0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-6XMFCVJS.js → chunk-N7YCONYR.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-IJ6UPW3H.js";
+} from "./chunk-HS2NQ7K6.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-3WUPCZGF.js → chunk-NA3FKCI2.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-UEX7PFSE.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-XA2IBHPB.js";
+} from "./chunk-B7XL6RON.js";
 
 // packages/core/dist/kernel/exploit/harness.js
 import { existsSync } from "node:fs";

package/chunks/{chunk-S2GITRD5.js → chunk-NABVDAAO.js}

@@ -4,10 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   getToolsForRole,
   runNativeAgentLoop
-} from "./chunk-5WAHHZBF.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   LlmApiRuntime
-} from "./chunk-IJ6UPW3H.js";
+} from "./chunk-HS2NQ7K6.js";
 
 // packages/core/dist/eval-runner.js
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-SZDD77KX.js → chunk-NNMOTHKC.js}

@@ -5,23 +5,19 @@ import {
   source_default
 } from "./chunk-HLFS6WV2.js";
 import {
-  agenticScan
-} from "./chunk-ZM6ANQZJ.js";
-import {
+  agenticScan,
+  getToolsForRole,
   runAgentLoop
-} from "./chunk-YSQWZ67M.js";
-import {
-  getToolsForRole
-} from "./chunk-5WAHHZBF.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   createRuntime
-} from "./chunk-K74DRDC5.js";
+} from "./chunk-EHNVP6QB.js";
 import {
   osecDB
-} from "./chunk-BMDG6T7D.js";
+} from "./chunk-72PU46MS.js";
 import {
   LlmApiRuntime
-} from "./chunk-IJ6UPW3H.js";
+} from "./chunk-HS2NQ7K6.js";
 
 // packages/cli/src/commands/orchestrate.ts
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-LMP2T4G2.js → chunk-OILVEROI.js}

@@ -14,25 +14,18 @@ import {
   resolveLayeredSettings,
   saveProjectOverrides,
   saveSettings
-} from "./chunk-X2IPO5JO.js";
-import {
-  expandHomePath,
-  isExistingLocalTargetPath,
-  isExplicitLocalTargetPath
-} from "./chunk-PJU24AKR.js";
+} from "./chunk-V2KJQVYE.js";
 import {
   ANALYTICS_LEVEL_ENV,
-  analyticsOptedOut,
   analyticsPipeline,
   levelAtLeast,
   resolveAnalyticsLevel
-} from "./chunk-PVJUPIQG.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   homeStateDir
-} from "./chunk-GXXX7AGH.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/tui/settings-store.ts
-import { useSyncExternalStore } from "react";
 var cached = null;
 var globalDraft = null;
 var projectDraft = null;
@@ -62,13 +55,6 @@ function getSettingSources() {
   getSettings();
   return cached.sources;
 }
-function getAnalyticsSetupDraft() {
-  const settings = getSettings();
-  const current = process.env[ANALYTICS_LEVEL_ENV];
-  const shellPreference = current !== void 0 && current !== bridgedAnalyticsEnv;
-  if (analyticsOptedOut() || shellPreference && resolveAnalyticsLevel() === "off") return "off";
-  return cached.sources.analyticsLevel === "default" ? "usage" : settings.analyticsLevel;
-}
 function setSettings(next) {
   const value = normalizeSettings(next);
   const saved = saveSettings(value, homeDir);
@@ -116,17 +102,6 @@ function resetSettings(next, keys) {
   notify(cached.settings);
   return globalSaved && projectSaved;
 }
-function previewSetting(key, value) {
-  if (cached === null) cached = loadLayered();
-  cached = { settings: { ...cached.settings, [key]: value }, sources: cached.sources };
-  notify(cached.settings);
-}
-function subscribeSettings(fn) {
-  subscribers.add(fn);
-  return () => {
-    subscribers.delete(fn);
-  };
-}
 var bridgedAnalyticsEnv;
 function bridgeAnalyticsLevel(settings) {
   try {
@@ -142,21 +117,6 @@ function bridgeAnalyticsLevel(settings) {
   } catch {
   }
 }
-function reloadSettings() {
-  globalDraft = null;
-  projectDraft = null;
-  cached = loadLayered();
-  notify(cached.settings);
-  return cached.settings;
-}
-function configureSettingsStore(options) {
-  homeDir = options.homeDir;
-  projectDir = options.projectDir;
-  reloadSettings();
-}
-function useSettings() {
-  return useSyncExternalStore(subscribeSettings, getSettings, getSettings);
-}
 
 // packages/cli/src/codex-auth.ts
 import { readFileSync, existsSync } from "node:fs";
@@ -198,84 +158,6 @@ function asString(value) {
   return typeof value === "string" ? value : void 0;
 }
 
-// packages/cli/src/engagement-plan.ts
-var PACKAGE_PREFIXES = {
-  "npm:": { ecosystem: "npm", targetType: "npm-package" },
-  "pypi:": { ecosystem: "pypi", targetType: "pypi-package" },
-  "cargo:": { ecosystem: "cargo", targetType: "cargo-package" },
-  "oci:": { ecosystem: "oci", targetType: "oci-image" }
-};
-function resolveEngagement(rawTarget) {
-  const raw = rawTarget.trim();
-  if (raw.length === 0) return { ok: false, message: "Enter a URL, source path, git URL, or ecosystem-prefixed package." };
-  for (const [prefix, packagePlan] of Object.entries(PACKAGE_PREFIXES)) {
-    if (!raw.startsWith(prefix)) continue;
-    const target = raw.slice(prefix.length).trim();
-    if (target.length === 0) return { ok: false, message: `${prefix} requires a package name.` };
-    return {
-      ok: true,
-      plan: {
-        kind: "package",
-        target,
-        targetType: packagePlan.targetType,
-        ecosystem: packagePlan.ecosystem,
-        label: `${packagePlan.ecosystem} package ${target}`
-      }
-    };
-  }
-  if (raw.startsWith("source:")) {
-    const target = raw.slice("source:".length).trim();
-    if (target.length === 0) return { ok: false, message: "source: requires a local path or git URL." };
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target: expandHomePath(target),
-        targetType: "source-code",
-        label: `source review ${target}`
-      }
-    };
-  }
-  if (raw.startsWith("git@") || raw.startsWith("git://") || raw.endsWith(".git") || raw.startsWith("https://github.com/")) {
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target: raw,
-        targetType: "source-code",
-        label: `source review ${raw}`
-      }
-    };
-  }
-  if (raw.startsWith("mcp://") || raw.startsWith("http://") || raw.startsWith("https://")) {
-    return {
-      ok: true,
-      plan: {
-        kind: "web",
-        target: raw,
-        targetType: "url",
-        label: `web target ${raw}`
-      }
-    };
-  }
-  if (isExplicitLocalTargetPath(raw) || isExistingLocalTargetPath(raw)) {
-    const target = expandHomePath(raw);
-    return {
-      ok: true,
-      plan: {
-        kind: "source",
-        target,
-        targetType: "source-code",
-        label: `source review ${target}`
-      }
-    };
-  }
-  return {
-    ok: false,
-    message: "Ambiguous target. Use https://\u2026, ./path, source:\u2026, npm:\u2026, pypi:\u2026, cargo:\u2026, or oci:\u2026."
-  };
-}
-
 // packages/cli/src/tui/credential-store.ts
 import { chmodSync, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { dirname, join as join2 } from "node:path";
@@ -306,11 +188,6 @@ function normalizeCredentials(raw) {
 function loadCredentials(homeDir2) {
   return projectApiKeys(loadAccountStore(homeDir2));
 }
-function saveCredentials(creds, homeDir2) {
-  const store = loadAccountStore(homeDir2);
-  const desired = normalizeCredentials(creds);
-  return saveAccountStore(replaceApiKeyLayer(store, desired), homeDir2);
-}
 function projectApiKeys(store) {
   const out = {};
   for (const providerId of Object.keys(store.providers)) {
@@ -319,26 +196,6 @@ function projectApiKeys(store) {
   }
   return out;
 }
-function replaceApiKeyLayer(store, desired) {
-  const providers = {};
-  for (const [providerId, entry] of Object.entries(store.providers)) {
-    const kept = {};
-    for (const [accountId, record] of Object.entries(entry.accounts)) {
-      if (record.kind !== "api_key") kept[accountId] = record;
-    }
-    const keptIds = Object.keys(kept);
-    if (keptIds.length === 0) continue;
-    const active = entry.activeAccountId !== void 0 && kept[entry.activeAccountId] !== void 0 ? entry.activeAccountId : keptIds[0];
-    providers[providerId] = { activeAccountId: active, accounts: kept };
-  }
-  for (const [providerId, secret] of Object.entries(desired)) {
-    const existing = providers[providerId];
-    const accounts = existing ? { ...existing.accounts } : {};
-    accounts[DEFAULT_ACCOUNT_ID] = { kind: "api_key", secret };
-    providers[providerId] = { activeAccountId: DEFAULT_ACCOUNT_ID, accounts };
-  }
-  return { version: STORE_VERSION, providers };
-}
 function credentialEnvPatch(creds, env) {
   const stored = normalizeCredentials(creds);
   const patch = {};
@@ -352,18 +209,6 @@ function credentialEnvPatch(creds, env) {
   }
   return patch;
 }
-var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
-var TAIL = 4;
-var PREFIX = 6;
-var MIN_LENGTH_FOR_TAIL = 12;
-var MIN_LENGTH_FOR_PREFIX = 20;
-function redactSecret(secret) {
-  const value = typeof secret === "string" ? secret.trim() : "";
-  if (value.length < MIN_LENGTH_FOR_TAIL) return MASK;
-  const tail = value.slice(-TAIL);
-  if (value.length < MIN_LENGTH_FOR_PREFIX) return `${MASK}${tail}`;
-  return `${value.slice(0, PREFIX)}\u2026${tail}`;
-}
 var STORE_VERSION = 2;
 var DEFAULT_ACCOUNT_ID = "default";
 var KNOWN_PROVIDER_IDS = new Set(PROVIDERS.map((provider) => provider.id));
@@ -419,7 +264,16 @@ function normalizeRecord(providerId, raw) {
     const tokens = normalizeTokens(raw.tokens);
     if (tokens === void 0) return void 0;
     const identity = normalizeIdentity(raw.identity);
-    return identity === void 0 ? { kind: "oauth", tokens } : { kind: "oauth", tokens, identity };
+    let oauthClient;
+    if (raw.oauthClient !== void 0) {
+      if (providerId !== "google" || !isPlainObject(raw.oauthClient)) return void 0;
+      const clientId = trimmedString(raw.oauthClient.clientId);
+      if (!clientId || /[\s\x00-\x1f\x7f]/.test(clientId)) return void 0;
+      const clientSecret = trimmedString(raw.oauthClient.clientSecret);
+      if (raw.oauthClient.clientSecret !== void 0 && (!clientSecret || /[\s\x00-\x1f\x7f]/.test(clientSecret))) return void 0;
+      oauthClient = { clientId, ...clientSecret ? { clientSecret } : {} };
+    }
+    return { kind: "oauth", tokens, ...identity ? { identity } : {}, ...oauthClient ? { oauthClient } : {} };
   }
   return void 0;
 }
@@ -568,6 +422,10 @@ function accountEnvPatch(store, env) {
       if (target !== void 0) patch[target] = record.secret;
       continue;
     }
+    if (info.id === "google") {
+      patch.ZERO_GEMINI_OAUTH_CLIENT_ID = record.oauthClient?.clientId ?? "";
+      patch.ZERO_GEMINI_OAUTH_CLIENT_SECRET = record.oauthClient?.clientSecret ?? "";
+    }
     const accessVar = info.envVars[0];
     if (accessVar !== void 0 && record.tokens.accessToken !== void 0) {
       patch[accessVar] = record.tokens.accessToken;
@@ -602,13 +460,13 @@ function validateConnectionConfig(providerId, value) {
   if (value.baseUrl !== void 0) {
     if (!BASE_URL_VARS[providerId]) throw new Error("This provider does not support a custom API endpoint.");
     const url = new URL(value.baseUrl);
-    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname))) {
-      throw new Error("API endpoint must be credential-free HTTPS, or loopback HTTP, without a query or fragment.");
+    if (url.username || url.password || url.search || url.hash || url.protocol !== "https:" && !(url.protocol === "http:" && (providerId === "openai" || ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))) {
+      throw new Error("API endpoint must be credential-free HTTPS (or HTTP for custom OpenAI-compatible endpoints and loopback), without a query or fragment.");
     }
     result.baseUrl = url.href.replace(/\/$/, "");
   }
   if (value.model !== void 0) {
-    if (providerId !== "azure") throw new Error("Deployment model configuration is only supported for Azure; select other models through runtime selection.");
+    if (providerId !== "azure" && providerId !== "openai") throw new Error("Connection model configuration is supported for Azure and custom OpenAI-compatible providers.");
     if (!value.model.trim() || value.model.length > 256 || /[\s\x00-\x1f\x7f]/.test(value.model)) throw new Error("Invalid deployment model.");
     result.model = value.model;
   }
@@ -662,6 +520,7 @@ function connectionConfigEnvPatch(env, homeDir2) {
     const variable = BASE_URL_VARS[id];
     if (variable && config.baseUrl && !env[variable]) patch[variable] = config.baseUrl;
     if (id === "azure" && config.model && !env.AZURE_OPENAI_MODEL) patch.AZURE_OPENAI_MODEL = config.model;
+    if (id === "openai" && config.model && !env.OPENAI_MODEL) patch.OPENAI_MODEL = config.model;
     if (id === "google" && config.projectId && !env.GOOGLE_CLOUD_PROJECT && !env.ZERO_GEMINI_PROJECT) patch.ZERO_GEMINI_PROJECT = config.projectId;
   }
   return patch;
@@ -670,20 +529,12 @@ function connectionConfigEnvPatch(env, homeDir2) {
 export {
   getSettings,
   getSettingSources,
-  getAnalyticsSetupDraft,
   defaultWriteLayer,
   updateSetting,
   resetSettings,
-  previewSetting,
-  subscribeSettings,
-  reloadSettings,
-  configureSettingsStore,
-  useSettings,
   maybeLoadCodexAuth,
   loadCredentials,
-  saveCredentials,
   credentialEnvPatch,
-  redactSecret,
   loadAccountStore,
   saveAccountStore,
   listAccounts,
@@ -695,6 +546,5 @@ export {
   validateConnectionConfig,
   loadConnectionConfigs,
   saveConnectionConfig,
-  connectionConfigEnvPatch,
-  resolveEngagement
+  connectionConfigEnvPatch
 };