0sec-cli 0.24.1 → 0.25.0

package/chunks/chunk-4ROZFLSR.js

@@ -1,279 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  scanExecutionTimeout
-} from "./chunk-BD7WULFS.js";
-
-// packages/core/dist/shared-analysis.js
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-var FOXGUARD_PINNED_TAG = "v0.14.0";
-var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini"]);
-function bufferToString(value) {
-  if (!value) {
-    return "";
-  }
-  return Buffer.isBuffer(value) ? value.toString("utf-8") : value;
-}
-function mapSemgrepSeverity(level) {
-  switch (level.toUpperCase()) {
-    case "ERROR":
-      return "high";
-    case "WARNING":
-      return "medium";
-    case "INFO":
-      return "low";
-    default:
-      return "info";
-  }
-}
-function mapFoxguardSeverity(level) {
-  switch ((level ?? "").toLowerCase()) {
-    case "error":
-    case "critical":
-      return "critical";
-    case "warning":
-    case "high":
-      return "high";
-    case "note":
-    case "medium":
-      return "medium";
-    case "low":
-      return "low";
-    default:
-      return "info";
-  }
-}
-function runSemgrepScan(targetPath, emit, opts) {
-  emit({
-    type: "stage:start",
-    stage: "source-analysis",
-    message: "Running semgrep security scan..."
-  });
-  if (opts?.paths?.length === 0) {
-    emit({ type: "stage:end", stage: "source-analysis", message: "Semgrep: no files selected" });
-    return [];
-  }
-  const args = [
-    "scan",
-    "--config",
-    "auto",
-    "--json",
-    ...opts?.noGitIgnore ? ["--no-git-ignore"] : [],
-    "--timeout",
-    "60",
-    "--max-target-bytes",
-    "1000000",
-    ...opts?.paths ?? [targetPath]
-  ];
-  let rawOutput;
-  try {
-    rawOutput = execFileSync("semgrep", args, {
-      timeout: scanExecutionTimeout(3e5),
-      stdio: "pipe",
-      encoding: "utf-8",
-      env: { ...process.env, SEMGREP_SEND_METRICS: "off" }
-    });
-  } catch (err) {
-    if (!err || typeof err !== "object" || !("status" in err) || err.status !== 1)
-      throw err;
-    rawOutput = bufferToString("stdout" in err ? err.stdout : void 0);
-  }
-  const raw = JSON.parse(rawOutput);
-  if (!raw || !Array.isArray(raw.results))
-    throw new Error("invalid Semgrep JSON report");
-  const results = raw.results;
-  const findings = results.map((r) => ({
-    ruleId: r.check_id,
-    message: r.extra?.message ?? "",
-    severity: mapSemgrepSeverity(r.extra?.severity ?? "WARNING"),
-    path: r.path,
-    startLine: r.start?.line ?? 0,
-    endLine: r.end?.line ?? 0,
-    snippet: r.extra?.lines ?? "",
-    metadata: r.extra?.metadata
-  }));
-  emit({
-    type: "stage:end",
-    stage: "source-analysis",
-    message: `Semgrep: ${findings.length} findings`
-  });
-  return findings;
-}
-function selectedStaticScanner() {
-  return process.env["ZERO_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
-}
-function runFoxguardScan(targetPath, emit, opts) {
-  emit({
-    type: "stage:start",
-    stage: "source-analysis",
-    message: "Running foxguard security scan..."
-  });
-  if (opts?.paths?.length === 0) {
-    emit({ type: "stage:end", stage: "source-analysis", message: "Foxguard: no files selected" });
-    return [];
-  }
-  const foxguardTag = opts?.foxguardTag ?? FOXGUARD_PINNED_TAG;
-  const runner = opts?.runner ?? execFileSync;
-  const logger = opts?.logger ?? ((m) => console.warn(m));
-  const cwd = statSync(targetPath, { throwIfNoEntry: false })?.isFile() ? dirname(resolve(targetPath)) : resolve(targetPath);
-  let useNpm = opts?.foxguardCommand !== void 0 || opts?.foxguardTag !== void 0;
-  const findings = [];
-  let selectionDir;
-  try {
-    let selectionFile;
-    if (opts?.paths && !opts.diffBase) {
-      const paths = opts.paths.map((path) => {
-        const selected = relative(cwd, resolve(cwd, path));
-        if (isAbsolute(selected) || selected === ".." || selected.startsWith(`..${sep}`) || /[\r\n\0]/.test(selected)) {
-          throw new Error(`selected Foxguard path is outside the scan root or cannot be represented: ${path}`);
-        }
-        return selected.split(sep).join("/");
-      });
-      selectionDir = mkdtempSync(join(tmpdir(), "0-foxguard-"));
-      selectionFile = join(selectionDir, "changed-files.txt");
-      writeFileSync(selectionFile, `${paths.join("\n")}
-`, { mode: 384 });
-    }
-    const scanRoot = relative(cwd, resolve(targetPath)) || ".";
-    const invocations = [opts?.diffBase ? ["diff", opts.diffBase, scanRoot, "--format", "json"] : ["--format", "json", ...selectionFile ? ["--changed-files-from", selectionFile] : [], scanRoot]];
-    for (const args of invocations) {
-      let rawOutput;
-      const invoke = () => {
-        try {
-          return bufferToString(runner(useNpm ? opts?.foxguardCommand ?? "npx" : "foxguard", useNpm ? ["--yes", `foxguard@${foxguardTag}`, ...args] : args, {
-            cwd,
-            timeout: scanExecutionTimeout(3e5),
-            maxBuffer: 64 * 1024 * 1024,
-            stdio: "pipe",
-            encoding: "utf-8"
-          }));
-        } catch (err) {
-          if (err && typeof err === "object" && "status" in err && err.status === 1) {
-            return bufferToString("stdout" in err ? err.stdout : void 0);
-          }
-          throw err;
-        }
-      };
-      try {
-        rawOutput = invoke();
-      } catch (err) {
-        if (!useNpm && err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
-          useNpm = true;
-          rawOutput = invoke();
-        } else {
-          throw err;
-        }
-      }
-      const report = parseFoxguardJson(rawOutput);
-      if (report === null)
-        throw new Error("invalid Foxguard JSON report");
-      if (report.filesScanned === 0) {
-        throw new Error("Foxguard scanned 0 files; static coverage is unavailable (files may be excluded or unsupported)");
-      }
-      for (const finding of translateFoxguardFindings(report.findings)) {
-        finding.path = resolve(cwd, finding.path);
-        findings.push(finding);
-      }
-    }
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    logger(`[0] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set ZERO_STATIC=semgrep to use semgrep.`);
-    emit({ type: "error", stage: "source-analysis", message: `Foxguard scan failed: ${message}` });
-    throw err;
-  } finally {
-    if (selectionDir)
-      rmSync(selectionDir, { recursive: true, force: true });
-  }
-  emit({
-    type: "stage:end",
-    stage: "source-analysis",
-    message: `Foxguard: ${findings.length} findings`
-  });
-  return findings;
-}
-function runSelectedStaticScan(targetPath, emit, opts) {
-  return selectedStaticScanner() === "foxguard" ? runFoxguardScan(targetPath, emit, opts) : runSemgrepScan(targetPath, emit, opts);
-}
-function parseFoxguardJson(rawJson) {
-  let parsed;
-  try {
-    parsed = JSON.parse(rawJson);
-  } catch {
-    return null;
-  }
-  if (Array.isArray(parsed))
-    return { findings: parsed };
-  if (!parsed || typeof parsed !== "object" || !("findings" in parsed))
-    return null;
-  for (const field of ["schema_version", "finding_schema_version"]) {
-    if (field in parsed && !/^1\.\d+\.\d+$/.test(String(parsed[field]))) {
-      return null;
-    }
-  }
-  if (!Array.isArray(parsed.findings))
-    return null;
-  const target = "target" in parsed ? parsed.target : void 0;
-  const filesScanned = target && typeof target === "object" && "files_scanned" in target ? target.files_scanned : void 0;
-  if (filesScanned !== void 0 && (typeof filesScanned !== "number" || !Number.isSafeInteger(filesScanned) || filesScanned < 0))
-    return null;
-  return { findings: parsed.findings, ...typeof filesScanned === "number" ? { filesScanned } : {} };
-}
-function translateFoxguardFindings(rawFindings) {
-  const out = [];
-  for (const raw of rawFindings) {
-    if (!raw || typeof raw !== "object")
-      continue;
-    if (!raw.rule_id || !raw.file || typeof raw.line !== "number")
-      continue;
-    const startLine = raw.line;
-    const endLine = typeof raw.end_line === "number" ? raw.end_line : startLine;
-    const metadata = { scanner: "foxguard" };
-    if (raw.cwe)
-      metadata.cwe = raw.cwe;
-    if (typeof raw.confidence === "number")
-      metadata.confidence = raw.confidence;
-    if (typeof raw.taint_hops === "number")
-      metadata.taintHops = raw.taint_hops;
-    if (raw.source_line || raw.sink_line) {
-      metadata.dataflow = {
-        sourceLine: raw.source_line,
-        sourceDescription: raw.source_description,
-        sinkLine: raw.sink_line,
-        sinkDescription: raw.sink_description
-      };
-    }
-    if (raw.fix_suggestion)
-      metadata.fixSuggestion = raw.fix_suggestion;
-    if (raw.tags && raw.tags.length > 0)
-      metadata.tags = raw.tags;
-    if (raw.crypto_algorithm)
-      metadata.cryptoAlgorithm = raw.crypto_algorithm;
-    if (raw.cnsa2_deadline)
-      metadata.cnsa2Deadline = raw.cnsa2_deadline;
-    if (raw.dep_name)
-      metadata.depName = raw.dep_name;
-    out.push({
-      ruleId: raw.rule_id,
-      message: raw.description ?? "",
-      severity: mapFoxguardSeverity(raw.severity),
-      path: raw.file,
-      startLine,
-      endLine,
-      snippet: raw.snippet ?? "",
-      metadata
-    });
-  }
-  return out;
-}
-
-export {
-  CLI_RUNTIME_TYPES,
-  bufferToString,
-  selectedStaticScanner,
-  runFoxguardScan,
-  runSelectedStaticScan
-};

package/chunks/chunk-56UTQKXO.js

@@ -1,56 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  createPresentationEvent
-} from "./chunk-GXXX7AGH.js";
-
-// packages/cli/src/presentation/event-bus.ts
-var PresentationEventBus = class {
-  listeners = [];
-  subscribe(listener) {
-    this.listeners.push(listener);
-    return () => {
-      const index = this.listeners.indexOf(listener);
-      if (index >= 0) this.listeners.splice(index, 1);
-    };
-  }
-  emit(event) {
-    for (const listener of [...this.listeners]) {
-      try {
-        listener.emit(event);
-      } catch {
-      }
-    }
-  }
-  get size() {
-    return this.listeners.length;
-  }
-};
-var presentationEventBus = new PresentationEventBus();
-function createPresentationEmitter(options = {}) {
-  const source = options.source ?? "cli";
-  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
-  const bus = options.bus ?? presentationEventBus;
-  let sequence = 0;
-  return {
-    emit(eventType, payload, correlation = {}) {
-      const event = createPresentationEvent({
-        source,
-        sequence: ++sequence,
-        at: now(),
-        eventType,
-        payload,
-        ...correlation.scanId ? { scanId: correlation.scanId } : {},
-        ...correlation.sessionId ? { sessionId: correlation.sessionId } : {}
-      });
-      bus.emit(event);
-      return event;
-    }
-  };
-}
-
-export {
-  presentationEventBus,
-  createPresentationEmitter
-};

package/chunks/chunk-BPU6M42R.js

@@ -1,77 +0,0 @@
-#!/usr/bin/env node
-import { createRequire as __0CreateRequire } from "node:module";
-const require = __0CreateRequire(import.meta.url);
-import {
-  connectionConfigEnvPatch,
-  credentialEnvPatch,
-  loadCredentials
-} from "./chunk-LMP2T4G2.js";
-
-// packages/cli/src/herdr-state.ts
-var sink = null;
-function setHerdrSink(next) {
-  sink = next;
-}
-function reportOperatorGate(blocked) {
-  if (!sink) return;
-  try {
-    if (blocked) sink.reportBlocked();
-    else sink.reportWorking();
-  } catch {
-  }
-}
-function withSink(fn) {
-  if (!sink) return;
-  try {
-    fn(sink);
-  } catch {
-  }
-}
-function reportHerdrModel(model, provider) {
-  withSink((s) => s.setModel(model, provider));
-}
-function reportHerdrContextPercent(percent) {
-  withSink((s) => s.setContextPercent(percent));
-}
-function reportHerdrTarget(target) {
-  withSink((s) => s.setTarget(target));
-}
-function reportHerdrObjective(objective) {
-  withSink((s) => s.setObjective(objective));
-}
-function reportHerdrActivity(activity) {
-  withSink((s) => s.setActivity(activity));
-}
-function reportHerdrCompaction() {
-  withSink((s) => s.reportCompacting());
-}
-function reportHerdrSession(ref) {
-  withSink((s) => s.reportSession(ref));
-}
-function reportHerdrSessionClose() {
-  withSink((s) => {
-    void s.release();
-  });
-}
-
-// packages/cli/src/connection-env.ts
-function savedConnectionEnvPatch(env, homeDir) {
-  return {
-    ...connectionConfigEnvPatch(env, homeDir),
-    ...credentialEnvPatch(loadCredentials(homeDir), env)
-  };
-}
-
-export {
-  setHerdrSink,
-  reportOperatorGate,
-  reportHerdrModel,
-  reportHerdrContextPercent,
-  reportHerdrTarget,
-  reportHerdrObjective,
-  reportHerdrActivity,
-  reportHerdrCompaction,
-  reportHerdrSession,
-  reportHerdrSessionClose,
-  savedConnectionEnvPatch
-};