0sec-cli 0.25.0 → 0.26.0

package/chunks/{chunk-YXTV2FRE.js → chunk-72PU46MS.js}

@@ -8,7 +8,7 @@ import {
   homeStateDir,
   parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -19,6 +19,7 @@ import { BaseSQLiteDatabase } from "drizzle-orm/sqlite-core/db";
 import { SQLiteSyncDialect } from "drizzle-orm/sqlite-core/dialect";
 import { createTableRelationsHelpers, extractTablesRelationalConfig } from "drizzle-orm/relations";
 import { createRequire } from "node:module";
+import { closeSync, openSync } from "node:fs";
 function isBunRuntime() {
   const g = globalThis;
   if (typeof g.Bun !== "undefined")
@@ -98,31 +99,19 @@ var ShimmedDatabase = class {
     this.engine.exec(sql2);
     return this;
   }
-  /**
-   * better-sqlite3 uses `.pragma()` both as a getter and a setter. Our code
-   * only uses it as a setter ("journal_mode = WAL", "foreign_keys = ON"), so
-   * we just `exec()` the pragma and swallow errors — some PRAGMAs (notably
-   * WAL journal mode) are not supported by node-sqlite3-wasm's VFS and error
-   * here, but losing them is acceptable for 0's single-process workload.
+  /** Return PRAGMA rows, or the first row's first value in simple mode.
+   * Setting errors propagate so callers cannot assume a safety setting applied
+   * after SQLite rejected it. SQLite itself ignores unknown PRAGMA names.
    */
-  pragma(query, _opts) {
-    try {
-      this.engine.exec(`PRAGMA ${query}`);
-    } catch {
-    }
-    return void 0;
+  pragma(query, opts) {
+    const rows = this.prepare(`PRAGMA ${query}`).all();
+    return opts?.simple ? rows[0] ? Object.values(rows[0])[0] : void 0 : rows;
   }
-  /**
-   * better-sqlite3's `db.transaction(fn)` returns a callable object with
-   * `.deferred`, `.immediate`, `.exclusive`, and `.default` methods, each
-   * running `fn` inside a BEGIN/COMMIT of the corresponding isolation level.
-   * All three variants are functionally equivalent for 0's single-writer
-   * workload, so we wire them to the same underlying implementation.
-   */
+  /** Synchronous transactions with SQLite's actual lock-acquisition modes. */
   transaction(fn) {
     const engine = this.engine;
-    const runInTx = (...args) => {
-      engine.exec("BEGIN");
+    const wrap = (begin) => (...args) => {
+      engine.exec(begin);
       try {
         const result = fn(...args);
         engine.exec("COMMIT");
@@ -135,11 +124,12 @@ var ShimmedDatabase = class {
         throw err;
       }
     };
+    const runInTx = wrap("BEGIN");
     return Object.assign(runInTx, {
       default: runInTx,
-      deferred: runInTx,
-      immediate: runInTx,
-      exclusive: runInTx
+      deferred: wrap("BEGIN DEFERRED"),
+      immediate: wrap("BEGIN IMMEDIATE"),
+      exclusive: wrap("BEGIN EXCLUSIVE")
     });
   }
   close() {
@@ -244,6 +234,14 @@ function createBunEngine(path) {
   };
 }
 function createShimmedDatabase(path) {
+  if (path && path !== ":memory:" && !path.startsWith("file:")) {
+    try {
+      closeSync(openSync(path, "wx", 384));
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+    }
+  }
   const engine = isBunRuntime() ? createBunEngine(path) : createWasmEngine(path);
   return new ShimmedDatabase(engine);
 }
@@ -279,7 +277,7 @@ function ensureDatabaseDirectory(path) {
 import { asc, eq, desc, and, gt, inArray, or, sql } from "drizzle-orm";
 import { createHash, randomUUID } from "node:crypto";
 import { join } from "node:path";
-import { closeSync, existsSync as existsSync2, openSync, readSync, renameSync, rmSync, statSync, writeSync } from "node:fs";
+import { closeSync as closeSync2, existsSync as existsSync2, openSync as openSync2, readSync, renameSync, rmSync } from "node:fs";
 
 // packages/db/dist/schema.js
 var schema_exports = {};
@@ -818,17 +816,12 @@ function resetOsecDatabase(dbPath) {
 function repairOsecDatabase(dbPath) {
   const path = resolveOsecDbPath(dbPath);
   ensureDatabaseDirectory(path);
-  clearStaleLockIfAny(path);
   const backupPath = backupCorruptDatabase(path) ?? void 0;
   resetOsecDatabase(path);
   const db = new osecDB(path);
   db.close();
   return { path, backupPath };
 }
-function isRecoverableDatabaseError(error) {
-  const message = error instanceof Error ? error.message : String(error);
-  return /database disk image is malformed|file is not a database|malformed|invalid page number|database main|btree|b-tree|database corrupt/i.test(message);
-}
 function timestampTag() {
   return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
 }
@@ -858,81 +851,22 @@ function ensureDatabaseHealthy(sqlite) {
     throw new Error(first);
   }
 }
-function migrateWalHeaderIfNeeded(path) {
-  if (!existsSync2(path))
+function assertDatabaseEngineCompatibility(path) {
+  if (isBunRuntime() || path === ":memory:" || !existsSync2(path))
     return;
-  let size;
+  const header = Buffer.alloc(20);
+  const fd = openSync2(path, "r");
+  let bytesRead;
   try {
-    size = statSync(path).size;
-  } catch {
-    return;
-  }
-  if (size < 20)
-    return;
-  const header = Buffer.alloc(100);
-  try {
-    const fd = openSync(path, "r");
-    try {
-      readSync(fd, header, 0, 100, 0);
-    } finally {
-      closeSync(fd);
-    }
-  } catch {
-    return;
+    bytesRead = readSync(fd, header, 0, header.length, 0);
+  } finally {
+    closeSync2(fd);
   }
-  if (header.subarray(0, 15).toString("ascii") !== "SQLite format 3")
+  if (bytesRead < header.length || header.subarray(0, 16).toString("ascii") !== "SQLite format 3\0")
     return;
   if (header[18] !== 2 && header[19] !== 2)
     return;
-  const walPath = `${path}-wal`;
-  const shmPath = `${path}-shm`;
-  let hadWalData = false;
-  try {
-    if (existsSync2(walPath) && statSync(walPath).size > 0)
-      hadWalData = true;
-  } catch {
-  }
-  try {
-    const fd = openSync(path, "r+");
-    try {
-      writeSync(fd, Buffer.from([1, 1]), 0, 2, 18);
-    } finally {
-      closeSync(fd);
-    }
-  } catch (err) {
-    return;
-  }
-  for (const sidecar of [walPath, shmPath]) {
-    if (existsSync2(sidecar)) {
-      try {
-        rmSync(sidecar, { force: true });
-      } catch {
-      }
-    }
-  }
-  if (hadWalData) {
-    console.warn(`[0] Migrated ${path} from WAL mode to rollback mode for WASM engine compatibility. A non-empty WAL sidecar was present and has been removed; any uncommitted transactions from a prior crashed run were discarded.`);
-  }
-}
-function clearStaleLockIfAny(path) {
-  const lockPath = `${path}.lock`;
-  let stat;
-  try {
-    stat = statSync(lockPath);
-  } catch {
-    return;
-  }
-  if (!stat.isDirectory())
-    return;
-  const ageMs = Date.now() - stat.mtimeMs;
-  const STALE_THRESHOLD_MS = 1e4;
-  if (ageMs < STALE_THRESHOLD_MS)
-    return;
-  try {
-    rmSync(lockPath, { recursive: true, force: true });
-    console.warn(`[0] Removed stale database lock at ${lockPath} (age ${Math.floor(ageMs / 1e3)}s \u2014 previous holder likely crashed).`);
-  } catch {
-  }
+  throw new Error(`Cannot open WAL-mode database at ${path} with the Node WASM SQLite engine. The database and WAL/SHM files have been preserved. Stop all database users, back up the database together with its sidecars, then use a native SQLite connection to checkpoint the WAL and set PRAGMA journal_mode=DELETE. Do not delete WAL/SHM files or rewrite the database header. Alternatively, use the Bun native SQLite runtime.`);
 }
 var osecDB = class {
   /** Resolved storage identity for scoped stores sharing this database. */
@@ -950,11 +884,10 @@ var osecDB = class {
       return;
     }
     ensureDatabaseDirectory(path);
-    this.openWithRecovery(path);
+    this.openDatabase(path);
   }
-  openWithRecovery(path) {
-    migrateWalHeaderIfNeeded(path);
-    clearStaleLockIfAny(path);
+  openDatabase(path) {
+    assertDatabaseEngineCompatibility(path);
     try {
       this.initializeDatabase(path);
     } catch (error) {
@@ -962,11 +895,7 @@ var osecDB = class {
         this.sqlite?.close();
       } catch {
       }
-      if (!isRecoverableDatabaseError(error))
-        throw error;
-      const backupPath = backupCorruptDatabase(path);
-      this.initializeDatabase(path);
-      console.warn(backupPath ? `[0] Recovered malformed database at ${path}. Backup saved to ${backupPath}.` : `[0] Recovered malformed database state at ${path} by recreating a fresh database.`);
+      throw error;
     }
   }
   initializeDatabase(path) {
@@ -981,6 +910,7 @@ var osecDB = class {
     })();
   }
   initializeReadOnlyDatabase(path) {
+    assertDatabaseEngineCompatibility(path);
     this.sqlite = createShimmedDatabase(path);
     this.sqlite.pragma("foreign_keys = ON");
     this.db = createDrizzleFromShim(this.sqlite, { schema: schema_exports });
@@ -1793,10 +1723,10 @@ var osecDB = class {
     this.updateFindingTriageByFingerprint(finding.fingerprint, triageStatus, triageNote);
   }
   getLatestFindingByFingerprint(fingerprint) {
-    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).get();
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp), desc(findings.id)).get();
   }
   getRelatedFindings(fingerprint) {
-    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp)).all();
+    return this.db.select().from(findings).where(eq(findings.fingerprint, fingerprint)).orderBy(desc(findings.timestamp), desc(findings.id)).all();
   }
   // ── Status Pipeline: discovered → verified → confirmed → scored → reported → fixed ──
   transitionFindingStatus(findingId, newStatus) {
@@ -2914,6 +2844,7 @@ function initializeLearningTables(db) {
     CREATE TABLE IF NOT EXISTS learning_active(project_id TEXT NOT NULL,kind TEXT NOT NULL,target_id TEXT NOT NULL,candidate_id TEXT NOT NULL,PRIMARY KEY(project_id,kind,target_id));
     CREATE TABLE IF NOT EXISTS learning_work(id TEXT PRIMARY KEY,event_id TEXT NOT NULL,kind TEXT NOT NULL,status TEXT NOT NULL,attempts INTEGER NOT NULL DEFAULT 0,available_at INTEGER NOT NULL,lease_until INTEGER,claim_token TEXT,owner TEXT,UNIQUE(event_id,kind));
     CREATE INDEX IF NOT EXISTS learning_events_project ON learning_events(project_id,updated_at);
+    CREATE INDEX IF NOT EXISTS learning_knowledge_project_id ON learning_knowledge(project_id,id);
     CREATE INDEX IF NOT EXISTS learning_work_ready ON learning_work(status,available_at,lease_until);`);
 }
 function appendLearningEvent(db, input) {
@@ -3001,6 +2932,13 @@ var LearningStore = class {
   listKnowledge(options) {
     return this.#list("learning_knowledge", options);
   }
+  /** Stable keyset pages for source freshness checks, unaffected by status updates. */
+  listCurrentSourceKnowledgePage(projectId, afterId, pageSize = 200) {
+    bounded(projectId, "project ID");
+    if (afterId !== void 0)
+      bounded(afterId, "knowledge cursor");
+    return this.#db.prepare("SELECT body FROM learning_knowledge WHERE project_id=? AND id>? AND json_extract(body,'$.status')='current' AND json_array_length(body,'$.sourceLinks')>0 ORDER BY id LIMIT ?").all(projectId, afterId ?? "", limit(pageSize)).map((row) => JSON.parse(row.body));
+  }
   getKnowledge(id) {
     return read(this.#db, "learning_knowledge", id);
   }
@@ -3089,6 +3027,22 @@ var LearningStore = class {
         fail("Evidence must belong to the same project.");
     }
   }
+  #knowledgeIdentity(input) {
+    return `knowledge:${createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path)), evidenceEventIds: [...input.evidenceEventIds].sort() })).digest("hex")}`;
+  }
+  /** Exact prior admission status, independent of library ordering or pagination. */
+  findSourceKnowledge(projectId, summary, sourceLinks, eventKey) {
+    const disabled = this.findDisabledSourceKnowledge(projectId, summary, sourceLinks);
+    if (disabled)
+      return disabled;
+    const row = this.#db.prepare("SELECT body FROM learning_events WHERE idempotency_key=? AND project_id=?").all(eventKey, projectId)[0];
+    if (!row)
+      return null;
+    const event = JSON.parse(row.body);
+    if (event.kind !== "source-context")
+      return null;
+    return this.getKnowledge(this.#knowledgeIdentity({ projectId, summary, sourceLinks, evidenceEventIds: [event.id] }));
+  }
   /** Match operator-disabled source lessons independently of library pagination. */
   findDisabledSourceKnowledge(projectId, summary, sourceLinks) {
     const fingerprint = (links) => JSON.stringify([...links].sort((a, b) => a.path.localeCompare(b.path) || a.hash.localeCompare(b.hash)));
@@ -3111,7 +3065,7 @@ var LearningStore = class {
       if (disabled)
         return disabled;
     }
-    const identity = `knowledge:${createHash2("sha256").update(JSON.stringify({ projectId: input.projectId, summary: input.summary, sourceLinks: [...input.sourceLinks].sort((a, b) => a.path.localeCompare(b.path)), evidenceEventIds: [...input.evidenceEventIds].sort() })).digest("hex")}`;
+    const identity = this.#knowledgeIdentity(input);
     const existing = this.getKnowledge(identity);
     if (existing)
       return existing;

package/chunks/{chunk-NO543ZBU.js → chunk-A7G6S5RA.js}

@@ -5,7 +5,7 @@ import {
   expandHomePath,
   isExistingLocalTargetPath,
   isExplicitLocalTargetPath
-} from "./chunk-2J3STRJT.js";
+} from "./chunk-R7VWEY45.js";
 
 // packages/cli/src/engagement-plan.ts
 var PACKAGE_PREFIXES = {

package/chunks/{chunk-ITEMDJAB.js → chunk-AFJ2UMPR.js}

@@ -8,10 +8,10 @@ import {
   parsePatch,
   readEvolutionArtifact,
   resolveScopedPath
-} from "./chunk-DJGJECBV.js";
+} from "./chunk-YGYJ2FTH.js";
 import {
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";

package/chunks/{chunk-FOLTHXRH.js → chunk-B7XL6RON.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/triage/kernel-vm-runner.js
 import { execFileSync, spawn } from "node:child_process";

package/chunks/{chunk-76CLUI54.js → chunk-BM6EYP2D.js}

@@ -5,13 +5,13 @@ import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-HFUOUT2B.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-FOLTHXRH.js";
+} from "./chunk-B7XL6RON.js";
 import {
   LlmApiRuntime
-} from "./chunk-EIONVEFN.js";
+} from "./chunk-HS2NQ7K6.js";
 import {
   __commonJS,
   __require,

package/chunks/{chunk-NBLKIQCW.js → chunk-D4M5WURF.js}

@@ -6,11 +6,11 @@ import {
 } from "./chunk-S4DFH2FJ.js";
 import {
   loadLayeredSettings
-} from "./chunk-6TA3CWND.js";
+} from "./chunk-V2KJQVYE.js";
 import {
   createPresentationEvent,
   homeStateDir
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/presentation/process-output.ts
 import { format } from "node:util";

package/chunks/{chunk-DHNYJ2ML.js → chunk-EHNVP6QB.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-O6KPVYOI.js";
 import {
   LlmApiRuntime
-} from "./chunk-EIONVEFN.js";
+} from "./chunk-HS2NQ7K6.js";
 import {
   readCacheUsage
 } from "./chunk-RS4MAN3Q.js";

package/chunks/{chunk-C6ZMPXN2.js → chunk-FBZBJYZS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   buildShareUrl
-} from "./chunk-ITHDAIRY.js";
+} from "./chunk-MNK373HF.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -11,14 +11,14 @@ import {
   formatHtml,
   formatMarkdown,
   formatSarif
-} from "./chunk-AL32F74R.js";
+} from "./chunk-YP2DHYNI.js";
 import {
   compareFindingsByBusinessPriority,
   createAuditReportDocument,
   createReviewReportDocument,
   createScanReportDocument,
   getFindingPriority
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/cli/src/formatters/terminal.ts
 var SEVERITY_COUNT_COLOR = {

package/chunks/{chunk-S3B6HFSM.js → chunk-GYEYTNHK.js}

@@ -67,7 +67,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.25.0";
+    return "0.26.0";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));