0sec-cli 0.17.0 → 0.21.4

package/chunks/{chunk-3MOLBTLS.js → chunk-K2PWUPUI.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/agent/cve-exploit-codex.js
 var CVE_EXPLOIT_CODEX = {

package/chunks/{chunk-MMLDQR4H.js → chunk-NDJU5ZZ7.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  LlmApiRuntime
-} from "./chunk-2SANI5RH.js";
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   ProcessRuntime
-} from "./chunk-CLHCDHP4.js";
+} from "./chunk-ER3SUMYJ.js";
+import {
+  LlmApiRuntime
+} from "./chunk-BACXRTQ4.js";
 
 // packages/core/dist/runtime/cli-native.js
 import { spawn } from "node:child_process";
@@ -215,7 +215,7 @@ function buildClaudePromptFromLastUser(messages) {
   }
   const parts = [];
   if (toolResults.length > 0) {
-    parts.push(`[0sec:tool_results]
+    parts.push(`[0:tool_results]
 ${JSON.stringify(toolResults, null, 2)}`);
   }
   if (textParts.length > 0) {
@@ -327,7 +327,7 @@ var OpenRouterRuntime = class _OpenRouterRuntime {
         });
       }
     } else {
-      const model = config.model ?? process.env["0SEC_MODEL"] ?? "anthropic/claude-sonnet-4.6";
+      const model = config.model ?? process.env["ZERO_MODEL"] ?? "anthropic/claude-sonnet-4.6";
       this.singleRuntime = this.createModelRuntime(model);
     }
   }
@@ -345,7 +345,7 @@ var OpenRouterRuntime = class _OpenRouterRuntime {
     if (this.ensembleRuntimes.length > 0) {
       return this.ensembleRuntimes.map((e) => e.model);
     }
-    return [this.config.model ?? process.env["0SEC_MODEL"] ?? "anthropic/claude-sonnet-4.6"];
+    return [this.config.model ?? process.env["ZERO_MODEL"] ?? "anthropic/claude-sonnet-4.6"];
   }
   /** Whether this runtime is in ensemble mode. */
   get isEnsemble() {
@@ -638,7 +638,7 @@ var OllamaRuntime = class {
    * Behaviour:
    *  - Each non-terminal frame's `message.content` is treated as a delta and
    *    forwarded to `callbacks.onDelta("assistant_response", delta)` exactly
-   *    once (no accumulation passed to the callback — 0sec's contract is
+   *    once (no accumulation passed to the callback — 0's contract is
    *    "incremental fragment only", see types.ts:88).
    *  - The terminal frame (`done: true`) is taken as authoritative for
    *    `tool_calls`, `done_reason`, and usage stats. Tool-call shape across
@@ -767,7 +767,7 @@ var RUNTIME_REGISTRY = [
   {
     type: "codex",
     command: "codex",
-    description: "Codex CLI / direct ChatGPT Codex provider \u2014 full parity across web scans, package audits (npm/pypi/cargo/oci), and source code review (incl. linux-kernel). Set 0SEC_CHATGPT_OAUTH_REFRESH_TOKEN to enable subscription auth without the local CLI binary (#402).",
+    description: "Codex CLI / direct ChatGPT Codex provider \u2014 full parity across web scans, package audits (npm/pypi/cargo/oci), and source code review (incl. linux-kernel). Set ZERO_CHATGPT_OAUTH_REFRESH_TOKEN to enable subscription auth without the local CLI binary (#402).",
     strengths: ["verify", "source-analysis", "discovery"],
     supportsSystemPrompt: false
   },
@@ -784,7 +784,7 @@ var RUNTIME_REGISTRY = [
     // so detection tools that key off `command` don't crash; the registry
     // uses `isAvailable()` not `which(command)` for ollama.
     command: "ollama",
-    description: "Ollama (local) \u2014 Gemma 4 27B via /api/chat with native function-calling. Pairs with `--seed-findings` for full-local hunts. See 0sec#369.",
+    description: "Ollama (local) \u2014 Gemma 4 27B via /api/chat with native function-calling. Pairs with `--seed-findings` for full-local hunts. See 0#369.",
     strengths: ["source-analysis", "discovery"],
     supportsSystemPrompt: true
   }
@@ -806,7 +806,7 @@ function pickRuntimeForStage(stage, availableRuntimes) {
   return first.done ? "claude" : first.value;
 }
 async function detectAvailableRuntimes() {
-  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-3Q7QJIOZ.js");
+  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-PNMC36JI.js");
   const available = /* @__PURE__ */ new Set();
   const checks = RUNTIME_REGISTRY.map(async (info) => {
     const rt = new ProcessRuntime2({ type: info.type, timeout: 5e3 });
@@ -832,7 +832,7 @@ function createRuntime(config) {
       return new ProcessRuntime(config);
     case "ollama":
       return new OllamaRuntime({
-        model: config.model ?? process.env["0SEC_OLLAMA_MODEL"] ?? "gemma4:27b",
+        model: config.model ?? process.env["ZERO_OLLAMA_MODEL"] ?? "gemma4:27b",
         timeout: config.timeout,
         host: process.env.OLLAMA_HOST
       });

package/chunks/{chunk-H44E2CRN.js → chunk-NOPBXZUV.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/cli/src/tui/session-store.ts
 import { chmodSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

package/chunks/{chunk-HE7LCA7G.js → chunk-O6SD4A36.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-SAFFWQW4.js → chunk-P6YG6TEZ.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   describeEdgeTechnique,
   highValueTargetIds,
   reachableTo,
   shortestPaths
-} from "./chunk-VQG4FT5D.js";
+} from "./chunk-UFHN6RIU.js";
 
 // packages/core/dist/identity/graph-client.js
 var DEFAULT_BASE_URL = "https://graph.microsoft.com/v1.0";
@@ -84,7 +84,7 @@ var GraphClient = class {
     this.pageDelayMs = opts.pageDelayMs ?? DEFAULT_PAGE_DELAY_MS;
     this.maxPages = opts.maxPages ?? DEFAULT_MAX_PAGES;
     this.sleep = opts.sleep ?? defaultSleep;
-    this.userAgent = opts.userAgent ?? "0sec-identity";
+    this.userAgent = opts.userAgent ?? "0-identity";
   }
   /** GET a v1.0-relative path (`/users`) and return the parsed body. */
   async get(path, query) {
@@ -4283,7 +4283,7 @@ function ingestAzureHound(documents) {
   for (const missing of ["azusers", "azgroups", "azroleassignments"].filter((c) => !seen.has(c))) {
     warnings.push(`export carried no \`${missing}\` collection; coverage is partial`);
   }
-  warnings.push("AzureHound exports do not include conditional-access policies, federation configuration, or PIM eligibility schedules \u2014 run `0sec identity` against a live tenant for the posture checks that read them");
+  warnings.push("AzureHound exports do not include conditional-access policies, federation configuration, or PIM eligibility schedules \u2014 run `0 identity` against a live tenant for the posture checks that read them");
   const relationships = haveRelationships ? {
     groupMembers,
     groupOwners,
@@ -4713,7 +4713,7 @@ function describeGaps(correspondences, coverage, conflicts, adNodeCount, entraNo
   if (correspondences.length === 0) {
     gaps.push(`NO IDENTITY CORRESPONDENCE COULD BE ESTABLISHED between the ${adNodeCount} on-premises principal(s) and the ${entraNodeCount} cloud principal(s) collected. No hybrid attack path could be computed, and that is a limit of the input, NOT a finding that the two directories are unconnected.`);
     if (!anchorsPresent) {
-      gaps.push("None of the cloud objects carried onPremisesImmutableId, onPremisesSecurityIdentifier, or onPremisesDistinguishedName. These attributes are not part of an AzureHound export and are dropped by Microsoft Graph when the token lacks directory read scope \u2014 so the most likely explanation is that they were never collected. Re-collect with `0sec identity` against the tenant, or supply the correspondence directly via `knownCorrespondences`.");
+      gaps.push("None of the cloud objects carried onPremisesImmutableId, onPremisesSecurityIdentifier, or onPremisesDistinguishedName. These attributes are not part of an AzureHound export and are dropped by Microsoft Graph when the token lacks directory read scope \u2014 so the most likely explanation is that they were never collected. Re-collect with `0 identity` against the tenant, or supply the correspondence directly via `knownCorrespondences`.");
     } else {
       gaps.push(`Synchronisation anchors WERE present on the cloud objects (immutableId: ${coverage["immutable-id"].entraObjectsCarrying}, SID: ${coverage["security-identifier"].entraObjectsCarrying}) but matched no collected on-premises object. The two collections most likely cover different forests or different scopes of the same forest.`);
     }

package/chunks/{chunk-KKGE5RQE.js → chunk-PC6RCKQV.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   external_exports
-} from "./chunk-YLMN3N25.js";
+} from "./chunk-VIT5ALXF.js";
 
 // packages/shared/dist/identity.js
 function defaultRoleFor(auth) {
@@ -45,7 +45,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.17.0";
+    return "0.21.4";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));
@@ -200,11 +200,18 @@ var MANUAL_PRICING = {
   // which this schema cannot represent.
   "DeepSeek-V4-Pro": { input: 1.74, output: 3.48 },
   "DeepSeek-V4-Flash": { input: 0.19, output: 0.51 },
+  // Fireworks Priority list-rate estimate, not an Azure invoice.
+  // The cache estimate remains rounded; don't substitute direct API pricing
+  // for the separately metered Foundry deployment.
+  "deepseek-v4.1-flash": { input: 0.375, output: 1.5, cachedInput: 8e-3 },
   "Kimi-K2.7-Code": { input: 0.95, output: 4, cachedInput: 0.19 },
   "gpt-oss-120b": { input: 0.15, output: 0.6 },
   "gpt-5.6-sol": { input: 5, output: 30, cachedInput: 0.5 },
   "gpt-5.6-luna": { input: 1, output: 6, cachedInput: 0.1 },
   "gpt-5.6-terra": { input: 2.5, output: 15, cachedInput: 0.25 },
+  // Azure Global Standard short-context list estimate (2026-09-23).
+  // Hosted settlement separately meters cache writes and bounds input context.
+  "gpt-6-luna": { input: 0.1, output: 0.5, cachedInput: 0.01 },
   default: { input: 3, output: 15 }
 };
 var MODEL_PRICING = {
@@ -214,11 +221,14 @@ var MODEL_PRICING = {
 var AZURE_DEPLOYMENT_PRICE_ALIASES = /* @__PURE__ */ new Map([
   ["deepseek-v4-pro", "DeepSeek-V4-Pro"],
   ["deepseek-v4-flash", "DeepSeek-V4-Flash"],
+  ["deepseek-v4.1-flash", "deepseek-v4.1-flash"],
+  ["fw-deepseek-v4.1-flash", "deepseek-v4.1-flash"],
   ["kimi-k2.7-code", "Kimi-K2.7-Code"],
   ["gpt-oss-120b", "gpt-oss-120b"],
   ["gpt-5.6-sol", "gpt-5.6-sol"],
   ["gpt-5.6-luna", "gpt-5.6-luna"],
-  ["gpt-5.6-terra", "gpt-5.6-terra"]
+  ["gpt-5.6-terra", "gpt-5.6-terra"],
+  ["gpt-6-luna", "gpt-6-luna"]
 ]);
 function azureDeploymentPriceKey(model) {
   const lower = model.toLowerCase();
@@ -255,7 +265,7 @@ function getRates(model) {
   const rates = MODEL_PRICING[key] ?? (aliasKey ? MODEL_PRICING[aliasKey] : void 0);
   if (!rates) {
     if (model)
-      console.warn(`[0sec] Unknown model for cost estimation: ${model}`);
+      console.warn(`[0] Unknown model for cost estimation: ${model}`);
     return MODEL_PRICING.default;
   }
   return rates;
@@ -832,17 +842,21 @@ function researchPlatformLpeDisclosureReady(envelope, platform) {
 import { homedir } from "node:os";
 import { join as join2 } from "node:path";
 function homeStateDir(home = homedir()) {
-  return join2(home, ".0sec");
+  return join2(home, ".0");
+}
+function cloudStateDir(home = homedir(), env = process.env) {
+  const state = homeStateDir(home);
+  return env["ZERO_DEV_SOURCE_ROOT"]?.trim() ? join2(state, "dev") : state;
 }
 function runStateDir(runId, home) {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(runId)) {
-    throw new Error(`Invalid 0sec run id ${JSON.stringify(runId)}.`);
+    throw new Error(`Invalid 0 run id ${JSON.stringify(runId)}.`);
   }
   return join2(homeStateDir(home), "runs", runId);
 }
 
 // packages/shared/dist/agent-assurance.js
-var AGENT_ACTION_ASSURANCE_SCHEMA_VERSION = "0sec.agent-action-assurance/v1";
+var AGENT_ACTION_ASSURANCE_SCHEMA_VERSION = "0.agent-action-assurance/v1";
 var AgentInjectionVectorSchema = external_exports.enum([
   "readme",
   "code-comment",
@@ -972,7 +986,7 @@ function parseAgentActionEvidenceManifest(value) {
 }
 
 // packages/shared/dist/presentation.js
-var PRESENTATION_PROTOCOL = "0sec.presentation/v1";
+var PRESENTATION_PROTOCOL = "0.presentation/v1";
 function createTranscriptDocument(entries) {
   return {
     protocol: PRESENTATION_PROTOCOL,
@@ -1015,6 +1029,176 @@ var DESKTOP_CONSOLE_SCHEMA_VERSION = 1;
 var DEFAULT_AUTONOMY_MODE = "yolo";
 var DEFAULT_ALLOW_MODEL_SELF_EXTENSION = true;
 
+// packages/shared/dist/jev.js
+var FEATURES = ["browser", "memory", "dedupe", "redteam", "kernel", "crash", "radar", "foxguard"];
+var INPUT_USD_PER_TOKEN = 0.042 / 1e6;
+var MAX_INPUT_TOKENS = 65536;
+var REQUEST_RESERVATION_USD = MAX_INPUT_TOKENS * INPUT_USD_PER_TOKEN;
+var probability = external_exports.number().finite().min(0).max(1);
+var questionSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("boolean"),
+    instructions: external_exports.string().min(1).max(8192),
+    criteria: external_exports.object({ true: external_exports.string().max(4096), false: external_exports.string().max(4096) }).optional()
+  }).strict(),
+  external_exports.object({
+    type: external_exports.literal("choice"),
+    instructions: external_exports.string().min(1).max(8192),
+    criteria: external_exports.record(external_exports.string().min(1).max(128), external_exports.string().max(4096)).refine((value) => Object.keys(value).length >= 2 && Object.keys(value).length <= 64)
+  }).strict()
+]);
+var normalizedAnswerSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({ type: external_exports.literal("boolean"), probability }),
+  external_exports.object({ type: external_exports.literal("choice"), choice: external_exports.string(), probabilities: external_exports.record(probability) })
+]);
+var usageSchema = external_exports.object({
+  inputTokens: external_exports.number().int().nonnegative().max(MAX_INPUT_TOKENS),
+  outputTokens: external_exports.number().int().nonnegative()
+});
+function positiveNumber(value, fallback, name) {
+  if (value === void 0)
+    return fallback;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0)
+    throw new Error(`${name} must be a positive number`);
+  return parsed;
+}
+function jevConfigFromEnvironment(feature, environment) {
+  const requested = (environment["ZERO_JEV_FEATURES"] ?? "").split(",").map((item) => item.trim()).filter(Boolean);
+  for (const name of requested) {
+    if (!FEATURES.includes(name))
+      throw new Error(`Unknown ZERO_JEV_FEATURES entry: ${name}`);
+  }
+  if (!requested.includes(feature))
+    return void 0;
+  const provider = environment["ZERO_JEV_PROVIDER"] ?? "vercel";
+  if (provider !== "vercel" && provider !== "cloud") {
+    throw new Error("ZERO_JEV_PROVIDER must be vercel or cloud");
+  }
+  const common = {
+    timeoutMs: positiveNumber(environment["ZERO_JEV_TIMEOUT_MS"], 1e4, "ZERO_JEV_TIMEOUT_MS"),
+    maxRequests: positiveNumber(environment["ZERO_JEV_MAX_REQUESTS"], 100, "ZERO_JEV_MAX_REQUESTS"),
+    maxCostUsd: positiveNumber(environment["ZERO_JEV_MAX_COST_USD"], 0.1, "ZERO_JEV_MAX_COST_USD")
+  };
+  const keyName = provider === "cloud" ? "ZERO_JEV_CLOUD_TOKEN" : "AI_GATEWAY_API_KEY";
+  const apiKey = environment[keyName]?.trim();
+  if (!apiKey)
+    throw new Error(`${keyName} is required when Jev assistance is enabled`);
+  if (provider === "cloud") {
+    return { provider, apiKey, cloudUrl: environment["ZERO_JEV_CLOUD_URL"], feature, ...common };
+  }
+  return {
+    provider,
+    apiKey,
+    ...common
+  };
+}
+function createJevEvaluator(config) {
+  if (!config.apiKey.trim())
+    throw new Error("A Jev provider credential is required");
+  const timeoutMs = config.timeoutMs ?? 1e4;
+  const maxRequests = config.maxRequests ?? 100;
+  const maxCostUsd = config.maxCostUsd ?? 0.1;
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4 || !Number.isInteger(maxRequests) || maxRequests < 1 || maxRequests > 1e4 || !Number.isFinite(maxCostUsd) || maxCostUsd <= 0) {
+    throw new Error("Invalid Jev timeout, request limit, or cost budget");
+  }
+  if (config.provider === "cloud") {
+    const url = new URL(config.cloudUrl ?? "");
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) || url.username || url.password || url.search || url.hash || !config.feature || !FEATURES.includes(config.feature)) {
+      throw new Error("Invalid Jev cloud evaluation endpoint or feature");
+    }
+  }
+  let requests = 0;
+  let chargedOrReservedUsd = 0;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  return {
+    async evaluate(request) {
+      request.signal?.throwIfAborted();
+      const questions = external_exports.record(external_exports.string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/), questionSchema).parse(request.questions);
+      const questionIds = Object.keys(questions);
+      if (questionIds.length < 1 || questionIds.length > 64)
+        throw new Error("Jev requires between 1 and 64 questions");
+      const encoded = JSON.stringify({ state: request.state, questions });
+      if (encoded.length > 32e3)
+        throw new Error("Jev state and questions exceed the bounded input limit");
+      if (requests >= maxRequests || chargedOrReservedUsd + REQUEST_RESERVATION_USD > maxCostUsd) {
+        throw new Error("Jev workflow evaluation budget exhausted");
+      }
+      requests++;
+      chargedOrReservedUsd += REQUEST_RESERVATION_USD;
+      const startedAt = performance.now();
+      const signal = request.signal ? AbortSignal.any([request.signal, AbortSignal.timeout(timeoutMs)]) : AbortSignal.timeout(timeoutMs);
+      let rawAnswers;
+      let model;
+      let rawUsage;
+      try {
+        if (config.provider === "cloud") {
+          const response = await fetchImpl(config.cloudUrl, {
+            method: "POST",
+            signal,
+            redirect: "error",
+            headers: { Authorization: `Bearer ${config.apiKey}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ feature: config.feature, state: request.state, questions })
+          });
+          if (!response.ok)
+            throw new Error(`Jev provider returned HTTP ${response.status}`);
+          const body = external_exports.object({ model: external_exports.string().min(1), answers: external_exports.record(external_exports.unknown()), usage: usageSchema }).parse(await response.json());
+          model = body.model;
+          rawUsage = body.usage;
+          rawAnswers = body.answers;
+        } else {
+          const [{ experimental_evaluate: evaluate }, { createGateway }] = await Promise.all([
+            import("./dist-KEULE5IQ.js"),
+            import("./dist-XZB53PS5.js")
+          ]);
+          signal.throwIfAborted();
+          const gateway = createGateway({ apiKey: config.apiKey, fetch: fetchImpl });
+          const result = await evaluate({
+            model: gateway.evaluationModel("typesafe-ai/jev"),
+            state: typeof request.state === "string" ? request.state : JSON.stringify(request.state),
+            questions,
+            abortSignal: signal,
+            maxRetries: 0
+          });
+          model = result.response.modelId;
+          rawUsage = result.usage;
+          rawAnswers = result.answers;
+        }
+        signal.throwIfAborted();
+        const parsedUsage = usageSchema.parse(rawUsage);
+        const usage = { ...parsedUsage, estimatedCostUsd: parsedUsage.inputTokens * INPUT_USD_PER_TOKEN };
+        chargedOrReservedUsd += usage.estimatedCostUsd - REQUEST_RESERVATION_USD;
+        config.onUsage?.(usage);
+        if (Object.keys(rawAnswers).length !== questionIds.length)
+          throw new Error("Jev returned unexpected answer IDs");
+        const answers = /* @__PURE__ */ Object.create(null);
+        for (const id of questionIds) {
+          const question = questions[id];
+          const answer = normalizedAnswerSchema.parse(rawAnswers[id]);
+          if (question.type !== answer.type)
+            throw new Error("Jev answer type does not match its question");
+          if (question.type === "choice" && answer.type === "choice") {
+            const options = Object.keys(question.criteria);
+            if (!Object.hasOwn(question.criteria, answer.choice) || Object.keys(answer.probabilities).length !== options.length || options.some((option) => !Object.hasOwn(answer.probabilities, option)) || Math.abs(options.reduce((sum, option) => sum + answer.probabilities[option], 0) - 1) > 0.02 || options.some((option) => answer.probabilities[option] > answer.probabilities[answer.choice])) {
+              throw new Error("Jev returned an invalid choice distribution");
+            }
+          }
+          answers[id] = answer;
+        }
+        return { model, answers, usage, durationMs: performance.now() - startedAt };
+      } catch (error) {
+        if (signal.aborted)
+          throw new Error(request.signal?.aborted ? "Jev evaluation cancelled" : "Jev evaluation timed out");
+        if (error instanceof external_exports.ZodError)
+          throw new Error("Jev provider returned malformed evaluation data");
+        if (error instanceof Error && /^Jev (provider returned HTTP \d{3}|returned (unexpected answer IDs|an invalid choice distribution)|answer type does not match its question)$/.test(error.message))
+          throw error;
+        throw new Error("Jev evaluation unavailable; retain the existing decision path");
+      }
+    }
+  };
+}
+
 export {
   defaultRoleFor,
   resolveIdentities,
@@ -1073,6 +1257,7 @@ export {
   researchWindowsLpeDisclosureReady,
   researchPlatformLpeDisclosureReady,
   homeStateDir,
+  cloudStateDir,
   runStateDir,
   AGENT_ACTION_ASSURANCE_SCHEMA_VERSION,
   AgentInjectionVectorSchema,
@@ -1090,5 +1275,7 @@ export {
   isPresentationEvent,
   DESKTOP_CONSOLE_SCHEMA_VERSION,
   DEFAULT_AUTONOMY_MODE,
-  DEFAULT_ALLOW_MODEL_SELF_EXTENSION
+  DEFAULT_ALLOW_MODEL_SELF_EXTENSION,
+  jevConfigFromEnvironment,
+  createJevEvaluator
 };

package/chunks/{chunk-LP3HHYQU.js → chunk-PD2BBBKT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/agent/apply-patch.js
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";

package/chunks/{chunk-BKZFDZ23.js → chunk-QCUFBVIZ.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   collectScopeFiles
-} from "./chunk-53G27VPS.js";
+} from "./chunk-AZ7L3HFD.js";
 
 // packages/core/dist/specdrift/extract.js
 var MODAL_RE = /\b(MUST(?:\s+NOT)?|SHALL(?:\s+NOT)?|SHOULD(?:\s+NOT)?|MAY|REQUIRED|OPTIONAL)\b/;

package/chunks/{chunk-KLTNTE2Z.js → chunk-QZVG3BG4.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/agent/sanitized-env.js
 var SENSITIVE_ENV_PATTERNS = [
@@ -51,20 +51,20 @@ var SENSITIVE_ENV_PATTERNS = [
   "NVD_API",
   "E2B_API",
   "WPSCAN_API_TOKEN",
-  "0SEC_WPSCAN_API_TOKEN",
+  "ZERO_WPSCAN_API_TOKEN",
   "GITHUB_TOKEN",
   "GITLAB_TOKEN",
   "GH_TOKEN",
   "GL_TOKEN",
   // Per-dispatch secrets injected by 0cloud's worker-controller.
-  "0SEC_CLOUD_TOKEN",
-  "0SEC_CHATGPT_ACCESS_TOKEN",
-  "0SEC_CHATGPT_OAUTH_REFRESH_TOKEN",
-  "0SEC_GITHUB_TOKEN",
-  "0SEC_GITLAB_TOKEN",
-  "0SEC_TARGET_AUTH_JSON",
-  "0SEC_GRAPH_ACCESS_TOKEN",
-  "0SEC_LLM_TARGET_KEY"
+  "ZERO_CLOUD_TOKEN",
+  "ZERO_CHATGPT_ACCESS_TOKEN",
+  "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN",
+  "ZERO_GITHUB_TOKEN",
+  "ZERO_GITLAB_TOKEN",
+  "ZERO_TARGET_AUTH_JSON",
+  "ZERO_GRAPH_ACCESS_TOKEN",
+  "ZERO_LLM_TARGET_KEY"
 ];
 function sanitizedEnv(env = process.env) {
   return allowlistedChildEnv({}, env);
@@ -95,9 +95,9 @@ var CHILD_ENV_ALLOWLIST = [
   "AUTH_VALUE",
   "AUTH_CURL_FLAG",
   // Existing child-runtime configuration contract; each name is non-secret.
-  "0SEC_FEATURE_JIT_SKILLS",
-  "0SEC_BASH_TIMEOUT_MS",
-  "0SEC_CLOUD_SCAN_ID"
+  "ZERO_FEATURE_JIT_SKILLS",
+  "ZERO_BASH_TIMEOUT_MS",
+  "ZERO_CLOUD_SCAN_ID"
 ];
 function allowlistedChildEnv(extras = {}, env = process.env) {
   const out = {};

package/chunks/{chunk-D6S3IIPG.js → chunk-RF5QGKLR.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  verifyKernelFinding
-} from "./chunk-SNKTC4BP.js";
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   createJournalWriter
-} from "./chunk-SOG2U7B3.js";
+} from "./chunk-CAJJRUTV.js";
+import {
+  verifyKernelFinding
+} from "./chunk-5T6D5BVY.js";
 import {
   homeStateDir
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/cve/adapt-loop.js
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
@@ -45,12 +45,12 @@ var PocFetchError = class extends Error {
   }
 };
 function defaultCacheDir() {
-  return process.env["0SEC_CVE_POC_CACHE"]?.trim() || join(homeStateDir(), "cve-pocs");
+  return process.env["ZERO_CVE_POC_CACHE"]?.trim() || join(homeStateDir(), "cve-pocs");
 }
 function buildHeaders(token) {
   const headers = {
     "Accept": "*/*",
-    "User-Agent": "0sec-cve-adapt/0.1"
+    "User-Agent": "0-cve-adapt/0.1"
   };
   const resolved = token ?? process.env.GITHUB_TOKEN?.trim();
   if (resolved)

package/chunks/{chunk-LOHTE223.js → chunk-SBMB4OL3.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/scope/waf-detect.js
 function readHeader(headers, name) {
@@ -574,7 +574,7 @@ async function defaultFetchJson(url, timeoutMs) {
   try {
     const res = await fetch(url, {
       signal: controller.signal,
-      headers: { Accept: "application/json", "User-Agent": "0sec-recon" }
+      headers: { Accept: "application/json", "User-Agent": "0-recon" }
     });
     if (!res.ok)
       throw new Error(`crt.sh HTTP ${res.status}`);
@@ -1041,8 +1041,8 @@ async function lookupKev(input, opts = {}) {
 }
 async function fetchKevCatalog(input, opts) {
   const cache = new IntelCache(input.cacheDir);
-  const url = process.env["0SEC_CISA_KEV_URL"] ?? DEFAULT_KEV_URL;
-  return await cachedJson(cache, "cisa-kev", url, async () => await fetchJson(url, { headers: { "User-Agent": "0sec-intel/0.1" } }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+  const url = process.env["ZERO_CISA_KEV_URL"] ?? DEFAULT_KEV_URL;
+  return await cachedJson(cache, "cisa-kev", url, async () => await fetchJson(url, { headers: { "User-Agent": "0-intel/0.1" } }, opts), { offline: input.offline, ttlMs: input.ttlMs });
 }
 
 // packages/core/dist/intel/github.js
@@ -1183,7 +1183,7 @@ function githubHeaders(extra) {
   const headers = {
     Accept: "application/vnd.github+json",
     "X-GitHub-Api-Version": "2022-11-28",
-    "User-Agent": "0sec-intel/0.1",
+    "User-Agent": "0-intel/0.1",
     ...extra ?? {}
   };
   const token = resolveGitHubToken();
@@ -1193,7 +1193,7 @@ function githubHeaders(extra) {
 }
 var cachedGitHubToken;
 function resolveGitHubToken() {
-  const envToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env["0SEC_GITHUB_TOKEN"];
+  const envToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env["ZERO_GITHUB_TOKEN"];
   if (envToken && envToken.trim())
     return envToken.trim();
   if (cachedGitHubToken !== void 0)
@@ -2113,7 +2113,7 @@ function pickMetric(cve) {
 }
 function nvdHeaders(extra) {
   const headers = {
-    "User-Agent": "0sec-intel/0.1",
+    "User-Agent": "0-intel/0.1",
     ...extra ?? {}
   };
   if (process.env.NVD_API_KEY)

package/chunks/{chunk-IOL7D5YV.js → chunk-SQCBHFWN.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   external_exports
-} from "./chunk-YLMN3N25.js";
+} from "./chunk-VIT5ALXF.js";
 
 // packages/core/dist/protocol/http-conformance.js
 import { randomUUID } from "node:crypto";