0sec-cli 0.24.0 → 0.25.0

package/chunks/chunk-YJU7QACE.js

@@ -1,279 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  scanExecutionTimeout
-} from "./chunk-YYOQADBB.js";
-
-// packages/core/dist/shared-analysis.js
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-var FOXGUARD_PINNED_TAG = "v0.14.0";
-var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini"]);
-function bufferToString(value) {
-  if (!value) {
-    return "";
-  }
-  return Buffer.isBuffer(value) ? value.toString("utf-8") : value;
-}
-function mapSemgrepSeverity(level) {
-  switch (level.toUpperCase()) {
-    case "ERROR":
-      return "high";
-    case "WARNING":
-      return "medium";
-    case "INFO":
-      return "low";
-    default:
-      return "info";
-  }
-}
-function mapFoxguardSeverity(level) {
-  switch ((level ?? "").toLowerCase()) {
-    case "error":
-    case "critical":
-      return "critical";
-    case "warning":
-    case "high":
-      return "high";
-    case "note":
-    case "medium":
-      return "medium";
-    case "low":
-      return "low";
-    default:
-      return "info";
-  }
-}
-function runSemgrepScan(targetPath, emit, opts) {
-  emit({
-    type: "stage:start",
-    stage: "source-analysis",
-    message: "Running semgrep security scan..."
-  });
-  if (opts?.paths?.length === 0) {
-    emit({ type: "stage:end", stage: "source-analysis", message: "Semgrep: no files selected" });
-    return [];
-  }
-  const args = [
-    "scan",
-    "--config",
-    "auto",
-    "--json",
-    ...opts?.noGitIgnore ? ["--no-git-ignore"] : [],
-    "--timeout",
-    "60",
-    "--max-target-bytes",
-    "1000000",
-    ...opts?.paths ?? [targetPath]
-  ];
-  let rawOutput;
-  try {
-    rawOutput = execFileSync("semgrep", args, {
-      timeout: scanExecutionTimeout(3e5),
-      stdio: "pipe",
-      encoding: "utf-8",
-      env: { ...process.env, SEMGREP_SEND_METRICS: "off" }
-    });
-  } catch (err) {
-    if (!err || typeof err !== "object" || !("status" in err) || err.status !== 1)
-      throw err;
-    rawOutput = bufferToString("stdout" in err ? err.stdout : void 0);
-  }
-  const raw = JSON.parse(rawOutput);
-  if (!raw || !Array.isArray(raw.results))
-    throw new Error("invalid Semgrep JSON report");
-  const results = raw.results;
-  const findings = results.map((r) => ({
-    ruleId: r.check_id,
-    message: r.extra?.message ?? "",
-    severity: mapSemgrepSeverity(r.extra?.severity ?? "WARNING"),
-    path: r.path,
-    startLine: r.start?.line ?? 0,
-    endLine: r.end?.line ?? 0,
-    snippet: r.extra?.lines ?? "",
-    metadata: r.extra?.metadata
-  }));
-  emit({
-    type: "stage:end",
-    stage: "source-analysis",
-    message: `Semgrep: ${findings.length} findings`
-  });
-  return findings;
-}
-function selectedStaticScanner() {
-  return process.env["ZERO_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
-}
-function runFoxguardScan(targetPath, emit, opts) {
-  emit({
-    type: "stage:start",
-    stage: "source-analysis",
-    message: "Running foxguard security scan..."
-  });
-  if (opts?.paths?.length === 0) {
-    emit({ type: "stage:end", stage: "source-analysis", message: "Foxguard: no files selected" });
-    return [];
-  }
-  const foxguardTag = opts?.foxguardTag ?? FOXGUARD_PINNED_TAG;
-  const runner = opts?.runner ?? execFileSync;
-  const logger = opts?.logger ?? ((m) => console.warn(m));
-  const cwd = statSync(targetPath, { throwIfNoEntry: false })?.isFile() ? dirname(resolve(targetPath)) : resolve(targetPath);
-  let useNpm = opts?.foxguardCommand !== void 0 || opts?.foxguardTag !== void 0;
-  const findings = [];
-  let selectionDir;
-  try {
-    let selectionFile;
-    if (opts?.paths && !opts.diffBase) {
-      const paths = opts.paths.map((path) => {
-        const selected = relative(cwd, resolve(cwd, path));
-        if (isAbsolute(selected) || selected === ".." || selected.startsWith(`..${sep}`) || /[\r\n\0]/.test(selected)) {
-          throw new Error(`selected Foxguard path is outside the scan root or cannot be represented: ${path}`);
-        }
-        return selected.split(sep).join("/");
-      });
-      selectionDir = mkdtempSync(join(tmpdir(), "0-foxguard-"));
-      selectionFile = join(selectionDir, "changed-files.txt");
-      writeFileSync(selectionFile, `${paths.join("\n")}
-`, { mode: 384 });
-    }
-    const scanRoot = relative(cwd, resolve(targetPath)) || ".";
-    const invocations = [opts?.diffBase ? ["diff", opts.diffBase, scanRoot, "--format", "json"] : ["--format", "json", ...selectionFile ? ["--changed-files-from", selectionFile] : [], scanRoot]];
-    for (const args of invocations) {
-      let rawOutput;
-      const invoke = () => {
-        try {
-          return bufferToString(runner(useNpm ? opts?.foxguardCommand ?? "npx" : "foxguard", useNpm ? ["--yes", `foxguard@${foxguardTag}`, ...args] : args, {
-            cwd,
-            timeout: scanExecutionTimeout(3e5),
-            maxBuffer: 64 * 1024 * 1024,
-            stdio: "pipe",
-            encoding: "utf-8"
-          }));
-        } catch (err) {
-          if (err && typeof err === "object" && "status" in err && err.status === 1) {
-            return bufferToString("stdout" in err ? err.stdout : void 0);
-          }
-          throw err;
-        }
-      };
-      try {
-        rawOutput = invoke();
-      } catch (err) {
-        if (!useNpm && err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-          useNpm = true;
-          rawOutput = invoke();
-        } else {
-          throw err;
-        }
-      }
-      const report = parseFoxguardJson(rawOutput);
-      if (report === null)
-        throw new Error("invalid Foxguard JSON report");
-      if (report.filesScanned === 0) {
-        throw new Error("Foxguard scanned 0 files; static coverage is unavailable (files may be excluded or unsupported)");
-      }
-      for (const finding of translateFoxguardFindings(report.findings)) {
-        finding.path = resolve(cwd, finding.path);
-        findings.push(finding);
-      }
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    logger(`[0] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set ZERO_STATIC=semgrep to use semgrep.`);
-    emit({ type: "error", stage: "source-analysis", message: `Foxguard scan failed: ${message}` });
-    throw err;
-  } finally {
-    if (selectionDir)
-      rmSync(selectionDir, { recursive: true, force: true });
-  }
-  emit({
-    type: "stage:end",
-    stage: "source-analysis",
-    message: `Foxguard: ${findings.length} findings`
-  });
-  return findings;
-}
-function runSelectedStaticScan(targetPath, emit, opts) {
-  return selectedStaticScanner() === "foxguard" ? runFoxguardScan(targetPath, emit, opts) : runSemgrepScan(targetPath, emit, opts);
-}
-function parseFoxguardJson(rawJson) {
-  let parsed;
-  try {
-    parsed = JSON.parse(rawJson);
-  } catch {
-    return null;
-  }
-  if (Array.isArray(parsed))
-    return { findings: parsed };
-  if (!parsed || typeof parsed !== "object" || !("findings" in parsed))
-    return null;
-  for (const field of ["schema_version", "finding_schema_version"]) {
-    if (field in parsed && !/^1\.\d+\.\d+$/.test(String(parsed[field]))) {
-      return null;
-    }
-  }
-  if (!Array.isArray(parsed.findings))
-    return null;
-  const target = "target" in parsed ? parsed.target : void 0;
-  const filesScanned = target && typeof target === "object" && "files_scanned" in target ? target.files_scanned : void 0;
-  if (filesScanned !== void 0 && (typeof filesScanned !== "number" || !Number.isSafeInteger(filesScanned) || filesScanned < 0))
-    return null;
-  return { findings: parsed.findings, ...typeof filesScanned === "number" ? { filesScanned } : {} };
-}
-function translateFoxguardFindings(rawFindings) {
-  const out = [];
-  for (const raw of rawFindings) {
-    if (!raw || typeof raw !== "object")
-      continue;
-    if (!raw.rule_id || !raw.file || typeof raw.line !== "number")
-      continue;
-    const startLine = raw.line;
-    const endLine = typeof raw.end_line === "number" ? raw.end_line : startLine;
-    const metadata = { scanner: "foxguard" };
-    if (raw.cwe)
-      metadata.cwe = raw.cwe;
-    if (typeof raw.confidence === "number")
-      metadata.confidence = raw.confidence;
-    if (typeof raw.taint_hops === "number")
-      metadata.taintHops = raw.taint_hops;
-    if (raw.source_line || raw.sink_line) {
-      metadata.dataflow = {
-        sourceLine: raw.source_line,
-        sourceDescription: raw.source_description,
-        sinkLine: raw.sink_line,
-        sinkDescription: raw.sink_description
-      };
-    }
-    if (raw.fix_suggestion)
-      metadata.fixSuggestion = raw.fix_suggestion;
-    if (raw.tags && raw.tags.length > 0)
-      metadata.tags = raw.tags;
-    if (raw.crypto_algorithm)
-      metadata.cryptoAlgorithm = raw.crypto_algorithm;
-    if (raw.cnsa2_deadline)
-      metadata.cnsa2Deadline = raw.cnsa2_deadline;
-    if (raw.dep_name)
-      metadata.depName = raw.dep_name;
-    out.push({
-      ruleId: raw.rule_id,
-      message: raw.description ?? "",
-      severity: mapFoxguardSeverity(raw.severity),
-      path: raw.file,
-      startLine,
-      endLine,
-      snippet: raw.snippet ?? "",
-      metadata
-    });
-  }
-  return out;
-}
-
-export {
-  CLI_RUNTIME_TYPES,
-  bufferToString,
-  selectedStaticScanner,
-  runFoxguardScan,
-  runSelectedStaticScan
-};

package/chunks/dashboard-B2AEGCFM.js

@@ -1,76 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  registerDashboardCommand
-} from "./chunk-GHEBZKUS.js";
-import "./chunk-G2EJ3R5I.js";
-import "./chunk-UHUW45S3.js";
-import "./chunk-ZPFBQ3SD.js";
-import "./chunk-O7Q2G2KW.js";
-import "./chunk-AV5BF4V7.js";
-import "./chunk-3XLEDCFX.js";
-import "./chunk-3XLFB46W.js";
-import "./chunk-TOFIGQ63.js";
-import "./chunk-W6IYTSZH.js";
-import "./chunk-TZRHWP7R.js";
-import "./chunk-WUPN3D37.js";
-import "./chunk-FEOPHBMY.js";
-import "./chunk-62PGWN7Y.js";
-import "./chunk-HLFS6WV2.js";
-import "./chunk-QEA2VHBD.js";
-import "./chunk-V5I5GAQH.js";
-import "./chunk-5FHFG5P2.js";
-import "./chunk-4YRXIVPZ.js";
-import "./chunk-TOAAYJVN.js";
-import "./chunk-4TUR47H5.js";
-import "./chunk-GVD6SJGH.js";
-import "./chunk-QCUFBVIZ.js";
-import "./chunk-V4BD7GSP.js";
-import "./chunk-IIBNQTOK.js";
-import "./chunk-2WNCI664.js";
-import "./chunk-23DG5YKS.js";
-import "./chunk-DQTNI3KY.js";
-import "./chunk-FKGFHLLS.js";
-import "./chunk-RPTO5FY2.js";
-import "./chunk-E42XEJTK.js";
-import "./chunk-HRBOZBMC.js";
-import "./chunk-AZ7L3HFD.js";
-import "./chunk-H76JYUPE.js";
-import "./chunk-CSPF47S3.js";
-import "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
-import "./chunk-K2PWUPUI.js";
-import "./chunk-CIMN2AO6.js";
-import "./chunk-YERUDEXT.js";
-import "./chunk-UEX7PFSE.js";
-import "./chunk-YJU7QACE.js";
-import "./chunk-YYOQADBB.js";
-import "./chunk-DNV3ZMPX.js";
-import "./chunk-A6AZZ6XX.js";
-import "./chunk-Y7KV7WV6.js";
-import "./chunk-SQCBHFWN.js";
-import "./chunk-EXTN4SQV.js";
-import "./chunk-O6KPVYOI.js";
-import "./chunk-FHC2B7LN.js";
-import "./chunk-DKSCN2AB.js";
-import "./chunk-UFHN6RIU.js";
-import "./chunk-RCHAFSWS.js";
-import "./chunk-554D4AYM.js";
-import "./chunk-IXT64DV5.js";
-import "./chunk-RD4FKFWR.js";
-import "./chunk-NJLKFC66.js";
-import "./chunk-O3ADFN2A.js";
-import "./chunk-EYBMTELO.js";
-import "./chunk-BIJPMYFA.js";
-import "./chunk-52AWIBCT.js";
-import "./chunk-RS4MAN3Q.js";
-import "./chunk-IK27KMVV.js";
-import "./chunk-RBOMXUYL.js";
-import "./chunk-5IBCBQEH.js";
-import "./chunk-RZR2XXAK.js";
-import "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
-export {
-  registerDashboardCommand
-};

package/chunks/eval-runner-XVRX3R2Y.js

@@ -1,31 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  getEvalCategories,
-  runEval
-} from "./chunk-V4BD7GSP.js";
-import "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
-import "./chunk-K2PWUPUI.js";
-import "./chunk-CIMN2AO6.js";
-import "./chunk-YERUDEXT.js";
-import "./chunk-YJU7QACE.js";
-import "./chunk-YYOQADBB.js";
-import "./chunk-Y7KV7WV6.js";
-import "./chunk-RCHAFSWS.js";
-import "./chunk-IXT64DV5.js";
-import "./chunk-EYBMTELO.js";
-import "./chunk-BIJPMYFA.js";
-import "./chunk-52AWIBCT.js";
-import "./chunk-RS4MAN3Q.js";
-import "./chunk-IK27KMVV.js";
-import "./chunk-RBOMXUYL.js";
-import "./chunk-5IBCBQEH.js";
-import "./chunk-RZR2XXAK.js";
-import "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
-export {
-  getEvalCategories,
-  runEval
-};

package/chunks/hunt-scan-DXV5H6YN.js

@@ -1,40 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  AimdState,
-  composeGate,
-  makeMultiLensVerifier,
-  makeSkepticVerifier,
-  runHuntScan
-} from "./chunk-CSPF47S3.js";
-import "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
-import "./chunk-K2PWUPUI.js";
-import "./chunk-CIMN2AO6.js";
-import "./chunk-YERUDEXT.js";
-import "./chunk-UEX7PFSE.js";
-import "./chunk-YJU7QACE.js";
-import "./chunk-YYOQADBB.js";
-import "./chunk-Y7KV7WV6.js";
-import "./chunk-EXTN4SQV.js";
-import "./chunk-O6KPVYOI.js";
-import "./chunk-RCHAFSWS.js";
-import "./chunk-IXT64DV5.js";
-import "./chunk-EYBMTELO.js";
-import "./chunk-BIJPMYFA.js";
-import "./chunk-52AWIBCT.js";
-import "./chunk-RS4MAN3Q.js";
-import "./chunk-IK27KMVV.js";
-import "./chunk-RBOMXUYL.js";
-import "./chunk-5IBCBQEH.js";
-import "./chunk-RZR2XXAK.js";
-import "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
-export {
-  AimdState,
-  composeGate,
-  makeMultiLensVerifier,
-  makeSkepticVerifier,
-  runHuntScan
-};

package/chunks/managed-operation-SQFMBWHG.js

@@ -1,60 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  executeManagedOperation
-} from "./chunk-TOFIGQ63.js";
-import "./chunk-V5I5GAQH.js";
-import "./chunk-5FHFG5P2.js";
-import "./chunk-4YRXIVPZ.js";
-import "./chunk-TOAAYJVN.js";
-import "./chunk-GVD6SJGH.js";
-import "./chunk-QCUFBVIZ.js";
-import "./chunk-V4BD7GSP.js";
-import "./chunk-IIBNQTOK.js";
-import "./chunk-2WNCI664.js";
-import "./chunk-23DG5YKS.js";
-import "./chunk-DQTNI3KY.js";
-import "./chunk-FKGFHLLS.js";
-import "./chunk-RPTO5FY2.js";
-import "./chunk-E42XEJTK.js";
-import "./chunk-HRBOZBMC.js";
-import "./chunk-AZ7L3HFD.js";
-import "./chunk-H76JYUPE.js";
-import "./chunk-CSPF47S3.js";
-import "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
-import "./chunk-K2PWUPUI.js";
-import "./chunk-CIMN2AO6.js";
-import "./chunk-YERUDEXT.js";
-import "./chunk-UEX7PFSE.js";
-import "./chunk-YJU7QACE.js";
-import "./chunk-YYOQADBB.js";
-import "./chunk-DNV3ZMPX.js";
-import "./chunk-A6AZZ6XX.js";
-import "./chunk-Y7KV7WV6.js";
-import "./chunk-SQCBHFWN.js";
-import "./chunk-EXTN4SQV.js";
-import "./chunk-O6KPVYOI.js";
-import "./chunk-FHC2B7LN.js";
-import "./chunk-DKSCN2AB.js";
-import "./chunk-UFHN6RIU.js";
-import "./chunk-RCHAFSWS.js";
-import "./chunk-554D4AYM.js";
-import "./chunk-IXT64DV5.js";
-import "./chunk-RD4FKFWR.js";
-import "./chunk-NJLKFC66.js";
-import "./chunk-O3ADFN2A.js";
-import "./chunk-EYBMTELO.js";
-import "./chunk-BIJPMYFA.js";
-import "./chunk-52AWIBCT.js";
-import "./chunk-RS4MAN3Q.js";
-import "./chunk-IK27KMVV.js";
-import "./chunk-RBOMXUYL.js";
-import "./chunk-5IBCBQEH.js";
-import "./chunk-RZR2XXAK.js";
-import "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
-export {
-  executeManagedOperation
-};

package/chunks/orchestrate-YHFJXGID.js

@@ -1,63 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  recoverStaleWorkers,
-  registerOrchestrateCommand
-} from "./chunk-TTDFBFNZ.js";
-import "./chunk-HLFS6WV2.js";
-import "./chunk-V5I5GAQH.js";
-import "./chunk-5FHFG5P2.js";
-import "./chunk-4YRXIVPZ.js";
-import "./chunk-TOAAYJVN.js";
-import "./chunk-GVD6SJGH.js";
-import "./chunk-QCUFBVIZ.js";
-import "./chunk-V4BD7GSP.js";
-import "./chunk-IIBNQTOK.js";
-import "./chunk-2WNCI664.js";
-import "./chunk-23DG5YKS.js";
-import "./chunk-DQTNI3KY.js";
-import "./chunk-FKGFHLLS.js";
-import "./chunk-RPTO5FY2.js";
-import "./chunk-E42XEJTK.js";
-import "./chunk-HRBOZBMC.js";
-import "./chunk-AZ7L3HFD.js";
-import "./chunk-H76JYUPE.js";
-import "./chunk-CSPF47S3.js";
-import "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
-import "./chunk-K2PWUPUI.js";
-import "./chunk-CIMN2AO6.js";
-import "./chunk-YERUDEXT.js";
-import "./chunk-UEX7PFSE.js";
-import "./chunk-YJU7QACE.js";
-import "./chunk-YYOQADBB.js";
-import "./chunk-DNV3ZMPX.js";
-import "./chunk-A6AZZ6XX.js";
-import "./chunk-Y7KV7WV6.js";
-import "./chunk-SQCBHFWN.js";
-import "./chunk-EXTN4SQV.js";
-import "./chunk-O6KPVYOI.js";
-import "./chunk-FHC2B7LN.js";
-import "./chunk-DKSCN2AB.js";
-import "./chunk-UFHN6RIU.js";
-import "./chunk-RCHAFSWS.js";
-import "./chunk-554D4AYM.js";
-import "./chunk-IXT64DV5.js";
-import "./chunk-RD4FKFWR.js";
-import "./chunk-NJLKFC66.js";
-import "./chunk-O3ADFN2A.js";
-import "./chunk-EYBMTELO.js";
-import "./chunk-BIJPMYFA.js";
-import "./chunk-52AWIBCT.js";
-import "./chunk-RS4MAN3Q.js";
-import "./chunk-IK27KMVV.js";
-import "./chunk-RBOMXUYL.js";
-import "./chunk-5IBCBQEH.js";
-import "./chunk-RZR2XXAK.js";
-import "./chunk-VIT5ALXF.js";
-import "./chunk-VCSFCHAJ.js";
-export {
-  recoverStaleWorkers,
-  registerOrchestrateCommand
-};