@0cloud/cli 0.1.0 → 0.2.0

package/README.md

@@ -19,8 +19,8 @@ CI. `--endpoint` and `--org` override the saved service and workspace.
 
 | Task | Command |
 | --- | --- |
-| Analyze local source without executing it | `0cloud scan ./src` |
-| Deeper source-only analysis | `0cloud scan ./src --whitebox --focus "Account access"` |
+| Analyze repository source where enabled | `0cloud scan https://github.com/owner/repository` |
+| Source upload where enabled | `0cloud scan ./src --whitebox --focus "Account access"` |
 | Inspect connected codebases | `0cloud codebases list` or `codebases show <repo-or-id>` |
 | Check saved scope and readiness | `0cloud tests readiness <repo-or-id>` |
 | Start a saved-codebase security test | `0cloud tests start <repo-or-id> --idempotency-key <uuid>` |
@@ -38,19 +38,24 @@ repairs. Opening configuration or checking readiness does not start work.
 ## Source analysis
 
 ```sh
-0cloud scan ./src
 0cloud scan https://github.com/owner/repository
 0cloud scan ./src --whitebox --focus "Authorization and tenant isolation"
 ```
 
+Ordinary `scan` accepts an HTTPS repository URL. Local files require an explicit
+`--whitebox` source-analysis request; the CLI rejects them before reading source
+or requesting a price. It never switches workflows automatically.
+
 Uploads exclude symlinks, `.env` files, dependency/build directories, invalid
 UTF-8 and common binary formats. Limits: 300 files, 400 KB per file and 8 MB total.
 Excluded paths are reported on stderr; exceeding total limits fails rather than
 silently returning a partial submission. Review the files you select before upload.
 
 `--whitebox` uses `/api/whitebox-scan`; `--focus` requires it. Repository URL
-support depends on deployment configuration. Funded source-analysis deployments
-can require file uploads; a rejected URL is reported as an error without a fallback.
+support depends on deployment configuration. The `/api/scan` route is repository-only, while fixed-credit or funded source
+configuration can reject URL acquisition. Those deployments may require explicit
+`--whitebox` file uploads or the connected `source-scans` workflow below. A rejected
+URL is reported as an error without a fallback.
 
 For deployments with queued source operations enabled:
 

package/dist/public/customer.js

@@ -7,12 +7,12 @@ import { UserError } from "./errors.js";
 export function dashboardApiContext(ctx) {
     return { ...ctx, endpoint: ctx.endpoint.replace(/\/orchestrator\/?$/, "") };
 }
-export async function customerRequest(opts, route, method = "GET", body) {
+export async function customerRequest(opts, route, method = "GET", body, idempotencyKey) {
     if (!/^\/[a-zA-Z0-9]/.test(route) || route.includes("\\") || route.includes("#") || /(^|\/)\.\.(\/|$)/.test(decodeURIComponent(route))) {
         throw new UserError("Use a relative API path, for example /scan or /project-setup.");
     }
     const ctx = dashboardApiContext(await resolveContext(opts));
-    return request(ctx, route, { method, body });
+    return request(ctx, route, { method, body, idempotencyKey });
 }
 const SKIP = new Set([".git", "node_modules", "vendor", "dist", "build", ".next", "target", "__pycache__", ".env", ".env.local"]);
 const BINARY = /\.(png|jpe?g|gif|webp|ico|pdf|zip|gz|tar|wasm|woff2?|ttf|eot|mp[34]|mov|exe|dll|so|dylib|bin)$/i;
@@ -73,31 +73,62 @@ export async function readSubmission(input) {
         throw new UserError("No source files to scan.");
     return { files, skipped };
 }
+/** Fail closed on missing, unauthorized, malformed or unavailable pricing APIs. */
+export async function quoteProduct(opts, offering) {
+    const catalog = await customerRequest(opts, "/product-prices");
+    if (!catalog || typeof catalog.enabled !== "boolean")
+        throw new UserError("Invalid product price response; no work was submitted.");
+    if (!catalog.enabled)
+        return {};
+    if (!Array.isArray(catalog.prices))
+        throw new UserError("Invalid product price response; no work was submitted.");
+    const matches = catalog.prices.filter((p) => !!p && typeof p === "object" && p.offering === offering);
+    const price = matches[0];
+    if (matches.length !== 1 || !price || !Number.isSafeInteger(price.credits) || price.credits <= 0 || typeof price.priceVersion !== "string" || !price.priceVersion.trim()) {
+        throw new UserError(`No valid fixed-credit price for ${offering}; no work was submitted.`);
+    }
+    process.stderr.write(`Price: ${price.credits} credits (${offering}; version ${price.priceVersion}).\n`);
+    return { expectedPriceVersion: price.priceVersion };
+}
+function attemptKey(key = randomUUID()) {
+    if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(key))
+        throw new UserError("Idempotency key must be a UUID.");
+    process.stderr.write(`Attempt key: ${key}. Reuse it for the same request after a connection failure; do not automatically resubmit.\n`);
+    return key;
+}
 export async function scanSubmission(input, opts, options = {}) {
     if (options.focus && !options.whitebox)
         throw new UserError("--focus requires --whitebox.");
+    if (!options.whitebox && !/^https:\/\//i.test(input)) {
+        throw new UserError("Repository analysis requires an HTTPS repository URL. Source uploads require explicit --whitebox and an enabled deployment.");
+    }
+    const key = attemptKey(options.idempotencyKey);
     const route = options.whitebox ? "/whitebox-scan" : "/scan";
     const focus = options.focus ? { focus: options.focus } : {};
+    let body;
     if (/^https:\/\//i.test(input))
-        return customerRequest(opts, route, "POST", options.whitebox ? { input, ...focus } : { repo_url: input });
-    const { files, skipped } = await readSubmission(input);
-    if (skipped)
-        process.stderr.write(`Skipped ${skipped} binary, generated or excluded paths.\n`);
-    return customerRequest(opts, route, "POST", { files, ...focus });
+        body = options.whitebox ? { input, ...focus } : { repo_url: input };
+    else {
+        const { files, skipped } = await readSubmission(input);
+        if (skipped)
+            process.stderr.write(`Skipped ${skipped} binary, generated or excluded paths.\n`);
+        body = { files, ...focus };
+    }
+    const quote = await quoteProduct(opts, "upload");
+    return customerRequest(opts, route, "POST", { ...body, ...(quote.expectedPriceVersion !== undefined ? { expected_price_version: quote.expectedPriceVersion } : {}) }, key);
 }
 export async function readCodebase(target, opts) {
     const field = /^[0-9a-f-]{36}$/i.test(target) ? "repository_id" : "target";
     return await customerRequest(opts, `/project-setup?${field}=${encodeURIComponent(target)}`);
 }
 export async function startPentest(target, opts, idempotencyKey = randomUUID()) {
-    if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(idempotencyKey))
-        throw new UserError("Idempotency key must be a UUID.");
-    process.stderr.write(`Attempt key: ${idempotencyKey}. Reuse it for the same request after a connection failure; do not automatically resubmit.\n`);
+    idempotencyKey = attemptKey(idempotencyKey);
     const record = await readCodebase(target, opts);
     if (!record.readiness.canStart)
         throw new UserError(record.readiness.reason || "Save and approve the codebase configuration before starting a pentest.");
+    const quote = await quoteProduct(opts, record.plan?.productTier ?? "quick");
     return customerRequest(opts, "/project-setup", "POST", {
-        action: "start", repositoryId: record.repository.id,
+        ...quote, action: "start", repositoryId: record.repository.id,
         expectedRevision: record.revision, idempotencyKey,
     });
 }

package/dist/public/http.js

@@ -32,6 +32,8 @@ export async function request(ctx, pathAndQuery, options = {}) {
     if (!options.omitOrgHeader && ctx.orgId) {
         headers["X-0-Org-Id"] = ctx.orgId;
     }
+    if (options.idempotencyKey)
+        headers["Idempotency-Key"] = options.idempotencyKey;
     let body;
     if (options.body !== undefined) {
         headers["Content-Type"] = "application/json";

package/dist/public/public-cli.js

@@ -42,7 +42,8 @@ export function buildPublicProgram() {
         .action(async (o, cmd) => runAuthLogin({ ...context(cmd), ...o }));
     auth.command("status").action(async (_o, cmd) => runAuthStatus({ json: true }));
     auth.command("logout").action(runAuthLogout);
-    p.command("scan <file-folder-or-repo>").description("Analyze source without executing it")
+    p.command("scan <repository-url-or-source>").description("Analyze a repository URL; --whitebox also accepts source uploads where enabled")
+        .option("--idempotency-key <uuid>", "Reuse this key when retrying the same source submission")
         .option("--whitebox", "Deeper source-only analysis, not an active security test")
         .option("--focus <text>", "Focus instructions for whitebox analysis")
         .action(async (input, o, cmd) => output(await scanSubmission(input, context(cmd), o)));
@@ -121,7 +122,7 @@ export function buildPublicProgram() {
     p.addHelpText("after", "\nStart here:\n  0cloud auth login\n  0cloud codebases list\n  0cloud tests readiness <codebase>\n  0cloud tests start <codebase> --idempotency-key <uuid>\n\nscan analyzes source; tests starts saved-codebase execution and honors its saved publication policy.\n");
     p.command("capabilities").description("Print command and API coverage")
         .action(() => output({ version: USER_AGENT_VERSION, commands: p.commands.map(c => c.name()),
-        workflows: { tests: "Saved-codebase security tests; pentests is a compatibility command", scan: "Immediate source-only analysis", sourceScans: "Queued exact-commit source analysis", memory: "Rules through the current Memory API", usage: "Read-only funding readiness and model catalog" },
+        workflows: { tests: "Saved-codebase security tests; pentests is a compatibility command", scan: "Immediate source-only analysis", sourceScans: "Queued exact-commit source analysis", memory: "Rules through the current Memory API", usage: "Read-only funding readiness, fixed product prices and model catalog" },
         pending: ["Website target setup and authorized test-start API parity", "Manual PR review dispatch", "Knowledge documents public API", "Team, integration and payment administration"],
         note: "Server availability and workspace permissions determine which actions can run." }));
     return p;

package/dist/public/workflow-commands.js

@@ -1,7 +1,7 @@
 import { Option } from "commander";
 import { randomUUID } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
-import { customerRequest, readCodebase, startPentest } from "./customer.js";
+import { customerRequest, quoteProduct, readCodebase, startPentest } from "./customer.js";
 import { resolveContext } from "./config.js";
 import { UserError } from "./errors.js";
 const output = (value) => { process.stdout.write(JSON.stringify(value, null, 2) + "\n"); };
@@ -38,6 +38,8 @@ export function registerWorkflowCommands(p) {
     const usage = p.command("usage").description("Read funding readiness and available inference models; never changes billing");
     usage.command("status").action(async (_o, cmd) => output(await customerRequest(context(cmd), "/inference/account")));
     usage.command("models").action(async (_o, cmd) => output(await customerRequest(context(cmd), "/inference/v1/models")));
+    usage.command("prices").description("Read fixed product credit prices for this workspace")
+        .action(async (_o, cmd) => output(await customerRequest(context(cmd), "/product-prices")));
     const memory = p.command("memory").description("Read Memory and manage explicit rules with revision checks");
     memory.command("list").option("--repository <uuid>", "Scope to a codebase", uuid)
         .action(async (o, cmd) => output(await customerRequest(context(cmd), `/memory${o.repository ? `?repositoryId=${o.repository}` : ""}`)));
@@ -67,7 +69,8 @@ export function registerWorkflowCommands(p) {
         const ctx = await resolveContext(context(cmd));
         const idempotencyKey = o.idempotencyKey ?? randomUUID();
         process.stderr.write(`Attempt key: ${idempotencyKey}. Reuse with the same repository, commit, operation and focus after a connection failure.\n`);
-        output(await customerRequest(context(cmd), "/source-scans", "POST", { orgId: ctx.orgId, repositoryId, commitSha: o.commit, operation: o.operation, idempotencyKey, ...(o.focus !== undefined ? { focus: o.focus } : {}) }));
+        const quote = await quoteProduct(context(cmd), "upload");
+        output(await customerRequest(context(cmd), "/source-scans", "POST", { ...quote, orgId: ctx.orgId, repositoryId, commitSha: o.commit, operation: o.operation, idempotencyKey, ...(o.focus !== undefined ? { focus: o.focus } : {}) }));
     });
     async function read(id, cmd) {
         const ctx = await resolveContext(context(cmd));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@0cloud/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "Standalone CLI for the 0cloud API: source scans, pentests, run status and workspace actions.",
   "bin": {