0sec-cli 0.17.0 → 0.21.4

package/chunks/{chunk-IR537GON.js → chunk-VCSFCHAJ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

package/chunks/{chunk-YLMN3N25.js → chunk-VIT5ALXF.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   __export
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};

package/chunks/{chunk-UJ4IK5PO.js → chunk-VOAXLO4A.js}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   analyzeFindingForKnownMarkers,
   detectKnownMarkers,
   extractFileRefs,
   redactSensitiveHeaders,
   require_dist
-} from "./chunk-UM3ZNQIM.js";
+} from "./chunk-W4JOXE4N.js";
 import {
   __toESM
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // packages/core/dist/disclose/screenshots.js
 import { execFileSync } from "node:child_process";
@@ -384,7 +384,7 @@ function extractSiblingFix(finding, options) {
 import { spawn } from "node:child_process";
 var MAX_CAPTURE_BYTES = 1024 * 1024;
 var DEFAULT_STEP_TIMEOUT_MS = 3e4;
-var PERSONA_HEADER = "X-0sec-Persona";
+var PERSONA_HEADER = "X-0-Persona";
 var TRUNCATION_MARKER = "\n\u2026[truncated at 1MiB]";
 var DEFAULT_RPS_PER_HOST = 2;
 var MAX_REDIRECT_HOPS = 5;
@@ -1221,7 +1221,7 @@ function assembleBundleIndex(entries, options) {
       lines.push(`| \`${id}\` | ${e.finding.severity} | ${titleCell} | ${e.patchStatus ?? "\u2014"} | ${e.behaviouralVerdict ?? "\u2014"} | ${redactReason(e)} | ${formatProvenance(e)} |`);
     }
   }
-  lines.push("", "## Before filing each advisory", "", "1. Re-read the draft \u2014 the PoC and Patch Status sections are auto-populated from the scan but you should sanity-check against the current upstream HEAD.", "2. Verify the CVSS vector suggested by 0sec is still appropriate for your deployment model.", "3. Attach or replace screenshots in the PoC section as needed.", "4. File at https://github.com/<owner>/<repo>/security/advisories/new", "");
+  lines.push("", "## Before filing each advisory", "", "1. Re-read the draft \u2014 the PoC and Patch Status sections are auto-populated from the scan but you should sanity-check against the current upstream HEAD.", "2. Verify the CVSS vector suggested by 0 is still appropriate for your deployment model.", "3. Attach or replace screenshots in the PoC section as needed.", "4. File at https://github.com/<owner>/<repo>/security/advisories/new", "");
   return lines.join("\n");
 }
 
@@ -1376,7 +1376,7 @@ function generateWriteup(parsed, opts = {}) {
     out.push(sanitizeWriteup(parts.join("\n\n")), "");
   }
   out.push("## Credits", "");
-  out.push("Found by 0sec's automated security-research tooling ([0sec.ai](https://0sec.ai)).", "");
+  out.push("Found by 0.security's automated security-research tooling ([0.security](https://0.security)).", "");
   const slug = slugify2(fm.short_name ? `${fm.package ?? ""}-${fm.short_name}` : title);
   const filename = `${slug || "writeup"}-${dateStamp}.md`;
   return {
@@ -1540,7 +1540,7 @@ var HIGH_IMPACT_CATEGORIES = /* @__PURE__ */ new Set([
   // HS-vs-RS), and predictable RNG for secrets are direct key-leak / auth-bypass
   // primitives, so the class is protected from score-only auto-drop.
   "crypto-misuse",
-  // AI-system adversarial classes — the core 0sec "adversarial reliability"
+  // AI-system adversarial classes — the core 0 "adversarial reliability"
   // thesis (authorization-boundary break, unsafe tool use, data exfiltration,
   // prompt hijack). A missed one of these is a disclosure-grade loss.
   "prompt-injection",
@@ -1728,7 +1728,7 @@ function assembleEvidencePack(finding, opts = {}) {
 function renderVendorNotificationMarkdown(draft) {
   const out = [];
   out.push(`# Vulnerability report: ${draft.title}`, "");
-  out.push("> **DRAFT \u2014 NOT SENT.** Auto-assembled vendor-notification draft. An operator must review, fill in any `to be filled in` fields, and send it manually. Nothing here is transmitted to a vendor by 0sec. Embargo rules in `disclosure/AGENTS.md` apply.", "");
+  out.push("> **DRAFT \u2014 NOT SENT.** Auto-assembled vendor-notification draft. An operator must review, fill in any `to be filled in` fields, and send it manually. Nothing here is transmitted to a vendor by 0. Embargo rules in `disclosure/AGENTS.md` apply.", "");
   if (!draft.reproduced) {
     out.push("> \u26A0\uFE0F This finding's PoC did **not** reproduce in an isolated env (`evidenceKind !== reproduced-poc`). Staged as an internal draft only \u2014 do not send to a vendor without a working PoC.", "");
   }
@@ -1866,7 +1866,7 @@ function assembleReproducibilityManifest(finding, opts = {}) {
     redactionsApplied.push("replay-verified-impact");
   const target = opts.targetIdentifier ? redactManifestValue(opts.targetIdentifier) : extractTarget(finding);
   const modelConfig = opts.modelConfig ? redactManifestValue(opts.modelConfig) : null;
-  const toolVersion = opts.toolVersion ?? process.env["0SEC_VERSION"] ?? "unknown";
+  const toolVersion = opts.toolVersion ?? process.env["ZERO_VERSION"] ?? "unknown";
   const timestamp = opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const sanitizedTitle = redactManifestValue(finding.title);
   const evidenceReq = finding.evidence?.request ?? null;

package/chunks/{chunk-UM3ZNQIM.js → chunk-W4JOXE4N.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   __commonJS,
   __require
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // node_modules/.pnpm/yaml@2.9.0/node_modules/yaml/dist/nodes/identity.js
 var require_identity = __commonJS({
@@ -7333,66 +7333,6 @@ var require_dist = __commonJS({
   }
 });
 
-// packages/core/dist/disclose/known-marker.js
-var SOURCE_MARKER_RE = /\b(TODO|FIXME|XXX|HACK)\b(?:[(:]\s*(.*?)\s*[):])?|(\bknown[ -](?:limitation|issue)s?\b|\bdocumented[ -]limitation\b)/gi;
-function hasKnownMarkerText(source) {
-  SOURCE_MARKER_RE.lastIndex = 0;
-  const matched = SOURCE_MARKER_RE.test(source);
-  SOURCE_MARKER_RE.lastIndex = 0;
-  return matched;
-}
-function detectKnownMarkers(source, filePath) {
-  const lines = source.split("\n");
-  const markers = [];
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i];
-    SOURCE_MARKER_RE.lastIndex = 0;
-    let match;
-    while ((match = SOURCE_MARKER_RE.exec(line)) !== null) {
-      const tag = match[1];
-      const phrase = match[3];
-      const markerText = tag ?? phrase ?? match[0];
-      const contextLines = [];
-      if (i > 0)
-        contextLines.push(lines[i - 1]);
-      contextLines.push(line);
-      if (i < lines.length - 1)
-        contextLines.push(lines[i + 1]);
-      markers.push({
-        marker: markerText.toLowerCase(),
-        line: line.length > 200 ? line.slice(0, 100) + "..." + line.slice(line.length - 97) : line,
-        lineNumber: i + 1,
-        sourcePath: filePath,
-        context: contextLines.join("\n")
-      });
-    }
-  }
-  return {
-    hasKnownMarker: markers.length > 0,
-    markers
-  };
-}
-function analyzeFindingForKnownMarkers(finding) {
-  const texts = [];
-  if (finding.evidence?.analysis)
-    texts.push(finding.evidence.analysis);
-  if (finding.description)
-    texts.push(finding.description);
-  if (finding.evidence?.request)
-    texts.push(finding.evidence.request);
-  if (finding.evidence?.response)
-    texts.push(finding.evidence.response);
-  const allMarkers = [];
-  for (const text of texts) {
-    const signal = detectKnownMarkers(text);
-    allMarkers.push(...signal.markers);
-  }
-  return {
-    hasKnownMarker: allMarkers.length > 0,
-    markers: allMarkers
-  };
-}
-
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {
   // LLM / agent
@@ -7666,6 +7606,8 @@ function metricsForReachability(tier) {
   switch (tier) {
     case "remote-unauth":
       return { av: "N", pr: "N", ui: "N" };
+    case "remote-auth":
+      return { av: "N", pr: "L", ui: "N" };
     case "proximity-rf":
       return { av: "A", pr: "N", ui: "N" };
     case "local-unpriv":
@@ -8382,6 +8324,8 @@ function cvss4MetricsForReachability(tier) {
   switch (tier) {
     case "remote-unauth":
       return { AV: "N", AT: "N", PR: "N", UI: "N" };
+    case "remote-auth":
+      return { AV: "N", AT: "N", PR: "L", UI: "N" };
     case "proximity-rf":
       return { AV: "A", AT: "N", PR: "N", UI: "N" };
     case "local-unpriv":
@@ -8690,17 +8634,31 @@ var EmptyPocError = class extends Error {
 };
 var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
   "authorization",
+  "proxy-authorization",
   "cookie",
   "set-cookie",
   "x-auth-token",
   "x-api-key",
-  "x-csrf-token"
+  "x-csrf-token",
+  "x-xsrf-token"
 ]);
 var AWS_KEY_RE = /\bAKIA[0-9A-Z]{16}\b/g;
 var JWT_RE = /\b[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+={0,2}\b/g;
 var INLINE_BEARER_RE = /\b(Bearer)\s+([^\s"'`]+)/gi;
 var INLINE_CURL_HEADER_RE = /(-H|--header)(\s+|=)(["']?)([A-Za-z][A-Za-z0-9-]*)\s*:\s*([^"'\n]*)\3/gi;
 function redactSensitiveHeaders(text) {
+  if (!text)
+    return text;
+  let out = redactAuthHeaders(text);
+  out = out.replace(AWS_KEY_RE, "<REDACTED-AWS-KEY>");
+  out = out.replace(JWT_RE, (match) => {
+    if (match.length < 80)
+      return match;
+    return "<REDACTED-JWT>";
+  });
+  return out;
+}
+function redactAuthHeaders(text) {
   if (!text)
     return text;
   const lines = text.split("\n");
@@ -8717,19 +8675,14 @@ function redactSensitiveHeaders(text) {
       return match;
     return `${flag}${sep}${quote}${name}: <REDACTED-${name}>${quote}`;
   });
-  out = out.replace(INLINE_BEARER_RE, "$1 <REDACTED-Bearer>");
-  out = out.replace(AWS_KEY_RE, "<REDACTED-AWS-KEY>");
-  out = out.replace(JWT_RE, (match) => {
-    if (match.length < 80)
-      return match;
-    return "<REDACTED-JWT>";
-  });
-  return out;
+  return out.replace(INLINE_BEARER_RE, "$1 <REDACTED-Bearer>");
 }
 function reachabilityLabel(tier) {
   switch (tier) {
     case "remote-unauth":
       return "remote, unauthenticated \u2014 reachable over the network with no credentials";
+    case "remote-auth":
+      return "remote, authenticated \u2014 requires an account or contributor access";
     case "proximity-rf":
       return "RF/physical proximity \u2014 attacker must be within radio range (NFC/BLE/Wi-Fi)";
     case "local-unpriv":
@@ -8748,6 +8701,8 @@ function weaponizabilityLabel(w) {
       return "remote code execution";
     case "lpe-to-root":
       return "local privilege escalation to root/SYSTEM";
+    case "integrity-tampering":
+      return "workflow integrity manipulation";
     case "info-leak":
       return "information disclosure";
     case "dos-crash":
@@ -8805,9 +8760,9 @@ function renderAdvisoryMarkdown(finding, ctx = {}) {
   } else if (ctx.target) {
     affectedLine = `\`${ctx.target}\`${ctx.targetRef ? ` at \`${ctx.targetRef}\`` : ""}${ctx.commitHash ? ` (commit \`${ctx.commitHash.slice(0, 12)}\`)` : ""}`;
   } else {
-    affectedLine = "_Pass `--repo <path>` to `0sec-cli disclose` to auto-detect the affected version range from git tags._";
+    affectedLine = "_Pass `--repo <path>` to `@0/cli disclose` to auto-detect the affected version range from git tags._";
   }
-  const cvssSource = cvss.source === "finding" ? "populated on the finding by 0sec" : cvss.source === "impact-assessment" ? "exploitability metrics derived from 0sec's reachability assessment; impact from category \u2014 verify against your deployment" : "heuristic from category + severity \u2014 override in the GHSA editor if the operator disagrees";
+  const cvssSource = cvss.source === "finding" ? "populated on the finding by 0" : cvss.source === "impact-assessment" ? "exploitability metrics derived from 0's reachability assessment; impact from category \u2014 verify against your deployment" : "heuristic from category + severity \u2014 override in the GHSA editor if the operator disagrees";
   const remediation = finding.remediation;
   const suggestedFixParts = [];
   if (remediation?.summary)
@@ -8832,7 +8787,7 @@ ${remediation.codeExample.after}
 \`\`\``);
   } else if (ctx.siblingFix) {
     const ref = `${ctx.siblingFix.fileRef.file}${ctx.siblingFix.fileRef.line ? `:${ctx.siblingFix.fileRef.line}` : ""}`;
-    suggestedFixParts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0sec):*
+    suggestedFixParts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0):*
 
 \`\`\`${ctx.siblingFix.language}
 ${ctx.siblingFix.snippet}
@@ -8864,7 +8819,7 @@ ${ctx.siblingFix.snippet}
   if (ctx.osecVersion || ctx.scanId) {
     const bits = [];
     if (ctx.osecVersion)
-      bits.push(`0sec \`${ctx.osecVersion}\``);
+      bits.push(`0 \`${ctx.osecVersion}\``);
     if (ctx.scanId)
       bits.push(`scan \`${ctx.scanId.slice(0, 8)}\``);
     const canaryPositive = ctx.patchStatus?.status === "still-vulnerable";
@@ -8916,7 +8871,7 @@ ${ctx.siblingFix.snippet}
   if (ctx.patchStatus) {
     out.push(formatPatchStatusSection(ctx.patchStatus), "");
   } else {
-    out.push("_Pass `--repo <path>` to `0sec-cli disclose` to auto-verify this against the target's current HEAD or a specific tag._", "");
+    out.push("_Pass `--repo <path>` to `@0/cli disclose` to auto-verify this against the target's current HEAD or a specific tag._", "");
   }
   if (ctx.pocExecution) {
     const verdict = ctx.pocExecution.overallVerdict === "exploit_still_works" ? "**Behavioural check: exploit still reproducible.**" : ctx.pocExecution.overallVerdict === "exploit_broken" ? "**Behavioural check: exploit no longer reproducible.**" : "**Behavioural check: could not run.**";
@@ -8924,7 +8879,7 @@ ${ctx.siblingFix.snippet}
     out.push(`> Verdict: \`${ctx.pocExecution.overallVerdict}\` (${ctx.pocExecution.steps.length} step${ctx.pocExecution.steps.length === 1 ? "" : "s"} executed).`, "");
   }
   out.push("## Credits", "");
-  out.push("Discovered by **0sec**, 0sec's AI-assisted security engine ([0sec.ai](https://0sec.ai)).", "", "Reporter: _(your github handle)_", "");
+  out.push("Discovered by **0.security**, the 0.security AI-assisted security engine ([0.security](https://0.security)).", "", "Reporter: _(your github handle)_", "");
   return {
     filename,
     markdown: out.join("\n").replace(/\n{3,}/g, "\n\n"),
@@ -9012,7 +8967,7 @@ ${remediation.codeExample.after}
 \`\`\``);
   } else if (ctx.siblingFix) {
     const ref = `${ctx.siblingFix.fileRef.file}${ctx.siblingFix.fileRef.line ? `:${ctx.siblingFix.fileRef.line}` : ""}`;
-    parts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0sec):*
+    parts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0):*
 
 \`\`\`${ctx.siblingFix.language}
 ${ctx.siblingFix.snippet}
@@ -9275,7 +9230,7 @@ _${cvssSourceLabel(parts.cvss)}_` },
   }
 };
 function cvssSourceLabel(cvss) {
-  return cvss.source === "finding" ? "CVSS source: populated on the finding by 0sec." : cvss.source === "impact-assessment" ? "CVSS source: exploitability derived from 0sec's reachability assessment; impact from category \u2014 verify against your deployment." : "CVSS source: heuristic from category + severity \u2014 verify before submission.";
+  return cvss.source === "finding" ? "CVSS source: populated on the finding by 0." : cvss.source === "impact-assessment" ? "CVSS source: exploitability derived from 0's reachability assessment; impact from category \u2014 verify against your deployment." : "CVSS source: heuristic from category + severity \u2014 verify before submission.";
 }
 var TEMPLATE_REGISTRY = {
   hackerone: HACKERONE_TEMPLATE,
@@ -9299,11 +9254,68 @@ function renderPlatformReport(finding, platform, ctx = {}) {
   return reportTemplate(platform).render(finding, ctx);
 }
 
+// packages/core/dist/disclose/known-marker.js
+var SOURCE_MARKER_RE = /\b(TODO|FIXME|XXX|HACK)\b(?:[(:]\s*(.*?)\s*[):])?|(\bknown[ -](?:limitation|issue)s?\b|\bdocumented[ -]limitation\b)/gi;
+function hasKnownMarkerText(source) {
+  SOURCE_MARKER_RE.lastIndex = 0;
+  const matched = SOURCE_MARKER_RE.test(source);
+  SOURCE_MARKER_RE.lastIndex = 0;
+  return matched;
+}
+function detectKnownMarkers(source, filePath) {
+  const lines = source.split("\n");
+  const markers = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    SOURCE_MARKER_RE.lastIndex = 0;
+    let match;
+    while ((match = SOURCE_MARKER_RE.exec(line)) !== null) {
+      const tag = match[1];
+      const phrase = match[3];
+      const markerText = tag ?? phrase ?? match[0];
+      const contextLines = [];
+      if (i > 0)
+        contextLines.push(lines[i - 1]);
+      contextLines.push(line);
+      if (i < lines.length - 1)
+        contextLines.push(lines[i + 1]);
+      markers.push({
+        marker: markerText.toLowerCase(),
+        line: line.length > 200 ? line.slice(0, 100) + "..." + line.slice(line.length - 97) : line,
+        lineNumber: i + 1,
+        sourcePath: filePath,
+        context: contextLines.join("\n")
+      });
+    }
+  }
+  return {
+    hasKnownMarker: markers.length > 0,
+    markers
+  };
+}
+function analyzeFindingForKnownMarkers(finding) {
+  const texts = [];
+  if (finding.evidence?.analysis)
+    texts.push(finding.evidence.analysis);
+  if (finding.description)
+    texts.push(finding.description);
+  if (finding.evidence?.request)
+    texts.push(finding.evidence.request);
+  if (finding.evidence?.response)
+    texts.push(finding.evidence.response);
+  const allMarkers = [];
+  for (const text of texts) {
+    const signal = detectKnownMarkers(text);
+    allMarkers.push(...signal.markers);
+  }
+  return {
+    hasKnownMarker: allMarkers.length > 0,
+    markers: allMarkers
+  };
+}
+
 export {
   require_dist,
-  hasKnownMarkerText,
-  detectKnownMarkers,
-  analyzeFindingForKnownMarkers,
   suggestCwesForCategory,
   formatCweSection,
   suggestCvss,
@@ -9322,8 +9334,12 @@ export {
   formatVersionRangeLine,
   EmptyPocError,
   redactSensitiveHeaders,
+  redactAuthHeaders,
   renderAdvisoryMarkdown,
   REPORT_PLATFORMS,
   reportTemplate,
-  renderPlatformReport
+  renderPlatformReport,
+  hasKnownMarkerText,
+  detectKnownMarkers,
+  analyzeFindingForKnownMarkers
 };

package/chunks/{chunk-DN25OQQA.js → chunk-WF5W75WY.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   allowlistedChildEnv
-} from "./chunk-KLTNTE2Z.js";
+} from "./chunk-QZVG3BG4.js";
 import {
   VERSION
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/verify/replay-runner.js
 import { spawn } from "node:child_process";
@@ -52,7 +52,7 @@ var LocalShellRunner = class {
           // child must not inherit the harness's provider/cloud credentials.
           // Build from the allowlist (PATH/HOME/TMPDIR + target-auth vars a
           // reproduction legitimately needs) rather than copying process.env.
-          env: allowlistedChildEnv({ "0SEC_VERIFY": "1" }),
+          env: allowlistedChildEnv({ "ZERO_VERIFY": "1" }),
           stdio: ["ignore", "pipe", "pipe"],
           // On POSIX, isolate the shell and all descendants into a process
           // group so a timeout cannot leave a grandchild holding stdout open.
@@ -138,7 +138,7 @@ function resolveStepCwd(cwd, runDir) {
 }
 var DEFAULT_DOCKER_SHELL_IMAGE = "alpine:3.20";
 var DEFAULT_DOCKER_HTTP_IMAGE = "curlimages/curl:8.12.1";
-var DOCKER_HTTP_STATUS_MARKER = "\n__0SEC_HTTP_STATUS__:";
+var DOCKER_HTTP_STATUS_MARKER = "\n__ZERO_HTTP_STATUS__:";
 var CONTAINER_ID_RE = /^[a-f0-9]{12,64}$/i;
 var DOCKER_NETWORK_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
 var DockerRunner = class {
@@ -176,7 +176,7 @@ var DockerRunner = class {
       return failedStep(step, startedAt, command);
     }
     const safeStepId = step.id.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 64) || "step";
-    const cidPath = join(ctx.runDir, `.0sec-docker-${safeStepId}-${randomUUID()}.cid`);
+    const cidPath = join(ctx.runDir, `.0-docker-${safeStepId}-${randomUUID()}.cid`);
     const args = this.dockerRunArgs(command, ctx.runDir, cidPath);
     const result = await runDockerCommand({
       dockerBinary: this.dockerBinary,
@@ -382,7 +382,7 @@ async function runDockerCommand(args) {
   try {
     child = spawn(args.dockerBinary, args.args, {
       cwd: args.runDir,
-      env: allowlistedChildEnv({ "0SEC_VERIFY": "1" }),
+      env: allowlistedChildEnv({ "ZERO_VERIFY": "1" }),
       stdio: ["ignore", "pipe", "pipe"],
       detached: nodePlatform !== "win32"
     });
@@ -444,7 +444,7 @@ function runDockerControl(dockerBinary, args, cwd) {
   try {
     child = spawn(dockerBinary, args, {
       cwd,
-      env: allowlistedChildEnv({ "0SEC_VERIFY": "1" }),
+      env: allowlistedChildEnv({ "ZERO_VERIFY": "1" }),
       stdio: "ignore",
       detached: nodePlatform !== "win32"
     });
@@ -483,9 +483,9 @@ var QemuRunner = class {
   memoryMb;
   cpus;
   constructor(options = {}) {
-    this.qemuBinary = options.qemuBinary ?? process.env["0SEC_REPLAY_QEMU_BINARY"]?.trim() ?? (nodeArch === "arm64" ? "qemu-system-aarch64" : "qemu-system-x86_64");
-    this.kernelImage = options.kernelImage ?? process.env["0SEC_REPLAY_QEMU_KERNEL"]?.trim() ?? "";
-    this.busyboxPath = options.busyboxPath ?? process.env["0SEC_REPLAY_QEMU_BUSYBOX"]?.trim() ?? "";
+    this.qemuBinary = options.qemuBinary ?? process.env["ZERO_REPLAY_QEMU_BINARY"]?.trim() ?? (nodeArch === "arm64" ? "qemu-system-aarch64" : "qemu-system-x86_64");
+    this.kernelImage = options.kernelImage ?? process.env["ZERO_REPLAY_QEMU_KERNEL"]?.trim() ?? "";
+    this.busyboxPath = options.busyboxPath ?? process.env["ZERO_REPLAY_QEMU_BUSYBOX"]?.trim() ?? "";
     this.memoryMb = options.memoryMb ?? 512;
     this.cpus = options.cpus ?? 1;
     if (!this.qemuBinary || !Number.isInteger(this.memoryMb) || this.memoryMb < 128 || !Number.isInteger(this.cpus) || this.cpus < 1) {
@@ -495,7 +495,7 @@ var QemuRunner = class {
   async exec(step, ctx) {
     const startedAt = Date.now();
     if (!this.kernelImage || !this.busyboxPath) {
-      return failedStep(step, startedAt, "QEMU replay requires kernelImage and busyboxPath (or 0SEC_REPLAY_QEMU_KERNEL and 0SEC_REPLAY_QEMU_BUSYBOX)");
+      return failedStep(step, startedAt, "QEMU replay requires kernelImage and busyboxPath (or ZERO_REPLAY_QEMU_KERNEL and ZERO_REPLAY_QEMU_BUSYBOX)");
     }
     if (!existsSync(this.kernelImage) || !statSync(this.kernelImage).isFile()) {
       return failedStep(step, startedAt, `QEMU kernel image is not a file: ${this.kernelImage}`);
@@ -511,7 +511,7 @@ var QemuRunner = class {
       return failedStep(step, startedAt, "QEMU replay refuses an absolute step cwd");
     }
     const safeStepId = step.id.replace(/[^a-zA-Z0-9_.-]/g, "_").slice(0, 64) || "step";
-    const workspaceName = `.0sec-qemu-${safeStepId}-${randomUUID()}`;
+    const workspaceName = `.0-qemu-${safeStepId}-${randomUUID()}`;
     const workspace = join(ctx.runDir, workspaceName);
     mkdirSync(workspace, { recursive: true });
     writeFileSync(join(workspace, "step.sh"), step.action.cmd, "utf8");
@@ -567,7 +567,7 @@ ${qemu.stdoutFull}` : "";
       "-append",
       "console=ttyS0 rdinit=/init panic=-1",
       "-virtfs",
-      `local,path=${resolve(runDir)},mount_tag=0sec-replay,security_model=none,id=osecshare`,
+      `local,path=${resolve(runDir)},mount_tag=0-replay,security_model=none,id=osecshare`,
       "-net",
       "none",
       "-sandbox",
@@ -577,11 +577,11 @@ ${qemu.stdoutFull}` : "";
 };
 function qemuGuestWorkingDirectory(cwd) {
   if (!cwd)
-    return "/mnt/0sec";
+    return "/mnt/0";
   if (isAbsolute(cwd))
     return void 0;
   const relative = resolve("/", cwd).slice(1);
-  return relative ? `/mnt/0sec/${relative}` : "/mnt/0sec";
+  return relative ? `/mnt/0/${relative}` : "/mnt/0";
 }
 function buildQemuInitramfs(args) {
   const empty = Buffer.alloc(0);
@@ -590,7 +590,7 @@ function buildQemuInitramfs(args) {
     { name: "bin", mode: 16877, body: empty },
     { name: "dev", mode: 16877, body: empty },
     { name: "mnt", mode: 16877, body: empty },
-    { name: "mnt/0sec", mode: 16877, body: empty },
+    { name: "mnt/0", mode: 16877, body: empty },
     { name: "proc", mode: 16877, body: empty },
     { name: "sys", mode: 16877, body: empty },
     { name: "tmp", mode: 16877, body: empty },
@@ -602,7 +602,7 @@ function buildQemuInitramfs(args) {
     appendNewcEntry(chunks, entries[index], index + 1);
   }
   appendNewcEntry(chunks, { name: "TRAILER!!!", mode: 0, body: empty }, 0);
-  const initrdPath = join(args.runDir, `.0sec-qemu-initrd-${randomUUID()}.cpio.gz`);
+  const initrdPath = join(args.runDir, `.0-qemu-initrd-${randomUUID()}.cpio.gz`);
   writeFileSync(initrdPath, gzipSync(Buffer.concat(chunks)));
   return initrdPath;
 }
@@ -634,19 +634,19 @@ function appendNewcEntry(chunks, entry, inode) {
     chunks.push(Buffer.alloc(bodyPadding));
 }
 function renderQemuInit(workspaceName, guestCwd) {
-  const workspace = `/mnt/0sec/${workspaceName}`;
+  const workspace = `/mnt/0/${workspaceName}`;
   const step = `${workspace}/step.sh`;
   const stdout = `${workspace}/stdout.log`;
   const stderr = `${workspace}/stderr.log`;
   const exitCode = `${workspace}/exit-code`;
   return [
     "#!/bin/busybox sh",
-    "/bin/busybox mkdir -p /proc /sys /dev /tmp /mnt/0sec",
+    "/bin/busybox mkdir -p /proc /sys /dev /tmp /mnt/0",
     "/bin/busybox mount -t proc proc /proc",
     "/bin/busybox mount -t sysfs sysfs /sys",
     "/bin/busybox mount -t devtmpfs devtmpfs /dev 2>/dev/null || true",
-    "if ! /bin/busybox mount -t 9p -o trans=virtio,version=9p2000.L 0sec-replay /mnt/0sec; then",
-    '  echo "__0SEC_QEMU_MOUNT_FAILED__"',
+    "if ! /bin/busybox mount -t 9p -o trans=virtio,version=9p2000.L 0-replay /mnt/0; then",
+    '  echo "__ZERO_QEMU_MOUNT_FAILED__"',
     "  /bin/busybox poweroff -f",
     "fi",
     `(
@@ -708,7 +708,7 @@ function runQemuCommand(args) {
   try {
     child = spawn(args.qemuBinary, args.args, {
       cwd: args.runDir,
-      env: allowlistedChildEnv({ "0SEC_VERIFY": "1" }),
+      env: allowlistedChildEnv({ "ZERO_VERIFY": "1" }),
       stdio: ["ignore", "pipe", "pipe"],
       detached: nodePlatform !== "win32"
     });
@@ -914,7 +914,7 @@ async function runDeterministicReplay(finding, opts = {}) {
   const runner = opts.runner ?? new LocalShellRunner();
   const stepTimeoutMs = opts.stepTimeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
   const engineVersion = opts.engineVersion ?? VERSION;
-  const runDir = opts.runDir ?? mkdtempSync(join(tmpdir(), "0sec-replay-"));
+  const runDir = opts.runDir ?? mkdtempSync(join(tmpdir(), "0-replay-"));
   mkdirSync(runDir, { recursive: true });
   const startedAt = /* @__PURE__ */ new Date();
   const startMs = Date.now();

package/chunks/{chunk-QKICO43A.js → chunk-WPQLBN4S.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-KKGE5RQE.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/cve/artifact-scraper.js
 import { createHash } from "node:crypto";
@@ -275,7 +275,7 @@ async function fetchGhsa(cveId, plumbing, githubToken, log) {
   const url = `https://api.github.com/advisories?cve_id=${encodeURIComponent(cveId)}`;
   const headers = {
     accept: "application/vnd.github+json",
-    "user-agent": "0sec-cve-scraper"
+    "user-agent": "0-cve-scraper"
   };
   if (githubToken)
     headers.authorization = `Bearer ${githubToken}`;
@@ -533,7 +533,7 @@ function clamp01(n) {
 async function fetchGithubPocSearch(cveId, plumbing, githubToken, log) {
   const headers = {
     accept: "application/vnd.github+json",
-    "user-agent": "0sec-cve-scraper"
+    "user-agent": "0-cve-scraper"
   };
   if (githubToken)
     headers.authorization = `Bearer ${githubToken}`;