixture = { id, path };
-    if (typeof entry.note === "string") fixture.note = entry.note;
-    if (typeof entry.expectedCwe === "string") fixture.expectedCwe = entry.expectedCwe;
-    if (typeof entry.expectedFile === "string") fixture.expectedFile = entry.expectedFile;
-    if (typeof entry.expectedLine === "number" && Number.isFinite(entry.expectedLine)) {
-      fixture.expectedLine = entry.expectedLine;
-    }
-    if (Array.isArray(entry.expectedRange) && entry.expectedRange.length === 2 && typeof entry.expectedRange[0] === "number" && typeof entry.expectedRange[1] === "number") {
-      fixture.expectedRange = [entry.expectedRange[0], entry.expectedRange[1]];
-    }
-    if (typeof entry.contentDigest === "string") fixture.contentDigest = entry.contentDigest;
-    if (typeof entry.cleanProvenance === "string") fixture.cleanProvenance = entry.cleanProvenance;
-    return fixture;
-  });
-}
-function parseMissInputFile(raw) {
-  if (!isRecord(raw)) throw new Error("miss-input must be a JSON object");
-  const missesRaw = isRecord(raw.misses) ? raw.misses : {};
-  const corpusRaw = isRecord(raw.corpus) ? raw.corpus : {};
-  const misses = {
-    ...Array.isArray(missesRaw.confirmedMisses) ? { confirmedMisses: missesRaw.confirmedMisses } : {},
-    ...Array.isArray(missesRaw.incompleteCoverage) ? { incompleteCoverage: missesRaw.incompleteCoverage } : {},
-    ...Array.isArray(missesRaw.curatedCandidates) ? { curatedCandidates: missesRaw.curatedCandidates } : {}
-  };
-  const heldOutFixtures = parseFixtures(corpusRaw.heldOut, "corpus.heldOut");
-  const corpus = {
-    positives: parseFixtures(corpusRaw.positives, "corpus.positives"),
-    negativeControls: parseFixtures(corpusRaw.negativeControls, "corpus.negativeControls"),
-    ...heldOutFixtures.length > 0 ? { heldOut: heldOutFixtures } : {},
-    ...typeof corpusRaw.baselineDigest === "string" ? { baselineDigest: corpusRaw.baselineDigest } : {}
-  };
-  if (corpus.positives.length === 0) {
-    throw new Error("corpus.positives must contain at least one fixture (the seeded miss) \u2014 the loop is fail-closed without it");
-  }
-  if (corpus.negativeControls.length === 0) {
-    throw new Error("corpus.negativeControls must contain at least one fixture \u2014 the loop cannot measure FP regression without it");
-  }
-  if (!corpus.heldOut || corpus.heldOut.length === 0) {
-    throw new Error("corpus.heldOut must contain at least one fixture \u2014 held-out positives are required to demonstrate generalisation beyond development misses");
-  }
-  return { misses, corpus };
-}
-async function harvestBenchMisses(fromBench, manifestPath) {
-  const ledger = await loadLedger(resolve(fromBench));
-  const entry = lastGreen(ledger) ?? ledger.entries[ledger.entries.length - 1];
-  if (!entry) throw new Error(`--from-bench: ledger ${fromBench} has no entries to harvest`);
-  const manifest = await loadManifest(resolve(manifestPath));
-  const result = harvestMissesFromLedgerEntry(entry, manifest);
-  return { misses: result.misses, result };
-}
-function trialCount(value) {
-  const count = value ?? 2;
-  if (!Number.isSafeInteger(count) || count < 2 || count > 10) throw new Error("--trials must be an integer between 2 and 10");
-  return count;
-}
-async function runLensSynthesisInput(input, opts, deps = {}) {
-  const trials = trialCount(opts.trials);
-  const log = deps.log ?? (() => {
-  });
-  const probe = deps.probe ?? makeFinderLensProbe({ log });
-  return runLensSynthesisLoop(input, {
-    ...deps.model ? { model: deps.model } : {},
-    ...opts.model ? { modelId: opts.model } : {},
-    probe,
-    ...opts.registry ? { registryPath: resolve(opts.registry) } : {},
-    maxRegistrations: opts.maxRegister ?? 1,
-    dryRun: !opts.promote,
-    trials,
-    ...opts.signal ? { signal: opts.signal } : {},
-    log
-  });
-}
-async function runLensSynthCommand(opts, deps = {}) {
-  const raw = JSON.parse(readFileSync(resolve(opts.missInput), "utf8"));
-  let input = parseMissInputFile(raw);
-  if (opts.fromBench) {
-    if (!opts.manifest) throw new Error("--from-bench requires --manifest");
-    const { misses } = await harvestBenchMisses(opts.fromBench, opts.manifest);
-    input = { ...input, misses: mergeHarvestedMisses(input.misses, misses) };
-    deps.log?.(`[lens-synth] harvested ${misses.length} bench miss(es) from ${opts.fromBench}`);
-  }
-  return runLensSynthesisInput(input, opts, deps);
-}
-async function watchLensSynthCommand(opts, deps = {}) {
-  const inputPath = resolve(opts.missInput);
-  const log = deps.log ?? (() => {
-  });
-  const requestedInterval = opts.pollIntervalMs ?? 2e3;
-  const pollIntervalMs = Number.isFinite(requestedInterval) ? Math.max(100, Math.floor(requestedInterval)) : 2e3;
-  const sleep = deps.sleep ?? ((milliseconds) => new Promise((done) => setTimeout(done, milliseconds)));
-  let previousRevision;
-  while (!deps.signal?.aborted) {
-    try {
-      const bytes = readFileSync(inputPath);
-      const revision = createHash("sha256").update(bytes).digest("hex");
-      if (revision !== previousRevision) {
-        previousRevision = revision;
-        const input = parseMissInputFile(JSON.parse(bytes.toString("utf8")));
-        const result = await runLensSynthesisInput(input, opts, deps);
-        deps.onResult?.(result);
-      }
-    } catch (cause) {
-      const error = cause instanceof Error ? cause : new Error(String(cause));
-      const revision = `error:${error.name}:${error.message}`;
-      if (revision !== previousRevision) {
-        previousRevision = revision;
-        if (deps.onError) deps.onError(error);
-        else log(`[lens-synth] input revision rejected: ${error.message}`);
-      }
-    }
-    if (deps.signal?.aborted) return;
-    const signal = deps.signal;
-    if (!signal) {
-      await sleep(pollIntervalMs);
-      continue;
-    }
-    if (signal.aborted) return;
-    await new Promise((resume) => {
-      const onAbort = () => {
-        signal.removeEventListener("abort", onAbort);
-        resume();
-      };
-      signal.addEventListener("abort", onAbort, { once: true });
-      void sleep(pollIntervalMs).then(() => {
-        signal.removeEventListener("abort", onAbort);
-        resume();
-      });
-    });
-  }
-}
-function formatLensSynthResult(result, dryRun) {
-  const lines = [
-    `captured ${result.candidatesCaptured} miss candidate(s) \u2192 ${result.clusters} cluster(s) \u2192 ${result.synthesized.length} synthesized`
-  ];
-  for (const validation of result.validations) {
-    lines.push(`  validate ${validation.lensId}: ${validation.passed ? "CHAMPION" : "rejected"} \u2014 ${validation.reason}`);
-  }
-  if (dryRun) {
-    lines.push(`dry-run: ${result.validations.filter((validation) => validation.passed).length} champion(s) would register (nothing written)`);
-  } else {
-    lines.push(
-      result.registered.length > 0 ? `REGISTERED ${result.registered.length} lens(es): ${result.registered.map((registered) => registered.uid).join(", ")}` : "registered 0 lenses"
-    );
-  }
-  for (const rejected of result.rejected) lines.push(`  rejected ${rejected.id}: ${rejected.reason}`);
-  for (const warning of result.warnings) lines.push(`  warning: ${warning}`);
-  return lines.join("\n");
-}
-function formatLensRegistryStatus(status) {
-  const lines = [
-    `registry: ${status.path}`,
-    `state: ${status.valid ? "valid" : "INVALID"}`,
-    `exists: ${status.exists ? "yes" : "no"}`,
-    `active lenses: ${status.activeLensCount}`,
-    `ledger entries: ${status.ledgerEntries}`,
-    `unbound archetypes: ${status.unboundArchetypes}`
-  ];
-  if (status.error) lines.push(`error: ${status.error}`);
-  return lines.join("\n");
-}
-function registerLensSynthCommand(program) {
-  program.command("lens-synth").description("Improve appsec detection coverage from curated missed findings").option("--miss-input <path>", "curated miss-input JSON ({ misses, corpus })").option("--registry <path>", "durable overlay path (default: ~/.0/lenses/appsec-archetypes.json)").option("--max-register <n>", "cap promoted champions per input revision", (value) => Number.parseInt(value, 10)).option("-m, --model <id>", "synthesis model override").option("--promote", "persist a validated champion to the durable overlay", false).option("--trials <n>", "repeated validation trials (2\u201310; default 2)", Number).option("--from-bench <ledger>", "harvest the champion's false-negatives from a benchmark ledger into the curated misses (requires --manifest)").option("--manifest <path>", "bench manifest path (ground-truth vuln class + sink); required with --from-bench").option("--watch", "poll the miss-input and process each new content revision", false).option("--poll-interval <ms>", "watch polling interval (minimum 100ms)", "2000").option("--status", "show the active durable overlay and promotion ledger", false).option("--rollback <lens-id>", "retire one previously promoted overlay lens").option("--json", "print machine-readable output", false).action(async (opts) => {
-    try {
-      const registry = opts.registry ? resolve(opts.registry) : void 0;
-      if (opts.status && opts.rollback) throw new Error("--status and --rollback cannot be combined");
-      if (opts.status) {
-        const status = inspectLensRegistry(registry);
-        process.stdout.write(opts.json ? `${JSON.stringify(status, null, 2)}
-` : `${formatLensRegistryStatus(status)}
-`);
-        if (!status.valid) process.exitCode = 3;
-        return;
-      }
-      if (opts.rollback) {
-        const outcome = retireArchetype(String(opts.rollback), { ...registry ? { registryPath: registry } : {} });
-        process.stdout.write(
-          opts.json ? `${JSON.stringify(outcome, null, 2)}
-` : outcome.retired ? `RETIRED ${outcome.id} from ${outcome.registryPath}
-` : `not retired ${outcome.id}: ${outcome.reason ?? "unknown reason"}
-`
-        );
-        if (!outcome.retired) process.exitCode = 3;
-        return;
-      }
-      if (!opts.missInput) throw new Error("--miss-input is required unless --status or --rollback is used");
-      if (opts.maxRegister !== void 0 && (!Number.isInteger(opts.maxRegister) || opts.maxRegister < 0)) {
-        throw new Error("--max-register must be a non-negative integer");
-      }
-      if (opts.fromBench && !opts.manifest) throw new Error("--from-bench requires --manifest");
-      if (opts.fromBench && opts.watch) throw new Error("--from-bench cannot be combined with --watch");
-      const pollIntervalMs = Number.parseInt(opts.pollInterval ?? "2000", 10);
-      if (!Number.isInteger(pollIntervalMs) || pollIntervalMs < 100) {
-        throw new Error("--poll-interval must be an integer of at least 100ms");
-      }
-      const request = {
-        missInput: String(opts.missInput),
-        ...registry ? { registry } : {},
-        ...opts.maxRegister !== void 0 ? { maxRegister: opts.maxRegister } : {},
-        ...opts.model ? { model: String(opts.model) } : {},
-        promote: Boolean(opts.promote),
-        trials: trialCount(opts.trials),
-        ...opts.fromBench ? { fromBench: String(opts.fromBench) } : {},
-        ...opts.manifest ? { manifest: resolve(String(opts.manifest)) } : {}
-      };
-      const printResult = (result) => {
-        process.stdout.write(
-          opts.json ? `${JSON.stringify(result, null, 2)}
-` : `${formatLensSynthResult(result, !opts.promote)}
-`
-        );
-      };
-      const log = (message) => {
-        process.stderr.write(`${message}
-`);
-      };
-      if (!opts.watch) {
-        printResult(await runLensSynthCommand(request, { log }));
-        return;
-      }
-      const controller = new AbortController();
-      const stop = () => controller.abort();
-      process.once("SIGINT", stop);
-      process.once("SIGTERM", stop);
-      try {
-        await watchLensSynthCommand(
-          { ...request, pollIntervalMs },
-          {
-            log,
-            signal: controller.signal,
-            onResult: printResult,
-            onError: (error) => process.stderr.write(`lens-synth watch: ${error.message}
-`)
-          }
-        );
-      } finally {
-        process.off("SIGINT", stop);
-        process.off("SIGTERM", stop);
-      }
-    } catch (error) {
-      process.stderr.write(`lens-synth: ${error instanceof Error ? error.message : String(error)}
-`);
-      process.exitCode = 3;
-    }
-  });
-}
-
-export {
-  runLensSynthesisInput,
-  watchLensSynthCommand,
-  registerLensSynthCommand
-};