0sec-cli 0.25.0 → 0.26.0

package/chunks/{chunk-6TA3CWND.js → chunk-V2KJQVYE.js}

@@ -7,13 +7,13 @@ import {
   createWorkbenchProviderBroker,
   runSmolvmWorkbench,
   snapshotSmolvmWorkspace
-} from "./chunk-EEP6GBUO.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   getReleaseChannel
-} from "./chunk-D4IBEO2K.js";
+} from "./chunk-VWE36MUN.js";
 import {
   TOOL_DEFINITIONS
-} from "./chunk-HFUOUT2B.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   ANALYTICS_LEVEL_ENV,
   getSmolvmWorkbenchStatus,
@@ -21,7 +21,7 @@ import {
   levelAtLeast,
   loadCloudCredentials,
   resolveAnalyticsLevel
-} from "./chunk-3T5R7P4T.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   ScopePolicy,
   aggregateCapabilities,
@@ -34,7 +34,7 @@ import {
   readInstalledPlugin,
   reconcile,
   writeEnablement
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   BackendIdSchema,
   DEFAULT_ALLOW_MODEL_SELF_EXTENSION,
@@ -42,7 +42,7 @@ import {
   VERSION,
   findingSchema,
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -991,7 +991,7 @@ var KEYBINDINGS = [
     description: "Cycle the autonomy mode: Standard \u2192 Co-pilot \u2192 YOLO \u2192 Recon; no preconfigured scope is required.",
     category: "Autonomy",
     lockReason: "mode-cycle",
-    handler: "if (isAutonomyCycleKey(key)) session.setAutonomyMode(nextAutonomyMode(modeRef.current))"
+    handler: "showToast(String(`YOLO is the only mode`))"
   }
 ];
 var MODIFIER_ALIASES = {
@@ -1810,6 +1810,14 @@ var PROVIDER_DEFS = [
     fileSource: "~/.codex/auth.json (override with ZERO_CHATGPT_AUTH_FILE)",
     hint: "run `codex login` to write ~/.codex/auth.json, or invoke 0 with env ZERO_CHATGPT_OAUTH_REFRESH_TOKEN=..."
   },
+  {
+    id: "chatgpt-plan",
+    label: "ChatGPT",
+    methods: ["oauth"],
+    envVars: [],
+    fileSource: "0 native ChatGPT connection",
+    hint: "connect your ChatGPT account through 0 native sign-in"
+  },
   {
     id: "deepseek",
     label: "DeepSeek",
@@ -1857,20 +1865,18 @@ var PROVIDER_DEFS = [
   {
     id: "kimi",
     label: "Moonshot Kimi",
-    // OAuth (device sign-in) is preferred; a pasted KIMI_API_KEY remains a
-    // secondary path. The OAuth access token is written to KIMI_API_KEY as a
-    // Bearer (llm-api.ts reads it there, no change needed), and the refresh
-    // token to the 0-owned var so the store can round-trip it.
+    // New sign-ins require an explicitly registered 0 client. Existing stored
+    // OAuth credentials remain readable through the original environment keys.
     methods: ["oauth", "api-key"],
     envVars: ["KIMI_API_KEY", "ZERO_KIMI_OAUTH_REFRESH_TOKEN"],
-    hint: "sign in with your Kimi account, or set KIMI_API_KEY from your Kimi coding plan (endpoint override: KIMI_BASE_URL)"
+    hint: "set KIMI_API_KEY from your Kimi coding plan (endpoint override: KIMI_BASE_URL); browser sign-in requires ZERO_KIMI_OAUTH_CLIENT_ID registered for 0"
   },
   {
     id: "qwen",
     label: "Alibaba Qwen",
     methods: ["api-key"],
     envVars: ["QWEN_API_KEY"],
-    hint: "set QWEN_API_KEY from Alibaba Model Studio (endpoint override: QWEN_BASE_URL)"
+    hint: "set QWEN_API_KEY and QWEN_BASE_URL for the same QwenCloud or Alibaba Model Studio product and region; Qwen OAuth is discontinued"
   },
   {
     id: "xai",
@@ -1881,7 +1887,7 @@ var PROVIDER_DEFS = [
     // token to the 0-owned var so the store can round-trip it.
     methods: ["oauth", "api-key"],
     envVars: ["XAI_API_KEY", "ZERO_XAI_OAUTH_REFRESH_TOKEN"],
-    hint: "sign in with your xAI account, or set XAI_API_KEY from console.x.ai (endpoint override: XAI_BASE_URL)"
+    hint: "set XAI_API_KEY from console.x.ai (endpoint override: XAI_BASE_URL); browser sign-in requires ZERO_XAI_OAUTH_CLIENT_ID registered for 0"
   },
   {
     id: "cline",
@@ -1906,7 +1912,7 @@ var PROVIDER_DEFS = [
     // there is no refresh-token env var.
     methods: ["oauth"],
     envVars: ["ZERO_COPILOT_GITHUB_TOKEN"],
-    hint: "sign in with your GitHub Copilot account (device sign-in), or set ZERO_COPILOT_GITHUB_TOKEN=... (endpoint override: COPILOT_BASE_URL)"
+    hint: "browser sign-in requires ZERO_COPILOT_OAUTH_CLIENT_ID registered for 0 and Copilot service access; existing ZERO_COPILOT_GITHUB_TOKEN credentials remain supported (endpoint override: COPILOT_BASE_URL)"
   },
   {
     id: "google",
@@ -1918,7 +1924,7 @@ var PROVIDER_DEFS = [
     // pasted-key equivalent — Code Assist authenticates only via OAuth.
     methods: ["oauth"],
     envVars: ["ZERO_GEMINI_ACCESS_TOKEN", "ZERO_GEMINI_OAUTH_REFRESH_TOKEN"],
-    hint: "sign in with your Google account (browser sign-in), or set ZERO_GEMINI_OAUTH_REFRESH_TOKEN=... for Gemini Code Assist (project override: GOOGLE_CLOUD_PROJECT / ZERO_GEMINI_PROJECT)"
+    hint: "browser sign-in requires ZERO_GOOGLE_OAUTH_CLIENT_ID registered for 0 and Code Assist access (plus ZERO_GOOGLE_OAUTH_CLIENT_SECRET if required); existing ZERO_GEMINI_OAUTH_REFRESH_TOKEN credentials remain supported"
   },
   {
     id: "anthropic",
@@ -2207,7 +2213,7 @@ function serializeSubmission(payload, target, env) {
   if (!target.sentryKey || !payload.diagnostic) return serializePayload(payload);
   const diagnostic = payload.diagnostic;
   const cliVersion = VERSION;
-  const commit = /^[0-9a-f]{40}$/i.test("9a5ac5ae02d8046aedb23583d6ac135dd22dea83") ? "9a5ac5ae02d8046aedb23583d6ac135dd22dea83".toLowerCase() : void 0;
+  const commit = /^[0-9a-f]{40}$/i.test("45384f71627b3e076ae0b7af35318b1fd4c1baf2") ? "45384f71627b3e076ae0b7af35318b1fd4c1baf2".toLowerCase() : void 0;
   const releaseChannel = getReleaseChannel(env);
   const environment = releaseChannel === "beta" ? "production" : "development";
   const event = JSON.stringify({
@@ -2394,7 +2400,7 @@ function serializeWorkbenchConfig(config, workspace) {
     if (config[key] !== void 0) throw new Error(`Host ${key} cannot execute through the workbench controller`);
   }
   const result = { workspaceRoot: "/workspace", target: mapWorkbenchTarget(config.target ?? "", workspace) };
-  for (const key of ["role", "tools", "codebaseLearning", "scanId", "maxToolIterations", "allowScanners", "systemPrompt", "autonomyMode", "refineObjective", "allowModelSelfExtension", "costModel", "contextWindowTokens", "compaction", "initialMessages"]) {
+  for (const key of ["role", "tools", "codebaseLearning", "scanId", "maxToolIterations", "allowScanners", "webSearchEnabled", "systemPrompt", "autonomyMode", "refineObjective", "allowModelSelfExtension", "costModel", "contextWindowTokens", "compaction", "initialMessages"]) {
     if (config[key] !== void 0) result[key] = structuredClone(config[key]);
   }
   if (config.maxTurnTokens !== void 0 && Number.isFinite(config.maxTurnTokens)) result.maxTurnTokens = config.maxTurnTokens;
@@ -2624,7 +2630,7 @@ var Controller = class {
       const artifacts = this.options.artifactDirectory ?? await realpath2(await mkdtemp2(join7(root, "run-")));
       const reader = new WorkbenchFrameReader();
       const launch = guestCommand(this.options, this.cli);
-      const connections = this.cli ? [] : (await import("./service-plugins-CN6Q2NSN.js")).loadServicePluginConnections(this.options.pluginHomeDir).filter((item) => item.enabled);
+      const connections = this.cli ? [] : (await import("./service-plugins-TN6KDX4L.js")).loadServicePluginConnections(this.options.pluginHomeDir).filter((item) => item.enabled);
       const servicePluginConnections = validateGuestServicePluginConnections(connections, this.options.network);
       this.redact = servicePluginSecretRedactor(servicePluginConnections);
       const plugins = stagedPlugins = await prepareWorkbenchPlugins(this.workspace, this.options.pluginHomeDir);
@@ -2838,7 +2844,8 @@ function createWorkbenchConsoleSession(options) {
       throw new Error("Workbench source context persistence failed");
     }
   };
-  let autonomyMode = config.autonomyMode ?? "standard";
+  let webSearchEnabled = config.webSearchEnabled ?? config.initialCheckpoint?.webSearchEnabled;
+  let autonomyMode = config.initialCheckpoint?.autonomyMode ?? config.autonomyMode ?? "standard";
   let systemPrompt = config.systemPrompt ?? "";
   let tools = config.tools ?? [];
   let sourceContext;
@@ -2965,6 +2972,7 @@ function createWorkbenchConsoleSession(options) {
       scope = state.scope ? new ScopePolicy(state.scope) : void 0;
       localScopePath = state.localScopePath ? hostWorkspacePath(String(state.localScopePath), workspace) : void 0;
       autonomyMode = state.autonomyMode;
+      if (typeof state.webSearchEnabled === "boolean") webSearchEnabled = state.webSearchEnabled;
       checkpoint = state.checkpoint ? mapWorkbenchCheckpoint(state.checkpoint, workspace, true) : void 0;
     } else if (frame.type === "event") {
       if (!EVENTS.has(String(frame.name)) || !Array.isArray(frame.args)) throw new Error("Invalid guest render callback");
@@ -3012,8 +3020,21 @@ function createWorkbenchConsoleSession(options) {
         explicitYoloSourceGrant = true;
         sourceScopePath ??= workspace;
       }
+      if (!controller.done && serial.initialCheckpoint) {
+        serial.initialCheckpoint = { ...serial.initialCheckpoint, autonomyMode: mode };
+        if (checkpoint) checkpoint = { ...checkpoint, autonomyMode: mode };
+      }
       queue("autonomy", mode);
     },
+    get webSearchEnabled() {
+      return webSearchEnabled;
+    },
+    async setWebSearchEnabled(enabled) {
+      if (active) throw new Error("Wait for the current turn before changing web search.");
+      if (controller.done) await controller.request("webSearch", { value: enabled });
+      webSearchEnabled = enabled;
+      serial.webSearchEnabled = enabled;
+    },
     configureEngagement(selection) {
       if (selection.target !== void 0) target = selection.target;
       if (selection.scope !== void 0) scope = selection.scope ?? void 0;
@@ -3248,7 +3269,7 @@ async function launchConfiguredWorkbench(args) {
     return void 0;
   }
   if (process.platform === "linux" && isAdmittedSmolvmWorkbench()) return void 0;
-  if (["workbench", "config", "web", "dashboard", "console", "chat", "team", "tui", "watch", "doctor", "help", "--help", "-h", "--version", "-v"].includes(args[0] ?? "") || args.length === 0) return void 0;
+  if (["api", "workbench", "config", "web", "dashboard", "console", "chat", "team", "tui", "watch", "doctor", "help", "--help", "-h", "--version", "-v"].includes(args[0] ?? "") || args.length === 0) return void 0;
   if (remoteBackendClientId(args)) return void 0;
   const hostSettings = loadGlobalSettings(home, { requireExecutionProfile: existsSync2(workbenchConfigPath(home)) });
   if (hostSettings.executionProfile !== "smolvm") return void 0;

package/chunks/{chunk-RFK5F45W.js → chunk-VJBEB2K6.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   getFindingPriority
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {

package/chunks/{chunk-D4IBEO2K.js → chunk-VWE36MUN.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   VERSION
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/tui/runtime.ts
 function getReleaseChannel(env = process.env) {

package/chunks/{chunk-B5TIXHCO.js → chunk-WNWDQ2TO.js}

@@ -8,7 +8,7 @@ import {
   osecDB,
   repairOsecDatabase,
   resetOsecDatabase
-} from "./chunk-YXTV2FRE.js";
+} from "./chunk-72PU46MS.js";
 
 // packages/cli/src/commands/db.ts
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-S2WCYEK2.js → chunk-WPJMA5AK.js}

@@ -10,10 +10,10 @@ import {
 import {
   extractFileRefs,
   redactSensitiveHeaders
-} from "./chunk-RFK5F45W.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   getFindingPriority
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";

package/chunks/{chunk-FI5YL4R2.js → chunk-XJ2TBEV7.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createJournalWriter
-} from "./chunk-ACYZMJHC.js";
+} from "./chunk-LRD5N2TQ.js";
 import {
   verifyKernelFinding
-} from "./chunk-FOLTHXRH.js";
+} from "./chunk-B7XL6RON.js";
 import {
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/cve/adapt-loop.js
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";

package/chunks/{chunk-3T5R7P4T.js → chunk-XOVYV7TT.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-MY44EZKD.js";
+} from "./chunk-ULRLUXSS.js";
 import {
   redactAuthHeaders
-} from "./chunk-RFK5F45W.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   ScopePolicy
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   allowlistedChildEnv,
   sanitizedEnv
@@ -18,7 +18,7 @@ import {
   VERSION,
   cloudStateDir,
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";

package/chunks/{chunk-DJGJECBV.js → chunk-YGYJ2FTH.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-3T5R7P4T.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   isScopeEnforcementEnabled
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -1024,7 +1024,8 @@ function isScopedPath(scopePath, inputPath) {
   const root = realpathSync4(scopePath);
   const logicalCandidate = isAbsolute4(inputPath) ? resolve4(inputPath) : resolve4(root, inputPath);
   const candidate = canonicalizePath(logicalCandidate);
-  return candidate === root || candidate.startsWith(root + sep4);
+  const prefix = root.endsWith(sep4) ? root : root + sep4;
+  return candidate === root || candidate.startsWith(prefix);
 }
 function resolveScopedPath(scopePath, inputPath) {
   const boundary2 = getLocalSourceBoundary();

package/chunks/{chunk-ZWAWZU6C.js → chunk-YJGPPPUB.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -108,6 +108,7 @@ var workerSchema = external_exports.object({
 var consoleStateSchema = external_exports.object({
   configuration: external_exports.object({
     modelSource: external_exports.literal("local").optional(),
+    webSearchEnabled: external_exports.boolean().optional(),
     workflowId: external_exports.string().regex(/^[A-Za-z0-9_-]{1,128}$/).optional(),
     skillId: external_exports.string().min(1).max(384).refine((value) => !/[\u0000-\u001f\u007f]/.test(value)).optional(),
     target: external_exports.string().max(8e3),
@@ -135,7 +136,7 @@ var consoleStateSchema = external_exports.object({
   lastOutcome: external_exports.object({
     assistantText: boundedString,
     stopReason: external_exports.enum(["end_turn", "max_tool_iterations", "max_turn_tokens", "output_cap", "cancelled", "error"]),
-    budget: external_exports.object({ tokensUsed: finite, tokenBudget: finite.nullable(), iterations: finite, maxToolIterations: finite }).strict(),
+    budget: external_exports.object({ tokensUsed: finite, tokenBudget: finite.nullable(), iterations: finite, maxToolIterations: finite.nullable() }).strict(),
     error: boundedString.optional(),
     usage: external_exports.object({ inputTokens: finite, outputTokens: finite }).strict().optional(),
     contextInputTokens: finite.optional(),
@@ -155,7 +156,7 @@ var consoleStateSchema = external_exports.object({
   focusedFindingId: external_exports.string().max(256).optional(),
   stagedPrompt: boundedString.optional()
 }).strict();
-function parseConsoleState(value) {
+function parseConsoleState(value, recoverDisplayState = false) {
   let nodes = 0;
   const ancestors = /* @__PURE__ */ new Set();
   const boundedJson = (entry, depth) => {
@@ -174,7 +175,28 @@ function parseConsoleState(value) {
   try {
     if (JSON.stringify(value).length > 4 * 1024 * 1024) return void 0;
     const parsed = consoleStateSchema.safeParse(value);
-    return parsed.success ? parsed.data : void 0;
+    if (parsed.success) return parsed.data;
+    if (!recoverDisplayState) return void 0;
+    const configuration = consoleStateSchema.shape.configuration.safeParse(rawValue(value, "configuration"));
+    if (!configuration.success || !configuration.data || rawValue(value, "version") !== 1) return void 0;
+    const field = (key, fallback) => {
+      const result = consoleStateSchema.shape[key].safeParse(rawValue(value, key));
+      return result.success ? result.data : fallback;
+    };
+    return {
+      version: 1,
+      configuration: configuration.data,
+      title: field("title", "Resumed chat"),
+      objective: field("objective", ""),
+      usage: field("usage", { inputTokens: 0, outputTokens: 0 }),
+      lastOutcome: field("lastOutcome", null),
+      todos: field("todos", null),
+      workers: field("workers", []),
+      compaction: field("compaction", null),
+      queuedMessages: field("queuedMessages", []),
+      userAttributions: field("userAttributions", []),
+      ...field("contextInputTokens", void 0) !== void 0 ? { contextInputTokens: field("contextInputTokens", void 0) } : {}
+    };
   } catch {
     return void 0;
   }
@@ -188,7 +210,7 @@ function parseSession(id, text) {
   }
   const messages = rawValue(raw, "messages");
   if (!Array.isArray(messages)) return null;
-  const consoleState = parseConsoleState(rawValue(raw, "consoleState"));
+  const consoleState = parseConsoleState(rawValue(raw, "consoleState"), true);
   return { ...storedSessionMetadata(id, raw, messages.length), messages, ...consoleState ? { consoleState } : {} };
 }
 function saveSession(session, homeDir) {
@@ -245,10 +267,16 @@ function listSessions(homeDir, opts) {
     } catch {
       continue;
     }
-    const parsed = parseSession(id, text);
-    if (parsed === null) continue;
-    if (opts?.cwd !== void 0 && parsed.cwd !== opts.cwd) continue;
-    const { messages: _messages, ...meta } = parsed;
+    let raw;
+    try {
+      raw = JSON.parse(text);
+    } catch {
+      continue;
+    }
+    const messages = rawValue(raw, "messages");
+    if (!Array.isArray(messages)) continue;
+    const meta = storedSessionMetadata(id, raw, messages.length);
+    if (opts?.cwd !== void 0 && meta.cwd !== opts.cwd) continue;
     out.push(meta);
   }
   out.sort((a, b) => b.savedAt - a.savedAt || a.id.localeCompare(b.id));