0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-WVTBZEQO.js

@@ -0,0 +1,1531 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  buildPlaybookInjection,
+  parseSanitizerLog,
+  verifyOracleByCategory
+} from "./chunk-P6WKNFWX.js";
+import {
+  allowlistedChildEnv
+} from "./chunk-KLTNTE2Z.js";
+
+// packages/core/dist/stages/memsafety-scan.js
+import { randomUUID } from "node:crypto";
+
+// packages/core/dist/triage/userspace-fuzz-runner.js
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
+var MEMSAFETY_ARTIFACT_SCHEMA = "0sec-memsafety-artifacts/v1";
+var MAX_RETAINED_CRASHES = 16;
+var MAX_RETAINED_REPRODUCER_BYTES = 1024 * 1024;
+var MAX_RETAINED_LOG_BYTES = 256 * 1024;
+var DEFAULT_RETAINED_ARTIFACT_BYTES = 4 * 1024 * 1024;
+var MIN_RETAINED_ARTIFACT_BYTES = 64 * 1024;
+var ARTIFACT_MANIFEST_RESERVE_BYTES = 64 * 1024;
+var TOOLING_HINTS = {
+  cargo: "cargo not found \u2014 install the Rust toolchain via https://rustup.rs",
+  "cargo-fuzz": "cargo-fuzz not found \u2014 install with `cargo install cargo-fuzz` (requires a nightly toolchain for `cargo fuzz run`)",
+  "cargo-fuzz-harness": "cargo-fuzz needs exactly one harness \u2014 pass `--harness <name>` or provide a source tree with one cargo-fuzz target",
+  miri: "miri not found \u2014 install with `rustup +nightly component add miri`",
+  clang: "clang not found \u2014 install LLVM/clang to compile the libFuzzer harness"
+};
+function commandAvailable(command, args) {
+  return new Promise((resolveProbe) => {
+    execFile(command, args, { timeout: 1e4, env: fuzzChildEnv() }, (error) => {
+      resolveProbe(!error);
+    });
+  });
+}
+async function cargoAvailable() {
+  return commandAvailable("cargo", ["--version"]);
+}
+async function cargoFuzzAvailable() {
+  return commandAvailable("cargo", ["fuzz", "--help"]);
+}
+async function miriAvailable() {
+  return commandAvailable("cargo", ["+nightly", "miri", "--version"]);
+}
+async function clangAvailable() {
+  return commandAvailable("clang", ["--version"]);
+}
+var ASAN_PRIMITIVE = {
+  "heap-use-after-free": "use-after-free",
+  "stack-use-after-return": "use-after-free",
+  "stack-use-after-scope": "use-after-free",
+  "double-free": "double-free",
+  "attempting-double-free": "double-free",
+  "stack-buffer-overflow": "stack-oob"
+};
+function primitiveFromSanitizerKind(kind, rw) {
+  if (kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") {
+    return rw === "write" ? "heap-oob-write" : "heap-oob-read";
+  }
+  const direct = ASAN_PRIMITIVE[kind];
+  if (direct)
+    return direct;
+  if (kind === "signed-integer-overflow" || kind === "shift-exponent") {
+    return "integer-overflow";
+  }
+  if (kind === "null-pointer-use")
+    return "null-deref";
+  return "unknown";
+}
+function signatureFromFrames(kind, frames, rawOutput) {
+  const top = frames.map((f) => normaliseFrame(f)).filter(Boolean).slice(0, 5);
+  const basis = top.length > 0 ? `${kind}
+${top.join("\n")}` : `${kind}
+${rawOutput.trim().split("\n").slice(0, 3).join("\n")}`;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
+function normaliseFrame(frame) {
+  return frame.replace(/0x[0-9a-fA-F]+/g, "").replace(/\+0x[0-9a-fA-F]+(\/0x[0-9a-fA-F]+)?/g, "").replace(/:\d+(:\d+)?\b/g, "").replace(/\s+/g, " ").trim();
+}
+function parseCrashOutput(output, hint) {
+  const text = output.trim();
+  if (!text)
+    return null;
+  const sanitizer = parseSanitizerLog(text);
+  if (sanitizer) {
+    const frames = sanitizer.frames.map((f) => [f.functionName, f.file && `${f.file}:${f.line ?? ""}`].filter(Boolean).join(" "));
+    const kind = sanitizer.sanitizer === "asan" ? "asan" : "ubsan";
+    const rw = sanitizer.primitive === "read" || sanitizer.primitive === "write" ? sanitizer.primitive : "unknown";
+    return {
+      kind,
+      signature: signatureFromFrames(sanitizer.kind, frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromSanitizerKind(sanitizer.kind, rw)
+    };
+  }
+  if (/error: Undefined Behavior|Miri caught|error\[E\d+\].*unsafe/i.test(text)) {
+    const frames = parseMiriFrames(text);
+    return {
+      kind: "miri",
+      signature: signatureFromFrames("miri", frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromMiri(text)
+    };
+  }
+  if (/thread '.*' panicked at|panicked at/i.test(text)) {
+    const frames = parseRustBacktrace(text);
+    return {
+      kind: "panic",
+      signature: signatureFromFrames("panic", frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromPanic(text)
+    };
+  }
+  if (hint?.kind === "timeout") {
+    return {
+      kind: "timeout",
+      signature: signatureFromFrames("timeout", [], text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "unknown"
+    };
+  }
+  if (/out-of-memory|libFuzzer: out-of-memory|rss limit exceeded/i.test(text)) {
+    return {
+      kind: "oom",
+      signature: signatureFromFrames("oom", [], text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "unknown"
+    };
+  }
+  if (hint?.kind === "segfault" || /SEGV|segmentation fault|deadly signal|SIGSEGV/i.test(text)) {
+    return {
+      kind: "segfault",
+      signature: signatureFromFrames("segfault", parseRustBacktrace(text), text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "null-deref"
+    };
+  }
+  return null;
+}
+function parseMiriFrames(text) {
+  const frames = [];
+  const locRe = /-->\s+(.+?:\d+(?::\d+)?)/g;
+  let m;
+  while ((m = locRe.exec(text)) !== null)
+    frames.push(m[1]);
+  return frames.length > 0 ? frames : parseRustBacktrace(text);
+}
+function parseRustBacktrace(text) {
+  const frames = [];
+  const symRe = /^\s*\d+:\s+(.+)$/gm;
+  let m;
+  while ((m = symRe.exec(text)) !== null)
+    frames.push(m[1].trim());
+  return frames;
+}
+function primitiveFromMiri(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("use-after-free") || lower.includes("dangling")) {
+    return "use-after-free";
+  }
+  if (lower.includes("uninitialized"))
+    return "uninit-read";
+  if (lower.includes("out-of-bounds") || lower.includes("out of bounds")) {
+    return "heap-oob-read";
+  }
+  if (lower.includes("null pointer") || lower.includes("null reference")) {
+    return "null-deref";
+  }
+  if (lower.includes("type") && lower.includes("validity"))
+    return "type-confusion";
+  return "unknown";
+}
+function primitiveFromPanic(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("index out of bounds"))
+    return "heap-oob-read";
+  if (lower.includes("overflow"))
+    return "integer-overflow";
+  return "unknown";
+}
+var FUZZ_TOOLCHAIN_ENV_PASSTHROUGH = [
+  "CARGO_HOME",
+  "RUSTUP_HOME",
+  "RUSTUP_TOOLCHAIN",
+  "CARGO_TARGET_DIR"
+];
+function fuzzChildEnv() {
+  const extras = {};
+  for (const key of FUZZ_TOOLCHAIN_ENV_PASSTHROUGH) {
+    const value = process.env[key];
+    if (value !== void 0)
+      extras[key] = value;
+  }
+  return allowlistedChildEnv(extras);
+}
+function runChild(command, args, cwd, timeoutMs) {
+  return new Promise((resolveRun) => {
+    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, killSignal: "SIGKILL", env: fuzzChildEnv() }, (error, stdout, stderr) => {
+      const stdoutText = String(stdout ?? "");
+      const output = `${stdoutText}${String(stderr ?? "")}`;
+      const timedOut = Boolean(error && error.killed);
+      const signalled = Boolean(error && error.signal);
+      resolveRun({
+        output,
+        stdout: stdoutText,
+        timedOut,
+        signalled,
+        failed: Boolean(error)
+      });
+    });
+  });
+}
+function dedupeBySignature(crashes) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const crash of crashes) {
+    if (!seen.has(crash.signature))
+      seen.set(crash.signature, crash);
+  }
+  return Array.from(seen.values());
+}
+function pathIsWithin(root, candidate) {
+  const rel = relative(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function resolveCargoFuzzDir(sourceRoot, fuzzDir) {
+  const raw = fuzzDir?.trim() || "fuzz";
+  if (isAbsolute(raw))
+    return void 0;
+  const candidate = resolve(sourceRoot, raw);
+  if (!pathIsWithin(sourceRoot, candidate))
+    return void 0;
+  try {
+    const canonical = realpathSync(candidate);
+    return canonical === candidate && pathIsWithin(sourceRoot, canonical) ? canonical : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isCargoFuzzHarnessName(value) {
+  return /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value);
+}
+function isStableSourceDirectory(sourceRoot, directory) {
+  try {
+    const canonical = realpathSync(directory);
+    return canonical === directory && pathIsWithin(sourceRoot, canonical);
+  } catch {
+    return false;
+  }
+}
+function resolveArtifactRoot(artifactDir, sourceRoot) {
+  if (!artifactDir)
+    return void 0;
+  mkdirSync(artifactDir, { recursive: true, mode: 448 });
+  const canonical = realpathSync(artifactDir);
+  if (pathIsWithin(sourceRoot, canonical)) {
+    throw new Error("artifactDir must resolve outside the prepared source tree");
+  }
+  return artifactDir;
+}
+function makeArtifactDir(artifactDir) {
+  if (artifactDir) {
+    return { dir: mkdtempSync(join(artifactDir, "0sec-uf-")), ephemeral: false };
+  }
+  return { dir: mkdtempSync(join(tmpdir(), "0sec-uf-")), ephemeral: true };
+}
+function corpusCount(dir) {
+  try {
+    return readdirSync(dir).filter((name) => {
+      try {
+        return statSync(join(dir, name)).isFile();
+      } catch {
+        return false;
+      }
+    }).length;
+  } catch {
+    return 0;
+  }
+}
+async function runUserspaceFuzzLoop(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const sourceRoot = resolve(opts.target.sourceRoot);
+  const canonicalSourceRoot = existsSync(sourceRoot) ? realpathSync(sourceRoot) : sourceRoot;
+  const runOpts = {
+    ...opts,
+    target: { ...opts.target, sourceRoot: canonicalSourceRoot }
+  };
+  const start = Date.now();
+  const timeoutSec = opts.timeoutSec ?? parseInt(process.env["0SEC_USERSPACE_FUZZ_TIMEOUT_SEC"]?.trim() || "60", 10);
+  const timeoutMs = Math.max(1, timeoutSec) * 1e3;
+  const artifactDir = resolveArtifactRoot(opts.artifactDir, canonicalSourceRoot);
+  const artifactMaxBytes = artifactDir ? resolveRetainedArtifactBytes(opts.artifactMaxBytes) : null;
+  const { dir: workDir, ephemeral } = makeArtifactDir(artifactDir);
+  const toolingMissing = [];
+  let retained = false;
+  try {
+    const result = runOpts.target.language === "rust" ? await runRustLoop(runOpts, { workDir, timeoutMs, toolingMissing, log, start }) : await runCLoop(runOpts, { workDir, timeoutMs, toolingMissing, log, start });
+    if (!ephemeral && artifactMaxBytes !== null) {
+      retained = persistCapturedArtifacts(result, workDir, canonicalSourceRoot, artifactMaxBytes, log);
+    }
+    return result;
+  } finally {
+    if (ephemeral || !retained)
+      rmSync(workDir, { recursive: true, force: true });
+  }
+}
+function persistCapturedArtifacts(result, workDir, sourceRoot, maxBytes, log) {
+  if (result.crashes.length === 0)
+    return false;
+  const runDir = basename(workDir);
+  const logsDir = join(workDir, "logs");
+  const reproducersDir = join(workDir, "reproducers");
+  mkdirSync(logsDir, { recursive: true, mode: 448 });
+  mkdirSync(reproducersDir, { recursive: true, mode: 448 });
+  let remaining = maxBytes - ARTIFACT_MANIFEST_RESERVE_BYTES;
+  const crashes = result.crashes.slice(0, MAX_RETAINED_CRASHES).map((crash, index) => {
+    const id = safeArtifactId(crash.signature, index);
+    let reproducer = null;
+    if (crash.inputPath && remaining > 0) {
+      const reproducerRef = `${runDir}/reproducers/${id}.input`;
+      reproducer = copyBoundedReproducer(crash.inputPath, join(reproducersDir, `${id}.input`), reproducerRef, sourceRoot, Math.min(MAX_RETAINED_REPRODUCER_BYTES, remaining));
+      if (reproducer) {
+        remaining -= reproducer.sizeBytes;
+        crash.inputPath = join(reproducersDir, `${id}.input`);
+        crash.artifactRef = reproducer.ref;
+      } else {
+        log(`[userspace-fuzz] did not retain reproducer for ${crash.signature} (missing, non-regular, changed while read, or exceeds the remaining evidence budget)`);
+      }
+    }
+    const logRef = `${runDir}/logs/${id}.log`;
+    const logFile = writeBoundedUtf8File(join(logsDir, `${id}.log`), crash.rawOutput, Math.min(MAX_RETAINED_LOG_BYTES, remaining));
+    if (logFile)
+      remaining -= logFile.sizeBytes;
+    return {
+      signature: crash.signature,
+      kind: crash.kind,
+      primitive: crash.primitive ?? null,
+      stack: boundedStack(crash.stack),
+      log: logFile ? { ...logFile, ref: logRef } : null,
+      reproducer
+    };
+  });
+  if (result.crashes.length > MAX_RETAINED_CRASHES) {
+    log(`[userspace-fuzz] retained the first ${MAX_RETAINED_CRASHES} of ${result.crashes.length} deduplicated crashes`);
+  }
+  const manifest = Buffer.from(JSON.stringify({
+    schema: MEMSAFETY_ARTIFACT_SCHEMA,
+    crashes
+  }, null, 2) + "\n", "utf8");
+  if (manifest.byteLength > ARTIFACT_MANIFEST_RESERVE_BYTES) {
+    rmSync(logsDir, { recursive: true, force: true });
+    rmSync(reproducersDir, { recursive: true, force: true });
+    log("[userspace-fuzz] evidence manifest exceeded its bounded reserve; discarded this run's retained copies");
+    return false;
+  }
+  writeFileSync(join(workDir, "manifest.json"), manifest, {
+    flag: "wx",
+    mode: 384
+  });
+  return true;
+}
+function resolveRetainedArtifactBytes(value) {
+  const bytes = value ?? DEFAULT_RETAINED_ARTIFACT_BYTES;
+  if (!Number.isSafeInteger(bytes) || bytes < MIN_RETAINED_ARTIFACT_BYTES) {
+    throw new Error(`artifactMaxBytes must be a safe integer of at least ${MIN_RETAINED_ARTIFACT_BYTES}`);
+  }
+  return bytes;
+}
+function safeArtifactId(signature, index) {
+  if (/^[0-9a-f]{16}$/.test(signature))
+    return signature;
+  return createHash("sha256").update(`${index}\0${signature}`).digest("hex").slice(0, 16);
+}
+function boundedStack(stack) {
+  return (stack ?? []).slice(0, 10).map((frame) => frame.slice(0, 1024));
+}
+function writeBoundedUtf8File(path, value, limit) {
+  if (limit <= 0)
+    return null;
+  const input = Buffer.from(value, "utf8");
+  const truncated = input.length > limit;
+  const bytes = truncated ? input.subarray(input.length - limit) : input;
+  writeFileSync(path, bytes, { flag: "wx", mode: 384 });
+  return {
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    sizeBytes: bytes.length,
+    ...truncated ? { truncated: true } : {}
+  };
+}
+function copyBoundedReproducer(source, destination, ref, sourceRoot, limit) {
+  let fd;
+  try {
+    if (!isStableSourceDirectory(sourceRoot, dirname(source))) {
+      return null;
+    }
+    const listed = lstatSync(source);
+    if (!listed.isFile() || listed.isSymbolicLink() || listed.size > limit) {
+      return null;
+    }
+    fd = openSync(source, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const before = fstatSync(fd);
+    if (!before.isFile() || before.dev !== listed.dev || before.ino !== listed.ino || before.size !== listed.size || before.mtimeMs !== listed.mtimeMs) {
+      return null;
+    }
+    const bytes = readFileSync(fd);
+    const after = fstatSync(fd);
+    if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || bytes.length !== before.size) {
+      return null;
+    }
+    if (!isStableSourceDirectory(sourceRoot, dirname(source))) {
+      return null;
+    }
+    writeFileSync(destination, bytes, { flag: "wx", mode: 384 });
+    return {
+      ref,
+      sha256: createHash("sha256").update(bytes).digest("hex"),
+      sizeBytes: bytes.length
+    };
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0)
+      closeSync(fd);
+  }
+}
+function cargoFuzzRunArgs(harnessEntry, fuzzDir, timeoutSec) {
+  const fuzzDirArgs = fuzzDir ? ["--fuzz-dir", fuzzDir] : [];
+  return [
+    "fuzz",
+    "run",
+    ...fuzzDirArgs,
+    harnessEntry,
+    "--",
+    `-max_total_time=${Math.floor(timeoutSec)}`
+  ];
+}
+function cargoFuzzListArgs(fuzzDir) {
+  return ["fuzz", "list", ...fuzzDir ? ["--fuzz-dir", fuzzDir] : []];
+}
+async function discoverCargoFuzzHarness(sourceRoot, fuzzDir, timeoutMs) {
+  if (!existsSync(join(sourceRoot, fuzzDir ?? "fuzz", "Cargo.toml"))) {
+    return { reason: `no cargo-fuzz manifest at ${fuzzDir ?? "fuzz"}/Cargo.toml` };
+  }
+  const res = await runChild("cargo", cargoFuzzListArgs(fuzzDir), sourceRoot, timeoutMs);
+  if (res.failed)
+    return { reason: "cargo fuzz list failed" };
+  const harnesses = Array.from(new Set(res.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)));
+  if (harnesses.length === 1)
+    return { harnessEntry: harnesses[0] };
+  if (harnesses.length === 0)
+    return { reason: "no cargo-fuzz harnesses found" };
+  return {
+    reason: `multiple cargo-fuzz harnesses found (${harnesses.join(", ")})`
+  };
+}
+async function runRustLoop(opts, ctx) {
+  const { target } = opts;
+  const sourceRoot = resolve(target.sourceRoot);
+  const fuzzRoot = resolveCargoFuzzDir(sourceRoot, target.fuzzDir);
+  const crashes = [];
+  let iterations = 0;
+  let harnessEntry = target.harnessEntry;
+  let executedHarness;
+  if (!await cargoAvailable()) {
+    ctx.toolingMissing.push("cargo");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.cargo}`);
+    return finish(crashes, iterations, sourceRoot, ctx, "fuzz");
+  }
+  if (!fuzzRoot || harnessEntry && !isCargoFuzzHarnessName(harnessEntry)) {
+    ctx.toolingMissing.push("cargo-fuzz-layout");
+    ctx.log("[userspace-fuzz] rejected unsafe cargo-fuzz directory or harness name");
+    return finish(crashes, iterations, sourceRoot, ctx, "fuzz");
+  }
+  const fuzzDir = relative(sourceRoot, fuzzRoot);
+  if (!await cargoFuzzAvailable()) {
+    ctx.toolingMissing.push("cargo-fuzz");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS["cargo-fuzz"]}`);
+  } else {
+    if (!harnessEntry) {
+      const discovery = await discoverCargoFuzzHarness(sourceRoot, fuzzDir, ctx.timeoutMs);
+      if ("reason" in discovery) {
+        ctx.toolingMissing.push("cargo-fuzz-harness");
+        ctx.log(`[userspace-fuzz] ${discovery.reason}; ${TOOLING_HINTS["cargo-fuzz-harness"]}`);
+      } else {
+        harnessEntry = discovery.harnessEntry;
+        if (!isCargoFuzzHarnessName(harnessEntry)) {
+          ctx.toolingMissing.push("cargo-fuzz-harness");
+          ctx.log("[userspace-fuzz] cargo-fuzz reported an unsafe harness name");
+          harnessEntry = void 0;
+        } else {
+          ctx.log(`[userspace-fuzz] auto-selected cargo-fuzz harness ${harnessEntry}`);
+        }
+      }
+    }
+    if (harnessEntry) {
+      ctx.log(`[userspace-fuzz] cargo fuzz run ${harnessEntry} (<=${ctx.timeoutMs / 1e3}s)`);
+      const res = await runChild("cargo", cargoFuzzRunArgs(harnessEntry, fuzzDir, ctx.timeoutMs / 1e3), sourceRoot, ctx.timeoutMs + 3e4);
+      executedHarness = harnessEntry;
+      iterations += 1;
+      const crash = parseCrashOutput(res.output, {
+        kind: res.timedOut ? "timeout" : void 0,
+        inputPath: findLibfuzzerCrashInput(join(fuzzRoot, "artifacts", harnessEntry), sourceRoot)
+      });
+      if (crash)
+        crashes.push(crash);
+    }
+  }
+  if (opts.runMiri) {
+    if (!await miriAvailable()) {
+      ctx.toolingMissing.push("miri");
+      ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.miri}`);
+    } else {
+      ctx.log("[userspace-fuzz] cargo +nightly miri test (UB run)");
+      const res = await runChild("cargo", ["+nightly", "miri", "test"], sourceRoot, ctx.timeoutMs + 3e4);
+      iterations += 1;
+      const crash = parseCrashOutput(res.output, {
+        kind: res.timedOut ? "timeout" : void 0
+      });
+      if (crash)
+        crashes.push(crash);
+    }
+  }
+  const corpusDir = harnessEntry ? join(fuzzRoot, "corpus", harnessEntry) : join(fuzzRoot, "corpus");
+  const result = finishWithCorpus(crashes, iterations, corpusDir, ctx);
+  if (executedHarness)
+    result.executedHarness = executedHarness;
+  return result;
+}
+async function runCLoop(opts, ctx) {
+  const crashes = [];
+  let iterations = 0;
+  if (!opts.tier2Artifact) {
+    ctx.log("[userspace-fuzz] C/C++ path requires a tier2Artifact (from buildTier2Harness); nothing to run");
+    return finish(crashes, iterations, resolve(opts.target.sourceRoot), ctx, "tier2");
+  }
+  if (!await clangAvailable()) {
+    ctx.toolingMissing.push("clang");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.clang}`);
+    return finish(crashes, iterations, resolve(opts.target.sourceRoot), ctx, "tier2");
+  }
+  const { compile_command, run_command } = opts.tier2Artifact;
+  const sourceRoot = resolve(opts.target.sourceRoot);
+  ctx.log(`[userspace-fuzz] compiling Tier-2 harness: ${compile_command}`);
+  const compileRes = await runChild("sh", ["-c", compile_command], sourceRoot, ctx.timeoutMs);
+  if (compileRes.signalled || /error:|fatal error:/i.test(compileRes.output)) {
+    ctx.log(`[userspace-fuzz] Tier-2 harness failed to compile:
+${compileRes.output.slice(-2e3)}`);
+    return finish(crashes, iterations, sourceRoot, ctx, "tier2");
+  }
+  ctx.log(`[userspace-fuzz] running Tier-2 harness: ${run_command}`);
+  const runRes = await runChild("sh", ["-c", run_command], sourceRoot, ctx.timeoutMs + 3e4);
+  iterations += 1;
+  const crash = parseCrashOutput(runRes.output, {
+    kind: runRes.timedOut ? "timeout" : runRes.signalled ? "segfault" : void 0
+  });
+  if (crash) {
+    crash.inputPath = findLibfuzzerCrashInput(sourceRoot, sourceRoot) ?? crash.inputPath;
+    crashes.push(crash);
+  }
+  return finishWithCorpus(crashes, iterations, sourceRoot, ctx);
+}
+function findLibfuzzerCrashInput(dir, sourceRoot) {
+  if (!isStableSourceDirectory(sourceRoot, dir))
+    return void 0;
+  try {
+    const hit = readdirSync(dir).find((name) => /^(crash|oom|timeout|leak)-[0-9a-f]+$/i.test(name));
+    if (!hit || !isStableSourceDirectory(sourceRoot, dir))
+      return void 0;
+    const candidate = join(dir, hit);
+    const listed = lstatSync(candidate);
+    return listed.isFile() && !listed.isSymbolicLink() ? candidate : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function finish(crashes, iterations, corpusDir, ctx, _phase) {
+  return finishWithCorpus(crashes, iterations, corpusDir, ctx);
+}
+function finishWithCorpus(crashes, iterations, corpusDir, ctx) {
+  const deduped = dedupeBySignature(crashes);
+  const result = {
+    iterations,
+    crashes: deduped,
+    corpusSize: corpusCount(corpusDir),
+    durationMs: Date.now() - ctx.start
+  };
+  if (ctx.toolingMissing.length > 0) {
+    result.toolingMissing = Array.from(new Set(ctx.toolingMissing));
+  }
+  ctx.log(`[userspace-fuzz] done: iterations=${result.iterations} crashes=${result.crashes.length} corpus=${result.corpusSize}` + (result.toolingMissing ? ` toolingMissing=[${result.toolingMissing.join(",")}]` : ""));
+  return result;
+}
+
+// packages/core/dist/triage/userspace-primitive.js
+var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
+function severityRank(sev) {
+  return SEVERITY_ORDER.indexOf(sev);
+}
+function maxMemSeverity(a, b) {
+  return severityRank(a) >= severityRank(b) ? a : b;
+}
+function sniffMemPrimitive(raw) {
+  if (/heap-use-after-free|use-after-free|use of (deallocated|freed)/i.test(raw)) {
+    return "use-after-free";
+  }
+  if (/double-free|attempting double-free|free of (already-freed|untracked)/i.test(raw)) {
+    return "double-free";
+  }
+  if (/stack-buffer-overflow|stack-use-after-(return|scope)|stack-oob/i.test(raw)) {
+    return "stack-oob";
+  }
+  if (/heap-buffer-overflow|global-buffer-overflow|dynamic-stack-buffer-overflow/i.test(raw)) {
+    return /\bWRITE of size\b/i.test(raw) ? "heap-oob-write" : "heap-oob-read";
+  }
+  if (/uninitialized (memory|bytes|value)|use of uninitialized|msan|memorysanitizer|conjuring an instance/i.test(raw)) {
+    return "uninit-read";
+  }
+  if (/dangling (reference|pointer)|pointer to .* was dereferenced after/i.test(raw)) {
+    return "use-after-free";
+  }
+  if (/out-of-bounds|out of bounds|index out of bounds/i.test(raw)) {
+    return /\bWRITE of size\b|writing|store/i.test(raw) ? "heap-oob-write" : "heap-oob-read";
+  }
+  if (/signed integer overflow|unsigned integer overflow|integer overflow|shift .* out of range/i.test(raw)) {
+    return "integer-overflow";
+  }
+  if (/(member|downcast|wrong type|type mismatch|invalid (vtable|downcast)).*type|type confusion|misaligned/i.test(raw)) {
+    return "type-confusion";
+  }
+  if (/null pointer|null-deref|dereferenc(e|ing) (a )?null|SEGV on unknown address 0x0+\b/i.test(raw)) {
+    return "null-deref";
+  }
+  return void 0;
+}
+function primitiveFromKind(kind) {
+  switch (kind) {
+    case "segfault":
+      return "null-deref";
+    case "ubsan":
+      return "integer-overflow";
+    case "msan":
+      return "uninit-read";
+    default:
+      return "unknown";
+  }
+}
+function sniffAccess(raw) {
+  if (/\bWRITE of size\b|\bwriting\b|\bstore\b|wild pointer write/i.test(raw))
+    return "write";
+  if (/\bREAD of size\b|\breading\b|\bload\b/i.test(raw))
+    return "read";
+  if (/\bexecute\b|\bPC\b.*invalid|control flow|return address/i.test(raw))
+    return "exec";
+  return "none";
+}
+function classifyUserspacePrimitive(crash) {
+  const raw = crash.rawOutput ?? "";
+  const primitive = crash.primitive ?? sniffMemPrimitive(raw) ?? primitiveFromKind(crash.kind);
+  const access = sniffAccess(raw);
+  let severity;
+  let controllable;
+  let readWrite;
+  let rationale;
+  switch (primitive) {
+    case "use-after-free": {
+      readWrite = access === "read" ? "read" : "write";
+      controllable = true;
+      severity = readWrite === "write" ? "critical" : "high";
+      rationale = `Use-after-free grants a dangling reference; a ${readWrite} after free is the lever \u2014 reclaim the freed allocation with a controlled object to turn it into ${readWrite === "write" ? "an object overwrite" : "an info-leak"}.`;
+      break;
+    }
+    case "double-free": {
+      readWrite = "write";
+      controllable = true;
+      severity = "high";
+      rationale = "Double-free confuses the allocator freelist, enabling overlapping allocations and downstream object overwrite.";
+      break;
+    }
+    case "heap-oob-write": {
+      readWrite = "write";
+      controllable = true;
+      severity = "critical";
+      rationale = "Heap out-of-bounds write corrupts an adjacent allocation \u2014 a write-what-where candidate once the neighbouring object is groomed.";
+      break;
+    }
+    case "heap-oob-read": {
+      readWrite = "read";
+      controllable = /attacker|user-?controlled|tainted|index|offset|length/i.test(raw);
+      severity = "medium";
+      rationale = "Heap out-of-bounds read leaks adjacent allocation contents \u2014 an info-leak candidate useful for defeating ASLR.";
+      break;
+    }
+    case "stack-oob": {
+      readWrite = access === "read" ? "read" : "write";
+      controllable = true;
+      severity = readWrite === "write" ? "high" : "medium";
+      rationale = "Stack out-of-bounds access; write variants can target saved registers / return addresses subject to stack-canary mitigation.";
+      break;
+    }
+    case "type-confusion": {
+      readWrite = "write";
+      controllable = true;
+      severity = "high";
+      rationale = "Type confusion treats one object layout as another, enabling controlled reads/writes through mismatched fields (e.g. a fake vtable).";
+      break;
+    }
+    case "uninit-read": {
+      readWrite = "read";
+      controllable = false;
+      severity = "medium";
+      rationale = "Uninitialised read returns stale memory \u2014 an info-leak building block; exploitability depends on whether the leaked bytes reach an attacker.";
+      break;
+    }
+    case "integer-overflow": {
+      readWrite = "none";
+      controllable = false;
+      severity = "low";
+      rationale = "Integer overflow rarely yields a direct memory primitive on its own; treat as a building block (e.g. an undersized allocation) pending further analysis.";
+      break;
+    }
+    case "null-deref": {
+      readWrite = "none";
+      controllable = false;
+      severity = "low";
+      rationale = "Null / faulting dereference is typically a denial-of-service in userspace unless a controlled offset reaches a mapped page.";
+      break;
+    }
+    default: {
+      readWrite = access;
+      controllable = false;
+      severity = "info";
+      rationale = `Crash kind ${crash.kind} did not map to a known memory-safety primitive; treat as undetermined pending symbolisation.`;
+    }
+  }
+  if ((crash.kind === "panic" || crash.kind === "timeout" || crash.kind === "oom") && primitive === "unknown") {
+    return {
+      primitive: "unknown",
+      severity: crash.kind === "panic" ? "low" : "info",
+      controllable: false,
+      readWrite: "none",
+      rationale: crash.kind === "panic" ? "Rust panic with no sanitizer signature \u2014 a safe-abort / availability bug, not a memory-corruption primitive." : `${crash.kind} with no corruption signature \u2014 an availability bug.`
+    };
+  }
+  return { primitive, severity, controllable, readWrite, rationale };
+}
+function describeExploitabilityVerdict(verdict) {
+  return [
+    `Primitive: ${verdict.primitive} (op=${verdict.readWrite})`,
+    `Severity: ${verdict.severity} (controllable=${verdict.controllable})`,
+    `- ${verdict.rationale}`
+  ];
+}
+
+// packages/core/dist/triage/pov-gate.js
+import { execFile as execFile2 } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile2);
+function oracleForCategory(category) {
+  switch (category) {
+    case "xss":
+      return "headless-browser";
+    case "ssrf":
+    case "command-injection":
+    case "code-injection":
+      return "oast-callback";
+    default:
+      return "regex-fallback";
+  }
+}
+function oastConfirmedPayload(finding, oracle) {
+  if (!oracle.verified)
+    return null;
+  if (oracleForCategory(finding.category) !== "oast-callback")
+    return null;
+  return {
+    findingId: finding.id,
+    category: finding.category,
+    oracle: "oast-callback",
+    hasPov: true,
+    reason: oracle.evidence || void 0
+  };
+}
+var POV_TOOLS = [
+  {
+    name: "bash",
+    description: "Execute a shell command (curl, python, etc.) to run the exploit. Use this to actually invoke your PoC and capture its output.",
+    input_schema: {
+      type: "object",
+      properties: {
+        command: { type: "string", description: "Shell command to run" }
+      },
+      required: ["command"]
+    }
+  },
+  {
+    name: "http_request",
+    description: "Send a raw HTTP request. Returns the response body/status. Useful when you want a typed request without shelling out to curl.",
+    input_schema: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "Target URL" },
+        method: { type: "string", description: "HTTP method (default GET)" },
+        body: { type: "string", description: "Request body" },
+        headers: {
+          type: "object",
+          description: "Additional headers as key-value pairs"
+        }
+      },
+      required: ["url"]
+    }
+  },
+  {
+    name: "submit_pov",
+    description: "Submit the final proof-of-vulnerability once you have confirmed the exploit works. Call this EXACTLY ONCE with the working artifact and the execution output that proves exploitation. Only call this after you have actually run the exploit and seen category-specific proof in the response.",
+    input_schema: {
+      type: "object",
+      properties: {
+        artifact_type: {
+          type: "string",
+          description: "Type of artifact",
+          enum: ["curl", "python", "javascript", "bash"]
+        },
+        artifact: {
+          type: "string",
+          description: "The concrete PoC (e.g. the full curl command or script source)."
+        },
+        execution_evidence: {
+          type: "string",
+          description: "The response / output from running the artifact, showing category-specific proof (extracted data, /etc/passwd, whoami, reflected script, etc.)."
+        }
+      },
+      required: ["artifact_type", "artifact", "execution_evidence"]
+    }
+  },
+  {
+    name: "give_up",
+    description: "Call this if you CANNOT produce a working exploit. Do NOT speculate or describe what would happen \u2014 if you cannot run it and see real proof, give up honestly.",
+    input_schema: {
+      type: "object",
+      properties: {
+        reason: { type: "string", description: "Why no PoV was possible" }
+      },
+      required: ["reason"]
+    }
+  }
+];
+var CATEGORY_JUDGES = {
+  "sql-injection": {
+    label: "SQLi: extracted DB data / error / version string",
+    patterns: [
+      /\b(mysql|mariadb|postgres|postgresql|sqlite|oracle)\b.*\bversion\b/i,
+      /\b\d+\.\d+\.\d+[-\w]*-?(mariadb|mysql|ubuntu|debian|log)\b/i,
+      /you have an error in your sql syntax/i,
+      /ORA-\d{5}/,
+      /pg_(sleep|version|database)/i,
+      /information_schema\.(tables|columns|schemata)/i,
+      /union\s+select/i,
+      /\bsqlite_version\(\)/i,
+      // Extracted user/hash row patterns
+      /['"]\s*,\s*['"][0-9a-f]{32,}['"]/
+    ]
+  },
+  xss: {
+    label: "XSS: script reflected unencoded or dialog fired",
+    patterns: [
+      /<script[^>]*>[^<]*(alert|confirm|prompt)\s*\(/i,
+      /on(error|load|click|mouseover)\s*=\s*["']?\s*(alert|confirm|prompt)\s*\(/i,
+      /dialog\s+(fired|opened|appeared)/i,
+      /\balert\(1\)/i,
+      /javascript:alert/i
+    ]
+  },
+  ssrf: {
+    label: "SSRF: internal IP/metadata endpoint responded",
+    patterns: [
+      /169\.254\.169\.254/,
+      /metadata\.google\.internal/i,
+      /instance-identity/i,
+      /iam\/security-credentials/i,
+      /127\.0\.0\.1|localhost/i,
+      /10\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+      /192\.168\.\d{1,3}\.\d{1,3}/,
+      /172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}/
+    ]
+  },
+  "command-injection": {
+    label: "RCE: command output in response",
+    patterns: [
+      /uid=\d+\([^)]+\)\s+gid=\d+/,
+      /\broot:x:0:0:/,
+      /Linux\s+[\w.-]+\s+\d+\.\d+\.\d+/,
+      /^\/bin\/(bash|sh)/m,
+      /PATH=[^\n]{5,}/,
+      /^(usr|bin|etc|var|tmp|home|root)\b/m,
+      /\bwhoami\b\s*[\r\n]+\s*\w+/i
+    ]
+  },
+  "code-injection": {
+    label: "Code injection: arbitrary code output in response",
+    patterns: [
+      /uid=\d+\([^)]+\)/,
+      /\broot:x:0:0:/,
+      /__import__|eval\(|exec\(/,
+      /\bpython\d?\b.*traceback/i
+    ]
+  },
+  "path-traversal": {
+    label: "LFI: sensitive file contents in response",
+    patterns: [
+      /\broot:x:0:0:/,
+      /\bdaemon:x:\d+:\d+:/,
+      /\[boot loader\]/i,
+      /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+      /\/etc\/shadow/
+    ]
+  },
+  "information-disclosure": {
+    label: "IDOR / info disclosure: access to restricted data",
+    patterns: [
+      /"(email|password|ssn|credit_?card|api[_-]?key|token)"\s*:/i,
+      /\broot:x:0:0:/,
+      /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+      /user\s*id\s*[:=]\s*\d+/i
+    ]
+  },
+  "heap-overflow": {
+    label: "Heap overflow: KASAN out-of-bounds or crash evidence",
+    patterns: [
+      /BUG:\s*KASAN:\s*(slab-)?out-of-bounds/i,
+      /heap-buffer-overflow/i,
+      /\bKASAN\b.*\b(read|write)\b.*\bsize\s+\d+\b/i,
+      /allocated by task/i,
+      /Oops:.*\[#\d+\]/
+    ]
+  },
+  "use-after-free": {
+    label: "UAF: KASAN use-after-free or freed-object access",
+    patterns: [
+      /BUG:\s*KASAN:\s*(slab-)?use-after-free/i,
+      /Freed by task/i,
+      /\buse-after-free\b/i,
+      /\bKASAN\b.*\bfreed\b/i,
+      /allocated by task.*\nfreed by task/is
+    ]
+  },
+  "stack-buffer-overflow": {
+    label: "Stack overflow: KASAN stack-out-of-bounds",
+    patterns: [
+      /BUG:\s*KASAN:\s*stack-out-of-bounds/i,
+      /stack-buffer-overflow/i,
+      /\bKASAN\b.*\bstack\b/i
+    ]
+  },
+  "null-pointer-deref": {
+    label: "Null deref: kernel NULL pointer dereference",
+    patterns: [
+      /BUG:\s*kernel NULL pointer dereference/i,
+      /unable to handle kernel NULL pointer/i,
+      /general protection fault.*0000/i,
+      /Oops:.*\[#\d+\]/,
+      /IP:.*\+0x/
+    ]
+  },
+  "integer-overflow": {
+    label: "Integer overflow: UBSAN or arithmetic overflow",
+    patterns: [
+      /UBSAN:\s*(shift|integer|array)/i,
+      /signed integer overflow/i,
+      /unsigned integer overflow/i,
+      /shift.*out of range/i,
+      /division by zero/i
+    ]
+  },
+  "race-condition": {
+    label: "Race: RCU stall or lock dependency violation",
+    patterns: [
+      /rcu.*stall/i,
+      /INFO:\s*possible circular locking/i,
+      /WARNING:.*lockdep/i,
+      /DEADLOCK/i,
+      /inconsistent lock state/i
+    ]
+  },
+  "double-free": {
+    label: "Double free: KASAN double-free detection",
+    patterns: [
+      /BUG:\s*KASAN:\s*double-free/i,
+      /KASAN.*double.?free/i,
+      /Object already free/i
+    ]
+  },
+  "type-confusion": {
+    label: "Type confusion: invalid cast or type mismatch",
+    patterns: [
+      /UBSAN:\s*member access.*type/i,
+      /type.*confusion/i,
+      /invalid.*downcast/i,
+      /load of misaligned address/i
+    ]
+  }
+};
+function judgePovEvidence(finding, executionEvidence) {
+  const judge = CATEGORY_JUDGES[finding.category];
+  if (judge) {
+    for (const pat of judge.patterns) {
+      const m = executionEvidence.match(pat);
+      if (m) {
+        return { passed: true, matchedPattern: m[0], label: judge.label };
+      }
+    }
+    return { passed: false, label: judge.label };
+  }
+  const generic = [
+    /uid=\d+\([^)]+\)/,
+    /\broot:x:0:0:/,
+    /flag\{[^}]+\}/i,
+    /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+    /HTTP\/\d\.\d\s+200\s+OK[\s\S]{0,2000}password/i
+  ];
+  for (const pat of generic) {
+    const m = executionEvidence.match(pat);
+    if (m) {
+      return {
+        passed: true,
+        matchedPattern: m[0],
+        label: "generic exploitation proof"
+      };
+    }
+  }
+  return { passed: false, label: "no category-specific proof" };
+}
+function buildPovSystemPrompt(finding, target, maxTurns) {
+  return `You are the PoV (Proof-of-Vulnerability) agent.
+
+You have ONE JOB: demonstrate that this finding is actually exploitable by
+RUNNING a working exploit against the target and capturing output that
+proves the vulnerability is real.
+
+# Target
+${target}
+
+# Finding under test
+- id: ${finding.id}
+- title: ${finding.title}
+- category: ${finding.category}
+- severity: ${finding.severity}
+
+# Evidence from the original agent
+Request:
+${(finding.evidence.request ?? "").slice(0, 2e3)}
+
+Response:
+${(finding.evidence.response ?? "").slice(0, 2e3)}
+
+Analysis:
+${(finding.evidence.analysis ?? "").slice(0, 1e3)}
+
+# Rules (these override any general instincts)
+1. You MUST produce a CONCRETE, EXECUTABLE exploit (curl/python/bash/js).
+2. You MUST actually RUN it via the \`bash\` or \`http_request\` tool and
+   capture the response.
+3. The captured response MUST contain category-specific proof of
+   exploitation (extracted data, /etc/passwd, uid=0, reflected <script>,
+   169.254.169.254 metadata, etc.). A 200 OK alone is NOT proof.
+4. DO NOT speculate, DO NOT describe what would happen, DO NOT paraphrase.
+   If you cannot run it and see real proof, call \`give_up\`.
+5. When you have working proof, call \`submit_pov\` ONCE with the exact
+   artifact and the exact output.
+6. You have at most ${maxTurns} turns. Be decisive.
+
+# Accepted proof by category
+- sql-injection: extracted rows, version strings, SQL error, union select data
+- xss: <script> reflected unencoded, or dialog fired
+- ssrf: 169.254.169.254 or internal network response
+- command-injection / code-injection: uid=, /etc/passwd, kernel version
+- path-traversal: /etc/passwd, shadow, private keys
+- information-disclosure: sensitive fields (password, api_key, tokens)
+
+Start by writing the exploit and running it. No preamble.`;
+}
+var MAX_OUTPUT_CHARS = 8e3;
+var BASH_TIMEOUT_MS = 15e3;
+function clip(s) {
+  if (s.length <= MAX_OUTPUT_CHARS)
+    return s;
+  return `${s.slice(0, MAX_OUTPUT_CHARS)}
+\u2026[truncated ${s.length - MAX_OUTPUT_CHARS} chars]`;
+}
+async function runBash(command) {
+  try {
+    const { stdout, stderr } = await execFileAsync("bash", ["-lc", command], {
+      timeout: BASH_TIMEOUT_MS,
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return clip(`$ ${command}
+${stdout}${stderr ? `
+[stderr]
+${stderr}` : ""}`);
+  } catch (err) {
+    const e = err;
+    return clip(`$ ${command}
+[error] ${e.message}
+${e.stdout ?? ""}${e.stderr ?? ""}`);
+  }
+}
+async function runHttp(input) {
+  const url = String(input.url ?? "");
+  const method = String(input.method ?? "GET");
+  const body = input.body !== void 0 ? String(input.body) : void 0;
+  const headers = input.headers ?? {};
+  if (!url)
+    return "[error] url is required";
+  try {
+    const res = await fetch(url, {
+      method,
+      headers,
+      body
+    });
+    const text = await res.text();
+    return clip(`HTTP/${res.status} ${method} ${url}
+${text}`);
+  } catch (err) {
+    return clip(`[error] fetch ${url}: ${err.message}`);
+  }
+}
+function isOracleInfraError(reason) {
+  return /\b(failed|error|threw|exception|unavailable|timed? ?out)\b/i.test(reason);
+}
+async function generatePov(finding, target, runtime, maxTurns = 5, opts = {}) {
+  const oracleKind = oracleForCategory(finding.category);
+  const system = buildPovSystemPrompt(finding, target, maxTurns);
+  const messages = [
+    {
+      role: "user",
+      content: [
+        {
+          type: "text",
+          text: "Build and run a working PoC for the finding above. Remember: real execution, real output, no speculation."
+        }
+      ]
+    }
+  ];
+  const judge = opts.judge ?? judgePovEvidence;
+  let submitted = null;
+  let gaveUpReason = null;
+  let turnsUsed = 0;
+  for (let turn = 1; turn <= maxTurns; turn++) {
+    turnsUsed = turn;
+    const result = await runtime.executeNative(system, messages, POV_TOOLS);
+    if (result.error) {
+      return {
+        hasPov: false,
+        povArtifact: null,
+        artifactType: "none",
+        executionEvidence: "",
+        confidence: 0,
+        turnsUsed,
+        reason: `runtime error: ${result.error}`,
+        oracle: oracleKind
+      };
+    }
+    messages.push({ role: "assistant", content: result.content });
+    const toolUseBlocks = result.content.filter((b) => b.type === "tool_use");
+    if (toolUseBlocks.length === 0) {
+      messages.push({
+        role: "user",
+        content: [
+          {
+            type: "text",
+            text: "No tool call detected. Either RUN the exploit via `bash`/`http_request` and then call `submit_pov`, or call `give_up`. No speculation."
+          }
+        ]
+      });
+      continue;
+    }
+    const toolResults = [];
+    for (const block of toolUseBlocks) {
+      let output;
+      switch (block.name) {
+        case "bash": {
+          const cmd = String(block.input.command ?? "");
+          output = opts.disableBash ? `[bash disabled in test mode] would run: ${cmd}` : await runBash(cmd);
+          break;
+        }
+        case "http_request": {
+          output = opts.disableHttp ? `[http disabled in test mode] would fetch: ${JSON.stringify(block.input)}` : await runHttp(block.input);
+          break;
+        }
+        case "submit_pov": {
+          const art = String(block.input.artifact ?? "");
+          const ev = String(block.input.execution_evidence ?? "");
+          const at = String(block.input.artifact_type ?? "bash");
+          submitted = {
+            artifact: art,
+            execution_evidence: ev,
+            artifact_type: ["curl", "python", "javascript", "bash"].includes(at) ? at : "bash"
+          };
+          output = "submitted";
+          break;
+        }
+        case "give_up": {
+          gaveUpReason = String(block.input.reason ?? "agent gave up");
+          output = "acknowledged";
+          break;
+        }
+        default:
+          output = `[error] unknown tool ${block.name}`;
+      }
+      toolResults.push({
+        type: "tool_result",
+        tool_use_id: block.id,
+        content: output
+      });
+    }
+    messages.push({ role: "user", content: toolResults });
+    if (submitted)
+      break;
+    if (gaveUpReason)
+      break;
+  }
+  if (gaveUpReason) {
+    return {
+      hasPov: false,
+      povArtifact: null,
+      artifactType: "none",
+      executionEvidence: "",
+      confidence: 0,
+      turnsUsed,
+      reason: `agent gave up: ${gaveUpReason}`,
+      oracle: oracleKind
+    };
+  }
+  if (!submitted) {
+    return {
+      hasPov: false,
+      povArtifact: null,
+      artifactType: "none",
+      executionEvidence: "",
+      confidence: 0,
+      turnsUsed,
+      reason: turnsUsed >= maxTurns ? `max turns (${maxTurns}) exceeded without a working PoC` : "agent exited without submitting a PoC",
+      oracle: oracleKind
+    };
+  }
+  if (oracleKind !== "regex-fallback") {
+    return adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTurns, oracleKind, opts);
+  }
+  const verdict = judge(finding, submitted.execution_evidence);
+  if (!verdict.passed) {
+    return {
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0.2,
+      turnsUsed,
+      reason: `submitted PoC did not contain category-specific proof (${verdict.label})`,
+      oracle: "regex-fallback"
+    };
+  }
+  const confidence = Math.max(0.7, 1 - (turnsUsed - 1) * (0.3 / Math.max(1, maxTurns - 1)));
+  return {
+    hasPov: true,
+    povArtifact: submitted.artifact,
+    artifactType: submitted.artifact_type,
+    executionEvidence: submitted.execution_evidence,
+    confidence,
+    turnsUsed,
+    reason: `PoV confirmed: ${verdict.label}${verdict.matchedPattern ? ` (matched: ${verdict.matchedPattern.slice(0, 80)})` : ""}`,
+    oracle: "regex-fallback"
+  };
+}
+async function adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTurns, oracleKind, opts) {
+  const runOracle = opts.oracle ?? verifyOracleByCategory;
+  let oracleResult;
+  try {
+    oracleResult = opts.precomputedOracle ?? await runOracle(finding, target);
+  } catch (err) {
+    return {
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0,
+      turnsUsed,
+      reason: `oracle (${oracleKind}) errored, inconclusive: ${err.message}`,
+      oracle: oracleKind,
+      inconclusive: true
+    };
+  }
+  if (oracleResult.verified) {
+    const speed = Math.max(0.7, 1 - (turnsUsed - 1) * (0.3 / Math.max(1, maxTurns - 1)));
+    return {
+      hasPov: true,
+      povArtifact: submitted.artifact,
+      artifactType: submitted.artifact_type,
+      // Prefer the oracle's reproduced evidence; keep the agent's as context.
+      executionEvidence: oracleResult.evidence || submitted.execution_evidence,
+      confidence: Math.min(speed, oracleResult.confidence || speed),
+      turnsUsed,
+      reason: `PoV confirmed by ${oracleKind} oracle: ${oracleResult.evidence}`,
+      oracle: oracleKind
+    };
+  }
+  if (isOracleInfraError(oracleResult.reason)) {
+    return {
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0,
+      turnsUsed,
+      reason: `oracle (${oracleKind}) inconclusive: ${oracleResult.reason}`,
+      oracle: oracleKind,
+      inconclusive: true
+    };
+  }
+  return {
+    hasPov: false,
+    povArtifact: submitted.artifact || null,
+    artifactType: submitted.artifact_type,
+    executionEvidence: submitted.execution_evidence,
+    confidence: 0,
+    turnsUsed,
+    reason: `${oracleKind} oracle did not reproduce the exploit: ${oracleResult.reason}`,
+    oracle: oracleKind
+  };
+}
+var MEMCORRUPTION_CRASH_KINDS = /* @__PURE__ */ new Set([
+  "asan",
+  "ubsan",
+  "msan",
+  "miri",
+  "segfault"
+]);
+function isReproducedMemCorruption(crash) {
+  return Boolean(crash.inputPath) && MEMCORRUPTION_CRASH_KINDS.has(crash.kind) && Boolean(crash.rawOutput && crash.rawOutput.trim().length > 0);
+}
+function memCorruptionVerdict(crash) {
+  const reproduced = isReproducedMemCorruption(crash);
+  const exploit = classifyUserspacePrimitive(crash);
+  if (!reproduced) {
+    return {
+      verdict: "inconclusive",
+      confidence: 0,
+      reasoning: `Crash artifact (kind=${crash.kind}) is not a reproduced memory-corruption PoC \u2014 ${crash.inputPath ? "no sanitizer/Miri corruption signature" : "no saved reproducing input"}. Inconclusive, not a rejection.`,
+      signals: [
+        {
+          name: "memcorruption_repro",
+          passed: false,
+          confidence: 0,
+          reasoning: `kind=${crash.kind}, primitive=${exploit.primitive}, savedInput=${Boolean(crash.inputPath)}`
+        }
+      ]
+    };
+  }
+  const gate = reproConfidence(crash);
+  return {
+    verdict: "confirmed",
+    confidence: gate.confidence,
+    reasoning: `Reproduced under the sanitizer/Miri build (kind=${crash.kind}): ${exploit.primitive} (${exploit.readWrite}). ${exploit.rationale}${gate.note}`,
+    signals: [
+      {
+        name: "memcorruption_repro",
+        passed: true,
+        confidence: gate.confidence,
+        reasoning: `signature=${crash.signature}, input=${crash.inputPath}` + (crash.reproConfirmations != null ? `, repro=${crash.reproConfirmations}/${crash.reproAttempts ?? crash.reproConfirmations}` : "")
+      }
+    ],
+    evidenceKind: "reproduced-memcorruption-poc"
+  };
+}
+function reproConfidence(crash) {
+  const n = crash.reproConfirmations;
+  if (n == null)
+    return { confidence: 0.95, note: "" };
+  if (n >= 2) {
+    const attempts = crash.reproAttempts ?? n;
+    return { confidence: 0.95, note: ` Reproduced ${n}/${attempts}\xD7 (N\xD7 confirmed).` };
+  }
+  if (n === 1) {
+    const attempts = crash.reproAttempts ?? 1;
+    return {
+      confidence: 0.82,
+      note: attempts > 1 ? ` Reproduced only 1/${attempts}\xD7 \u2014 flaky-repro risk; re-run to confirm before relying on it.` : ` Single-shot reproduction (N=1) \u2014 re-run to rule out an environment fluke.`
+    };
+  }
+  return { confidence: 0.82, note: " Reproduction count is 0 \u2014 treat as unconfirmed flake." };
+}
+
+// packages/core/dist/stages/memsafety-scan.js
+function memPrimitiveToCategory(primitive) {
+  switch (primitive) {
+    case "use-after-free":
+      return "use-after-free";
+    case "double-free":
+      return "double-free";
+    case "heap-oob-read":
+      return "out-of-bounds-read";
+    case "heap-oob-write":
+      return "out-of-bounds-write";
+    case "stack-oob":
+      return "stack-buffer-overflow";
+    case "type-confusion":
+      return "type-confusion";
+    case "uninit-read":
+      return "uninitialized-memory";
+    case "null-deref":
+      return "null-deref";
+    case "integer-overflow":
+      return "integer-overflow";
+    case "unknown":
+      return "other";
+  }
+}
+function crashArtifactToFinding(crash, target, exploitability, verdict) {
+  const severity = exploitability.severity;
+  const category = memPrimitiveToCategory(exploitability.primitive);
+  const stackSummary = (crash.stack ?? []).slice(0, 5).join(" \u2192 ");
+  const reproducerRef = crash.artifactRef ?? crash.inputPath;
+  const reproduced = verdict.verdict === "confirmed";
+  const description = [
+    `Userspace ${crash.kind} crash in ${target.language} target (${target.sourceRoot}).`,
+    `Primitive: ${exploitability.primitive} (op=${exploitability.readWrite}, controllable=${exploitability.controllable}).`,
+    stackSummary ? `Stack: ${stackSummary}.` : "",
+    reproducerRef ? `Reproducing input: ${reproducerRef}.` : "",
+    reproduced ? "Reproduced under the sanitizer/Miri build (memory-corruption PoC)." : "Observed crash; not yet a reproduced memory-corruption PoC (inconclusive \u2014 not a rejection)."
+  ].filter(Boolean).join("\n");
+  const analysisLines = [
+    `Crash kind: ${crash.kind}`,
+    `Signature: ${crash.signature}`,
+    `Category: ${category}`,
+    `Build system: ${target.buildSystem}`,
+    target.harnessEntry ? `Harness: ${target.harnessEntry}` : "",
+    "",
+    "---exploitability---",
+    ...describeExploitabilityVerdict(exploitability),
+    "",
+    "---verify verdict---",
+    `Verdict: ${verdict.verdict} (confidence=${verdict.confidence})`,
+    verdict.evidenceKind ? `Evidence: ${verdict.evidenceKind}` : "",
+    verdict.reasoning
+  ].filter(Boolean);
+  const confidence = reproduced ? verdict.confidence : 0.3;
+  const rawOut = crash.rawOutput ?? "";
+  return {
+    id: randomUUID(),
+    templateId: `memsafety-${crash.kind}`,
+    title: `Userspace ${exploitability.primitive} (${crash.kind}) in ${target.sourceRoot}`,
+    description,
+    severity,
+    category,
+    status: "discovered",
+    evidence: {
+      request: reproducerRef ?? "N/A (userspace crash artifact)",
+      response: rawOut.length > 4e3 ? rawOut.slice(0, 4e3) + "\n... [truncated]" : rawOut,
+      analysis: analysisLines.join("\n")
+    },
+    fingerprint: `memsafety:${crash.signature}`,
+    confidence,
+    timestamp: Date.now()
+  };
+}
+async function runMemSafetyScan(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const warnings = [];
+  const playbookContext = buildPlaybookInjection(["rust_memsafety"]);
+  log(`[memsafety] fuzzing ${opts.target.language} target at ${opts.target.sourceRoot}` + (opts.target.harnessEntry ? ` (harness=${opts.target.harnessEntry})` : ""));
+  const loop = await runUserspaceFuzzLoop({
+    ...opts.fuzz,
+    target: opts.target,
+    logger: log
+  });
+  const toolingMissing = loop.toolingMissing ?? [];
+  if (toolingMissing.length > 0) {
+    const note = `[memsafety] fuzz loop could not complete \u2014 unavailable prerequisite: ${toolingMissing.join(", ")}. No findings emitted (no fabricated results).`;
+    log(note);
+    warnings.push(note);
+  }
+  const details = [];
+  for (const crash of loop.crashes) {
+    const exploitability = classifyUserspacePrimitive(crash);
+    const verdict = memCorruptionVerdict(crash);
+    const finding = crashArtifactToFinding(crash, opts.target, exploitability, verdict);
+    details.push({ finding, crash, exploitability, verdict });
+  }
+  if (details.length === 0 && toolingMissing.length === 0) {
+    log(`[memsafety] fuzz loop ran ${loop.iterations} iteration(s) with no crashes captured.`);
+  }
+  return {
+    findings: details.map((d) => d.finding),
+    details,
+    loop,
+    toolingMissing,
+    playbookContext,
+    warnings
+  };
+}
+
+export {
+  parseCrashOutput,
+  runUserspaceFuzzLoop,
+  maxMemSeverity,
+  sniffMemPrimitive,
+  classifyUserspacePrimitive,
+  describeExploitabilityVerdict,
+  oracleForCategory,
+  oastConfirmedPayload,
+  judgePovEvidence,
+  generatePov,
+  isReproducedMemCorruption,
+  memCorruptionVerdict,
+  memPrimitiveToCategory,
+  crashArtifactToFinding,
+  runMemSafetyScan
+};