0sec-cli 0.17.0 → 0.18.0

package/chunks/{commands-U3AMV5ZU.js → commands-TBC2F5CE.js}

@@ -3,10 +3,10 @@ import { createRequire as __0secCreateRequire } from "node:module";
 const require = __0secCreateRequire(import.meta.url);
 import {
   registerOrchestrateCommand
-} from "./chunk-4Y4KQJXE.js";
+} from "./chunk-XM5NLHYU.js";
 import {
   registerDbCommand
-} from "./chunk-RDZYQQLW.js";
+} from "./chunk-WXQ6BJ6A.js";
 import {
   canUseOpenTui,
   isBunRuntime
@@ -33,12 +33,13 @@ import {
   runLogin,
   runUnified,
   startCodexDeviceAuth
-} from "./chunk-3QFDYBZQ.js";
-import "./chunk-H44E2CRN.js";
+} from "./chunk-TSK2AG6J.js";
+import "./chunk-BVAZO4WA.js";
 import {
+  InvalidArgumentError,
   Option,
   performAutoUpdate
-} from "./chunk-VGRDNSHA.js";
+} from "./chunk-AD7WXDH6.js";
 import {
   DEFAULT_THEME_NAME,
   SETTING_DEFS,
@@ -68,7 +69,7 @@ import {
   validateTheme,
   writeInstalledTheme,
   writePresentationLine
-} from "./chunk-2CJ776PV.js";
+} from "./chunk-GMT2AZKM.js";
 import {
   AjvJsonSchemaValidator,
   CallToolRequestSchema,
@@ -174,6 +175,7 @@ import {
   runCliPathTraversalReplayFixture,
   runEnsembleCraft,
   runReproductionBundle,
+  runSecureProject,
   runTournament,
   safeParse,
   safeParseAsync,
@@ -190,19 +192,19 @@ import {
   toScopeFile,
   withVariantFeatureFlags,
   writeAgentActionEvidenceBundle
-} from "./chunk-IORC6MQX.js";
+} from "./chunk-5JI7L7KV.js";
 import {
   RateLimiter,
   enumerateJsChunkUrls,
   parseRateLimitFlag
-} from "./chunk-QJQKHO7G.js";
+} from "./chunk-CMKXP5RR.js";
 import {
   source_default
 } from "./chunk-SF4KZ4O3.js";
 import {
   getEvalCategories,
   runEval
-} from "./chunk-HDWV7PGI.js";
+} from "./chunk-AHTBZC3E.js";
 import {
   oracleForCategory
 } from "./chunk-WVTBZEQO.js";
@@ -217,14 +219,14 @@ import {
   DETECTOR_REGISTRY,
   resolveDetectors
 } from "./chunk-RWONANDA.js";
-import "./chunk-KTQDLNSR.js";
-import "./chunk-HE7LCA7G.js";
+import "./chunk-BATRQBOR.js";
+import "./chunk-2JCCA2JL.js";
 import {
   adaptAndVerify
-} from "./chunk-D6S3IIPG.js";
-import "./chunk-A6CLR72I.js";
-import "./chunk-47TQJWDH.js";
-import "./chunk-SNKTC4BP.js";
+} from "./chunk-ASUR522M.js";
+import "./chunk-BFRB6HB2.js";
+import "./chunk-JQHOLLTD.js";
+import "./chunk-3KPWWJCI.js";
 import {
   runSourceFix
 } from "./chunk-F3WBKITT.js";
@@ -233,7 +235,7 @@ import {
   LocalShellRunner,
   QemuRunner,
   runDeterministicReplay
-} from "./chunk-DN25OQQA.js";
+} from "./chunk-C2WXWFBB.js";
 import {
   runHttpConformanceCheck
 } from "./chunk-IOL7D5YV.js";
@@ -246,7 +248,7 @@ import {
   runSpecdriftScan
 } from "./chunk-BKZFDZ23.js";
 import "./chunk-53G27VPS.js";
-import "./chunk-K26SZ37E.js";
+import "./chunk-BFR2CDV5.js";
 import "./chunk-RJWOYEOG.js";
 import {
   ToolExecutor,
@@ -276,17 +278,17 @@ import {
   targetRequiresScope,
   validateAwsCredentials,
   verifyImprovementLedger
-} from "./chunk-O462Y7P2.js";
+} from "./chunk-BZNEY2ZS.js";
 import {
   buildIntelDossier,
   lookupCve,
   searchAdvisories,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-LOHTE223.js";
+} from "./chunk-YYRBQVFE.js";
 import "./chunk-3MOLBTLS.js";
 import "./chunk-P6WKNFWX.js";
-import "./chunk-SOG2U7B3.js";
+import "./chunk-UCYRA73C.js";
 import "./chunk-LP3HHYQU.js";
 import "./chunk-KLTNTE2Z.js";
 import {
@@ -295,12 +297,12 @@ import {
   resolveOsecDbPath,
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-HT6P7RY3.js";
+} from "./chunk-72CISA2D.js";
 import "./chunk-QI233I24.js";
-import "./chunk-SZJCPG2I.js";
+import "./chunk-242TMK6G.js";
 import {
   runFileReviewPipeline
-} from "./chunk-WKNNZVJS.js";
+} from "./chunk-Z5FA2XOX.js";
 import "./chunk-RRMJC3ZE.js";
 import "./chunk-H2FFLZNK.js";
 import {
@@ -323,24 +325,24 @@ import {
   renderReproducibilityManifest,
   renderVendorNotificationMarkdown,
   transition
-} from "./chunk-UJ4IK5PO.js";
+} from "./chunk-U5FLXGHT.js";
 import {
   EmptyPocError,
   detectVersionRange,
   renderAdvisoryMarkdown,
   verifyAgainstRef
-} from "./chunk-UM3ZNQIM.js";
+} from "./chunk-WEBMRWEG.js";
 import {
   findCveArtifacts,
   normaliseCveId
-} from "./chunk-QKICO43A.js";
+} from "./chunk-SVJEDVYK.js";
 import {
   ScopePolicy,
   loadScope
 } from "./chunk-57ZENEX2.js";
 import {
   createRuntime
-} from "./chunk-MMLDQR4H.js";
+} from "./chunk-N7BOUYEV.js";
 import {
   CloudAuthMissingError,
   CloudClient,
@@ -352,11 +354,11 @@ import {
   LlmApiRuntime,
   features,
   loadCloudCredentials
-} from "./chunk-2SANI5RH.js";
-import "./chunk-CLHCDHP4.js";
+} from "./chunk-UR4ELX2Y.js";
+import "./chunk-ATATQACO.js";
 import {
   eventBus
-} from "./chunk-QOKTUOU2.js";
+} from "./chunk-ADOLI6DT.js";
 import {
   AgentActionScenarioSchema,
   DEFAULT_AUTONOMY_MODE,
@@ -371,7 +373,7 @@ import {
   parseAgentActionEvidenceManifest,
   pocStepArraySchema,
   reportSummarySchema
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-6L26OBWI.js";
 import {
   ZodOptional,
   external_exports
@@ -519,7 +521,7 @@ function registerScanCommand(program) {
   ).option("--base <branch>", "Base branch for `--emit pr` (default: main)").option("--dry-run", "For `--emit pr`: print git/gh commands instead of running them. Auto-enabled if `gh auth status` fails.", false).option("--emit-out-dir <path>", "Directory for `--emit pr` rollup files (default: system temp)").option("--resume <run-id>", "Resume a previous run from its journal on disk (0sec#374). Locates the run's journal, rehydrates agent state, and continues from the last entry.").option("--branch-from <entry-index>", "Branch the journal at the given entry index before resuming (requires --resume). Copies entries 0..N into a new run and resumes from there.").option("--verbose", "Show detailed output", false).option("--replay", "Replay the last scan's results", false).action(async (opts) => {
     if (opts.replay) {
       try {
-        const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+        const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
         const db = new osecDB2(opts.dbPath);
         const scans = db.listScans(1);
         if (scans.length === 0) {
@@ -646,7 +648,7 @@ function registerScanCommand(program) {
         process.exit(2);
       }
       try {
-        const { loadScope: loadScope2 } = await import("./dist-FDKALV4R.js");
+        const { loadScope: loadScope2 } = await import("./dist-4YICS2J2.js");
         const policy = loadScope2(scopeFile);
         const verdict = policy.match(String(opts.target));
         if (!verdict.allowed) {
@@ -673,7 +675,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveAttribution: resolveAttribution2,
         extractAttributionFromScopeJson: extractAttributionFromScopeJson2
-      } = await import("./dist-FDKALV4R.js");
+      } = await import("./dist-4YICS2J2.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveAttribution2({
         scopeFileBlock: policy ? extractAttributionFromScopeJson2(policy.raw) : void 0,
@@ -691,7 +693,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveEngagementProfile: resolveEngagementProfile2,
         extractEngagementFromScopeJson: extractEngagementFromScopeJson2
-      } = await import("./dist-FDKALV4R.js");
+      } = await import("./dist-4YICS2J2.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveEngagementProfile2({
         scopeFileBlock: policy ? extractEngagementFromScopeJson2(policy.raw) : void 0,
@@ -720,7 +722,7 @@ function registerScanCommand(program) {
     const rateLimit = opts.rateLimit;
     if (rateLimit !== void 0 && rateLimit !== "") {
       try {
-        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-FDKALV4R.js");
+        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-4YICS2J2.js");
         parseRateLimitFlag2(rateLimit);
       } catch (err) {
         console.error(source_default.red(err instanceof Error ? err.message : String(err)));
@@ -889,7 +891,7 @@ function registerResumeCommand(program) {
 
 // packages/cli/src/commands/replay.ts
 async function replayScan(opts) {
-  const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+  const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
   const db = new osecDB2(opts.dbPath);
   const requestedScan = opts.scan;
   let scanRecord;
@@ -958,7 +960,7 @@ function registerReplayCommand(program) {
     try {
       const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-J7PLXZNM.js");
       if (isBunRuntime2() && canUseOpenTui2()) {
-        const { showOpenTuiReplay } = await import("./run-ESNN4V5W.js");
+        const { showOpenTuiReplay } = await import("./run-D56MPDKY.js");
         await showOpenTuiReplay({ dbPath: opts.dbPath, scanId: opts.scan });
         return;
       }
@@ -979,7 +981,7 @@ function registerHistoryCommand(program) {
     const limit2 = Number.parseInt(opts.limit ?? "10", 10);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-J7PLXZNM.js");
     if (opts.dbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiHistory } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiHistory } = await import("./run-D56MPDKY.js");
       await showOpenTuiHistory({ dbPath: opts.dbPath, limit: limit2 });
       return;
     }
@@ -1170,7 +1172,7 @@ function registerFindingsCommand(program) {
     const selectedDbPath = resolveDbPath(resolved);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-J7PLXZNM.js");
     if (selectedDbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiFindings } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiFindings } = await import("./run-D56MPDKY.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1193,7 +1195,7 @@ function registerFindingsCommand(program) {
     const selectedDbPath = resolveDbPath(resolved);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-J7PLXZNM.js");
     if (selectedDbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiFindings } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiFindings } = await import("./run-D56MPDKY.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1251,7 +1253,7 @@ function registerFindingsCommand(program) {
         console.log(`  ${source_default.dim(finding.evidenceAnalysis)}`);
       }
       {
-        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-FDKALV4R.js");
+        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-4YICS2J2.js");
         const provenance = summarizeTriageProvenance({
           ...finding,
           layerVerdicts: parseLayerVerdicts(finding.layerVerdicts)
@@ -1295,17 +1297,84 @@ function registerFindingsCommand(program) {
   });
 }
 
+// packages/cli/src/commands/secure.ts
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+function positiveInteger(value) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed <= 0) {
+    throw new InvalidArgumentError("Must be a positive integer.");
+  }
+  return parsed;
+}
+function positiveAmount(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new InvalidArgumentError("Must be a positive finite dollar amount.");
+  }
+  return parsed;
+}
+function registerSecureCommand(program) {
+  program.command("secure").description("Investigate, reproduce, repair, test, and independently verify a repository; retain evidence and optionally open repair PRs").argument("<repo>", "Local Git repository or HTTPS Git URL; execution occurs in the current worker, not a newly provisioned sandbox").requiredOption("--test-command <command>", "Operator-approved regression command; must pass before and after repair").option("--setup-command <command>", "Operator-approved setup/build command run in each disposable checkout").option("--state-dir <path>", "Persistent run directory; defaults to a stable per-repository path so learnings accumulate").option("--runtime <runtime>", "Native repair runtime: auto or api", "api").option("-m, --model <model>", "Model for investigation and repair; inherits configured provider when omitted").option("--timeout <ms>", "Whole workflow deadline in milliseconds", positiveInteger, 36e5).option("--cost-ceiling <usd>", "Whole workflow model cost ceiling in USD", positiveAmount).option("--max-findings <n>", "Maximum findings to repair; remaining findings keep the run blocked", positiveInteger, 10).option("--max-attempts <n>", "Maximum repair candidates per finding", positiveInteger, 3).option("--max-turns <n>", "Maximum model turns per repair phase", positiveInteger, 30).option("--resume", "Resume the compatible persisted run for this repository; never blindly replays publication", false).option("--publish", "Publish verified patches as PRs using authorized repository credentials; never merge or deploy", false).option("--rules <text>", 'Plain-English team repair standards (e.g. "minimal diffs, no new dependencies")').option("--format <format>", "Output format: json", "json").action(async (repo, options) => {
+    if (options.format !== "json") throw new InvalidArgumentError("--format must be json.");
+    if (!["api", "auto"].includes(options.runtime)) throw new InvalidArgumentError("--runtime must be api or auto.");
+    if (!options.testCommand.trim()) throw new InvalidArgumentError("--test-command cannot be blank.");
+    if (options.setupCommand !== void 0 && !options.setupCommand.trim()) throw new InvalidArgumentError("--setup-command cannot be blank.");
+    const repoKey = createHash("sha256").update(resolve(repo)).digest("hex").slice(0, 12);
+    const stateDir = resolve(options.stateDir ?? join(homedir(), ".0sec", "secure", repoKey));
+    const controller = new AbortController();
+    const cancel = () => controller.abort(new Error("Workflow cancelled by operator"));
+    process.once("SIGINT", cancel);
+    process.once("SIGTERM", cancel);
+    const cloudOutput = process.env["0SEC_EMIT_RESULT_LINE"] === "1" || Boolean(process.env["0SEC_CLOUD_SINK"]);
+    const onEvent = (event) => {
+      if (cloudOutput) process.stdout.write(`0SEC_SECURE_EVENT=${JSON.stringify(event)}
+`);
+      else process.stderr.write(`[secure:${event.phase}] ${event.message}
+`);
+    };
+    try {
+      const result = await runSecureProject({
+        repoRoot: repo,
+        stateDir,
+        testCommand: options.testCommand,
+        setupCommand: options.setupCommand,
+        runtime: options.runtime,
+        model: options.model,
+        timeoutMs: options.timeout,
+        costCeilingUsd: options.costCeiling,
+        maxFindings: options.maxFindings,
+        maxAttempts: options.maxAttempts,
+        maxTurns: options.maxTurns,
+        resume: options.resume,
+        publish: options.publish,
+        rules: options.rules,
+        signal: controller.signal,
+        onEvent
+      });
+      process.stdout.write(cloudOutput ? `0SEC_RESULT=${JSON.stringify(result)}
+` : `${JSON.stringify(result, null, 2)}
+`);
+      process.exitCode = { completed: 0, blocked: 2, failed: 3, cancelled: 130 }[result.status];
+    } finally {
+      process.removeListener("SIGINT", cancel);
+      process.removeListener("SIGTERM", cancel);
+    }
+  });
+}
+
 // packages/cli/src/commands/review.ts
 import { readFile } from "node:fs/promises";
 
 // packages/cli/src/commands/review-harness-tier2.ts
-import { resolve, join, basename } from "node:path";
+import { resolve as resolve2, join as join2, basename } from "node:path";
 import { existsSync as existsSync3 } from "node:fs";
 var VALID_BUILD_SYSTEMS = /* @__PURE__ */ new Set(["autotools", "cmake", "meson", "auto"]);
 var VALID_SANITIZERS = /* @__PURE__ */ new Set(["asan", "ubsan", "msan"]);
 async function runHarnessTier2(args2) {
-  const { buildTier2Harness, extractCorpus } = await import("./dist-FDKALV4R.js");
-  const repoAbs = resolve(args2.repo);
+  const { buildTier2Harness, extractCorpus } = await import("./dist-4YICS2J2.js");
+  const repoAbs = resolve2(args2.repo);
   if (!existsSync3(repoAbs)) {
     throw new Error(`Tier-2: repo path '${repoAbs}' does not exist.`);
   }
@@ -1315,8 +1384,8 @@ async function runHarnessTier2(args2) {
     );
   }
   const sanitizers = parseSanitizers(args2.sanitizers);
-  const outputDir = resolve(args2.outputDir ?? join(repoAbs, ".0sec-out", "tier2"));
-  const corpusDir = join(outputDir, "corpus");
+  const outputDir = resolve2(args2.outputDir ?? join2(repoAbs, ".0sec-out", "tier2"));
+  const corpusDir = join2(outputDir, "corpus");
   const functionName = args2.functionName ?? deriveDefaultFunctionName(repoAbs);
   const header = args2.header ?? `${functionName}.h`;
   console.log(
@@ -1391,7 +1460,7 @@ function deriveDefaultFunctionName(repoPath) {
 }
 
 // packages/cli/src/commands/review-harness-tier3.ts
-import { resolve as resolve2, join as join2, basename as basename2 } from "node:path";
+import { resolve as resolve3, join as join3, basename as basename2 } from "node:path";
 import { existsSync as existsSync4 } from "node:fs";
 var VALID_BUILD_SYSTEMS2 = /* @__PURE__ */ new Set(["autotools", "cmake", "meson", "auto"]);
 var VALID_SANITIZERS2 = /* @__PURE__ */ new Set(["asan", "ubsan", "msan"]);
@@ -1400,8 +1469,8 @@ async function runHarnessTier3(args2) {
     buildTier2Harness,
     extractCorpus,
     runTier3Validation
-  } = await import("./dist-FDKALV4R.js");
-  const repoAbs = resolve2(args2.repo);
+  } = await import("./dist-4YICS2J2.js");
+  const repoAbs = resolve3(args2.repo);
   if (!existsSync4(repoAbs)) {
     throw new Error(`Tier-3: repo path '${repoAbs}' does not exist.`);
   }
@@ -1411,8 +1480,8 @@ async function runHarnessTier3(args2) {
     );
   }
   const sanitizers = parseSanitizers2(args2.sanitizers);
-  const outputDir = resolve2(args2.outputDir ?? join2(repoAbs, ".0sec-out", "tier3"));
-  const corpusDir = join2(outputDir, "corpus");
+  const outputDir = resolve3(args2.outputDir ?? join3(repoAbs, ".0sec-out", "tier3"));
+  const corpusDir = join3(outputDir, "corpus");
   const functionName = args2.functionName ?? deriveDefaultFunctionName2(repoAbs);
   const header = args2.header ?? `${functionName}.h`;
   console.log(
@@ -1620,7 +1689,7 @@ function registerReviewCommand(program) {
     let seedFindings;
     const seedPath = opts.seedFindings;
     if (seedPath) {
-      const { readSeedFindings } = await import("./dist-FDKALV4R.js");
+      const { readSeedFindings } = await import("./dist-4YICS2J2.js");
       seedFindings = readSeedFindings(seedPath);
       console.log(
         source_default.cyan(
@@ -1636,7 +1705,7 @@ function registerReviewCommand(program) {
       );
     }
     if (fixCommit) {
-      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-FDKALV4R.js");
+      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-4YICS2J2.js");
       const result = huntAppFixVariants({
         repoPath: repo,
         fixCommit
@@ -1764,7 +1833,7 @@ function registerReviewCommand(program) {
 
 // packages/cli/src/commands/fix.ts
 import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
-import { dirname, resolve as resolve3 } from "node:path";
+import { dirname, resolve as resolve4 } from "node:path";
 var FIX_RUNTIMES = {
   api: true
 };
@@ -1781,7 +1850,7 @@ function isNativeRuntime(runtime) {
 async function loadFinding(path) {
   let raw;
   try {
-    raw = JSON.parse(await readFile2(resolve3(path), "utf8"));
+    raw = JSON.parse(await readFile2(resolve4(path), "utf8"));
   } catch (error) {
     throw new Error(`failed to read finding JSON: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -1797,7 +1866,7 @@ async function loadFinding(path) {
 async function loadVerificationResult(path) {
   let raw;
   try {
-    raw = JSON.parse(await readFile2(resolve3(path), "utf8"));
+    raw = JSON.parse(await readFile2(resolve4(path), "utf8"));
   } catch (error) {
     throw new Error(`failed to read verification result JSON: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -1841,7 +1910,7 @@ function createFixRuntime(type, opts) {
   return runtime;
 }
 async function writePatch(path, patch) {
-  const resolved = resolve3(path);
+  const resolved = resolve4(path);
   await mkdir(dirname(resolved), { recursive: true });
   await writeFile(resolved, `${patch}
 `, "utf8");
@@ -1879,7 +1948,7 @@ function registerFixCommand(program) {
       throw new Error(`runtime '${runtimeType}' is not available`);
     }
     const result = await runSourceFix({
-      repoRoot: resolve3(repo),
+      repoRoot: resolve4(repo),
       finding,
       runtime,
       testCommand: opts.testCommand,
@@ -1896,6 +1965,139 @@ function registerFixCommand(program) {
   });
 }
 
+// packages/cli/src/commands/connect.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync5, mkdtempSync, readFileSync as readFileSync2, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join4 } from "node:path";
+function detectTestCommand(repoUrl) {
+  const dir = mkdtempSync(join4(tmpdir(), "0sec-connect-"));
+  try {
+    execFileSync("git", ["clone", "--depth", "1", "--quiet", repoUrl, dir], {
+      timeout: 12e4,
+      stdio: "pipe"
+    });
+    if (existsSync5(join4(dir, "package.json"))) {
+      const pkg = JSON.parse(readFileSync2(join4(dir, "package.json"), "utf8"));
+      const test = pkg.scripts?.test;
+      if (test && !test.includes("no test specified")) {
+        const runner = pkg.packageManager?.startsWith("pnpm") ? "pnpm" : pkg.packageManager?.startsWith("yarn") ? "yarn" : existsSync5(join4(dir, "pnpm-lock.yaml")) ? "pnpm" : existsSync5(join4(dir, "yarn.lock")) ? "yarn" : "npm";
+        return { command: runner === "npm" ? "npm test" : `${runner} test`, source: "package.json" };
+      }
+    }
+    if (existsSync5(join4(dir, "Makefile"))) {
+      const make = readFileSync2(join4(dir, "Makefile"), "utf8");
+      if (/^test:/m.test(make)) return { command: "make test", source: "Makefile" };
+    }
+    if (existsSync5(join4(dir, "pyproject.toml")) || existsSync5(join4(dir, "pytest.ini")) || existsSync5(join4(dir, "tox.ini"))) {
+      return { command: "python3 -m pytest", source: "python project files" };
+    }
+    if (existsSync5(join4(dir, "Cargo.toml"))) return { command: "cargo test", source: "Cargo.toml" };
+    if (existsSync5(join4(dir, "go.mod"))) return { command: "go test ./...", source: "go.mod" };
+    return null;
+  } catch {
+    return null;
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+function registerConnectCommand(program) {
+  program.command("connect").description("Connect a repository: 0sec starts securing it now and keeps it secure on a schedule").argument("<repo>", "HTTPS git URL of the repository you own or are authorized to assess").option("--test-command <command>", "Regression command; auto-detected from the repo when omitted").option("--setup-command <command>", "Setup/build command run before tests (e.g. pnpm install)").option("-m, --model <model>", "Model for the managed runs; defaults to the cloud routing default").option("--cost-ceiling <usd>", "Per-run model cost ceiling in USD", (v) => {
+    const n = Number(v);
+    if (!Number.isFinite(n) || n <= 0) throw new InvalidArgumentError("Must be a positive dollar amount.");
+    return n;
+  }).option("--cron <expression>", "Recurring schedule (cron). Default: daily at 03:00 UTC", "0 3 * * *").option("--no-schedule", "Only run once, do not install a recurring schedule").action(async (repo, options) => {
+    if (!/^https:\/\/[^\s]+\.git$|^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/?$/.test(repo)) {
+      throw new InvalidArgumentError("repo must be an HTTPS git URL (e.g. https://github.com/org/repo)");
+    }
+    let creds;
+    try {
+      creds = loadCloudCredentials();
+    } catch (error) {
+      if (error instanceof CloudAuthMissingError) {
+        process.stderr.write(
+          `${source_default.red("Not authenticated.")} Run ${source_default.bold("0sec auth login")} first, then connect again.
+`
+        );
+        process.exitCode = 2;
+        return;
+      }
+      throw error;
+    }
+    const client = new CloudClient({ host: creds.host, token: creds.token });
+    try {
+      await client.pingHealth();
+    } catch (error) {
+      if (error instanceof CloudUnauthorizedError) {
+        process.stderr.write(`${source_default.red("Cloud token rejected.")} Run ${source_default.bold("0sec auth login")} again.
+`);
+        process.exitCode = 2;
+        return;
+      }
+      throw error;
+    }
+    let testCommand = options.testCommand;
+    if (!testCommand) {
+      process.stderr.write("Detecting test command\u2026\n");
+      const detected = detectTestCommand(repo);
+      if (!detected) {
+        process.stderr.write(
+          `${source_default.red("Could not detect a test command.")} Pass ${source_default.bold("--test-command")} explicitly (e.g. --test-command "npm test").
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      testCommand = detected.command;
+      process.stderr.write(`Detected ${source_default.bold(testCommand)} (from ${detected.source}).
+`);
+    }
+    const secureConfig = {
+      repo,
+      test_command: testCommand,
+      ...options.setupCommand ? { setup_command: options.setupCommand } : {},
+      ...options.model ? { model: options.model } : {},
+      ...options.costCeiling ? { cost_ceiling_usd: options.costCeiling } : {}
+    };
+    process.stderr.write("Starting the first secure run\u2026\n");
+    const scan2 = await client.postJson("/api/scans", {
+      target: repo,
+      scan_mode: "secure",
+      secure_config: secureConfig
+    });
+    let schedule = null;
+    if (options.schedule) {
+      if (!scan2.target_id) {
+        process.stderr.write(source_default.yellow("Scan created without a target id \u2014 skipping schedule.\n"));
+      } else {
+        schedule = await client.postJson(
+          "/api/scan-schedules",
+          {
+            target_id: scan2.target_id,
+            cron_expression: options.cron,
+            scan_mode: "secure",
+            secure_config: secureConfig
+          }
+        );
+      }
+    }
+    const scanUrl = `${creds.host}/cloud/scans/${scan2.id}`;
+    process.stdout.write(
+      [
+        "",
+        source_default.green.bold("Connected."),
+        `  Repository:   ${repo}`,
+        `  Test command: ${testCommand}`,
+        `  First run:    ${scanUrl}`,
+        schedule ? `  Schedule:     ${options.cron} (next: ${schedule.next_run_at ?? "pending"})` : "  Schedule:     none (one-shot run)",
+        "",
+        "0sec will investigate, reproduce, repair, and verify. Verified patches and evidence are retained on the scan for your review.",
+        ""
+      ].join("\n")
+    );
+  });
+}
+
 // packages/cli/src/commands/audit.ts
 var SUPPORTED_AUDIT_ECOSYSTEMS = /* @__PURE__ */ new Set(["npm", "pypi", "cargo", "oci"]);
 function registerAuditCommand(program) {
@@ -1942,7 +2144,7 @@ function registerDoctorCommand(program) {
   program.command("doctor").description("Check local runtime prerequisites and suggest the next command").action(async () => {
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-J7PLXZNM.js");
     if (isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiDoctor } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiDoctor } = await import("./run-D56MPDKY.js");
       await showOpenTuiDoctor();
       return;
     }
@@ -1979,11 +2181,11 @@ function registerDoctorCommand(program) {
 import { createServer } from "node:http";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
-import { existsSync as existsSync5, mkdirSync, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { dirname as dirname2, extname, join as join3, resolve as resolve4, sep } from "node:path";
+import { existsSync as existsSync6, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync } from "node:fs";
+import { dirname as dirname2, extname, join as join5, resolve as resolve5, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { URL as URL2 } from "node:url";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 import { isIP } from "node:net";
 
 // packages/cli/src/desktop/console-gateway.ts
@@ -2478,7 +2680,7 @@ function sendFile(res, filePath, controlToken) {
     "Content-Type": contentType,
     "Cache-Control": ext === ".html" ? "no-store" : "public, max-age=300"
   });
-  let content = readFileSync2(filePath);
+  let content = readFileSync3(filePath);
   if (controlToken && ext === ".html") {
     content = content.toString().replace(
       "</head>",
@@ -2488,7 +2690,7 @@ function sendFile(res, filePath, controlToken) {
   res.end(content);
 }
 function readJson(req) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve27, reject) => {
     let data = "";
     req.on("data", (chunk) => {
       data += chunk;
@@ -2498,7 +2700,7 @@ function readJson(req) {
     });
     req.on("end", () => {
       try {
-        resolve26(data ? JSON.parse(data) : {});
+        resolve27(data ? JSON.parse(data) : {});
       } catch (err) {
         reject(err);
       }
@@ -2964,7 +3166,7 @@ function parseControlPath(pathname) {
   };
 }
 function resolveCliEntrypoint() {
-  return resolve4(process.argv[1] ?? join3(process.cwd(), "dist", "index.js"));
+  return resolve5(process.argv[1] ?? join5(process.cwd(), "dist", "index.js"));
 }
 function startManagedDaemon(args2) {
   if (managedDaemon?.child.exitCode === null && !managedDaemon.child.killed) {
@@ -3086,41 +3288,41 @@ function groupByKey(rows, key) {
 }
 function materializeEmbeddedDashboardAssets(assets) {
   if (assets.length === 0) return null;
-  const assetDir = mkdtempSync(join3(tmpdir(), "0sec-dashboard-"));
+  const assetDir = mkdtempSync2(join5(tmpdir2(), "0sec-dashboard-"));
   try {
     for (const [relativePath, contentBase64] of assets) {
-      const candidate = resolve4(assetDir, `.${relativePath.replaceAll("\\", "/")}`);
+      const candidate = resolve5(assetDir, `.${relativePath.replaceAll("\\", "/")}`);
       if (candidate === assetDir || !candidate.startsWith(`${assetDir}${sep}`)) {
         throw new Error(`Invalid embedded dashboard asset path: ${JSON.stringify(relativePath)}`);
       }
       mkdirSync(dirname2(candidate), { recursive: true, mode: 448 });
       writeFileSync(candidate, Buffer.from(contentBase64, "base64"), { mode: 384 });
     }
-    if (!existsSync5(join3(assetDir, "index.html"))) {
+    if (!existsSync6(join5(assetDir, "index.html"))) {
       throw new Error("Embedded dashboard assets do not contain index.html.");
     }
   } catch (error) {
-    rmSync(assetDir, { recursive: true, force: true });
+    rmSync2(assetDir, { recursive: true, force: true });
     throw error;
   }
   return {
     path: assetDir,
-    cleanup: () => rmSync(assetDir, { recursive: true, force: true })
+    cleanup: () => rmSync2(assetDir, { recursive: true, force: true })
   };
 }
 function resolveDashboardAssetDir(explicitAssetDir) {
-  const moduleDir = resolve4(fileURLToPath(new URL2(".", import.meta.url)));
+  const moduleDir = resolve5(fileURLToPath(new URL2(".", import.meta.url)));
   const candidates = [
-    ...explicitAssetDir ? [resolve4(explicitAssetDir)] : [],
-    join3(moduleDir, "dashboard"),
-    join3(moduleDir, "..", "dashboard"),
+    ...explicitAssetDir ? [resolve5(explicitAssetDir)] : [],
+    join5(moduleDir, "dashboard"),
+    join5(moduleDir, "..", "dashboard"),
     // A source checkout must serve the freshly built workspace dashboard,
     // not an unrelated stale root bundle left by an earlier packaging run.
-    join3(process.cwd(), "packages", "dashboard", "dist"),
-    join3(process.cwd(), "dist", "dashboard")
+    join5(process.cwd(), "packages", "dashboard", "dist"),
+    join5(process.cwd(), "dist", "dashboard")
   ];
   for (const candidate of candidates) {
-    if (existsSync5(join3(candidate, "index.html"))) {
+    if (existsSync6(join5(candidate, "index.html"))) {
       return { path: candidate };
     }
   }
@@ -3130,10 +3332,10 @@ function resolveDashboardAssetDir(explicitAssetDir) {
 }
 function resolveAssetPath(assetDir, pathname) {
   const trimmed = pathname === "/" ? "/index.html" : pathname;
-  const assetRoot = resolve4(assetDir);
-  const candidate = resolve4(assetRoot, `.${trimmed}`);
+  const assetRoot = resolve5(assetDir);
+  const candidate = resolve5(assetRoot, `.${trimmed}`);
   if (candidate !== assetRoot && !candidate.startsWith(`${assetRoot}${sep}`)) return null;
-  if (!existsSync5(candidate)) return null;
+  if (!existsSync6(candidate)) return null;
   return candidate;
 }
 function requireControlToken(req, res, controlToken) {
@@ -3269,7 +3471,7 @@ data: ${JSON.stringify(event)}
 `);
 }
 async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
-  const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+  const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
   if (isPresentationEventsStreamPath(pathname)) {
     if (req.method !== "GET") {
       json(res, 405, { error: "Method not allowed" });
@@ -3323,7 +3525,7 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
       return true;
     }
     if (controlPath.action === "recover-stale-workers") {
-      const { recoverStaleWorkers } = await import("./orchestrate-ZUWAUWBC.js");
+      const { recoverStaleWorkers } = await import("./orchestrate-OC2VZN2X.js");
       const body = await readJson(req);
       const recovered = recoverStaleWorkers(
         dbPath,
@@ -3407,8 +3609,8 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
       return true;
     }
     if (controlPath.action === "reset-database") {
-      const { resetOsecDatabase } = await import("./dist-GL66KMUX.js");
-      const { seedVerificationWorkbench } = await import("./db-26NGQFKO.js");
+      const { resetOsecDatabase } = await import("./dist-4MAW5X6L.js");
+      const { seedVerificationWorkbench } = await import("./db-KFWOAUUB.js");
       const body = await readJson(req);
       const seed = typeof body.seed === "string" ? body.seed.trim().toLowerCase() : "verification";
       if (!["verification", "empty"].includes(seed)) {
@@ -3708,7 +3910,7 @@ function registerDashboardCommand(program) {
           json(res, 404, { error: "Asset not found" });
           return;
         }
-        sendFile(res, join3(assetDir, "index.html"), controlToken);
+        sendFile(res, join5(assetDir, "index.html"), controlToken);
       } catch (err) {
         json(res, 500, { error: err instanceof Error ? err.message : String(err) });
       }
@@ -3753,7 +3955,7 @@ function registerTuiCommand(program) {
   program.command("tui").alias("watch").description("Open the unified engagement control plane (Bun-only)").action(async () => {
     const { isBunRuntime: isBunRuntime2 } = await import("./runtime-J7PLXZNM.js");
     if (isBunRuntime2()) {
-      const { showOpenTuiHome } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiHome } = await import("./run-D56MPDKY.js");
       await showOpenTuiHome();
       return;
     }
@@ -4662,7 +4864,7 @@ var McpServer = class {
     let task = createTaskResult.task;
     const pollInterval = task.pollInterval ?? 5e3;
     while (task.status !== "completed" && task.status !== "failed" && task.status !== "cancelled") {
-      await new Promise((resolve26) => setTimeout(resolve26, pollInterval));
+      await new Promise((resolve27) => setTimeout(resolve27, pollInterval));
       const updatedTask = await extra.taskStore.getTask(taskId);
       if (!updatedTask) {
         throw new McpError(ErrorCode.InternalError, `Task ${taskId} not found during polling`);
@@ -5287,12 +5489,12 @@ var StdioServerTransport = class {
     this.onclose?.();
   }
   send(message) {
-    return new Promise((resolve26) => {
+    return new Promise((resolve27) => {
       const json2 = serializeMessage(message);
       if (this._stdout.write(json2)) {
-        resolve26();
+        resolve27();
       } else {
-        this._stdout.once("drain", resolve26);
+        this._stdout.once("drain", resolve27);
       }
     });
   }
@@ -5406,9 +5608,9 @@ function toolResultToMcp(result) {
   return toTextResult(text2, { success: true, output: result.output });
 }
 function withToolTimeout(task, timeoutMs) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve27) => {
     const timer = setTimeout(() => {
-      resolve26({
+      resolve27({
         success: false,
         output: null,
         error: `MCP tool timed out after ${timeoutMs}ms`
@@ -5417,11 +5619,11 @@ function withToolTimeout(task, timeoutMs) {
     task.then(
       (result) => {
         clearTimeout(timer);
-        resolve26(result);
+        resolve27(result);
       },
       (error) => {
         clearTimeout(timer);
-        resolve26({
+        resolve27({
           success: false,
           output: null,
           error: error instanceof Error ? error.message : String(error)
@@ -5609,11 +5811,11 @@ function rowToFinding(row) {
   };
 }
 async function openStore(dbPath) {
-  const { MemoryStore } = await import("./dist-FDKALV4R.js");
+  const { MemoryStore } = await import("./dist-4YICS2J2.js");
   return new MemoryStore(dbPath);
 }
 async function loadFinding2(dbPath, findingId) {
-  const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+  const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
   const db = new osecDB2(dbPath);
   try {
     const rows = db.listFindings({ limit: 5e3 });
@@ -5688,7 +5890,7 @@ async function runMemoryRemove(id, dbPath) {
 async function runMarkFp(findingId, opts) {
   const row = await loadFinding2(opts.dbPath, findingId);
   const finding = rowToFinding(row);
-  const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+  const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
   const db = new osecDB2(opts.dbPath);
   try {
     db.updateFindingTriage(row.id, "suppressed", opts.reason);
@@ -5748,11 +5950,11 @@ function registerTriageCommand(program) {
 }
 
 // packages/cli/src/commands/eval.ts
-import { readFileSync as readFileSync3, existsSync as existsSync6 } from "node:fs";
+import { readFileSync as readFileSync4, existsSync as existsSync7 } from "node:fs";
 function parseAuthFlag2(value) {
   let raw;
-  if (!value.trimStart().startsWith("{") && existsSync6(value)) {
-    raw = readFileSync3(value, "utf-8");
+  if (!value.trimStart().startsWith("{") && existsSync7(value)) {
+    raw = readFileSync4(value, "utf-8");
   } else {
     raw = value;
   }
@@ -5903,8 +6105,8 @@ function registerEvalCommand(program) {
 }
 
 // packages/cli/src/commands/bench.ts
-import { readFileSync as readFileSync8, existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
-import { resolve as resolve9, join as join8 } from "node:path";
+import { readFileSync as readFileSync9, existsSync as existsSync12, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "node:fs";
+import { resolve as resolve10, join as join10 } from "node:path";
 import { performance } from "node:perf_hooks";
 
 // packages/benchmark/dist/bench-integrations/xbow.js
@@ -5912,11 +6114,11 @@ import { randomBytes as randomBytes2 } from "node:crypto";
 
 // packages/benchmark/dist/xbow-runner.js
 import { execSync, spawnSync } from "node:child_process";
-import { readFileSync as readFileSync4, existsSync as existsSync7, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readdirSync } from "node:fs";
-import { join as join4, dirname as dirname3, resolve as resolve5 } from "node:path";
+import { readFileSync as readFileSync5, existsSync as existsSync8, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, readdirSync } from "node:fs";
+import { join as join6, dirname as dirname3, resolve as resolve6 } from "node:path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
 import { randomBytes } from "node:crypto";
-import { tmpdir as tmpdir2 } from "node:os";
+import { tmpdir as tmpdir3 } from "node:os";
 
 // packages/benchmark/dist/wilson.js
 var Z_95 = 1.959963984540054;
@@ -6067,13 +6269,13 @@ function normalizeBenchmarkRepo(repo) {
 }
 function cacheDirForRepo(repo) {
   const slug = repo.replace(/^https?:\/\//, "").replace(/^git@/, "").replace(/\.git$/, "").replace(/[^\w.-]+/g, "_");
-  return join4(tmpdir2(), `0sec-xbow-cache`, slug);
+  return join6(tmpdir3(), `0sec-xbow-cache`, slug);
 }
 function ensureBenchmarkRepo(repo, ref) {
   const url = normalizeBenchmarkRepo(repo);
   const dest = cacheDirForRepo(url);
-  const benchDir = join4(dest, "benchmarks");
-  if (existsSync7(benchDir)) {
+  const benchDir = join6(dest, "benchmarks");
+  if (existsSync8(benchDir)) {
     if (!jsonOutput) {
       console.log(`  using cached benchmark repo at ${dest}`);
     }
@@ -6124,20 +6326,20 @@ function chooseBetterResult(a, b) {
   return b.durationMs < a.durationMs ? b : a;
 }
 function loadXbowChallenges(xbowPath = XBOW_PATH) {
-  const benchDir = join4(xbowPath, "benchmarks");
-  if (!existsSync7(benchDir)) {
+  const benchDir = join6(xbowPath, "benchmarks");
+  if (!existsSync8(benchDir)) {
     throw new Error(`XBOW benchmarks not found at ${benchDir}. Clone them or pass --benchmark-path / XBOW_PATH.`);
   }
   const dirs = readdirSync(benchDir).filter((d) => d.startsWith("XBEN-")).sort();
   const challenges = [];
   for (const dir of dirs) {
-    const configPath = join4(benchDir, dir, "benchmark.json");
-    const yamlPath = join4(benchDir, dir, "benchmark.yaml");
+    const configPath = join6(benchDir, dir, "benchmark.json");
+    const yamlPath = join6(benchDir, dir, "benchmark.yaml");
     let config;
-    if (existsSync7(configPath)) {
-      config = JSON.parse(readFileSync4(configPath, "utf8"));
-    } else if (existsSync7(yamlPath)) {
-      const yaml = readFileSync4(yamlPath, "utf8");
+    if (existsSync8(configPath)) {
+      config = JSON.parse(readFileSync5(configPath, "utf8"));
+    } else if (existsSync8(yamlPath)) {
+      const yaml = readFileSync5(yamlPath, "utf8");
       config = {
         name: yaml.match(/name:\s*(.+)/)?.[1]?.trim() ?? dir,
         description: yaml.match(/content:\s*(.+)/)?.[1]?.trim() ?? "",
@@ -6155,7 +6357,7 @@ function loadXbowChallenges(xbowPath = XBOW_PATH) {
       level: parseInt(config.level ?? "2"),
       tags: config.tags ?? [],
       winCondition: config.win_condition ?? "flag",
-      path: join4(benchDir, dir)
+      path: join6(benchDir, dir)
     });
   }
   return challenges;
@@ -6257,7 +6459,7 @@ async function runChallengeOnce(challenge, model) {
     });
     try {
       if (useAgentic) {
-        const dbPath = join4(tmpdir2(), `0sec-xbow-${challenge.id}-${Date.now()}.db`);
+        const dbPath = join6(tmpdir3(), `0sec-xbow-${challenge.id}-${Date.now()}.db`);
         const hint = challenge.description ? `
 Challenge hint: ${challenge.description}` : "";
         const repoPath = whiteBox ? challenge.path : void 0;
@@ -6322,7 +6524,7 @@ Challenge hint: ${challenge.description}` : "";
     }
     if (report.trace && Array.isArray(report.trace) && report.trace.length > 0) {
       try {
-        const tracesDir = join4(__dirname, "..", "results", "traces");
+        const tracesDir = join6(__dirname, "..", "results", "traces");
         mkdirSync2(tracesDir, { recursive: true });
         const tracePayload = {
           challengeId: challenge.id,
@@ -6331,7 +6533,7 @@ Challenge hint: ${challenge.description}` : "";
           turns: report.benchmarkMeta?.attackTurns ?? 0,
           messages: sanitizeTrace(report.trace)
         };
-        writeFileSync2(join4(tracesDir, `${challenge.id}-trace.json`), JSON.stringify(tracePayload, null, 2));
+        writeFileSync2(join6(tracesDir, `${challenge.id}-trace.json`), JSON.stringify(tracePayload, null, 2));
       } catch (traceErr) {
         if (!jsonOutput) {
           console.log(`  [trace] failed to write trace for ${challenge.id}: ${traceErr instanceof Error ? traceErr.message : String(traceErr)}`);
@@ -6594,12 +6796,12 @@ async function main() {
     }
     console.log("");
   }
-  const resultsDir = join4(__dirname, "..", "results");
+  const resultsDir = join6(__dirname, "..", "results");
   mkdirSync2(resultsDir, { recursive: true });
-  const latestPath = join4(resultsDir, "xbow-latest.json");
-  if (!freshRun && existsSync7(latestPath)) {
+  const latestPath = join6(resultsDir, "xbow-latest.json");
+  if (!freshRun && existsSync8(latestPath)) {
     try {
-      const existing = JSON.parse(readFileSync4(latestPath, "utf8"));
+      const existing = JSON.parse(readFileSync5(latestPath, "utf8"));
       const existingById = new Map(existing.results.map((r) => [r.id, r]));
       for (const r of report.results) {
         existingById.set(r.id, r);
@@ -6645,7 +6847,7 @@ function isXbowRunnerEntrypoint(moduleUrl, argvPath = process.argv[1]) {
   if (!argvPath || !/(?:^|[/\\])xbow-runner\.(?:[cm]?[jt]s)$/.test(argvPath)) {
     return false;
   }
-  return moduleUrl === pathToFileURL(resolve5(argvPath)).href;
+  return moduleUrl === pathToFileURL(resolve6(argvPath)).href;
 }
 if (isXbowRunnerEntrypoint(import.meta.url))
   main().then(() => {
@@ -6745,35 +6947,35 @@ function createXbowBenchIntegration(opts = {}) {
 }
 
 // packages/benchmark/dist/bench-integrations/cybergym.js
-import { createHash as createHash2 } from "node:crypto";
-import { readFileSync as readFileSync6 } from "node:fs";
+import { createHash as createHash3 } from "node:crypto";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // packages/benchmark/dist/cybergym-runner.js
-import { execFileSync } from "node:child_process";
-import { readFileSync as readFileSync5, existsSync as existsSync8, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
-import { join as join5, dirname as dirname4, isAbsolute, resolve as resolve6 } from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { readFileSync as readFileSync6, existsSync as existsSync9, writeFileSync as writeFileSync3, appendFileSync, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync3, rmSync as rmSync3 } from "node:fs";
+import { join as join7, dirname as dirname4, isAbsolute, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL as pathToFileURL2 } from "node:url";
-import { createHash } from "node:crypto";
-import { tmpdir as tmpdir3 } from "node:os";
+import { createHash as createHash2 } from "node:crypto";
+import { tmpdir as tmpdir4 } from "node:os";
 var __dirname2 = dirname4(fileURLToPath3(import.meta.url));
 var CYBERGYM_CORPUS_PATH = "results/cybergym-v1.jsonl";
-function resolveCorpusPath(override, packageRoot = join5(__dirname2, "..")) {
+function resolveCorpusPath(override, packageRoot = join7(__dirname2, "..")) {
   const requested = override ?? process.env.CYBERGYM_CORPUS_PATH;
   if (requested && requested.length > 0) {
-    return isAbsolute(requested) ? requested : join5(process.cwd(), requested);
+    return isAbsolute(requested) ? requested : join7(process.cwd(), requested);
   }
-  return join5(packageRoot, CYBERGYM_CORPUS_PATH);
+  return join7(packageRoot, CYBERGYM_CORPUS_PATH);
 }
 function parseTaskDir(taskDir, taskId, difficulty = "level1") {
-  if (!existsSync8(taskDir)) {
+  if (!existsSync9(taskDir)) {
     throw new Error(`CyberGym task dir not found: ${taskDir}`);
   }
-  const descPath = join5(taskDir, "description.txt");
-  if (!existsSync8(descPath)) {
+  const descPath = join7(taskDir, "description.txt");
+  if (!existsSync9(descPath)) {
     throw new Error(`CyberGym task dir missing description.txt: ${taskDir}`);
   }
-  const description = readFileSync5(descPath, "utf8");
+  const description = readFileSync6(descPath, "utf8");
   const repoRoot = locateOrUnpackRepo(taskDir);
   return {
     taskId: taskId ?? deriveTaskId(taskDir, description),
@@ -6784,15 +6986,15 @@ function parseTaskDir(taskDir, taskId, difficulty = "level1") {
   };
 }
 function locateOrUnpackRepo(taskDir) {
-  const unpacked = join5(taskDir, "repo-vul");
-  if (existsSync8(unpacked))
+  const unpacked = join7(taskDir, "repo-vul");
+  if (existsSync9(unpacked))
     return unpacked;
-  const tarball = join5(taskDir, "repo-vul.tar.gz");
-  if (!existsSync8(tarball)) {
+  const tarball = join7(taskDir, "repo-vul.tar.gz");
+  if (!existsSync9(tarball)) {
     throw new Error(`CyberGym task dir has neither repo-vul/ nor repo-vul.tar.gz: ${taskDir}`);
   }
   mkdirSync3(unpacked, { recursive: true });
-  execFileSync("tar", ["-xzf", tarball, "-C", unpacked], { stdio: "pipe" });
+  execFileSync2("tar", ["-xzf", tarball, "-C", unpacked], { stdio: "pipe" });
   return unpacked;
 }
 function deriveTaskId(taskDir, description) {
@@ -6807,24 +7009,24 @@ function cleanupOwnedTaskDir(taskDir) {
   if (!ownedTaskDirs.has(taskDir))
     return;
   try {
-    rmSync2(taskDir, { recursive: true, force: true });
+    rmSync3(taskDir, { recursive: true, force: true });
   } catch {
   }
   ownedTaskDirs.delete(taskDir);
 }
 function generateTask(taskId, difficulty, harnessDir) {
-  if (!existsSync8(harnessDir)) {
+  if (!existsSync9(harnessDir)) {
     throw new Error(`CyberGym harness dir not found: ${harnessDir}. Set --harness-dir or CYBERGYM_HARNESS to the sunblaze-ucb/cybergym checkout (needs #1027).`);
   }
-  const outDir = mkdtempSync2(join5(tmpdir3(), "cybergym-task-"));
+  const outDir = mkdtempSync3(join7(tmpdir4(), "cybergym-task-"));
   ownedTaskDirs.add(outDir);
-  const maskMap = process.env.CYBERGYM_MASK_MAP ?? join5(harnessDir, "mask_map.json");
-  const modernEntrypoint = join5(harnessDir, "src", "cybergym", "task", "gen_task.py");
+  const maskMap = process.env.CYBERGYM_MASK_MAP ?? join7(harnessDir, "mask_map.json");
+  const modernEntrypoint = join7(harnessDir, "src", "cybergym", "task", "gen_task.py");
   const python = process.env.CYBERGYM_PYTHON ?? "python3";
-  if (existsSync8(modernEntrypoint)) {
-    const dataDir = process.env.CYBERGYM_DATA_DIR ?? join5(dirname4(harnessDir), "data", "data");
+  if (existsSync9(modernEntrypoint)) {
+    const dataDir = process.env.CYBERGYM_DATA_DIR ?? join7(dirname4(harnessDir), "data", "data");
     const server = process.env.CYBERGYM_SERVER ?? "http://127.0.0.1:8666";
-    execFileSync(python, [
+    execFileSync2(python, [
       "-m",
       "cybergym.task.gen_task",
       "--task-id",
@@ -6837,18 +7039,18 @@ function generateTask(taskId, difficulty, harnessDir) {
       dataDir,
       "--server",
       server,
-      ...existsSync8(maskMap) ? ["--mask-map", maskMap] : []
+      ...existsSync9(maskMap) ? ["--mask-map", maskMap] : []
     ], { stdio: "pipe", cwd: harnessDir });
   } else {
-    execFileSync(python, [
-      join5(harnessDir, "gen_task.py"),
+    execFileSync2(python, [
+      join7(harnessDir, "gen_task.py"),
       "--task-id",
       taskId,
       "--difficulty",
       difficulty,
       "--out-dir",
       outDir,
-      ...existsSync8(maskMap) ? ["--mask-map", maskMap] : []
+      ...existsSync9(maskMap) ? ["--mask-map", maskMap] : []
     ], { stdio: "pipe", cwd: harnessDir });
   }
   return parseTaskDir(outDir, taskId, difficulty);
@@ -6875,14 +7077,14 @@ async function verifyThroughOracleBridge(bridge, capability, agentId, pocId, fet
   return JSON.stringify(record2);
 }
 var submitToOracle = async (task, pocPath) => {
-  const submitScript = join5(task.taskDir, "submit.sh");
-  if (!existsSync8(submitScript)) {
+  const submitScript = join7(task.taskDir, "submit.sh");
+  if (!existsSync9(submitScript)) {
     throw new Error(`CyberGym task missing submit.sh: ${task.taskDir}`);
   }
   const harnessDir = process.env.CYBERGYM_HARNESS ?? "/root/cybergym";
   const server = process.env.CYBERGYM_SERVER ?? "http://127.0.0.1:8666";
-  const pocdbPath = process.env.CYBERGYM_POCDB ?? join5(harnessDir, "server_poc", "poc.db");
-  const submitOut = execFileSync("bash", [submitScript, pocPath], {
+  const pocdbPath = process.env.CYBERGYM_POCDB ?? join7(harnessDir, "server_poc", "poc.db");
+  const submitOut = execFileSync2("bash", [submitScript, pocPath], {
     cwd: task.taskDir,
     encoding: "utf8",
     stdio: "pipe"
@@ -6899,8 +7101,8 @@ var submitToOracle = async (task, pocPath) => {
       }
       verifyOut = await verifyThroughOracleBridge(bridge, capability, agentId, submit.pocId);
     } else {
-      verifyOut = execFileSync("python3", [
-        join5(harnessDir, "scripts", "verify_agent_result.py"),
+      verifyOut = execFileSync2("python3", [
+        join7(harnessDir, "scripts", "verify_agent_result.py"),
         "--server",
         server,
         "--pocdb_path",
@@ -6918,13 +7120,13 @@ ${verifyOut}`.trim()
   };
 };
 var submitVulOnly = async (task, pocPath) => {
-  const submitScript = join5(task.taskDir, "submit.sh");
-  if (!existsSync8(submitScript)) {
+  const submitScript = join7(task.taskDir, "submit.sh");
+  if (!existsSync9(submitScript)) {
     throw new Error(`CyberGym task missing submit.sh: ${task.taskDir}`);
   }
   let submitOut;
   try {
-    submitOut = execFileSync("bash", [submitScript, pocPath], {
+    submitOut = execFileSync2("bash", [submitScript, pocPath], {
       cwd: task.taskDir,
       encoding: "utf8",
       stdio: "pipe"
@@ -6942,9 +7144,9 @@ var submitVulOnly = async (task, pocPath) => {
   return { ...submit, raw: submitOut.trim() };
 };
 function extractAgentId(submitScriptPath) {
-  if (!existsSync8(submitScriptPath))
+  if (!existsSync9(submitScriptPath))
     return void 0;
-  const src = readFileSync5(submitScriptPath, "utf8");
+  const src = readFileSync6(submitScriptPath, "utf8");
   return /["']agent_id["']\s*:\s*["']([0-9a-fA-F-]+)["']/.exec(src)?.[1];
 }
 function verdictFromPocRecords(out, pocId, vulExitFallback) {
@@ -6998,7 +7200,7 @@ function parseSubmitOutput(out) {
   };
 }
 var runEngineDefault = async (task, opts) => {
-  const dbPath = join5(tmpdir3(), `0sec-cybergym-${sanitizeId(task.taskId)}-${Date.now()}.db`);
+  const dbPath = join7(tmpdir4(), `0sec-cybergym-${sanitizeId(task.taskId)}-${Date.now()}.db`);
   const memory = process.env.CYBERGYM_MEMORY_DB ? new CraftMemoryStore(process.env.CYBERGYM_MEMORY_DB) : void 0;
   const cpgPath = process.env.CYBERGYM_CPG_PATH;
   const adversarialReviewModel = process.env.CYBERGYM_ADVERSARIAL_REVIEW_MODEL?.trim();
@@ -7144,14 +7346,14 @@ function extractPocPath(findings) {
   for (const f of findings) {
     const ev = f?.evidence;
     const req = ev?.request;
-    if (typeof req === "string" && req.length > 0 && req !== "N/A (userspace crash artifact)" && existsSync8(req)) {
+    if (typeof req === "string" && req.length > 0 && req !== "N/A (userspace crash artifact)" && existsSync9(req)) {
       return req;
     }
   }
   return void 0;
 }
 function detectLanguage(repoRoot) {
-  if (existsSync8(join5(repoRoot, "CMakeLists.txt")))
+  if (existsSync9(join7(repoRoot, "CMakeLists.txt")))
     return "cpp";
   return "c";
 }
@@ -7572,14 +7774,14 @@ function appendToCorpus(results, corpusPath) {
   const lines = results.map((r) => sampleToJsonl(resultToSample(r)));
   if (lines.length === 0)
     return;
-  if (existsSync8(corpusPath)) {
+  if (existsSync9(corpusPath)) {
     appendFileSync(corpusPath, lines.join("\n") + "\n");
   } else {
     writeFileSync3(corpusPath, lines.join("\n") + "\n");
   }
 }
 function sha256File(path) {
-  return createHash("sha256").update(readFileSync5(path)).digest("hex");
+  return createHash2("sha256").update(readFileSync6(path)).digest("hex");
 }
 function sanitizeId(id) {
   return id.replace(/[^\w.-]+/g, "_");
@@ -7675,7 +7877,7 @@ function resolveTasks(cfg) {
   }
   let taskIds = [];
   if (cfg.subset) {
-    taskIds = readFileSync5(cfg.subset, "utf8").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
+    taskIds = readFileSync6(cfg.subset, "utf8").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !l.startsWith("#"));
   } else if (cfg.taskId) {
     taskIds = [cfg.taskId];
   }
@@ -7764,7 +7966,7 @@ function isCyberGymRunnerEntrypoint(moduleUrl, argvPath = process.argv[1]) {
   if (!argvPath || !/(?:^|[/\\])cybergym-runner\.(?:[cm]?[jt]s)$/.test(argvPath)) {
     return false;
   }
-  return moduleUrl === pathToFileURL2(resolve6(argvPath)).href;
+  return moduleUrl === pathToFileURL2(resolve7(argvPath)).href;
 }
 if (isCyberGymRunnerEntrypoint(import.meta.url)) {
   main2().then(() => process.exit(0)).catch((err) => {
@@ -7781,10 +7983,10 @@ var CYBERGYM_ORACLE_CONFIG = {
   version: 1
 };
 function sha256(bytes) {
-  return `sha256:${createHash2("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash3("sha256").update(bytes).digest("hex")}`;
 }
 function cyberGymBenchOracleEvaluatorAttestation() {
-  const codeDigest = sha256(readFileSync6(fileURLToPath4(import.meta.url)));
+  const codeDigest = sha256(readFileSync7(fileURLToPath4(import.meta.url)));
   const configDigest = sha256(Buffer.from(`${JSON.stringify(CYBERGYM_ORACLE_CONFIG)}
 `));
   const bundleDigest = sha256(Buffer.from(`${JSON.stringify({ schemaVersion: 1, codeDigest, configDigest })}
@@ -7813,7 +8015,7 @@ function createCyberGymManifest(taskIds, opts = {}) {
   });
 }
 function loadCyberGymTaskIds(subsetPath) {
-  const taskIds = readFileSync6(subsetPath, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+  const taskIds = readFileSync7(subsetPath, "utf8").split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
   const seen = /* @__PURE__ */ new Set();
   for (const taskId of taskIds) {
     if (seen.has(taskId))
@@ -7952,20 +8154,20 @@ function createCyberGymBenchIntegration(opts = {}) {
 import {
   closeSync,
   constants,
-  existsSync as existsSync9,
+  existsSync as existsSync10,
   fstatSync,
   fsyncSync,
   linkSync,
   lstatSync,
   mkdirSync as mkdirSync4,
   openSync,
-  readFileSync as readFileSync7,
-  rmSync as rmSync3,
+  readFileSync as readFileSync8,
+  rmSync as rmSync4,
   unlinkSync,
   writeSync
 } from "node:fs";
-import { createHash as createHash3, randomUUID as randomUUID3 } from "node:crypto";
-import { basename as basename3, dirname as dirname5, join as join6, resolve as resolve7 } from "node:path";
+import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
+import { basename as basename3, dirname as dirname5, join as join8, resolve as resolve8 } from "node:path";
 var REQUIRED_0SEC_CHECKS = [
   "build",
   "ecosystem-audit-smoke (cargo)",
@@ -7997,7 +8199,7 @@ function digest(value, label) {
   }
   return result;
 }
-function positiveInteger(value, label) {
+function positiveInteger2(value, label) {
   if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
     throw new Error(`${label} must be a positive integer`);
   }
@@ -8037,7 +8239,7 @@ function stringArray(value, label) {
   return strings;
 }
 function readArtifactBytes(pathValue, label) {
-  const path = resolve7(pathValue);
+  const path = resolve8(pathValue);
   const stat3 = lstatSync(path);
   if (!stat3.isFile() || stat3.isSymbolicLink()) {
     throw new Error(`${label} must be a regular non-symlink file`);
@@ -8050,7 +8252,7 @@ function readArtifactBytes(pathValue, label) {
     if (stat3.dev !== before.dev || stat3.ino !== before.ino || stat3.size !== before.size || stat3.mtimeMs !== before.mtimeMs) {
       throw new Error(`${label} changed before it was opened`);
     }
-    const content = readFileSync7(fd);
+    const content = readFileSync8(fd);
     const after = fstatSync(fd);
     if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
       throw new Error(`${label} changed while it was being read`);
@@ -8061,7 +8263,7 @@ function readArtifactBytes(pathValue, label) {
   }
 }
 function sha256Bytes(content) {
-  return `sha256:${createHash3("sha256").update(content).digest("hex")}`;
+  return `sha256:${createHash4("sha256").update(content).digest("hex")}`;
 }
 function readArtifactJsonWithDigest(pathValue, label) {
   const content = readArtifactBytes(pathValue, label);
@@ -8101,9 +8303,9 @@ function parseCandidateMetadata(value) {
     calibrationEmptyFindings: change?.kind === "feature_flag" && knobs?.["calibration.empty_findings"] === true,
     change: { kind: text(change.kind, "candidate.change.kind"), knobs: parsedKnobs },
     budget: {
-      maxRuns: positiveInteger(budget.maxRuns, "candidate.budget.maxRuns"),
+      maxRuns: positiveInteger2(budget.maxRuns, "candidate.budget.maxRuns"),
       maxUsd: finiteNonNegative(budget.maxUsd, "candidate.budget.maxUsd"),
-      maxWallClockMinutes: positiveInteger(
+      maxWallClockMinutes: positiveInteger2(
         budget.maxWallClockMinutes,
         "candidate.budget.maxWallClockMinutes"
       )
@@ -8205,7 +8407,7 @@ function caseResult(value, manifestCase, label, configuredPassAtK, configuredAtt
   if (!Array.isArray(raw.tags) || JSON.stringify(raw.tags) !== JSON.stringify(manifestCase.tags)) {
     throw new Error(`${label}.tags do not match its manifest case`);
   }
-  const passAtK = positiveInteger(raw.passAtK, `${label}.passAtK`);
+  const passAtK = positiveInteger2(raw.passAtK, `${label}.passAtK`);
   if (passAtK !== (manifestCase.passAtK ?? configuredPassAtK)) {
     throw new Error(`${label}.passAtK does not match its manifest or tournament config`);
   }
@@ -8280,12 +8482,12 @@ function validateScorecard(value, manifest, label) {
   }
   const totals = record(raw.totals, `${label}.totals`);
   const config = record(raw.config, `${label}.config`);
-  positiveInteger(config.passAtK, `${label}.config.passAtK`);
+  positiveInteger2(config.passAtK, `${label}.config.passAtK`);
   const attemptPolicy = text(config.attemptPolicy, `${label}.config.attemptPolicy`);
   if (attemptPolicy !== "pass-at-k" && attemptPolicy !== "independent-repeat") {
     throw new Error(`${label}.config.attemptPolicy is invalid`);
   }
-  positiveInteger(config.maxTurns, `${label}.config.maxTurns`);
+  positiveInteger2(config.maxTurns, `${label}.config.maxTurns`);
   nullableCost(config.costCeilingUsd, `${label}.config.costCeilingUsd`);
   if (typeof config.ciSubset !== "boolean") throw new Error(`${label}.config.ciSubset must be boolean`);
   const cases = nonNegativeInteger(totals.cases, `${label}.totals.cases`);
@@ -8401,7 +8603,7 @@ function parseTournamentPair(value, label) {
     throw new Error(`${label} tournament manifest does not match its manifest`);
   }
   const config = record(tournamentRaw.config, `${label}.tournament.config`);
-  positiveInteger(config.passAtK, `${label}.tournament.config.passAtK`);
+  positiveInteger2(config.passAtK, `${label}.tournament.config.passAtK`);
   const attemptPolicy = text(
     config.attemptPolicy,
     `${label}.tournament.config.attemptPolicy`
@@ -8416,7 +8618,7 @@ function parseTournamentPair(value, label) {
   if (schedule !== "variant-major" && schedule !== "case-major") {
     throw new Error(`${label}.tournament.config.schedule is invalid`);
   }
-  positiveInteger(config.maxTurns, `${label}.tournament.config.maxTurns`);
+  positiveInteger2(config.maxTurns, `${label}.tournament.config.maxTurns`);
   nullableCost(config.costCeilingUsd, `${label}.tournament.config.costCeilingUsd`);
   if (typeof config.ciSubset !== "boolean") {
     throw new Error(`${label}.tournament.config.ciSubset must be boolean`);
@@ -8779,11 +8981,11 @@ function canonicalJson(value) {
 `;
 }
 function writeCanonicalJsonAtomic(outputValue, value) {
-  const output = resolve7(outputValue);
+  const output = resolve8(outputValue);
   const parent = dirname5(output);
   mkdirSync4(parent, { recursive: true });
-  if (existsSync9(output)) throw new Error(`output already exists: ${output}`);
-  const temporary = join6(parent, `.${basename3(output)}.${process.pid}.${randomUUID3()}.tmp`);
+  if (existsSync10(output)) throw new Error(`output already exists: ${output}`);
+  const temporary = join8(parent, `.${basename3(output)}.${process.pid}.${randomUUID3()}.tmp`);
   let fd;
   try {
     fd = openSync(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 384);
@@ -8795,52 +8997,52 @@ function writeCanonicalJsonAtomic(outputValue, value) {
       linkSync(temporary, output);
       unlinkSync(temporary);
     } catch (error) {
-      if (existsSync9(output)) throw new Error(`output already exists: ${output}`);
+      if (existsSync10(output)) throw new Error(`output already exists: ${output}`);
       throw error;
     }
   } finally {
     if (fd !== void 0) closeSync(fd);
-    if (existsSync9(temporary)) unlinkSync(temporary);
+    if (existsSync10(temporary)) unlinkSync(temporary);
   }
 }
 function writeImprovementBundleAtomic(outputDirectoryValue, bundle) {
-  const outputDirectory = resolve7(outputDirectoryValue);
+  const outputDirectory = resolve8(outputDirectoryValue);
   const parent = dirname5(outputDirectory);
   mkdirSync4(parent, { recursive: true });
   try {
     mkdirSync4(outputDirectory, { mode: 448 });
   } catch (error) {
-    if (existsSync9(outputDirectory)) throw new Error(`output already exists: ${outputDirectory}`);
+    if (existsSync10(outputDirectory)) throw new Error(`output already exists: ${outputDirectory}`);
     throw error;
   }
   try {
-    writeCanonicalJsonAtomic(join6(outputDirectory, "result.json"), bundle.result);
+    writeCanonicalJsonAtomic(join8(outputDirectory, "result.json"), bundle.result);
     writeCanonicalJsonAtomic(
-      join6(outputDirectory, "execution-evidence.json"),
+      join8(outputDirectory, "execution-evidence.json"),
       bundle.executionEvidence
     );
-    writeCanonicalJsonAtomic(join6(outputDirectory, "COMPLETE"), { schemaVersion: 1 });
+    writeCanonicalJsonAtomic(join8(outputDirectory, "COMPLETE"), { schemaVersion: 1 });
   } catch (error) {
-    rmSync3(outputDirectory, { recursive: true, force: true });
+    rmSync4(outputDirectory, { recursive: true, force: true });
     throw error;
   }
 }
 function writePromotionAssessmentBundleAtomic(outputDirectoryValue, bundle) {
-  const outputDirectory = resolve7(outputDirectoryValue);
+  const outputDirectory = resolve8(outputDirectoryValue);
   const parent = dirname5(outputDirectory);
   mkdirSync4(parent, { recursive: true });
   try {
     mkdirSync4(outputDirectory, { mode: 448 });
   } catch (error) {
-    if (existsSync9(outputDirectory)) throw new Error(`output already exists: ${outputDirectory}`);
+    if (existsSync10(outputDirectory)) throw new Error(`output already exists: ${outputDirectory}`);
     throw error;
   }
   try {
-    writeCanonicalJsonAtomic(join6(outputDirectory, "promotion-decision.json"), bundle.decision);
-    writeCanonicalJsonAtomic(join6(outputDirectory, "ledger.json"), bundle.ledger);
-    writeCanonicalJsonAtomic(join6(outputDirectory, "COMPLETE"), { schemaVersion: 1 });
+    writeCanonicalJsonAtomic(join8(outputDirectory, "promotion-decision.json"), bundle.decision);
+    writeCanonicalJsonAtomic(join8(outputDirectory, "ledger.json"), bundle.ledger);
+    writeCanonicalJsonAtomic(join8(outputDirectory, "COMPLETE"), { schemaVersion: 1 });
   } catch (error) {
-    rmSync3(outputDirectory, { recursive: true, force: true });
+    rmSync4(outputDirectory, { recursive: true, force: true });
     throw error;
   }
 }
@@ -8963,13 +9165,13 @@ function registerBenchImprovementCommand(bench) {
 }
 
 // packages/cli/src/commands/bench-calibration.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync5, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join7, resolve as resolve8 } from "node:path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync5, rmSync as rmSync5, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join9, resolve as resolve9 } from "node:path";
 var CALIBRATION_CHAMPION_ID2 = "calibration-champion";
 var CALIBRATION_CHALLENGER_ID2 = "calibration-challenger";
 function materializeObjectiveOracleEvaluator(outputDirectoryValue) {
-  const outputDirectory = resolve8(outputDirectoryValue);
-  if (existsSync10(outputDirectory)) {
+  const outputDirectory = resolve9(outputDirectoryValue);
+  if (existsSync11(outputDirectory)) {
     throw new Error(`evaluator output already exists: ${outputDirectory}`);
   }
   mkdirSync5(outputDirectory, { recursive: false, mode: 448 });
@@ -8992,15 +9194,15 @@ function materializeObjectiveOracleEvaluator(outputDirectoryValue) {
     if (sha256Bytes(bundle) !== attestation.bundleDigest) {
       throw new Error("evaluator bundle bytes do not match their attestation");
     }
-    writeFileSync4(join7(outputDirectory, "evaluator.js"), code, { flag: "wx", mode: 384 });
-    writeFileSync4(join7(outputDirectory, "evaluator-config.json"), config, { flag: "wx", mode: 384 });
-    writeFileSync4(join7(outputDirectory, "evaluator-bundle.json"), bundle, { flag: "wx", mode: 384 });
-    writeFileSync4(join7(outputDirectory, "COMPLETE"), '{"schemaVersion":1}\n', {
+    writeFileSync4(join9(outputDirectory, "evaluator.js"), code, { flag: "wx", mode: 384 });
+    writeFileSync4(join9(outputDirectory, "evaluator-config.json"), config, { flag: "wx", mode: 384 });
+    writeFileSync4(join9(outputDirectory, "evaluator-bundle.json"), bundle, { flag: "wx", mode: 384 });
+    writeFileSync4(join9(outputDirectory, "COMPLETE"), '{"schemaVersion":1}\n', {
       flag: "wx",
       mode: 384
     });
   } catch (error) {
-    rmSync4(outputDirectory, { recursive: true, force: true });
+    rmSync5(outputDirectory, { recursive: true, force: true });
     throw error;
   }
 }
@@ -9061,11 +9263,11 @@ function registerBenchCalibrationCommand(bench) {
   bench.command("calibrate").description("Emit a sealed, provider-free no-uplift tournament for 0research calibration").requiredOption("--manifest <path>", "corpus manifest path").option("--case-id <id>", "exact pre-registered case id (repeatable)", collect2, []).requiredOption("--manifest-id <id>", "sealed calibration slice id").requiredOption("--tournament-output <path>", "create-once sealed calibration evidence").option("--evaluator-output-dir <path>", "create-once exact evaluator code/config/bundle").action(async (opts) => {
     const caseIds = opts.caseId;
     if (caseIds.length === 0) throw new Error("--case-id must be supplied at least once");
-    if (existsSync10(resolve8(String(opts.tournamentOutput)))) {
-      throw new Error(`tournament output already exists: ${resolve8(String(opts.tournamentOutput))}`);
+    if (existsSync11(resolve9(String(opts.tournamentOutput)))) {
+      throw new Error(`tournament output already exists: ${resolve9(String(opts.tournamentOutput))}`);
     }
-    if (opts.evaluatorOutputDir && existsSync10(resolve8(String(opts.evaluatorOutputDir)))) {
-      throw new Error(`evaluator output already exists: ${resolve8(String(opts.evaluatorOutputDir))}`);
+    if (opts.evaluatorOutputDir && existsSync11(resolve9(String(opts.evaluatorOutputDir)))) {
+      throw new Error(`evaluator output already exists: ${resolve9(String(opts.evaluatorOutputDir))}`);
     }
     const source = await loadManifest(String(opts.manifest));
     const manifest = subsetManifest(source, caseIds, String(opts.manifestId));
@@ -9100,17 +9302,17 @@ function selectRunManifest(source, opts) {
 }
 function resolveManifestPath(manifestPath, bundledCorpusPath = corpusV1Path()) {
   if (manifestPath) return manifestPath;
-  if (existsSync11(bundledCorpusPath)) return bundledCorpusPath;
+  if (existsSync12(bundledCorpusPath)) return bundledCorpusPath;
   throw new Error(
     "No bundled benchmark corpus is available. Pass --manifest <path> to run an external or public corpus."
   );
 }
 function validateCaptureDestination(outputValue, ledgerValue) {
-  const output = resolve9(outputValue);
-  if (output === resolve9(ledgerValue)) {
+  const output = resolve10(outputValue);
+  if (output === resolve10(ledgerValue)) {
     throw new Error("--tournament-output must differ from --ledger");
   }
-  if (existsSync11(output)) throw new Error(`tournament output already exists: ${output}`);
+  if (existsSync12(output)) throw new Error(`tournament output already exists: ${output}`);
 }
 async function measureOperation(operation, monotonicClock = () => performance.now()) {
   const startedAt = monotonicClock();
@@ -9124,7 +9326,7 @@ async function measureOperation(operation, monotonicClock = () => performance.no
 function parseVariants(opts) {
   if (opts.variants) {
     const path = String(opts.variants);
-    const raw = existsSync11(path) ? readFileSync8(path, "utf8") : String(opts.variants);
+    const raw = existsSync12(path) ? readFileSync9(path, "utf8") : String(opts.variants);
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -9335,10 +9537,10 @@ function registerBenchCommand(program) {
       ...opts.title ? { title: String(opts.title) } : {},
       keepRuns: Number(opts.keepRuns)
     });
-    const outDir = resolve9(String(opts.out));
+    const outDir = resolve10(String(opts.out));
     mkdirSync6(outDir, { recursive: true });
-    const mdPath = join8(outDir, "scoreboard.md");
-    const jsonPath = join8(outDir, "scoreboard.json");
+    const mdPath = join10(outDir, "scoreboard.md");
+    const jsonPath = join10(outDir, "scoreboard.json");
     writeFileSync5(mdPath, markdown, "utf8");
     writeFileSync5(jsonPath, JSON.stringify(json2, null, 2) + "\n", "utf8");
     console.log(source_default.green(`  wrote ${mdPath}`));
@@ -9347,8 +9549,8 @@ function registerBenchCommand(program) {
 }
 
 // packages/cli/src/commands/ingest.ts
-import { readFileSync as readFileSync9, statSync } from "node:fs";
-import { resolve as resolve10 } from "node:path";
+import { readFileSync as readFileSync10, statSync } from "node:fs";
+import { resolve as resolve11 } from "node:path";
 var VALID_FORMATS = ["auto", "kasan", "ubsan", "oops", "syzkaller", "generic"];
 var VALID_OUTPUT_FORMATS = ["terminal", "json", "sarif"];
 function registerIngestCommand(program) {
@@ -9377,7 +9579,7 @@ function registerIngestCommand(program) {
       if (inputPath && directReproducerPath) {
         throw new Error("Do not pass a crash-report path together with --reproducer or --syz.");
       }
-      const resolved = inputPath ? resolve10(inputPath) : "";
+      const resolved = inputPath ? resolve11(inputPath) : "";
       const stat3 = inputPath ? statSync(resolved) : void 0;
       const reviewSubsystem = opts.reviewSubsystem === true;
       if (reviewSubsystem && !opts.tree) {
@@ -9403,7 +9605,7 @@ function registerIngestCommand(program) {
         reviewKernelCrashSubsystems,
         verifyStandaloneKernelReproducer,
         verifyKernelCrash
-      } = await import("./dist-FDKALV4R.js");
+      } = await import("./dist-4YICS2J2.js");
       let kernelBuild;
       if (opts.kernelTree) {
         kernelBuild = prepareKernelVmArtifacts({
@@ -9423,14 +9625,14 @@ function registerIngestCommand(program) {
         if (outputFormat === "sarif") {
           throw new Error("--output sarif is not supported for standalone reproducers.");
         }
-        const reproPath = resolve10(directReproducerPath);
+        const reproPath = resolve11(directReproducerPath);
         console.log(source_default.blue(`Running ${directReproducerLanguage} reproducer: ${reproPath}`));
         const verification = await verifyStandaloneKernelReproducer({
           raw: "",
           crashType: "unknown",
           faultingFunction: "unknown",
           stackFrames: [],
-          reproducer: readFileSync9(reproPath, "utf8"),
+          reproducer: readFileSync10(reproPath, "utf8"),
           reproducerLanguage: directReproducerLanguage
         });
         const directResult = {
@@ -9481,7 +9683,7 @@ ${verdict} ${source_default.white(verification.reproducedCrashType ?? "no crash
       }
       if (reviewSubsystem) {
         const reviewResult = await reviewKernelCrashSubsystems(artifacts, {
-          tree: resolve10(opts.tree),
+          tree: resolve11(opts.tree),
           runtime: opts.runtime ?? "auto",
           apiKey: opts.apiKey,
           model: opts.model,
@@ -9705,7 +9907,7 @@ Ingested ${findings.length} finding${findings.length > 1 ? "s" : ""}:
 }
 
 // packages/cli/src/commands/kernel.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "node:fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "node:fs";
 var VALID_OUTPUT_FORMATS2 = ["terminal", "json", "sarif"];
 function parsePositiveInt(value, name, max) {
   const parsed = Number.parseInt(value, 10);
@@ -9803,7 +10005,7 @@ function registerKernelCommand(program) {
       const details = parsePositiveInt(opts.details, "--details", 100);
       const detailDelayMs = parsePositiveInt(opts.detailDelay, "--detail-delay", 5e3);
       const subsystems = opts.subsystems.split(",").map((value) => value.trim()).filter(Boolean);
-      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-FDKALV4R.js");
+      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-4YICS2J2.js");
       const result = await mineSyzbotQueue({
         fetch: defaultSyzbotFetcher,
         fetchDetail: defaultSyzbotFetcher,
@@ -9822,9 +10024,9 @@ function registerKernelCommand(program) {
   });
   kernel.command("weights").description("Generate an LLM-derived syzkaller choice_weights.json for a kernelCTF target").requiredOption("--target <version>", "Target kernel version, e.g. 6.12.101").option("--crash-summary <path>", "File with recent crash descriptions to inform weighting").option("--enabled-syscalls <path>", "JSON array file of manager-enabled syscall names to constrain the plan").option("--from-file <path>", "Validate/normalize a raw model JSON plan instead of calling the API").option("-m, --model <model>", "Override model (default: env/auto-detected)").option("--max-entries <n>", "Maximum weighted syscalls", "48").option("--dry-run", "Print the weights file instead of writing").option("-o, --out <path>", "Output path for choice_weights.json").action(async (opts) => {
     try {
-      const crashSummary = opts.crashSummary ? readFileSync10(opts.crashSummary, "utf8") : void 0;
-      const enabledSyscalls = opts.enabledSyscalls ? JSON.parse(readFileSync10(opts.enabledSyscalls, "utf8")) : void 0;
-      const result = opts.fromFile ? syzChoiceWeightsFromPlan(readFileSync10(opts.fromFile, "utf8"), {
+      const crashSummary = opts.crashSummary ? readFileSync11(opts.crashSummary, "utf8") : void 0;
+      const enabledSyscalls = opts.enabledSyscalls ? JSON.parse(readFileSync11(opts.enabledSyscalls, "utf8")) : void 0;
+      const result = opts.fromFile ? syzChoiceWeightsFromPlan(readFileSync11(opts.fromFile, "utf8"), {
         target: opts.target,
         crashSummary,
         maxEntries: parsePositiveInt(opts.maxEntries, "--max-entries", 128)
@@ -9855,7 +10057,7 @@ function registerKernelCommand(program) {
           `Invalid output format '${opts.output}'. Valid: ${VALID_OUTPUT_FORMATS2.join(", ")}`
         );
       }
-      const { runKernelVariantHunt } = await import("./dist-FDKALV4R.js");
+      const { runKernelVariantHunt } = await import("./dist-4YICS2J2.js");
       const report = await runKernelVariantHunt({
         tree: opts.tree,
         advisory: opts.advisory,
@@ -9881,9 +10083,9 @@ function registerKernelCommand(program) {
 }
 
 // packages/cli/src/commands/disclose.ts
-import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, existsSync as existsSync12, readFileSync as readFileSync11 } from "node:fs";
-import { resolve as resolve11, join as join9, dirname as dirname6 } from "node:path";
-import { homedir } from "node:os";
+import { writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, existsSync as existsSync13, readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve12, join as join11, dirname as dirname6 } from "node:path";
+import { homedir as homedir2 } from "node:os";
 var STATUS_COLOUR = {
   "still-vulnerable": (s) => source_default.green(s),
   "partial-fix": (s) => source_default.yellow(s),
@@ -9954,11 +10156,11 @@ var VERDICT_COLOUR = {
   could_not_run: (s) => source_default.red(s)
 };
 function resolveOutputDir(opts, scanId) {
-  if (opts.outputDir) return resolve11(opts.outputDir);
-  return join9(homedir(), "0sec", "disclosures", `scan-${scanId.slice(0, 8)}`);
+  if (opts.outputDir) return resolve12(opts.outputDir);
+  return join11(homedir2(), "0sec", "disclosures", `scan-${scanId.slice(0, 8)}`);
 }
 async function disclose(findingId, opts) {
-  const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+  const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
   const db = new osecDB2(opts.dbPath);
   try {
     let routeDroppedFinding2 = function(args2) {
@@ -9975,7 +10177,7 @@ async function disclose(findingId, opts) {
       };
       if (!opts.dryRun) {
         mkdirSync7(droppedDir, { recursive: true });
-        const reasonPath = join9(droppedDir, droppedFilename(droppedEntry));
+        const reasonPath = join11(droppedDir, droppedFilename(droppedEntry));
         const body = formatDroppedReason({
           finding,
           scanId,
@@ -10028,7 +10230,7 @@ async function disclose(findingId, opts) {
       );
     }
     const outputDir = resolveOutputDir(opts, scanId);
-    const imagesDir = join9(outputDir, "images");
+    const imagesDir = join11(outputDir, "images");
     if (!opts.dryRun) mkdirSync7(outputDir, { recursive: true });
     const freezeOn = !opts.noScreenshots && !opts.dryRun && isFreezeAvailable();
     const reverifyOn = !!opts.repo;
@@ -10046,7 +10248,7 @@ async function disclose(findingId, opts) {
       throw new Error(`--reverify-rps must be a positive number, got: ${opts.reverifyRps}`);
     }
     const scopeAllowlist = opts.scopeAllowlist ? opts.scopeAllowlist.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
-    const droppedDir = join9(outputDir, "_dropped");
+    const droppedDir = join11(outputDir, "_dropped");
     console.log(source_default.red.bold("\n  \u25C6 0sec") + source_default.gray(` disclose \u2014 ${selected.length} finding${selected.length === 1 ? "" : "s"}`));
     console.log(source_default.gray(`  output: ${outputDir}${opts.dryRun ? " (dry-run \u2014 nothing written)" : ""}`));
     console.log(source_default.gray(`  screenshots: ${freezeOn ? "on (freeze)" : opts.noScreenshots ? "disabled" : opts.dryRun ? "skipped (dry-run)" : "disabled (freeze not on PATH)"}`));
@@ -10082,7 +10284,7 @@ async function disclose(findingId, opts) {
           console.log(source_default.red(`  behavioural reverify failed on ${row.id.slice(0, 8)}: ${err instanceof Error ? err.message : String(err)}`));
         }
         if (behaviouralReport && !opts.dryRun) {
-          const execPath = join9(outputDir, `${finding.id.slice(0, 8)}.execution.json`);
+          const execPath = join11(outputDir, `${finding.id.slice(0, 8)}.execution.json`);
           writeFileSync7(execPath, JSON.stringify(behaviouralReport, null, 2), "utf8");
           db.saveFindingPocExecution(finding.id, behaviouralReport);
         }
@@ -10187,10 +10389,10 @@ async function disclose(findingId, opts) {
         }
         throw err;
       }
-      const path = join9(outputDir, rendered.filename);
+      const path = join11(outputDir, rendered.filename);
       let state = "wrote";
       if (!opts.dryRun) {
-        if (existsSync12(path)) {
+        if (existsSync13(path)) {
           state = "skipped-exists";
         } else {
           writeFileSync7(path, rendered.markdown, "utf8");
@@ -10219,7 +10421,7 @@ async function disclose(findingId, opts) {
       );
     }
     if (!opts.dryRun) {
-      const indexPath = join9(outputDir, "INDEX.md");
+      const indexPath = join11(outputDir, "INDEX.md");
       const indexContent = assembleBundleIndex(results, { scanIds });
       writeFileSync7(indexPath, indexContent, "utf8");
       console.log("\n  " + source_default.gray(`wrote ${indexPath}`));
@@ -10231,7 +10433,7 @@ async function disclose(findingId, opts) {
 function discloseEvidencePack(findingPath, opts) {
   let finding;
   try {
-    const raw = readFileSync11(resolve11(findingPath), "utf8");
+    const raw = readFileSync12(resolve12(findingPath), "utf8");
     finding = JSON.parse(raw);
   } catch (err) {
     console.error(source_default.red(`Failed to read finding JSON '${findingPath}': ${err instanceof Error ? err.message : String(err)}`));
@@ -10266,8 +10468,8 @@ Refusing to draft a vendor notification for an unreproduced finding. Pass --allo
     return;
   }
   if (opts.out) {
-    writeFileSync7(resolve11(opts.out), md, "utf8");
-    console.log(source_default.gray(`DRAFT vendor-notification written to ${resolve11(opts.out)} (not sent).`));
+    writeFileSync7(resolve12(opts.out), md, "utf8");
+    console.log(source_default.gray(`DRAFT vendor-notification written to ${resolve12(opts.out)} (not sent).`));
     return;
   }
   console.log(md);
@@ -10276,7 +10478,7 @@ function discloseTrack(findingId, opts) {
   let record2;
   try {
     if (opts.record) {
-      const raw = readFileSync11(resolve11(opts.record), "utf8");
+      const raw = readFileSync12(resolve12(opts.record), "utf8");
       const loaded = JSON.parse(raw);
       if (!opts.to) {
         console.error(source_default.red("--record requires --to <status> to apply a transition."));
@@ -10305,15 +10507,15 @@ function discloseTrack(findingId, opts) {
   }
   const json2 = JSON.stringify(record2, null, 2);
   if (opts.out) {
-    writeFileSync7(resolve11(opts.out), json2, "utf8");
-    console.log(source_default.gray(`Disclosure record (status: ${record2.status}) written to ${resolve11(opts.out)} \u2014 intent only, nothing sent.`));
+    writeFileSync7(resolve12(opts.out), json2, "utf8");
+    console.log(source_default.gray(`Disclosure record (status: ${record2.status}) written to ${resolve12(opts.out)} \u2014 intent only, nothing sent.`));
     return;
   }
   console.log(json2);
 }
 function discloseReview(findingPath, opts) {
-  const jsonPath = resolve11(findingPath);
-  const raw = readFileSync11(jsonPath, "utf8");
+  const jsonPath = resolve12(findingPath);
+  const raw = readFileSync12(jsonPath, "utf8");
   const finding = JSON.parse(raw);
   const manifest = assembleReproducibilityManifest(finding, {
     timestamp: opts.timestamp,
@@ -10323,9 +10525,9 @@ function discloseReview(findingPath, opts) {
   });
   const rendered = renderReproducibilityManifest(manifest);
   if (opts.out) {
-    const outPath = resolve11(opts.out);
+    const outPath = resolve12(opts.out);
     const outDir = dirname6(outPath);
-    if (!existsSync12(outDir)) {
+    if (!existsSync13(outDir)) {
       mkdirSync7(outDir, { recursive: true });
     }
     writeFileSync7(outPath, rendered + "\n", "utf8");
@@ -10373,10 +10575,10 @@ function registerDiscloseCommand(program) {
 }
 
 // packages/cli/src/commands/verify.ts
-import { mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync3, readFileSync as readFileSync12, rmSync as rmSync5, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
-import { createHash as createHash4 } from "node:crypto";
-import { tmpdir as tmpdir4 } from "node:os";
-import { join as join10, resolve as resolve12 } from "node:path";
+import { mkdirSync as mkdirSync8, mkdtempSync as mkdtempSync4, readFileSync as readFileSync13, rmSync as rmSync6, statSync as statSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import { tmpdir as tmpdir5 } from "node:os";
+import { join as join12, resolve as resolve13 } from "node:path";
 var EXCERPT_BYTES = 4 * 1024;
 function excerpt(text2, max = EXCERPT_BYTES) {
   if (!text2) return "";
@@ -10624,11 +10826,11 @@ function artifactFromPath(kind, path) {
   try {
     const stat3 = statSync2(path);
     if (!stat3.isFile()) return null;
-    const body = readFileSync12(path);
+    const body = readFileSync13(path);
     return {
       kind: kind.replace(/_ref$/, ""),
       path,
-      sha256: createHash4("sha256").update(body).digest("hex"),
+      sha256: createHash5("sha256").update(body).digest("hex"),
       bytes: stat3.size
     };
   } catch {
@@ -10665,10 +10867,10 @@ function fixtureResultToShared(result) {
   };
 }
 function readJson2(path, kind) {
-  const abs = resolve12(path);
+  const abs = resolve13(path);
   let raw;
   try {
-    raw = readFileSync12(abs, "utf8");
+    raw = readFileSync13(abs, "utf8");
   } catch (err) {
     throw new Error(
       `failed to read ${kind} from ${abs}: ${err instanceof Error ? err.message : String(err)}`
@@ -10720,7 +10922,7 @@ function parseDurationMs(raw) {
   }
 }
 async function runKernelFindingVerify(opts) {
-  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-FDKALV4R.js");
+  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-4YICS2J2.js");
   const rawFinding = readJson2(opts.findingPath, "finding");
   let finding;
   try {
@@ -10767,12 +10969,12 @@ async function runKernelFindingVerify(opts) {
   };
 }
 function allocateIsolatedWorkspace() {
-  const cwd = mkdtempSync3(join10(tmpdir4(), "0sec-verify-"));
+  const cwd = mkdtempSync4(join12(tmpdir5(), "0sec-verify-"));
   return {
     cwd,
     cleanup: () => {
       try {
-        rmSync5(cwd, { recursive: true, force: true });
+        rmSync6(cwd, { recursive: true, force: true });
       } catch {
       }
     }
@@ -10877,7 +11079,7 @@ async function runDeterministicReplayCli(args2) {
   }
   let runDir;
   if (args2.outDir) {
-    runDir = resolve12(args2.outDir);
+    runDir = resolve13(args2.outDir);
     mkdirSync8(runDir, { recursive: true });
   }
   if (args2.dockerNetwork && args2.runner !== "docker") {
@@ -10935,7 +11137,7 @@ async function verifyAction(opts, positionalFinding) {
       2
     );
     if (opts.output) {
-      writeFileSync8(resolve12(opts.output), result + "\n", "utf8");
+      writeFileSync8(resolve13(opts.output), result + "\n", "utf8");
     } else {
       process.stdout.write(result + "\n");
     }
@@ -10970,7 +11172,7 @@ async function verifyAction(opts, positionalFinding) {
     });
     const kernelJson = JSON.stringify(kernelOutcome.result, null, 2);
     if (opts.output) {
-      writeFileSync8(resolve12(opts.output), kernelJson + "\n", "utf8");
+      writeFileSync8(resolve13(opts.output), kernelJson + "\n", "utf8");
     } else {
       process.stdout.write(kernelJson + "\n");
     }
@@ -11002,7 +11204,7 @@ async function verifyAction(opts, positionalFinding) {
     });
     const json3 = JSON.stringify(result, null, 2);
     if (opts.output) {
-      writeFileSync8(resolve12(opts.output), json3 + "\n", "utf8");
+      writeFileSync8(resolve13(opts.output), json3 + "\n", "utf8");
     } else {
       process.stdout.write(json3 + "\n");
     }
@@ -11030,7 +11232,7 @@ async function verifyAction(opts, positionalFinding) {
     });
     const json3 = JSON.stringify(bundleResult, null, 2);
     if (opts.output) {
-      writeFileSync8(resolve12(opts.output), json3 + "\n", "utf8");
+      writeFileSync8(resolve13(opts.output), json3 + "\n", "utf8");
     } else {
       process.stdout.write(json3 + "\n");
     }
@@ -11067,7 +11269,7 @@ async function verifyAction(opts, positionalFinding) {
   });
   const json2 = JSON.stringify(outcome.result, null, 2);
   if (opts.output) {
-    writeFileSync8(resolve12(opts.output), json2 + "\n", "utf8");
+    writeFileSync8(resolve13(opts.output), json2 + "\n", "utf8");
   } else {
     process.stdout.write(json2 + "\n");
   }
@@ -11162,7 +11364,7 @@ function registerVerifyCommand(program) {
       const json2 = JSON.stringify(result, null, 2);
       if (opts.output) {
         try {
-          writeFileSync8(resolve12(opts.output), json2 + "\n", "utf8");
+          writeFileSync8(resolve13(opts.output), json2 + "\n", "utf8");
         } catch {
           process.stderr.write(json2 + "\n");
         }
@@ -11175,8 +11377,8 @@ function registerVerifyCommand(program) {
 }
 
 // packages/cli/src/commands/exploit.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
-import { resolve as resolve13 } from "node:path";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 var CATEGORY_TO_CRASH_TYPE = {
   "use-after-free": "kasan-uaf",
   "heap-overflow": "kasan-oob",
@@ -11187,10 +11389,10 @@ var CATEGORY_TO_CRASH_TYPE = {
   "null-pointer-deref": "kasan-null"
 };
 function readJson3(path, kind) {
-  const abs = resolve13(path);
+  const abs = resolve14(path);
   let raw;
   try {
-    raw = readFileSync13(abs, "utf8");
+    raw = readFileSync14(abs, "utf8");
   } catch (err) {
     throw new Error(
       `failed to read ${kind} from ${abs}: ${err instanceof Error ? err.message : String(err)}`
@@ -11212,7 +11414,7 @@ async function runExploit(opts) {
     classifyPrimitiveFromDmesg,
     describeKernelPrimitive,
     runWeaponization
-  } = await import("./dist-FDKALV4R.js");
+  } = await import("./dist-4YICS2J2.js");
   const rawFinding = readJson3(opts.findingPath, "finding");
   let finding;
   try {
@@ -11223,7 +11425,7 @@ async function runExploit(opts) {
     }
     throw err;
   }
-  const reproducer = opts.reproducerPath ? readFileSync13(resolve13(opts.reproducerPath), "utf8") : void 0;
+  const reproducer = opts.reproducerPath ? readFileSync14(resolve14(opts.reproducerPath), "utf8") : void 0;
   const primitive = classifyPrimitiveFromDmesg(
     dmesgFromFinding(finding),
     CATEGORY_TO_CRASH_TYPE[finding.category]
@@ -11275,7 +11477,7 @@ async function runExploit(opts) {
 }
 async function exploitAction(opts) {
   if (opts.agent) {
-    const { agentFromExploitOpts } = await import("./exploit-agent-XP23ISN7.js");
+    const { agentFromExploitOpts } = await import("./exploit-agent-45YQOHPJ.js");
     process.exitCode = await agentFromExploitOpts({
       ...opts.task ? { task: opts.task } : {},
       ...opts.flagPath ? { flagPath: opts.flagPath } : {},
@@ -11290,7 +11492,7 @@ async function exploitAction(opts) {
     return;
   }
   if (opts.autoclimb) {
-    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-E6T7RRSC.js");
+    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-UZGEMGYT.js");
     process.exitCode = await autoclimbFromExploitOpts({
       ...opts.bugSpec ? { bugSpec: opts.bugSpec } : {},
       ...opts.bootScript ? { bootScript: opts.bootScript } : {},
@@ -11304,7 +11506,7 @@ async function exploitAction(opts) {
     throw new Error("missing required flag: --finding <path>");
   }
   if (opts.climb) {
-    const { runClimb } = await import("./exploit-climb-2FAUP6XU.js");
+    const { runClimb } = await import("./exploit-climb-SG23KB2G.js");
     let loopBoots = 8;
     if (opts.loopBoots !== void 0) {
       loopBoots = parseInt(opts.loopBoots, 10);
@@ -11323,7 +11525,7 @@ async function exploitAction(opts) {
     });
     const json3 = JSON.stringify(outcome2.result, null, 2);
     if (opts.output) {
-      writeFileSync9(resolve13(opts.output), json3 + "\n", "utf8");
+      writeFileSync9(resolve14(opts.output), json3 + "\n", "utf8");
     } else {
       process.stdout.write(json3 + "\n");
     }
@@ -11344,7 +11546,7 @@ async function exploitAction(opts) {
   });
   const json2 = JSON.stringify(outcome.result, null, 2);
   if (opts.output) {
-    writeFileSync9(resolve13(opts.output), json2 + "\n", "utf8");
+    writeFileSync9(resolve14(opts.output), json2 + "\n", "utf8");
   } else {
     process.stdout.write(json2 + "\n");
   }
@@ -11419,7 +11621,7 @@ function registerExploitCommand(program) {
       const json2 = JSON.stringify(result, null, 2);
       if (opts.output) {
         try {
-          writeFileSync9(resolve13(opts.output), json2 + "\n", "utf8");
+          writeFileSync9(resolve14(opts.output), json2 + "\n", "utf8");
         } catch {
           process.stderr.write(json2 + "\n");
         }
@@ -11433,7 +11635,7 @@ function registerExploitCommand(program) {
 
 // packages/cli/src/commands/recency-hunt.ts
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join11, resolve as resolve14 } from "node:path";
+import { join as join13, resolve as resolve15 } from "node:path";
 function parseDetectors(raw) {
   if (!raw) return void 0;
   const valid = /* @__PURE__ */ new Set(["dataflow", "refcount", "race", "dual-view"]);
@@ -11458,10 +11660,10 @@ function parseWitnessMode(raw) {
 }
 async function recencyAction(opts) {
   if (!opts.tree) throw new Error("missing required flag: --tree <kernel source tree>");
-  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-FDKALV4R.js");
-  const tree = resolve14(opts.tree);
+  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-4YICS2J2.js");
+  const tree = resolve15(opts.tree);
   const runtime = opts.runtime ?? "api";
-  const modelDir = opts.modelDir ? resolve14(opts.modelDir) : join11(tree, ".recency-models");
+  const modelDir = opts.modelDir ? resolve15(opts.modelDir) : join13(tree, ".recency-models");
   mkdirSync9(modelDir, { recursive: true });
   const report = await runRecencyHunt({
     tree,
@@ -11495,22 +11697,22 @@ async function recencyAction(opts) {
   const json2 = JSON.stringify(report, null, 2);
   const md = renderRecencyReportMarkdown(report);
   if (opts.reportDir) {
-    const dir = resolve14(opts.reportDir);
+    const dir = resolve15(opts.reportDir);
     mkdirSync9(dir, { recursive: true });
     const day = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-    writeFileSync10(join11(dir, `${day}.json`), json2 + "\n", "utf8");
-    writeFileSync10(join11(dir, `${day}.md`), md + "\n", "utf8");
+    writeFileSync10(join13(dir, `${day}.json`), json2 + "\n", "utf8");
+    writeFileSync10(join13(dir, `${day}.md`), md + "\n", "utf8");
     const f = report.funnel;
     const cbd = f.candidatesByDetector;
     const dv = report.detectors.includes("dual-view") ? `, dual-view: ${cbd.dualView} (\u2192${f.dualViewWitnessAttempted} witnessed-attempted \u2192${f.survivorsByDetector.dualView} WITNESSED)` : "";
     process.stdout.write(
-      `recency-flywheel ${day}: ${f.commits} commits \u2192 ${f.changedFiles} files \u2192 ${f.inScope} in-scope \u2192 ${f.semantic} semantic \u2192 ${f.candidates} candidates {dataflow: ${cbd.dataflow}, refcount: ${cbd.refcount}, race: ${cbd.race}${dv}} \u2192 ${f.survivors} survivor(s). detectors: ${report.detectors.join("+")}. reports: ${join11(dir, day)}.{json,md}
+      `recency-flywheel ${day}: ${f.commits} commits \u2192 ${f.changedFiles} files \u2192 ${f.inScope} in-scope \u2192 ${f.semantic} semantic \u2192 ${f.candidates} candidates {dataflow: ${cbd.dataflow}, refcount: ${cbd.refcount}, race: ${cbd.race}${dv}} \u2192 ${f.survivors} survivor(s). detectors: ${report.detectors.join("+")}. reports: ${join13(dir, day)}.{json,md}
 `
     );
   } else {
-    if (opts.output) writeFileSync10(resolve14(opts.output), json2 + "\n", "utf8");
+    if (opts.output) writeFileSync10(resolve15(opts.output), json2 + "\n", "utf8");
     else process.stdout.write(json2 + "\n");
-    if (opts.md) writeFileSync10(resolve14(opts.md), md + "\n", "utf8");
+    if (opts.md) writeFileSync10(resolve15(opts.md), md + "\n", "utf8");
   }
   process.exitCode = report.range === "(empty window)" ? 2 : report.survivors.length > 0 ? 0 : 1;
 }
@@ -11525,7 +11727,7 @@ function registerRecencyHuntCommand(program) {
       const json2 = JSON.stringify({ mode: "recency-hunt", error: reason }, null, 2);
       if (opts.output) {
         try {
-          writeFileSync10(resolve14(opts.output), json2 + "\n", "utf8");
+          writeFileSync10(resolve15(opts.output), json2 + "\n", "utf8");
         } catch {
           process.stderr.write(json2 + "\n");
         }
@@ -11536,8 +11738,8 @@ function registerRecencyHuntCommand(program) {
 }
 
 // packages/cli/src/commands/memsafety.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync10, realpathSync, writeFileSync as writeFileSync11 } from "node:fs";
-import { resolve as resolve15, join as join12, sep as sep2 } from "node:path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync10, realpathSync, writeFileSync as writeFileSync11 } from "node:fs";
+import { resolve as resolve16, join as join14, sep as sep2 } from "node:path";
 var VALID_LANGUAGES = /* @__PURE__ */ new Set(["c", "cpp", "rust"]);
 var VALID_BUILD_SYSTEMS3 = /* @__PURE__ */ new Set([
   "cargo",
@@ -11546,8 +11748,8 @@ var VALID_BUILD_SYSTEMS3 = /* @__PURE__ */ new Set([
   "meson",
   "make"
 ]);
-function detectMemSafetyBuild(sourceRoot, exists = existsSync13) {
-  const has = (rel) => exists(join12(sourceRoot, rel));
+function detectMemSafetyBuild(sourceRoot, exists = existsSync14) {
+  const has = (rel) => exists(join14(sourceRoot, rel));
   if (has("Cargo.toml")) return { language: "rust", buildSystem: "cargo" };
   if (has("CMakeLists.txt")) return { language: "cpp", buildSystem: "cmake" };
   if (has("meson.build")) return { language: "c", buildSystem: "meson" };
@@ -11562,7 +11764,7 @@ function detectMemSafetyBuild(sourceRoot, exists = existsSync13) {
 function resolveArtifactDir(value, sourceRoot) {
   const raw = value?.trim();
   if (!raw) return void 0;
-  const artifactDir = resolve15(raw);
+  const artifactDir = resolve16(raw);
   const preparedRoot = realpathSync(sourceRoot);
   mkdirSync10(artifactDir, { recursive: true, mode: 448 });
   const canonicalArtifactDir = realpathSync(artifactDir);
@@ -11574,7 +11776,7 @@ function resolveArtifactDir(value, sourceRoot) {
   return canonicalArtifactDir;
 }
 async function runMemSafety(opts) {
-  const { prepare: prepare2, runMemSafetyScan, getCloudSinkConfig, postFinding } = await import("./dist-FDKALV4R.js");
+  const { prepare: prepare2, runMemSafetyScan, getCloudSinkConfig, postFinding } = await import("./dist-4YICS2J2.js");
   const log = opts.log ?? (() => {
   });
   const prepared = await prepare2(
@@ -11585,11 +11787,11 @@ async function runMemSafety(opts) {
       if (e.message) log(`[memsafety:source] ${e.message}`);
     }
   );
-  const sourceRoot = resolve15(prepared.resolvedTarget);
+  const sourceRoot = resolve16(prepared.resolvedTarget);
   try {
     let scopeRoot = sourceRoot;
     if (opts.subsystem && opts.subsystem.trim() !== "") {
-      const scoped = resolve15(join12(sourceRoot, opts.subsystem));
+      const scoped = resolve16(join14(sourceRoot, opts.subsystem));
       if (scoped !== sourceRoot && !scoped.startsWith(sourceRoot + sep2)) {
         throw new Error(`--subsystem '${opts.subsystem}' escapes the source tree`);
       }
@@ -11724,7 +11926,7 @@ function parseArtifactOptions(opts) {
     throw new Error("--artifact-max-bytes must be at least 65536");
   }
   return {
-    artifactDir: resolve15(artifactDir),
+    artifactDir: resolve16(artifactDir),
     artifactMaxBytes: maxBytes
   };
 }
@@ -11748,7 +11950,7 @@ async function memsafetyAction(target, opts) {
     log: (m) => process.stderr.write(m + "\n")
   });
   const json2 = JSON.stringify(outcome.result, null, 2);
-  if (opts.output) writeFileSync11(resolve15(opts.output), json2 + "\n", "utf8");
+  if (opts.output) writeFileSync11(resolve16(opts.output), json2 + "\n", "utf8");
   else process.stdout.write(json2 + "\n");
   process.exitCode = outcome.exitCode;
 }
@@ -11770,7 +11972,7 @@ function registerMemsafetyCommand(program) {
       if (opts.output) {
         const { writeFileSync: writeFileSync18 } = await import("node:fs");
         try {
-          writeFileSync18(resolve15(opts.output), json2 + "\n", "utf8");
+          writeFileSync18(resolve16(opts.output), json2 + "\n", "utf8");
         } catch {
           process.stderr.write(json2 + "\n");
         }
@@ -11781,7 +11983,7 @@ function registerMemsafetyCommand(program) {
 }
 
 // packages/cli/src/commands/assumption-hunt.ts
-import { resolve as resolve16 } from "node:path";
+import { resolve as resolve17 } from "node:path";
 function parseWitnessMode2(raw) {
   if (raw === void 0) return void 0;
   const m = raw.trim();
@@ -11791,16 +11993,16 @@ function parseWitnessMode2(raw) {
   return m;
 }
 async function runAssumptionHuntCli(sourceRoot, opts) {
-  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-FDKALV4R.js");
+  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-4YICS2J2.js");
   const log = (m) => process.stderr.write(m + "\n");
   const runtime = opts.runtime ?? "api";
-  const root = resolve16(sourceRoot);
+  const root = resolve17(sourceRoot);
   const subsystem = opts.subsystem?.trim() || "subsystem";
   const files = (opts.files ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   if (files.length === 0) {
     throw new Error("--files is required: a comma-separated list of subsystem source files (repo-relative to <source-root>)");
   }
-  const modelPath = opts.modelPath ? resolve16(opts.modelPath) : resolve16(root, `.0sec/assumption-models/${subsystem.replaceAll("/", "_")}.json`);
+  const modelPath = opts.modelPath ? resolve17(opts.modelPath) : resolve17(root, `.0sec/assumption-models/${subsystem.replaceAll("/", "_")}.json`);
   const models = opts.models ? opts.models.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
   const verify = opts.skipHunt || opts.noVerify ? void 0 : (
     // `finderModels` decorrelates the refute pass from the finder fan-out
@@ -11826,7 +12028,7 @@ async function runAssumptionHuntCli(sourceRoot, opts) {
     ...models ? { finderModels: models } : {},
     ...opts.finderTargeting === false ? { finderTargeting: false } : {},
     ...opts.dualView === false ? { dualView: false } : {},
-    ...opts.excerptDir ? { excerptDir: resolve16(opts.excerptDir) } : {},
+    ...opts.excerptDir ? { excerptDir: resolve17(opts.excerptDir) } : {},
     ...opts.dynamicWitness ? {
       dynamicWitness: {
         runtime,
@@ -11910,7 +12112,7 @@ function registerAssumptionHuntCommand(program) {
       const json2 = JSON.stringify(outcome.result, null, 2);
       if (opts.output) {
         const { writeFileSync: writeFileSync18 } = await import("node:fs");
-        writeFileSync18(resolve16(opts.output), json2 + "\n", "utf8");
+        writeFileSync18(resolve17(opts.output), json2 + "\n", "utf8");
       } else process.stdout.write(json2 + "\n");
       process.exitCode = outcome.exitCode;
     } catch (err) {
@@ -11922,8 +12124,8 @@ function registerAssumptionHuntCommand(program) {
 }
 
 // packages/cli/src/commands/specdrift.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync12 } from "node:fs";
-import { basename as basename4, resolve as resolve17 } from "node:path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync12 } from "node:fs";
+import { basename as basename4, resolve as resolve18 } from "node:path";
 function parsePositive3(flag, raw, dflt) {
   if (raw === void 0) return dflt;
   const n = parseInt(raw, 10);
@@ -11933,8 +12135,8 @@ function parsePositive3(flag, raw, dflt) {
 async function runSpecdriftExtract(opts) {
   if (!opts.spec) throw new Error("missing required flag: --spec <path>");
   const maxInvariants = parsePositive3("--max-invariants", opts.maxInvariants, 40);
-  const specPath = resolve17(opts.spec);
-  const specText = readFileSync14(specPath, "utf8");
+  const specPath = resolve18(opts.spec);
+  const specText = readFileSync15(specPath, "utf8");
   return extractSpecInvariants({
     specName: opts.specName ?? basename4(specPath),
     specText,
@@ -11955,8 +12157,8 @@ async function runSpecdriftSourceWorkflow(opts, stage) {
   const maxCandidatesPerInvariant = parsePositive3("--max-candidates-per-invariant", opts.maxCandidatesPerInvariant, 5);
   const maxHypotheses = parsePositive3("--max-hypotheses", opts.maxHypotheses, 20);
   const timeout = parsePositive3("--timeout", opts.timeout, 6e5);
-  const specPath = resolve17(opts.spec);
-  const specText = readFileSync14(specPath, "utf8");
+  const specPath = resolve18(opts.spec);
+  const specText = readFileSync15(specPath, "utf8");
   const prepared = await prepare(opts.source, "source-code", { timeout }, (e) => {
     if (e.message) process.stderr.write(`[specdrift:source] ${e.message}
 `);
@@ -11965,7 +12167,7 @@ async function runSpecdriftSourceWorkflow(opts, stage) {
     const input = {
       specName: opts.specName ?? basename4(specPath),
       specText,
-      sourceRoot: resolve17(prepared.resolvedTarget),
+      sourceRoot: resolve18(prepared.resolvedTarget),
       maxInvariants,
       maxFiles,
       maxCandidatesPerInvariant
@@ -11979,14 +12181,14 @@ async function writeJsonResult(fn, output, stage = "extract") {
   try {
     const result = await fn();
     const json2 = JSON.stringify(result, null, 2);
-    if (output) writeFileSync12(resolve17(output), json2 + "\n", "utf8");
+    if (output) writeFileSync12(resolve18(output), json2 + "\n", "utf8");
     else process.stdout.write(json2 + "\n");
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     const json2 = JSON.stringify({ mode: "specdrift", stage, error: reason }, null, 2);
     if (output) {
       try {
-        writeFileSync12(resolve17(output), json2 + "\n", "utf8");
+        writeFileSync12(resolve18(output), json2 + "\n", "utf8");
       } catch {
         process.stderr.write(json2 + "\n");
       }
@@ -12008,8 +12210,8 @@ function registerSpecdriftCommand(program) {
 }
 
 // packages/cli/src/commands/protocol-check.ts
-import { readFileSync as readFileSync15 } from "node:fs";
-import { resolve as resolve18 } from "node:path";
+import { readFileSync as readFileSync16 } from "node:fs";
+import { resolve as resolve19 } from "node:path";
 function resolveNativeRuntime(runtimeFlag) {
   const choice = (runtimeFlag ?? "auto").toLowerCase();
   const timeout = 6e4;
@@ -12028,9 +12230,9 @@ function resolveNativeRuntime(runtimeFlag) {
   return rt;
 }
 function readExcerpt(path, label) {
-  const abs = resolve18(path);
+  const abs = resolve19(path);
   try {
-    return readFileSync15(abs, "utf8");
+    return readFileSync16(abs, "utf8");
   } catch (err) {
     throw new Error(
       `failed to read ${label} from ${abs}: ${err instanceof Error ? err.message : String(err)}`
@@ -12154,8 +12356,8 @@ function registerProtocolCheckCommand(program) {
 }
 
 // packages/cli/src/commands/cve.ts
-import { readFileSync as readFileSync16 } from "node:fs";
-import { resolve as resolve19 } from "node:path";
+import { readFileSync as readFileSync17 } from "node:fs";
+import { resolve as resolve20 } from "node:path";
 var VALID_FORMATS2 = ["json", "table"];
 var EXIT_OK = 0;
 var EXIT_USER_ERROR = 1;
@@ -12187,10 +12389,10 @@ function parseAttempts(input, fallback = 5) {
   return parsed;
 }
 function loadArtifactsFile(path) {
-  const abs = resolve19(path);
+  const abs = resolve20(path);
   let raw;
   try {
-    raw = readFileSync16(abs, "utf-8");
+    raw = readFileSync17(abs, "utf-8");
   } catch (err) {
     throw new Error(`failed to read --artifacts ${abs}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -12435,7 +12637,7 @@ function wrapText(input, width) {
 // packages/cli/src/commands/upgrade.ts
 var RELEASES_URL = "https://github.com/0sec-labs/0sec/releases/latest";
 function registerUpgradeCommand(program) {
-  program.command("upgrade").description("Fetch and install the latest 0sec binary (re-runs install.sh)").option("--version <tag>", "Pin a specific release tag (e.g. v0.10.0)").option("--install-dir <path>", "Override the install directory (default: ~/.0sec/bin)").action(async (opts) => {
+  program.command("upgrade").alias("update").description("Fetch and install the latest 0sec binary (re-runs install.sh)").option("--version <tag>", "Pin a specific release tag (e.g. v0.10.0)").option("--install-dir <path>", "Override the install directory (default: ~/.0sec/bin)").action(async (opts) => {
     if (process.platform === "win32") {
       console.log("");
       console.log(`  ${source_default.bold("0sec upgrade")} doesn't support Windows yet.`);
@@ -13280,7 +13482,7 @@ function registerConsoleCommand(program) {
     let resumedTarget;
     let openResumePicker = false;
     if (opts.continue || opts.resume !== void 0) {
-      const { listSessions, loadSession } = await import("./session-store-BCFQYDCE.js");
+      const { listSessions, loadSession } = await import("./session-store-GZ4A4KYT.js");
       const idArg = typeof opts.resume === "string" ? opts.resume.trim() : "";
       if (idArg || opts.continue) {
         let stored = idArg ? loadSession(idArg) : null;
@@ -13361,7 +13563,7 @@ turn failed: ${err instanceof Error ? err.message : String(err)}`));
       console.log(source_default.dim(`MCP: connected ${mcpHost.serverIds().length} server(s) \u2014 ${mcpHost.registeredTools().length} tool(s)`));
     }
     if (useOpenTui) {
-      const { showOpenTuiConsole, showOpenTuiResume } = await import("./run-ESNN4V5W.js");
+      const { showOpenTuiConsole, showOpenTuiResume } = await import("./run-D56MPDKY.js");
       const baseOptions = {
         target: focusedTarget,
         scope,
@@ -14006,7 +14208,7 @@ function renderIdentity(result) {
 
 // packages/cli/src/commands/adgraph.ts
 import { readdir, readFile as readFile3, stat } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join15 } from "node:path";
 var DEFAULT_TIMEOUT_MS2 = "120000";
 var SEVERITY_ORDER2 = ["critical", "high", "medium", "low", "info"];
 var SEVERITY_COLOR2 = {
@@ -14113,7 +14315,7 @@ async function resolveInputFiles(input) {
   } catch (err) {
     throw new Error(`--input directory '${input}' could not be listed: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const files = entries.filter((name) => name.toLowerCase().endsWith(".json")).sort().map((name) => join13(input, name));
+  const files = entries.filter((name) => name.toLowerCase().endsWith(".json")).sort().map((name) => join15(input, name));
   if (files.length === 0) {
     throw new Error(`--input directory '${input}' contains no *.json files. Point it at an unzipped BloodHound collection.`);
   }
@@ -14195,7 +14397,7 @@ function renderAdGraph(analysis, readWarnings) {
 
 // packages/cli/src/commands/entragraph.ts
 import { readdir as readdir2, readFile as readFile4, stat as stat2 } from "node:fs/promises";
-import { join as join14 } from "node:path";
+import { join as join16 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = "120000";
 var SEVERITY_ORDER3 = ["critical", "high", "medium", "low", "info"];
 var SEVERITY_COLOR3 = {
@@ -14319,7 +14521,7 @@ async function resolveInputFiles2(input) {
       `--input directory '${input}' could not be listed: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const files = entries.filter((name) => name.toLowerCase().endsWith(".json")).sort().map((name) => join14(input, name));
+  const files = entries.filter((name) => name.toLowerCase().endsWith(".json")).sort().map((name) => join16(input, name));
   if (files.length === 0) {
     throw new Error(
       `--input directory '${input}' contains no *.json files. Point it at an unzipped AzureHound collection.`
@@ -14509,7 +14711,7 @@ function loadScopeOrExit(path) {
 }
 
 // packages/cli/src/commands/xnu-fuzz.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync13 } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13 } from "node:fs";
 function enumerateAction(opts) {
   const bundle = opts.bundle ?? "com.apple.unknown";
   const model = enumerateTargetModelFromKext(opts.kext, { kext: bundle, source: opts.kext });
@@ -14546,7 +14748,7 @@ function pickClient(model, name) {
   return model.userClients[0];
 }
 function genAction(opts) {
-  const model = JSON.parse(readFileSync17(opts.model, "utf8"));
+  const model = JSON.parse(readFileSync18(opts.model, "utf8"));
   const uc = pickClient(model, opts.class);
   if (!uc) {
     process.stderr.write("no user client in model\n");
@@ -14632,15 +14834,15 @@ function registerXnuFuzzCommand(program) {
 }
 
 // packages/cli/src/commands/research.ts
-import { readFileSync as readFileSync18 } from "node:fs";
-import { resolve as resolve20 } from "node:path";
+import { readFileSync as readFileSync19 } from "node:fs";
+import { resolve as resolve21 } from "node:path";
 function print(value) {
   process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
 function registerResearchCommand(program) {
   const research = program.command("research").description("Run target-specific engines through the shared evidence research plane");
   research.command("pipeline").description("Run the existing web/AI/source/package pipeline through the shared evidence plane").requiredOption("--target <target>", "URL, local path, repository, package, or image").option("--target-type <type>", "url, web-app, source-code, npm-package, pypi-package, cargo-package, or oci-image").option("--profile <profile>", "Source review profile").option("--depth <depth>", "quick, default, or deep", "default").option("--runtime <runtime>", "auto, api, claude, codex, gemini, or ollama", "auto").option("--artifact-root <path>", "Research artifact root", ".0sec-research").action(async (opts) => {
-    const { UnifiedPipelineResearchAdapter, postFinding, runResearch } = await import("./dist-FDKALV4R.js");
+    const { UnifiedPipelineResearchAdapter, postFinding, runResearch } = await import("./dist-4YICS2J2.js");
     const allowedTypes = /* @__PURE__ */ new Set(["url", "web-app", "source-code", "npm-package", "pypi-package", "cargo-package", "oci-image"]);
     if (opts.targetType && !allowedTypes.has(opts.targetType)) throw new Error(`unsupported --target-type ${opts.targetType}`);
     print(await runResearch(
@@ -14659,35 +14861,35 @@ function registerResearchCommand(program) {
           }
         }
       },
-      { artifactRoot: resolve20(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
+      { artifactRoot: resolve21(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
     ));
   });
   research.command("mobile").description("Run passive mobile intake; indicators remain hypotheses and only scoped adapters may hand off targets").requiredOption("--target <path>", "Extracted APK/IPA directory or metadata file").option("--artifact-root <path>", "Research artifact root", ".0sec-research").action(async (opts) => {
-    const { MobileStaticResearchAdapter, postFinding, runResearch } = await import("./dist-FDKALV4R.js");
-    const targetPath = resolve20(opts.target);
+    const { MobileStaticResearchAdapter, postFinding, runResearch } = await import("./dist-4YICS2J2.js");
+    const targetPath = resolve21(opts.target);
     print(await runResearch(
       new MobileStaticResearchAdapter(),
       { kind: "mobile.static-intake", id: `mobile:${targetPath}`, location: targetPath, config: {} },
-      { artifactRoot: resolve20(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
+      { artifactRoot: resolve21(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
     ));
   });
   research.command("linux-matrix").description("Import externally executed vulnerable-vs-patched boot logs; 0sec validates and hashes them but does not execute boots").requiredOption("--matrix <path>", "Versioned external boot-matrix manifest JSON").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").option("--artifact-root <path>", "Research artifact root", ".0sec-research").action(async (opts) => {
-    const { LinuxBootMatrixImportAdapter, postFinding, runResearch } = await import("./dist-FDKALV4R.js");
-    const matrix = resolve20(opts.matrix);
-    const finding = JSON.parse(readFileSync18(resolve20(opts.finding), "utf8"));
+    const { LinuxBootMatrixImportAdapter, postFinding, runResearch } = await import("./dist-4YICS2J2.js");
+    const matrix = resolve21(opts.matrix);
+    const finding = JSON.parse(readFileSync19(resolve21(opts.finding), "utf8"));
     const result = await runResearch(
       new LinuxBootMatrixImportAdapter(),
       { kind: "linux.kernel-boot-matrix-import", id: `linux-matrix:${finding.id}`, location: matrix, config: { finding } },
-      { artifactRoot: resolve20(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
+      { artifactRoot: resolve21(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
     );
     if (result.candidates.length === 0) throw new Error("external boot-matrix manifest failed validation");
     print(result);
   });
   research.command("linux").description("Run a supplied Linux kernel reproducer through the shared N-boot evidence gate").requiredOption("--kernel-tree <path>", "Linux source tree").requiredOption("--reproducer <path>", "C reproducer or syzkaller .syz program").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").requiredOption("--expected-signature <literal>", "Literal crash signature that every counted boot must contain").option("--boots <n>", "Fresh boots", "3").option("--min-hits <n>", "Required reproducing boots", "2").option("--artifact-root <path>", "Research artifact root", ".0sec-research").action(async (opts) => {
-    const { LinuxKernelResearchAdapter, postFinding, runResearch } = await import("./dist-FDKALV4R.js");
-    const kernelTree = resolve20(opts.kernelTree);
-    const reproducer = resolve20(opts.reproducer);
-    const finding = JSON.parse(readFileSync18(resolve20(opts.finding), "utf8"));
+    const { LinuxKernelResearchAdapter, postFinding, runResearch } = await import("./dist-4YICS2J2.js");
+    const kernelTree = resolve21(opts.kernelTree);
+    const reproducer = resolve21(opts.reproducer);
+    const finding = JSON.parse(readFileSync19(resolve21(opts.finding), "utf8"));
     const boots = Number.parseInt(opts.boots, 10);
     const minHits = Number.parseInt(opts.minHits, 10);
     if (!Number.isFinite(boots) || boots < 1 || !Number.isFinite(minHits) || minHits < 1 || minHits > boots) {
@@ -14703,7 +14905,7 @@ function registerResearchCommand(program) {
         location: kernelTree,
         config: { finding, verify }
       },
-      { artifactRoot: resolve20(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
+      { artifactRoot: resolve21(opts.artifactRoot), emitFinding: postFinding, log: (message) => process.stderr.write(message + "\n") }
     );
     if (result.findings.length === 0) {
       throw new Error("kernel N-boot verification did not reproduce the expected signature");
@@ -14749,7 +14951,7 @@ function registerTimelineCommand(program) {
       process.exitCode = 2;
       return;
     }
-    const { osecDB: osecDB2 } = await import("./dist-GL66KMUX.js");
+    const { osecDB: osecDB2 } = await import("./dist-4MAW5X6L.js");
     const db = new osecDB2(opts.dbPath);
     let scan2;
     let rows;
@@ -15036,7 +15238,7 @@ function strArray(value) {
 }
 
 // packages/cli/src/commands/file-review.ts
-import { resolve as resolve21 } from "node:path";
+import { resolve as resolve22 } from "node:path";
 function parseDurationMs2(raw) {
   const m = /^(\d+(?:\.\d+)?)(ms|s|m|h)?$/.exec(raw.trim());
   if (!m) throw new Error(`invalid duration '${raw}' \u2014 use e.g. 30m, 2h, 500ms`);
@@ -15067,7 +15269,7 @@ function registerFileReviewCommand(program) {
   program.command("file-review <target>").description(
     "Whole-repo file-level security review: regex scan \u2192 coverage gate \u2192 batched AI investigation (refusal audit, field repair) \u2192 optional static revalidation. Resumable: exit code 3 means a cost/duration limit stopped the run at a checkpoint \u2014 re-run the same command to continue."
   ).option("--project-id <id>", "Project id (defaults to the target basename)").option("--data-dir <path>", "Record store directory (default <target>/.0sec-review)").option("--runtime <mode>", "Engine runtime: api|claude|codex|gemini|ollama (default api)").option("-m, --model <model>", "Model for the investigation/revalidation agents").option("--timeout <ms>", "Per-invocation timeout in milliseconds", "600000").option("--max-cost-usd <usd>", "Hard USD cap for the whole run (resumable stop)").option("--max-duration <dur>", "Wall-clock cap: 30m / 2h / ms (resumable stop)").option("--batch-size <n>", "Files per investigation batch (default 5)").option("--concurrency <n>", "Batches in flight (default 2)").option("--inventory", "Generate the AI surface inventory + INFO.md first (requires claude, codex, or gemini)").option("--revalidate", "Run the static adversarial revalidation on HIGH+ findings").option("--json", "Emit the pipeline result as JSON").action(async (target, opts) => {
-    const rootPath = resolve21(target);
+    const rootPath = resolve22(target);
     const rtType = (opts.runtime ?? "api") === "auto" ? "api" : opts.runtime ?? "api";
     if (opts.inventory && (rtType === "api" || rtType === "ollama")) {
       console.error(
@@ -15143,12 +15345,12 @@ function registerFileReviewCommand(program) {
 }
 
 // packages/cli/src/commands/agent-assure.ts
-import { createHash as createHash5 } from "node:crypto";
-import { readFileSync as readFileSync19 } from "node:fs";
+import { createHash as createHash6 } from "node:crypto";
+import { readFileSync as readFileSync20 } from "node:fs";
 function readScenario(path) {
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(path, "utf8"));
+    raw = JSON.parse(readFileSync20(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`agent-assure: failed to read scenario ${path}: ${message}`);
@@ -15159,7 +15361,7 @@ function readHeaders(path, field) {
   if (!path) return {};
   let raw;
   try {
-    raw = JSON.parse(readFileSync19(path, "utf8"));
+    raw = JSON.parse(readFileSync20(path, "utf8"));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`agent-assure: failed to read ${field} file ${path}: ${message}`);
@@ -15206,7 +15408,7 @@ function assertInScope(scope, endpoint, label) {
   }
 }
 function readBaseline(path) {
-  const raw = readFileSync19(path, "utf8");
+  const raw = readFileSync20(path, "utf8");
   return {
     manifest: parseAgentActionEvidenceManifest(JSON.parse(raw)),
     sha256: agentActionManifestSha256(raw)
@@ -15223,11 +15425,11 @@ function registerAgentAssureCommand(program) {
     assertInScope(scope, opts.mcpEndpoint, "MCP endpoint");
     assertInScope(scope, opts.oracleEndpoint, "oracle endpoint");
     const baseline = opts.baseline ? readBaseline(opts.baseline) : void 0;
-    const scenarioPayloadSha256 = createHash5("sha256").update(scenario.payload).digest("hex");
+    const scenarioPayloadSha256 = createHash6("sha256").update(scenario.payload).digest("hex");
     if (baseline && (baseline.manifest.scenario.id !== scenario.id || baseline.manifest.scenario.payload_sha256 !== scenarioPayloadSha256)) {
       throw new Error("agent-assure: --baseline must describe the same scenario id and payload");
     }
-    const scopeRaw = readFileSync19(opts.scope, "utf8");
+    const scopeRaw = readFileSync20(opts.scope, "utf8");
     const timeoutMs = parsePositiveMilliseconds(opts.timeout, "--timeout");
     const oracleTimeoutMs = parsePositiveMilliseconds(opts.oracleTimeout, "--oracle-timeout");
     const run = await runAgentActionAssurance({
@@ -15247,7 +15449,7 @@ function registerAgentAssureCommand(program) {
       }),
       scenario,
       targetConfig: {
-        scopeSha256: createHash5("sha256").update(scopeRaw).digest("hex"),
+        scopeSha256: createHash6("sha256").update(scopeRaw).digest("hex"),
         environment: opts.environment,
         agentEndpoint: opts.agentEndpoint,
         mcpEndpoint: opts.mcpEndpoint,
@@ -15290,15 +15492,15 @@ function registerAgentAssureCommand(program) {
 
 // packages/cli/src/commands/binary.ts
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync14 } from "node:fs";
-import { dirname as dirname7, join as join15, resolve as resolve22 } from "node:path";
+import { existsSync as existsSync15 } from "node:fs";
+import { dirname as dirname7, join as join17, resolve as resolve23 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 var BINARY_MODES = ["triage", "run", "scan"];
 function locateOverseDir(startDir) {
   let dir = startDir ?? dirname7(fileURLToPath5(import.meta.url));
   for (let i = 0; i < 12; i++) {
-    const candidate = join15(dir, "0verse");
-    if (existsSync14(join15(candidate, "pyproject.toml"))) {
+    const candidate = join17(dir, "0verse");
+    if (existsSync15(join17(candidate, "pyproject.toml"))) {
       return candidate;
     }
     const parent = dirname7(dir);
@@ -15391,7 +15593,7 @@ function registerBinaryCommand(program) {
     const overseDir = resolution.overseDir;
     const argv = ["run", "--frozen", "0verse", ...resolution.argv ?? []];
     const child = spawn2("uv", argv, {
-      cwd: resolve22(overseDir),
+      cwd: resolve23(overseDir),
       stdio: "inherit",
       shell: false
     });
@@ -15413,17 +15615,17 @@ function registerBinaryCommand(program) {
 
 // packages/cli/src/commands/plugin.ts
 import { chmodSync, mkdirSync as mkdirSync11, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join18 } from "node:path";
 var cachedCore;
 async function defaultCorePort() {
   if (cachedCore) return cachedCore;
-  const mod = await import("./dist-FDKALV4R.js");
+  const mod = await import("./dist-4YICS2J2.js");
   cachedCore = mod;
   return mod;
 }
 var EXIT_OK4 = 0;
 var EXIT_USER_ERROR4 = 1;
-function resolve23(deps) {
+function resolve24(deps) {
   return {
     core: deps.core,
     fetchImpl: deps.fetchImpl ?? fetch,
@@ -15455,7 +15657,7 @@ function installedViews(d) {
   return out;
 }
 function runList(deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   const installed = installedViews(d);
   const record2 = d.core.readEnablement(d.projectPath, d.homeDir);
   const reconciled = d.core.reconcile(record2, installed);
@@ -15485,7 +15687,7 @@ function runList(deps) {
   process.exitCode = EXIT_OK4;
 }
 async function runSearch(query, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (d.registryUrl.trim().length === 0) {
     d.out("The Hackstore is disabled (registry URL is empty), so there is nothing to search.");
     d.out("  The default community Hackstore lives at github.com/0sec-labs/hackstore.");
@@ -15522,7 +15724,7 @@ async function runSearch(query, deps) {
   process.exitCode = EXIT_OK4;
 }
 async function runInstall(id, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (!d.core.isSafePluginId(id)) {
     d.err(source_default.red(`"${id}" is not a valid plugin id; refused before any filesystem access.`));
     process.exitCode = EXIT_USER_ERROR4;
@@ -15574,17 +15776,17 @@ function writePluginFiles(d, root, entry) {
   if (!d.core.ensurePluginsRoot(root)) {
     return { ok: false, error: `could not create the plugins root at ${root}` };
   }
-  const dir = join16(root, entry.id);
+  const dir = join18(root, entry.id);
   try {
     mkdirSync11(dir, { recursive: true, mode: d.core.PLUGIN_DIR_MODE });
     chmodSync(dir, d.core.PLUGIN_DIR_MODE);
-    const manifestPath = join16(dir, d.core.PLUGIN_MANIFEST_FILE);
+    const manifestPath = join18(dir, d.core.PLUGIN_MANIFEST_FILE);
     writeFileSync14(manifestPath, `${JSON.stringify(entry.manifest, null, 2)}
 `, {
       mode: d.core.PLUGIN_FILE_MODE
     });
     chmodSync(manifestPath, d.core.PLUGIN_FILE_MODE);
-    const entryPath = join16(dir, d.core.PLUGIN_ENTRY_FILE);
+    const entryPath = join18(dir, d.core.PLUGIN_ENTRY_FILE);
     writeFileSync14(entryPath, entryBody, { mode: d.core.PLUGIN_FILE_MODE });
     chmodSync(entryPath, d.core.PLUGIN_FILE_MODE);
     return { ok: true, dir };
@@ -15593,7 +15795,7 @@ function writePluginFiles(d, root, entry) {
   }
 }
 function runEnable(id, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (!d.core.isSafePluginId(id)) {
     d.err(source_default.red(`"${id}" is not a valid plugin id.`));
     process.exitCode = EXIT_USER_ERROR4;
@@ -15637,7 +15839,7 @@ function runEnable(id, deps) {
   process.exitCode = EXIT_OK4;
 }
 function runDisable(id, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (!d.core.isSafePluginId(id)) {
     d.err(source_default.red(`"${id}" is not a valid plugin id.`));
     process.exitCode = EXIT_USER_ERROR4;
@@ -15661,7 +15863,7 @@ function runDisable(id, deps) {
   process.exitCode = EXIT_OK4;
 }
 function runInfo(id, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (!d.core.isSafePluginId(id)) {
     d.err(source_default.red(`"${id}" is not a valid plugin id.`));
     process.exitCode = EXIT_USER_ERROR4;
@@ -15680,7 +15882,7 @@ function runInfo(id, deps) {
   const enabled = d.core.isEnabled(record2, id);
   d.out(source_default.bold(`${m.name} (${m.id}@${m.version})`));
   if (m.minCoreVersion) d.out(`  Requires @0sec/core >= ${m.minCoreVersion}`);
-  d.out(`  Source: ${join16(root, id)}`);
+  d.out(`  Source: ${join18(root, id)}`);
   d.out(`  Enabled for this project: ${enabled ? source_default.green("yes") : source_default.dim("no")}`);
   d.out(`  Aggregated capabilities: ${capSummary(d.core.aggregateCapabilities(m))}`);
   d.out(source_default.dim("  Signature: not re-verified after install (verification happens at fetch time)."));
@@ -15717,7 +15919,7 @@ function parseRunArgs(pairs, jsonArgs) {
   return { ok: true, args: args2 };
 }
 async function runRun(id, tool, pairs, deps) {
-  const d = resolve23(deps);
+  const d = resolve24(deps);
   if (!d.core.isSafePluginId(id)) {
     d.err(source_default.red(`"${id}" is not a valid plugin id.`));
     process.exitCode = EXIT_USER_ERROR4;
@@ -15868,7 +16070,7 @@ var EXIT_USER_ERROR5 = 1;
 var cachedCore2;
 async function defaultThemeCorePort() {
   if (cachedCore2) return cachedCore2;
-  const mod = await import("./dist-FDKALV4R.js");
+  const mod = await import("./dist-4YICS2J2.js");
   cachedCore2 = mod;
   return mod;
 }
@@ -16073,8 +16275,8 @@ function registerThemeCommand(program) {
 }
 
 // packages/cli/src/commands/evolve.ts
-import { readFileSync as readFileSync20, existsSync as existsSync15 } from "node:fs";
-import { resolve as resolve24 } from "node:path";
+import { readFileSync as readFileSync21, existsSync as existsSync16 } from "node:fs";
+import { resolve as resolve25 } from "node:path";
 var EXIT_OK6 = 0;
 var EXIT_USER_ERROR6 = 1;
 var EXIT_RUNTIME_ERROR = 2;
@@ -16221,13 +16423,13 @@ function registerEvolveCommand(program) {
   });
   evolve.command("status").description("Show active and canary versions, snapshot identities, and registry events").option("--store <path>", "Required path to evolution store directory").option("--json", "Output structured JSON").action(async (opts) => {
     try {
-      const storePath = opts.store ? resolve24(opts.store) : void 0;
+      const storePath = opts.store ? resolve25(opts.store) : void 0;
       if (!storePath) {
         console.error(source_default.red("--store <path> is required. Point it to the evolution store directory containing registry.json."));
         process.exitCode = EXIT_USER_ERROR6;
         return;
       }
-      if (!existsSync15(storePath)) {
+      if (!existsSync16(storePath)) {
         console.error(source_default.red(`store directory not found: ${storePath}`));
         process.exitCode = EXIT_USER_ERROR6;
         return;
@@ -16250,7 +16452,7 @@ function registerEvolveCommand(program) {
     const interrupt = () => controller.abort();
     process.once("SIGINT", interrupt);
     try {
-      const result = await approveEvolutionCandidate(resolve24(opts.store), opts.version, { signal: controller.signal });
+      const result = await approveEvolutionCandidate(resolve25(opts.store), opts.version, { signal: controller.signal });
       if (opts.json) console.log(JSON.stringify(result));
       else console.log(`Promoted ${result.versionId}; canary cost $${result.evaluationCostUsd.toFixed(4)}`);
       process.exitCode = EXIT_OK6;
@@ -16265,8 +16467,8 @@ function registerEvolveCommand(program) {
   });
   evolve.command("rollback").description("Retire an active or canary evolution version and restore its parent").requiredOption("--store <path>", "Path to evolution store directory").requiredOption("--version <id>", "Active or canary version ID to retire").option("--reason <text>", "Reason for rollback", "operator rollback").action(async (opts) => {
     try {
-      const storePath = resolve24(opts.store);
-      if (!existsSync15(storePath)) {
+      const storePath = resolve25(opts.store);
+      if (!existsSync16(storePath)) {
         console.error(source_default.red(`store directory not found: ${storePath}`));
         process.exitCode = EXIT_USER_ERROR6;
         return;
@@ -16333,9 +16535,9 @@ function registerEvolveCommand(program) {
   const feedback = evolve.command("feedback").description("Capture, approve, and inspect evolution feedback candidates");
   feedback.command("capture").description("Capture an evidence-backed observation from a JSON file; does not confirm a finding").requiredOption("--input <path>", "Observation JSON file with source revision and evidence references").option("--store <path>", "Feedback queue JSON file").option("--allow-source-access", "Explicitly consent to source use for this observation").action((opts) => {
     try {
-      const input = parseObservationInput(JSON.parse(readFileSync20(resolve24(opts.input), "utf8")));
+      const input = parseObservationInput(JSON.parse(readFileSync21(resolve25(opts.input), "utf8")));
       const result = captureObservation({ ...input, consent: opts.allowSourceAccess === true }, {
-        ...opts.store ? { storePath: resolve24(opts.store) } : {}
+        ...opts.store ? { storePath: resolve25(opts.store) } : {}
       });
       console.log(JSON.stringify(result, null, 2));
       process.exitCode = EXIT_OK6;
@@ -16346,9 +16548,9 @@ function registerEvolveCommand(program) {
   });
   feedback.command("approve").description("Approve independent positive, held-out, and negative fixtures for an observation").requiredOption("--id <feedback-id>", "Full observation ID").requiredOption("--fixtures <path>", "Curation JSON containing positives, heldOut, and negativeControls").option("--store <path>", "Feedback queue JSON file").option("--allow-source-access", "Explicitly consent to source use for synthesis").action((opts) => {
     try {
-      const shape = parseApprovedObservationShape(JSON.parse(readFileSync20(resolve24(opts.fixtures), "utf8")));
+      const shape = parseApprovedObservationShape(JSON.parse(readFileSync21(resolve25(opts.fixtures), "utf8")));
       const result = approveObservation(opts.id, shape, {
-        ...opts.store ? { storePath: resolve24(opts.store) } : {},
+        ...opts.store ? { storePath: resolve25(opts.store) } : {},
         ...opts.allowSourceAccess === true ? { allowModelSourceAccess: true } : {}
       });
       if (!result) throw new Error("observation was not found or is not pending");
@@ -16361,7 +16563,7 @@ function registerEvolveCommand(program) {
   });
   feedback.command("release").description("Release a stale processing claim after its worker has stopped").requiredOption("--id <feedback-id>", "Full observation ID").requiredOption("--claim-token <token>", "Exact claim token shown by feedback status --json").option("--store <path>", "Feedback queue JSON file").action((opts) => {
     try {
-      if (!releaseClaim(opts.id, opts.claimToken, opts.store ? { storePath: resolve24(opts.store) } : {})) {
+      if (!releaseClaim(opts.id, opts.claimToken, opts.store ? { storePath: resolve25(opts.store) } : {})) {
         throw new Error("observation or processing claim no longer matches");
       }
       console.log(`Released feedback claim ${opts.id}`);
@@ -16373,7 +16575,7 @@ function registerEvolveCommand(program) {
   });
   feedback.command("status").description("Show retained observations and their approval/processing status").option("--store <path>", "Feedback queue JSON file").option("--json", "Output structured JSON").action((opts) => {
     try {
-      const observations = listObservations(void 0, { ...opts.store ? { storePath: resolve24(opts.store) } : {} });
+      const observations = listObservations(void 0, { ...opts.store ? { storePath: resolve25(opts.store) } : {} });
       if (opts.json) console.log(JSON.stringify(observations, null, 2));
       else if (observations.length === 0) console.log("No feedback observations.");
       else for (const observation of observations) console.log(`${observation.id}  ${observation.status}  ${observation.classHint}`);
@@ -16386,7 +16588,7 @@ function registerEvolveCommand(program) {
 }
 
 // packages/cli/src/commands/config.ts
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync16 } from "node:fs";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync16 } from "node:fs";
 var EXIT_OK7 = 0;
 var EXIT_USER_ERROR7 = 1;
 var SECURITY_KEYS = SETTING_DEFS.filter(
@@ -16454,7 +16656,7 @@ function runConfigImport(file, deps = {}) {
   const scope = deps.scope ?? "global";
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync21(file, "utf8"));
+    parsed = JSON.parse(readFileSync22(file, "utf8"));
   } catch (e) {
     err(source_default.red(`Could not read ${file}: ${e instanceof Error ? e.message : String(e)}`));
     process.exitCode = EXIT_USER_ERROR7;
@@ -16519,8 +16721,8 @@ function registerConfigCommand(program) {
 }
 
 // packages/cli/src/commands/hackstore.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync12, readdirSync as readdirSync2, readFileSync as readFileSync22, statSync as statSync3, writeFileSync as writeFileSync17 } from "node:fs";
-import { join as join17, resolve as resolve25 } from "node:path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync12, readdirSync as readdirSync2, readFileSync as readFileSync23, statSync as statSync3, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join19, resolve as resolve26 } from "node:path";
 var HACKSTORE_REGISTRY_REPO = "github.com/0sec-labs/hackstore";
 var HACKSTORE_SCHEMA_ID = "https://raw.githubusercontent.com/0sec-labs/hackstore/main/hackstore-manifest.schema.json";
 var MANIFEST_FILE = "manifest.json";
@@ -16529,18 +16731,18 @@ var EXIT_USER_ERROR8 = 1;
 var cachedCore3;
 async function defaultCorePort2() {
   if (cachedCore3) return cachedCore3;
-  const mod = await import("./dist-FDKALV4R.js");
+  const mod = await import("./dist-4YICS2J2.js");
   cachedCore3 = { validatePluginManifest: mod.validatePluginManifest };
   return cachedCore3;
 }
 function resolveManifestPath2(pathArg) {
-  const target = resolve25(pathArg);
-  if (!existsSync16(target)) {
+  const target = resolve26(pathArg);
+  if (!existsSync17(target)) {
     return { ok: false, error: `path does not exist: ${target}` };
   }
   const stat3 = statSync3(target);
-  const file = stat3.isDirectory() ? join17(target, MANIFEST_FILE) : target;
-  if (!existsSync16(file)) {
+  const file = stat3.isDirectory() ? join19(target, MANIFEST_FILE) : target;
+  if (!existsSync17(file)) {
     return { ok: false, error: `no ${MANIFEST_FILE} found at: ${file}` };
   }
   return { ok: true, file };
@@ -16563,7 +16765,7 @@ function runValidate(pathArg, deps) {
   }
   let raw;
   try {
-    raw = JSON.parse(readFileSync22(located.file, "utf8"));
+    raw = JSON.parse(readFileSync23(located.file, "utf8"));
   } catch (err) {
     fail2([`${MANIFEST_FILE} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`]);
     return;
@@ -16686,15 +16888,15 @@ input.on("line", (line) => {
 `;
 }
 function isNonEmptyDir(dir) {
-  if (!existsSync16(dir)) return false;
+  if (!existsSync17(dir)) return false;
   const stat3 = statSync3(dir);
   if (!stat3.isDirectory()) return true;
   return readdirSync2(dir).length > 0;
 }
 function runInit(name, deps) {
-  const base = deps.dir ? resolve25(deps.dir) : process.cwd();
-  const targetDir = join17(base, name);
-  if (existsSync16(targetDir) && statSync3(targetDir).isFile()) {
+  const base = deps.dir ? resolve26(deps.dir) : process.cwd();
+  const targetDir = join19(base, name);
+  if (existsSync17(targetDir) && statSync3(targetDir).isFile()) {
     console.error(source_default.red(`Cannot scaffold: a file already exists at ${targetDir}`));
     process.exitCode = EXIT_USER_ERROR8;
     return;
@@ -16709,10 +16911,10 @@ function runInit(name, deps) {
   const manifest = scaffoldManifest(name);
   const id = manifest.id;
   mkdirSync12(targetDir, { recursive: true });
-  writeFileSync17(join17(targetDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync17(join19(targetDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
-  writeFileSync17(join17(targetDir, "README.md"), scaffoldReadme(name, id), "utf8");
-  writeFileSync17(join17(targetDir, "plugin.js"), scaffoldPluginSource(), "utf8");
+  writeFileSync17(join19(targetDir, "README.md"), scaffoldReadme(name, id), "utf8");
+  writeFileSync17(join19(targetDir, "plugin.js"), scaffoldPluginSource(), "utf8");
   console.log(source_default.green(`Scaffolded Hackstore extension ${source_default.bold(id)} in ${targetDir}`));
   console.log("");
   console.log(source_default.bold("  Files:"));
@@ -16721,7 +16923,7 @@ function runInit(name, deps) {
   console.log(`    plugin.js          self-contained plugin (NDJSON protocol over stdio)`);
   console.log("");
   console.log(source_default.bold("  Next steps:"));
-  console.log(`    1. Edit ${join17(name, MANIFEST_FILE)} \u2014 declare your tools + capabilities`);
+  console.log(`    1. Edit ${join19(name, MANIFEST_FILE)} \u2014 declare your tools + capabilities`);
   console.log(`    2. Validate:  ${source_default.cyan(`0sec hackstore validate ${name}`)}`);
   console.log(`    3. Test locally and submit: https://${HACKSTORE_REGISTRY_REPO}/blob/main/CONTRIBUTING.md`);
   process.exitCode = EXIT_OK8;
@@ -16745,6 +16947,7 @@ export {
   registerBinaryCommand,
   registerCloudCommand,
   registerConfigCommand,
+  registerConnectCommand,
   registerConsoleCommand,
   registerCveCommand,
   registerDashboardCommand,
@@ -16783,6 +16986,7 @@ export {
   registerResumeCommand,
   registerReviewCommand,
   registerScanCommand,
+  registerSecureCommand,
   registerSpecdriftCommand,
   registerThemeCommand,
   registerTimelineCommand,