0sec-cli 0.24.1 → 0.25.0

package/chunks/{chunk-S2GITRD5.js → chunk-PMAKX6KP.js}

@@ -4,10 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   getToolsForRole,
   runNativeAgentLoop
-} from "./chunk-5WAHHZBF.js";
+} from "./chunk-HFUOUT2B.js";
 import {
   LlmApiRuntime
-} from "./chunk-IJ6UPW3H.js";
+} from "./chunk-EIONVEFN.js";
 
 // packages/core/dist/eval-runner.js
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-LMP2T4G2.js → chunk-RBTJYREN.js}

@@ -14,25 +14,18 @@ import {
   resolveLayeredSettings,
   saveProjectOverrides,
   saveSettings
-} from "./chunk-X2IPO5JO.js";
-import {
-  expandHomePath,
-  isExistingLocalTargetPath,
-  isExplicitLocalTargetPath
-} from "./chunk-PJU24AKR.js";
+} from "./chunk-6TA3CWND.js";
 import {
   ANALYTICS_LEVEL_ENV,
-  analyticsOptedOut,
   analyticsPipeline,
   levelAtLeast,
   resolveAnalyticsLevel
-} from "./chunk-PVJUPIQG.js";
+} from "./chunk-3T5R7P4T.js";
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-S3B6HFSM.js";
 
 // packages/cli/src/tui/settings-store.ts
-import { useSyncExternalStore } from "react";
 var cached = null;
 var globalDraft = null;
 var projectDraft = null;
@@ -62,13 +55,6 @@ function getSettingSources() {
   getSettings();
   return cached.sources;
 }
-function getAnalyticsSetupDraft() {
-  const settings = getSettings();
-  const current = process.env[ANALYTICS_LEVEL_ENV];
-  const shellPreference = current !== void 0 && current !== bridgedAnalyticsEnv;
-  if (analyticsOptedOut() || shellPreference && resolveAnalyticsLevel() === "off") return "off";
-  return cached.sources.analyticsLevel === "default" ? "usage" : settings.analyticsLevel;
-}
 function setSettings(next) {
   const value = normalizeSettings(next);
   const saved = saveSettings(value, homeDir);
@@ -116,17 +102,6 @@ function resetSettings(next, keys) {
   notify(cached.settings);
   return globalSaved && projectSaved;
 }
-function previewSetting(key, value) {
-  if (cached === null) cached = loadLayered();
-  cached = { settings: { ...cached.settings, [key]: value }, sources: cached.sources };
-  notify(cached.settings);
-}
-function subscribeSettings(fn) {
-  subscribers.add(fn);
-  return () => {
-    subscribers.delete(fn);
-  };
-}
 var bridgedAnalyticsEnv;
 function bridgeAnalyticsLevel(settings) {
   try {
@@ -142,21 +117,6 @@ function bridgeAnalyticsLevel(settings) {
   } catch {
   }
 }
-function reloadSettings() {
-  globalDraft = null;
-  projectDraft = null;
-  cached = loadLayered();
-  notify(cached.settings);
-  return cached.settings;
-}
-function configureSettingsStore(options) {
-  homeDir = options.homeDir;
-  projectDir = options.projectDir;
-  reloadSettings();
-}
-function useSettings() {
-  return useSyncExternalStore(subscribeSettings, getSettings, getSettings);
-}
 
 // packages/cli/src/codex-auth.ts
 import { readFileSync, existsSync } from "node:fs";
@@ -198,84 +158,6 @@ function asString(value) {
   return typeof value === "string" ? value : void 0;
 }
 
-// packages/cli/src/engagement-plan.ts
-var PACKAGE_PREFIXES = {
-  "npm:": { ecosystem: "npm", targetType: "npm-package" },
-  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
-  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
-  "oci:": { ecosystem: "oci", targetType: "oci-image" }
-};
-function resolveEngagement(rawTarget) {
-  const raw = rawTarget.trim();
-  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
-  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
-    if (!raw.startsWith(prefix)) continue;
-    const target = raw.slice(prefix.length).trim();
-    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
-    return {
-      ok: true,
-      plan: {
-        kind: "package",
-        target,
-        targetType: packagePlan.targetType,
-        ecosystem: packagePlan.ecosystem,
-        label: `${packagePlan.ecosystem} package ${target}`
-      }
-    };
-  }
-  if (raw.startsWith("source:")) {
-    const target = raw.slice("source:".length).trim();
-    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target: expandHomePath(target),
-        targetType: "source-code",
-        label: `source review ${target}`
-      }
-    };
-  }
-  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target: raw,
-        targetType: "source-code",
-        label: `source review ${raw}`
-      }
-    };
-  }
-  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
-    return {
-      ok: true,
-      plan: {
-        kind: "web",
-        target: raw,
-        targetType: "url",
-        label: `web target ${raw}`
-      }
-    };
-  }
-  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
-    const target = expandHomePath(raw);
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target,
-        targetType: "source-code",
-        label: `source review ${target}`
-      }
-    };
-  }
-  return {
-    ok: false,
-    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
-  };
-}
-
 // packages/cli/src/tui/credential-store.ts
 import { chmodSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
@@ -306,11 +188,6 @@ function normalizeCredentials(raw) {
 function loadCredentials(homeDir2) {
   return projectApiKeys(loadAccountStore(homeDir2));
 }
-function saveCredentials(creds, homeDir2) {
-  const store = loadAccountStore(homeDir2);
-  const desired = normalizeCredentials(creds);
-  return saveAccountStore(replaceApiKeyLayer(store, desired), homeDir2);
-}
 function projectApiKeys(store) {
   const out = {};
   for (const providerId of Object.keys(store.providers)) {
@@ -319,26 +196,6 @@ function projectApiKeys(store) {
   }
   return out;
 }
-function replaceApiKeyLayer(store, desired) {
-  const providers = {};
-  for (const [providerId, entry] of Object.entries(store.providers)) {
-    const kept = {};
-    for (const [accountId, record] of Object.entries(entry.accounts)) {
-      if (record.kind !== "api_key") kept[accountId] = record;
-    }
-    const keptIds = Object.keys(kept);
-    if (keptIds.length === 0) continue;
-    const active = entry.activeAccountId !== void 0 && kept[entry.activeAccountId] !== void 0 ? entry.activeAccountId : keptIds[0];
-    providers[providerId] = { activeAccountId: active, accounts: kept };
-  }
-  for (const [providerId, secret] of Object.entries(desired)) {
-    const existing = providers[providerId];
-    const accounts = existing ? { ...existing.accounts } : {};
-    accounts[DEFAULT_ACCOUNT_ID] = { kind: "api_key", secret };
-    providers[providerId] = { activeAccountId: DEFAULT_ACCOUNT_ID, accounts };
-  }
-  return { version: STORE_VERSION, providers };
-}
 function credentialEnvPatch(creds, env) {
   const stored = normalizeCredentials(creds);
   const patch = {};
@@ -352,18 +209,6 @@ function credentialEnvPatch(creds, env) {
   }
   return patch;
 }
-var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
-var TAIL = 4;
-var PREFIX = 6;
-var MIN_LENGTH_FOR_TAIL = 12;
-var MIN_LENGTH_FOR_PREFIX = 20;
-function redactSecret(secret) {
-  const value = typeof secret === "string" ? secret.trim() : "";
-  if (value.length < MIN_LENGTH_FOR_TAIL) return MASK;
-  const tail = value.slice(-TAIL);
-  if (value.length < MIN_LENGTH_FOR_PREFIX) return `${MASK}${tail}`;
-  return `${value.slice(0, PREFIX)}\u2026${tail}`;
-}
 var STORE_VERSION = 2;
 var DEFAULT_ACCOUNT_ID = "default";
 var KNOWN_PROVIDER_IDS = new Set(PROVIDERS.map((provider) => provider.id));
@@ -602,13 +447,13 @@ function validateConnectionConfig(providerId, value) {
   if (value.baseUrl !== void 0) {
     if (!BASE_URL_VARS[providerId]) throw new Error("This provider does not support a custom API endpoint.");
     const url = new URL(value.baseUrl);
-    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
-      throw new Error("API endpoint must be credential-free HTTPS, or loopback HTTP, without a query or fragment.");
+    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && (providerId === "openai" || ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))) {
+      throw new Error("API endpoint must be credential-free HTTPS (or HTTP for custom OpenAI-compatible endpoints and loopback), without a query or fragment.");
     }
     result.baseUrl = url.href.replace(/\/$/, "");
   }
   if (value.model !== void 0) {
-    if (providerId !== "azure") throw new Error("Deployment model configuration is only supported for Azure; select other models through runtime selection.");
+    if (providerId !== "azure" && providerId !== "openai") throw new Error("Connection model configuration is supported for Azure and custom OpenAI-compatible providers.");
     if (!value.model.trim() || value.model.length > 256 || /[\s\x00-\x1f\x7f]/.test(value.model)) throw new Error("Invalid deployment model.");
     result.model = value.model;
   }
@@ -662,6 +507,7 @@ function connectionConfigEnvPatch(env, homeDir2) {
     const variable = BASE_URL_VARS[id];
     if (variable && config.baseUrl && !env[variable]) patch[variable] = config.baseUrl;
     if (id === "azure" && config.model && !env.AZURE_OPENAI_MODEL) patch.AZURE_OPENAI_MODEL = config.model;
+    if (id === "openai" && config.model && !env.OPENAI_MODEL) patch.OPENAI_MODEL = config.model;
     if (id === "google" && config.projectId && !env.GOOGLE_CLOUD_PROJECT && !env.ZERO_GEMINI_PROJECT) patch.ZERO_GEMINI_PROJECT = config.projectId;
   }
   return patch;
@@ -670,20 +516,12 @@ function connectionConfigEnvPatch(env, homeDir2) {
 export {
   getSettings,
   getSettingSources,
-  getAnalyticsSetupDraft,
   defaultWriteLayer,
   updateSetting,
   resetSettings,
-  previewSetting,
-  subscribeSettings,
-  reloadSettings,
-  configureSettingsStore,
-  useSettings,
   maybeLoadCodexAuth,
   loadCredentials,
-  saveCredentials,
   credentialEnvPatch,
-  redactSecret,
   loadAccountStore,
   saveAccountStore,
   listAccounts,
@@ -695,6 +533,5 @@ export {
   validateConnectionConfig,
   loadConnectionConfigs,
   saveConnectionConfig,
-  connectionConfigEnvPatch,
-  resolveEngagement
+  connectionConfigEnvPatch
 };

package/chunks/{chunk-CGBDEST2.js → chunk-RFK5F45W.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   getFindingPriority
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-S3B6HFSM.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {

package/chunks/{chunk-GTED3FSZ.js → chunk-S2WCYEK2.js}

@@ -4,15 +4,16 @@ const require = __0CreateRequire(import.meta.url);
 import {
   analyzeFindingForKnownMarkers,
   detectKnownMarkers,
+  evidenceKindForFinding,
   require_dist
-} from "./chunk-IXT64DV5.js";
+} from "./chunk-XPDJE537.js";
 import {
   extractFileRefs,
   redactSensitiveHeaders
-} from "./chunk-CGBDEST2.js";
+} from "./chunk-RFK5F45W.js";
 import {
   getFindingPriority
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-S3B6HFSM.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";
@@ -790,99 +791,6 @@ function isPubliclyDisclosed(record) {
   return PUBLIC_STATUSES.has(record.status);
 }
 
-// packages/core/dist/triage/can-auto-suppress.js
-var PROTECTED_SEVERITIES = /* @__PURE__ */ new Set([
-  "critical",
-  "high"
-]);
-var HIGH_IMPACT_CATEGORIES = /* @__PURE__ */ new Set([
-  // Remote code / command / code execution
-  "command-injection",
-  "code-injection",
-  // Injection into the data store
-  "sql-injection",
-  // Unsafe deserialization is a classic RCE primitive
-  "unsafe-deserialization",
-  // Server-side request forgery (pivot / internal network reach)
-  "ssrf",
-  // Arbitrary file read/write
-  "path-traversal",
-  // Memory corruption / binary / kernel classes
-  "heap-overflow",
-  "out-of-bounds-read",
-  "out-of-bounds-write",
-  "use-after-free",
-  "stack-buffer-overflow",
-  "integer-overflow",
-  "type-confusion",
-  "double-free",
-  "format-string",
-  "uninitialized-memory",
-  "race-condition",
-  "toctou",
-  // Supply-chain compromise (known-vulnerable / malicious package)
-  "known-vulnerable-package",
-  "supply-chain",
-  // Prototype-pollution gadget → auth bypass / RCE when chained. We actively
-  // disclose these (e.g. the jsonwebtoken verify() gadget), so they must never
-  // be auto-dropped on a score alone.
-  "prototype-pollution",
-  // Cryptographic misuse — hardcoded keys/IVs, JWT alg-confusion (alg=none /
-  // HS-vs-RS), and predictable RNG for secrets are direct key-leak / auth-bypass
-  // primitives, so the class is protected from score-only auto-drop.
-  "crypto-misuse",
-  // AI-system adversarial classes — the core 0 "adversarial reliability"
-  // thesis (authorization-boundary break, unsafe tool use, data exfiltration,
-  // prompt hijack). A missed one of these is a disclosure-grade loss.
-  "prompt-injection",
-  "data-exfiltration",
-  "tool-misuse"
-]);
-function canAutoSuppressDetailed(finding) {
-  if (PROTECTED_SEVERITIES.has(finding.severity)) {
-    return {
-      canSuppress: false,
-      guard: "high_severity",
-      reason: `severity=${finding.severity} is disclosure-grade; routed to verification instead of auto-drop`
-    };
-  }
-  if (HIGH_IMPACT_CATEGORIES.has(finding.category)) {
-    return {
-      canSuppress: false,
-      guard: "high_impact_class",
-      reason: `category=${finding.category} is a high-impact class; routed to verification instead of auto-drop`
-    };
-  }
-  return {
-    canSuppress: true,
-    reason: `severity=${finding.severity}, category=${finding.category} eligible for score/heuristic auto-suppression`
-  };
-}
-
-// packages/core/dist/triage/verify-verdict.js
-var REPRODUCING_LAYERS = /* @__PURE__ */ new Set(["poc_gen", "pov_gate", "oracle"]);
-function evidenceKindForFinding(finding) {
-  const hasPocSteps = Array.isArray(finding.pocSteps) && finding.pocSteps.length > 0;
-  const reproduced = hasPocSteps && (finding.layerVerdicts ?? []).some((v) => v.verdict === "pass" && REPRODUCING_LAYERS.has(v.layer));
-  return reproduced ? "reproduced-poc" : "source-only";
-}
-function outcomeOf(verdict) {
-  return typeof verdict === "string" ? verdict : verdict.verdict;
-}
-function isDisclosureWorthy(finding, verdict) {
-  if (outcomeOf(verdict) !== "rejected") {
-    return {
-      keep: true,
-      reason: `verdict=${outcomeOf(verdict)}: not a rejection \u2014 finding kept`
-    };
-  }
-  const guard = canAutoSuppressDetailed(finding);
-  if (guard.canSuppress) {
-    return { keep: false, reason: guard.reason };
-  }
-  return { keep: true, guard: guard.guard, reason: guard.reason };
-}
-
 // packages/core/dist/disclose/evidence-pack.js
 var UnreproducedFindingError = class extends Error {
   findingId;
@@ -1284,9 +1192,6 @@ export {
   createDisclosureRecord,
   transition,
   isPubliclyDisclosed,
-  canAutoSuppressDetailed,
-  evidenceKindForFinding,
-  isDisclosureWorthy,
   UnreproducedFindingError,
   assembleEvidencePack,
   renderVendorNotificationMarkdown,