0sec-cli 0.17.0 → 0.21.4

package/chunks/{dist-FDKALV4R.js → dist-F6X62TQK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   BenchCaseSchema,
   BenchIntegrationRegistry,
@@ -20,6 +20,7 @@ import {
   CraftStagedOrchestrator,
   DEFAULT_CALL_TIMEOUT_MS,
   DEFAULT_HANDSHAKE_TIMEOUT_MS,
+  DEFAULT_MAX_TOOL_ITERATIONS,
   DEFAULT_RACE_WIDEN_DELAY_MS,
   DEFAULT_REGISTRY_URL,
   DEFAULT_SEED_DIRS,
@@ -55,6 +56,8 @@ import {
   HerdrEventSink,
   HuntResearchAdapter,
   KERNELCTF_TIER1_RACE_GRID,
+  KERNEL_FUNCTION_BATCH_SIZE,
+  KERNEL_FUNCTION_LABELS,
   KERNEL_RUN_PROGRAM_MAX_BYTES,
   KERNEL_RUN_TOOL_DEFINITION,
   KNOWN_ATTACK_SURFACES,
@@ -90,6 +93,7 @@ import {
   STAGE_ACTION_HISTORY_CAP,
   SYNTH_TOOL,
   SYNTH_TOOL_NAME,
+  ScanCostLedger,
   SourceAuditTargetSchema,
   SuiteOracleObjectiveSchema,
   SuiteTaskTargetSchema,
@@ -110,6 +114,7 @@ import {
   XNU_RECEIPT_SCHEMA_VERSION,
   XnuIokitResearchAdapter,
   XnuReceiptReplayer,
+  activeAppsecLensRegistryPath,
   addAttackResult,
   addFinding,
   agenticScan,
@@ -123,6 +128,11 @@ import {
   applySurfaceRanking,
   applyVerificationToFinding,
   approveObservation,
+  appsecArchetypeDigest,
+  appsecArchetypeToFinderLens,
+  appsecArchetypesPath,
+  appsecLensLedgerEntryDigest,
+  appsecUserArchetypesPath,
   arbReadValueWitnessed,
   arbWriteFaultWitnessed,
   arbWriteTargetV,
@@ -172,6 +182,7 @@ import {
   cardanoVerifyLenses,
   categoryToWebKind,
   changedFilesInRange,
+  checkAlreadyFixed,
   checkFixPresentInTarget,
   checkNotYetIntroduced,
   checkResearchNovelty,
@@ -199,10 +210,12 @@ import {
   crashSeverity,
   crashSignatureFromReport,
   crashSignatureFromText,
+  crashSummaryFromTriage,
   crashToFinding,
   crashTypeToCategory,
   createAgenticScanAdapter,
   createBenchIntegrationRegistry,
+  createConsoleJevRuntime,
   createConsoleRuntime,
   createConsoleSession,
   createCoreBenchIntegration,
@@ -273,6 +286,7 @@ import {
   extractDupeSignature,
   extractFeatures,
   extractKernelFindingMetadata,
+  extractKernelFunctions,
   extractTouchedFunctions,
   fetchRegistryIndex,
   fileDiff,
@@ -344,6 +358,8 @@ import {
   listMcpTools,
   listObservations,
   listPrograms,
+  loadAppsecArchetypes,
+  loadAppsecFinderLenses,
   loadCpg,
   loadH1Credentials,
   loadLedger,
@@ -445,9 +461,13 @@ import {
   raceStrategies,
   raceWidenEnv,
   raceWithDefaults,
+  radarCandidatesToSeedFindings,
   rankAndDedupeFoxguardLeads,
   rankBugsByProvenRung,
   rankCandidates,
+  rankCrashesWithJev,
+  rankKernelCommitsWithJev,
+  rankKernelHypothesesWithJev,
   rankResearchProposals,
   reachabilityGate,
   reachableTargets,
@@ -483,6 +503,7 @@ import {
   retireArchetype,
   reviewKernelCrashSubsystems,
   rootProofInstructions,
+  runBehavioralRepair,
   runBenchCase,
   runBenchSuite,
   runCliPathTraversalReplayFixture,
@@ -493,6 +514,7 @@ import {
   runEnsembleCraft,
   runExploitScan,
   runKernelExploitChain,
+  runKernelSourceJevPrepass,
   runKernelVariantHunt,
   runLensSynthesisLoop,
   runLlmIpiAudit,
@@ -506,6 +528,7 @@ import {
   runReproductionBundle,
   runResearch,
   runSecondAudit,
+  runSecureProject,
   runSelfConsistencyVerify,
   runStaticAnalysis,
   runStructuredVerify,
@@ -522,6 +545,7 @@ import {
   scan,
   scanForModuleInit,
   scanForPatchGapCandidates,
+  scanRepoCommitsWithJev,
   scanReportToBenchResult,
   scoreEvidence,
   scoreMemory,
@@ -551,6 +575,7 @@ import {
   summarizeTriageProvenance,
   synthesizeArchetypes,
   syzChoiceWeightsFromPlan,
+  syzWeightingContextFromJev,
   syzbotQueueBrief,
   tableMetrics,
   tallyConsensus,
@@ -564,6 +589,7 @@ import {
   toHuntCandidates,
   toScopeFile,
   toScopeJson,
+  toToolContextJevRuntime,
   toVerifyVerdict,
   trainProposalRanker,
   triageKcsanRace,
@@ -592,18 +618,37 @@ import {
   withVariantFeatureFlags,
   writeEnablement,
   xnuArtifactDigest
-} from "./chunk-IORC6MQX.js";
+} from "./chunk-FAH6V4QM.js";
+import {
+  MAX_POC_BYTES,
+  PocFetchError,
+  adaptAndVerify,
+  applyUnifiedDiff,
+  extractInlineCodeBlock,
+  fetchPoc,
+  renderAdaptationPrompt
+} from "./chunk-RF5QGKLR.js";
 import {
   RateLimiter,
   TokenBucket,
   enumerateJsChunkUrls,
   parseRateLimitFlag,
   parseRetryAfter
-} from "./chunk-QJQKHO7G.js";
+} from "./chunk-Y5H6E24H.js";
+import {
+  createLiveHttpSender
+} from "./chunk-GVD6SJGH.js";
+import {
+  extractSpecInvariants,
+  mapInvariantsToImplementation,
+  planSpecdriftHypotheses,
+  runSpecdriftPlan,
+  runSpecdriftScan
+} from "./chunk-QCUFBVIZ.js";
 import {
   getEvalCategories,
   runEval
-} from "./chunk-HDWV7PGI.js";
+} from "./chunk-2WSXFFJZ.js";
 import {
   classifyUserspacePrimitive,
   crashArtifactToFinding,
@@ -619,11 +664,11 @@ import {
   runMemSafetyScan,
   runUserspaceFuzzLoop,
   sniffMemPrimitive
-} from "./chunk-WVTBZEQO.js";
+} from "./chunk-G34QP2XW.js";
 import {
   leadToFinding,
   runNpmDynamicDiscovery
-} from "./chunk-5G3ZXFBW.js";
+} from "./chunk-2WNCI664.js";
 import {
   OsvLookupError,
   createOsvAdvisoryLookup,
@@ -632,7 +677,7 @@ import {
   inProcessProbe,
   localSandboxProvider,
   staticProbe
-} from "./chunk-7DQEV5QI.js";
+} from "./chunk-Z3IKZX3X.js";
 import {
   DETECTOR_REGISTRY,
   DETECTOR_REGISTRY_BY_ID,
@@ -645,7 +690,7 @@ import {
   resolveDetectors,
   runDetectorOnPackage,
   ssppFuzzDetector
-} from "./chunk-RWONANDA.js";
+} from "./chunk-DQTNI3KY.js";
 import {
   PRIMITIVE_LIBRARY,
   RUNG_MARKER_TAG,
@@ -661,7 +706,7 @@ import {
   runStrategy,
   runWeaponization,
   selectStrategies
-} from "./chunk-KTQDLNSR.js";
+} from "./chunk-YA4PUM4H.js";
 import {
   BENIGN_MAX_CLASS,
   UPGRADE_MIN_CLASS,
@@ -672,21 +717,16 @@ import {
   isDangerUpgrade,
   maxDangerClass,
   rankDanger
-} from "./chunk-HE7LCA7G.js";
-import {
-  MAX_POC_BYTES,
-  PocFetchError,
-  adaptAndVerify,
-  applyUnifiedDiff,
-  extractInlineCodeBlock,
-  fetchPoc,
-  renderAdaptationPrompt
-} from "./chunk-D6S3IIPG.js";
+} from "./chunk-O6SD4A36.js";
 import {
   applyReachabilityGate,
   classifyPathReachability,
   generateVariantCandidates
-} from "./chunk-A6CLR72I.js";
+} from "./chunk-TF46UWFU.js";
+import {
+  collectScopeFiles,
+  countScopeFilesUpTo
+} from "./chunk-AZ7L3HFD.js";
 import {
   ASSUMPTION_MODEL_VERSION,
   INVARIANT_MODEL_VERSION,
@@ -727,53 +767,7 @@ import {
   violationsToHuntPlan,
   witnessAssumptionViolation,
   witnessDualViewContexts
-} from "./chunk-47TQJWDH.js";
-import {
-  defaultDmesgOutPath,
-  detectOutOfBandModuleLoad,
-  loadKernelVmConfigFromEnv,
-  prepareKernelVmArtifacts,
-  verifyKernelFinding,
-  writeProofFileReadOnly
-} from "./chunk-SNKTC4BP.js";
-import {
-  evaluateVerificationSpec,
-  runSourceFix
-} from "./chunk-F3WBKITT.js";
-import {
-  DEFAULT_STEP_TIMEOUT_MS as DEFAULT_STEP_TIMEOUT_MS2,
-  DockerRunner,
-  LocalShellRunner,
-  MAX_STREAM_CAPTURE_BYTES,
-  QemuRunner,
-  STREAM_EXCERPT_BYTES,
-  argvForStep,
-  assertionFromStepExpect,
-  evaluateAssertion,
-  excerpt,
-  persistArtifact,
-  runDeterministicReplay
-} from "./chunk-DN25OQQA.js";
-import {
-  generateConformanceModel,
-  judgeHttpDivergence,
-  runHttpConformanceCheck,
-  structurallyValidateConformanceModel
-} from "./chunk-IOL7D5YV.js";
-import {
-  createLiveHttpSender
-} from "./chunk-2RMLOJVB.js";
-import {
-  extractSpecInvariants,
-  mapInvariantsToImplementation,
-  planSpecdriftHypotheses,
-  runSpecdriftPlan,
-  runSpecdriftScan
-} from "./chunk-BKZFDZ23.js";
-import {
-  collectScopeFiles,
-  countScopeFilesUpTo
-} from "./chunk-53G27VPS.js";
+} from "./chunk-YHWWF4QY.js";
 import {
   CHROMIUM_BARE_WORDS,
   FREEBSD_BARE_KERNEL_WORDS,
@@ -858,15 +852,7 @@ import {
   unresolvedHuntClaims,
   validateHuntClaimRecord,
   validateResearchProposal
-} from "./chunk-K26SZ37E.js";
-import {
-  ESCALATION_LADDER,
-  ladderUpTo,
-  maxRung,
-  ratchet,
-  rungAtLeast,
-  rungRank
-} from "./chunk-RJWOYEOG.js";
+} from "./chunk-E2UOY5PJ.js";
 import {
   ACTION_LOG_ARGS_MAX,
   ACTION_LOG_ARG_VALUE_MAX,
@@ -878,6 +864,7 @@ import {
   BUILTIN_GUARDS,
   CONSERVATIVE_JITTER_MS,
   CONSERVATIVE_RPS,
+  CONTRIBUTION_ENDPOINT,
   DEFAULT_CONCURRENCY,
   DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
   DEFAULT_MAX_DURATION_MS,
@@ -906,6 +893,8 @@ import {
   PLUGIN_CAPABILITIES,
   PROTOCOL_VERSION,
   RESULT_TRUNCATION_MARKER,
+  RunCapture,
+  RunContributionClient,
   SCOPE_DEPENDENT_BASH_GUARDS,
   SCOPE_GUARDS_INERT_EVENT,
   SELF_EXTENSION_SETTING_DEF,
@@ -937,10 +926,18 @@ import {
   classifyTakeover,
   clearSkillRegistry,
   composeGuards,
+  configureRunContributionsFromEnvironment,
+  contributionChunkSchema,
+  contributionClientPolicySchema,
+  contributionManifestSchema,
+  contributionPurposeSchema,
+  contributionReceiptSchema,
+  contributionTransitionSchema,
   createDockerEvolutionSandbox,
   createEvolutionCandidate,
   createEvolutionSandbox,
   createSmolvmEvolutionSandbox,
+  currentRunContribution,
   decideAddressing,
   decodeHostMessage,
   decodeMessage,
@@ -971,6 +968,7 @@ import {
   formatUserAgent,
   gateFlagsFor,
   getCloudSinkConfig,
+  getConfiguredRunContributionClient,
   getSkillById,
   getToolsForRole,
   getWorkspaceHarnessTrust,
@@ -1048,8 +1046,22 @@ import {
   verifyEvolutionSnapshot,
   verifyImprovementLedger,
   verifyPrompt,
-  wilson95
-} from "./chunk-O462Y7P2.js";
+  wilson95,
+  withRunContribution
+} from "./chunk-ANDKY54G.js";
+import {
+  DEFAULT_JOURNAL_SIDECAR_THRESHOLD_BYTES,
+  JOURNAL_SCHEMA_VERSION,
+  branchJournal,
+  createJournalWriter,
+  defaultJournalRootDir,
+  loadJournal,
+  migrateJournalEntry,
+  rehydrateContext,
+  resolveJournalPaths,
+  streamJournal
+} from "./chunk-CAJJRUTV.js";
+import "./chunk-K2PWUPUI.js";
 import {
   IntelCache,
   advisorySweep,
@@ -1081,169 +1093,53 @@ import {
   searchTargetHistory,
   toGraphSnapshot,
   toOsvEcosystem
-} from "./chunk-LOHTE223.js";
-import "./chunk-3MOLBTLS.js";
+} from "./chunk-SBMB4OL3.js";
 import {
   parseSanitizerLog,
   renderSanitizerVerdict
-} from "./chunk-P6WKNFWX.js";
-import {
-  DEFAULT_JOURNAL_SIDECAR_THRESHOLD_BYTES,
-  JOURNAL_SCHEMA_VERSION,
-  branchJournal,
-  createJournalWriter,
-  defaultJournalRootDir,
-  loadJournal,
-  migrateJournalEntry,
-  rehydrateContext,
-  resolveJournalPaths,
-  streamJournal
-} from "./chunk-SOG2U7B3.js";
-import "./chunk-LP3HHYQU.js";
-import "./chunk-KLTNTE2Z.js";
-import "./chunk-HT6P7RY3.js";
-import {
-  activeAppsecLensRegistryPath,
-  appsecArchetypeDigest,
-  appsecArchetypeToFinderLens,
-  appsecArchetypesPath,
-  appsecLensLedgerEntryDigest,
-  appsecUserArchetypesPath,
-  loadAppsecArchetypes,
-  loadAppsecFinderLenses
-} from "./chunk-QI233I24.js";
+} from "./chunk-2OQOQ2FZ.js";
 import {
-  ScanCostLedger
-} from "./chunk-SZJCPG2I.js";
-import {
-  CORE_REVIEW_PROMPT,
-  DEFAULT_IGNORE_DIR_GLOBS,
-  DEFAULT_IGNORE_FILE_GLOBS,
-  DEFAULT_REVIEW_COVERAGE_POLICY,
-  DEFAULT_REVIEW_MATCHERS,
-  REFUSAL_FOLLOWUP_PROMPT,
-  ReviewLimitError,
-  ReviewStore,
-  SLUG_NOTES,
-  STALE_LOCK_MS,
-  TECH_HIGHLIGHTS,
-  appendAnalysis,
-  assembleReviewPrompt,
-  atomicWriteFile,
-  atomicWriteFileSync,
-  batchCandidates,
-  buildInvestigatePrompt,
-  candidateSignature,
-  collectScannableFiles,
-  compileMatchers,
-  computeReviewFindingId,
-  ensureReviewFindingIds,
-  evaluateReviewCoverage,
-  expandSurfaceInventory,
-  expectedFindingsForBatch,
-  extractFencedJson,
-  findingSignature,
-  generateSurfaceInventory,
-  globToRegex,
-  groundSurfaceInventory,
-  matchAnyGlob,
-  matchFileContent,
-  matchGlob,
-  mergeCandidates,
-  mergeFindings,
-  newRunId,
-  normalizeRelPath,
-  normalizeTitle,
-  parseInvestigateResults,
-  parseRefusalReport,
-  parseRevalidateVerdicts,
-  reconcileVerdicts,
-  runFileReviewPipeline,
-  runReviewProcess,
-  runReviewRevalidate,
-  runReviewScan,
-  validateSurfaceInventory
-} from "./chunk-WKNNZVJS.js";
-import "./chunk-RRMJC3ZE.js";
-import "./chunk-H2FFLZNK.js";
+  ESCALATION_LADDER,
+  ladderUpTo,
+  maxRung,
+  ratchet,
+  rungAtLeast,
+  rungRank
+} from "./chunk-UEX7PFSE.js";
 import {
-  DEFAULT_STEP_TIMEOUT_MS,
-  DISCLOSURE_STATUSES,
-  IllegalTransitionError,
-  IncompleteEvidenceError,
-  MAX_CAPTURE_BYTES,
-  PUBLIC_STATUSES,
-  TERMINAL_STATUSES,
-  UnreproducedFindingError,
-  UnverifiedFindingError,
-  allowedNextStatuses,
-  assembleBundleIndex,
-  assembleEvidencePack,
-  assembleReproducibilityManifest,
-  canTransition,
-  composeExploitSession,
-  composeStepSession,
-  createDisclosureRecord,
-  decideFilingState,
-  dropSlug,
-  droppedFilename,
-  evidenceKindForFinding,
-  executePocSteps,
-  extractSiblingFix,
-  formatDroppedReason,
-  isDisclosureWorthy,
-  isFreezeAvailable,
-  isPubliclyDisclosed,
-  renderExploitScreenshot,
-  renderReproducibilityManifest,
-  renderVendorNotificationMarkdown,
-  setRuntimeDeps,
-  transition
-} from "./chunk-UJ4IK5PO.js";
+  defaultDmesgOutPath,
+  detectOutOfBandModuleLoad,
+  loadKernelVmConfigFromEnv,
+  prepareKernelVmArtifacts,
+  verifyKernelFinding,
+  writeProofFileReadOnly
+} from "./chunk-5T6D5BVY.js";
 import {
-  Cvss4ParseError,
-  EmptyPocError,
-  REPORT_PLATFORMS,
-  computeCvss4BaseScore,
-  cvss4Severity,
-  detectVersionRange,
-  extractFileRefs,
-  formatCvss4Vector,
-  formatCweSection,
-  formatPatchStatusSection,
-  formatVersionRangeLine,
-  parseCvss4Vector,
-  redactSensitiveHeaders,
-  renderAdvisoryMarkdown,
-  renderCvssSection,
-  renderPlatformReport,
-  reportTemplate,
-  scoreCvss4Vector,
-  suggestCvss,
-  suggestCvss4,
-  suggestCwesForCategory,
-  verifyAgainstRef
-} from "./chunk-UM3ZNQIM.js";
+  evaluateVerificationSpec,
+  runSourceFix
+} from "./chunk-GIQKESMN.js";
+import "./chunk-PD2BBBKT.js";
 import {
-  classifyReferences,
-  findCveArtifacts,
-  findRedHatTrackerUrls,
-  findUbuntuTrackerUrls,
-  normaliseCveId,
-  parseGhsaResponse,
-  parseNvdResponse as parseNvdResponse2,
-  parseOsvResponse as parseOsvResponse2,
-  parseRedHatTracker,
-  parseUbuntuTracker,
-  scoreCodeCandidate,
-  scoreRepoCandidate
-} from "./chunk-QKICO43A.js";
+  DEFAULT_STEP_TIMEOUT_MS as DEFAULT_STEP_TIMEOUT_MS2,
+  DockerRunner,
+  LocalShellRunner,
+  MAX_STREAM_CAPTURE_BYTES,
+  QemuRunner,
+  STREAM_EXCERPT_BYTES,
+  argvForStep,
+  assertionFromStepExpect,
+  evaluateAssertion,
+  excerpt,
+  persistArtifact,
+  runDeterministicReplay
+} from "./chunk-WF5W75WY.js";
+import "./chunk-QZVG3BG4.js";
 import {
-  ScopePolicy,
-  extractUrls,
-  loadScope,
-  matchUrl
-} from "./chunk-57ZENEX2.js";
+  generateConformanceModel,
+  judgeHttpDivergence,
+  runHttpConformanceCheck,
+  structurallyValidateConformanceModel
+} from "./chunk-SQCBHFWN.js";
 import {
   DEFAULT_ENSEMBLE_MODELS,
   OpenRouterRuntime,
@@ -1252,54 +1148,17 @@ import {
   detectAvailableRuntimes,
   getRuntimeInfo,
   pickRuntimeForStage
-} from "./chunk-MMLDQR4H.js";
-import {
-  CloudAuthError,
-  CloudAuthMissingError,
-  CloudClient,
-  CloudError,
-  CloudForbiddenError,
-  CloudNetworkError,
-  CloudUnauthorizedError,
-  DEFAULT_CLOUD_HOST,
-  FEATURE_PRESETS,
-  LlmApiRuntime,
-  MAX_BUFFERED,
-  MAX_CODE_LENGTH,
-  MAX_FIELDS,
-  MAX_FIELD_VALUE_LENGTH,
-  MAX_MESSAGE_LENGTH,
-  OperatorAbortError,
-  QuotaExhaustedError,
-  _resetDiagnosticsForTests,
-  applyFeaturePreset,
-  applyFeaturePresetFromEnv,
-  claimDiagnostics,
-  diag,
-  features,
-  formatDiagnosticLine,
-  isDiagnosticsClaimed,
-  loadCloudCredentials,
-  parseUsageLimitReached,
-  recentDiagnostics,
-  resolveFeaturePreset,
-  stderrDiagnosticSink,
-  subscribeDiagnostics
-} from "./chunk-2SANI5RH.js";
+} from "./chunk-NDJU5ZZ7.js";
 import {
   ProcessRuntime
-} from "./chunk-CLHCDHP4.js";
+} from "./chunk-ER3SUMYJ.js";
 import {
   cloudEventSink,
   eventBus,
   isCloudEventSinkActive,
   maybeSubscribeCloudEventSink,
   presentationEventSink
-} from "./chunk-QOKTUOU2.js";
-import {
-  estimateCost
-} from "./chunk-KKGE5RQE.js";
-import "./chunk-YLMN3N25.js";
+} from "./chunk-CXKDWFNO.js";
 import {
   AD_ANALYZERS_BY_ID,
   buildAdGraph,
@@ -1307,7 +1166,7 @@ import {
   ingestBloodHoundJson,
   parseBloodHoundFile,
   runAdGraphAnalysis
-} from "./chunk-6LKRLK2R.js";
+} from "./chunk-FHC2B7LN.js";
 import {
   AZ_EDGE_TECHNIQUES,
   ENTRA_PATH_ANALYZERS,
@@ -1400,7 +1259,7 @@ import {
   tier0TargetIds,
   tokenFingerprint,
   writebackEnabled
-} from "./chunk-SAFFWQW4.js";
+} from "./chunk-P6YG6TEZ.js";
 import {
   AD_ANALYZERS,
   AD_EDGE_TECHNIQUES,
@@ -1418,7 +1277,80 @@ import {
   reachableFrom,
   reachableTo,
   shortestPaths
-} from "./chunk-VQG4FT5D.js";
+} from "./chunk-UFHN6RIU.js";
+import "./chunk-WZISK5VC.js";
+import {
+  DEFAULT_STEP_TIMEOUT_MS,
+  DISCLOSURE_STATUSES,
+  IllegalTransitionError,
+  IncompleteEvidenceError,
+  MAX_CAPTURE_BYTES,
+  PUBLIC_STATUSES,
+  TERMINAL_STATUSES,
+  UnreproducedFindingError,
+  UnverifiedFindingError,
+  allowedNextStatuses,
+  assembleBundleIndex,
+  assembleEvidencePack,
+  assembleReproducibilityManifest,
+  canTransition,
+  composeExploitSession,
+  composeStepSession,
+  createDisclosureRecord,
+  decideFilingState,
+  dropSlug,
+  droppedFilename,
+  evidenceKindForFinding,
+  executePocSteps,
+  extractSiblingFix,
+  formatDroppedReason,
+  isDisclosureWorthy,
+  isFreezeAvailable,
+  isPubliclyDisclosed,
+  renderExploitScreenshot,
+  renderReproducibilityManifest,
+  renderVendorNotificationMarkdown,
+  setRuntimeDeps,
+  transition
+} from "./chunk-VOAXLO4A.js";
+import {
+  Cvss4ParseError,
+  EmptyPocError,
+  REPORT_PLATFORMS,
+  computeCvss4BaseScore,
+  cvss4Severity,
+  detectVersionRange,
+  extractFileRefs,
+  formatCvss4Vector,
+  formatCweSection,
+  formatPatchStatusSection,
+  formatVersionRangeLine,
+  parseCvss4Vector,
+  redactSensitiveHeaders,
+  renderAdvisoryMarkdown,
+  renderCvssSection,
+  renderPlatformReport,
+  reportTemplate,
+  scoreCvss4Vector,
+  suggestCvss,
+  suggestCvss4,
+  suggestCwesForCategory,
+  verifyAgainstRef
+} from "./chunk-W4JOXE4N.js";
+import {
+  classifyReferences,
+  findCveArtifacts,
+  findRedHatTrackerUrls,
+  findUbuntuTrackerUrls,
+  normaliseCveId,
+  parseGhsaResponse,
+  parseNvdResponse as parseNvdResponse2,
+  parseOsvResponse as parseOsvResponse2,
+  parseRedHatTracker,
+  parseUbuntuTracker,
+  scoreCodeCandidate,
+  scoreRepoCandidate
+} from "./chunk-WPQLBN4S.js";
 import {
   detectTargetType,
   expandHomePath,
@@ -1426,9 +1358,56 @@ import {
   isExplicitLocalTargetPath,
   prepare,
   resolveLocalTargetPath
-} from "./chunk-WU6AFRAZ.js";
-import "./chunk-DW5UWPFY.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-V36HVTUL.js";
+import "./chunk-4VGLO2YS.js";
+import "./chunk-6YNKRUMC.js";
+import {
+  ScopePolicy,
+  extractUrls,
+  loadScope,
+  matchUrl
+} from "./chunk-CGHCEN7W.js";
+import {
+  loadCodexModelCatalog
+} from "./chunk-HPQZHOIU.js";
+import {
+  CloudAuthError,
+  CloudAuthMissingError,
+  CloudClient,
+  CloudError,
+  CloudForbiddenError,
+  CloudNetworkError,
+  CloudUnauthorizedError,
+  DEFAULT_CLOUD_HOST,
+  FEATURE_PRESETS,
+  LlmApiRuntime,
+  MAX_BUFFERED,
+  MAX_CODE_LENGTH,
+  MAX_FIELDS,
+  MAX_FIELD_VALUE_LENGTH,
+  MAX_MESSAGE_LENGTH,
+  OperatorAbortError,
+  QuotaExhaustedError,
+  _resetDiagnosticsForTests,
+  applyFeaturePreset,
+  applyFeaturePresetFromEnv,
+  claimDiagnostics,
+  diag,
+  features,
+  formatDiagnosticLine,
+  isDiagnosticsClaimed,
+  loadCloudCredentials,
+  parseUsageLimitReached,
+  recentDiagnostics,
+  resolveFeaturePreset,
+  stderrDiagnosticSink,
+  subscribeDiagnostics
+} from "./chunk-BACXRTQ4.js";
+import {
+  estimateCost
+} from "./chunk-PC6RCKQV.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   ACTION_LOG_ARGS_MAX,
   ACTION_LOG_ARG_VALUE_MAX,
@@ -1460,7 +1439,7 @@ export {
   COMPACT_DETAIL_CHARS,
   CONSERVATIVE_JITTER_MS,
   CONSERVATIVE_RPS,
-  CORE_REVIEW_PROMPT,
+  CONTRIBUTION_ENDPOINT,
   CloudAuthError,
   CloudAuthMissingError,
   CloudClient,
@@ -1477,16 +1456,13 @@ export {
   DEFAULT_CONCURRENCY,
   DEFAULT_ENSEMBLE_MODELS,
   DEFAULT_HANDSHAKE_TIMEOUT_MS,
-  DEFAULT_IGNORE_DIR_GLOBS,
-  DEFAULT_IGNORE_FILE_GLOBS,
   DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
   DEFAULT_JOURNAL_SIDECAR_THRESHOLD_BYTES,
   DEFAULT_MAX_DURATION_MS,
+  DEFAULT_MAX_TOOL_ITERATIONS,
   DEFAULT_MCP_PATHS,
   DEFAULT_RACE_WIDEN_DELAY_MS,
   DEFAULT_REGISTRY_URL,
-  DEFAULT_REVIEW_COVERAGE_POLICY,
-  DEFAULT_REVIEW_MATCHERS,
   DEFAULT_SEED_DIRS,
   DEFAULT_SPEC_PATHS,
   DEFAULT_STEP_TIMEOUT_MS,
@@ -1560,6 +1536,8 @@ export {
   IntelCache,
   JOURNAL_SCHEMA_VERSION,
   KERNELCTF_TIER1_RACE_GRID,
+  KERNEL_FUNCTION_BATCH_SIZE,
+  KERNEL_FUNCTION_LABELS,
   KERNEL_RUN_PROGRAM_MAX_BYTES,
   KERNEL_RUN_TOOL_DEFINITION,
   KNOWN_ATTACK_SURFACES,
@@ -1634,7 +1612,6 @@ export {
   RECENCY_DETECTORS_ALL,
   RECENCY_DETECTORS_FULL,
   RECENCY_REACHABLE_ALLOWLIST,
-  REFUSAL_FOLLOWUP_PROMPT,
   REPORT_PLATFORMS,
   RESULT_TRUNCATION_MARKER,
   ROLE_TEMPLATE_IDS,
@@ -1642,15 +1619,13 @@ export {
   RUNTIME_REGISTRY,
   RateLimiter,
   ResearchAdapterRegistry,
-  ReviewLimitError,
-  ReviewStore,
+  RunCapture,
+  RunContributionClient,
   SCOPE_DEPENDENT_BASH_GUARDS,
   SCOPE_GUARDS_INERT_EVENT,
   SELF_EXTENSION_SETTING_DEF,
   SEMANTIC_COSMETIC_RUBRIC,
-  SLUG_NOTES,
   STAGE_ACTION_HISTORY_CAP,
-  STALE_LOCK_MS,
   STANDARD_RPS,
   SYNTH_TOOL,
   SYNTH_TOOL_NAME,
@@ -1661,7 +1636,6 @@ export {
   SuiteOracleObjectiveSchema,
   SuiteTaskTargetSchema,
   TECHNIQUE_LIBRARY,
-  TECH_HIGHLIGHTS,
   TERMINAL_STATUSES,
   TIER0_GRAPH_PERMISSIONS,
   TIER0_ROLE_TEMPLATE_IDS,
@@ -1719,7 +1693,6 @@ export {
   analyzeToken,
   apiSpecToAssets,
   appFixVariantsToSeedFindings,
-  appendAnalysis,
   appendHuntClaim,
   appendImprovementLedgerEntry,
   appendLedgerEntry,
@@ -1748,15 +1721,12 @@ export {
   assembleBundleIndex,
   assembleEvidencePack,
   assembleReproducibilityManifest,
-  assembleReviewPrompt,
   assertReadOnlyAction,
   assertionFromStepExpect,
   assessEscalation,
   assumptionsToHuntPlan,
   atlasTechniquesForCategory,
   atlasTechniquesForEvent,
-  atomicWriteFile,
-  atomicWriteFileSync,
   attackPrompt,
   attemptExploitabilityUpgrade,
   attemptWinRace,
@@ -1767,7 +1737,6 @@ export {
   automationVerdict,
   autonomousClimb,
   availableRefuterCandidates,
-  batchCandidates,
   blindVerifyPrompt,
   bootedCacheKey,
   boundaryCrossings,
@@ -1795,7 +1764,6 @@ export {
   buildIntelDossier,
   buildInvariantHuntContext,
   buildInvariantModel,
-  buildInvestigatePrompt,
   buildKernelPromotionEnvelope,
   buildKernelVerifyInitialPrompt,
   buildKernelVerifySystemPrompt,
@@ -1825,7 +1793,6 @@ export {
   canTransition,
   candidateGrepPatterns,
   candidateReferenceTokens,
-  candidateSignature,
   canonicalEntryPayload,
   canonicalEvolutionJson,
   canonicalProposalJson,
@@ -1836,6 +1803,7 @@ export {
   categoryToWebKind,
   shouldWeaponize as ceilingClearsWeaponizeBar,
   changedFilesInRange,
+  checkAlreadyFixed,
   checkFixPresentInTarget,
   checkNotYetIntroduced,
   checkNovelty,
@@ -1865,12 +1833,10 @@ export {
   cloudEventSink,
   clusterCandidates,
   coerceEnablementRecord,
-  collectScannableFiles,
   collectScopeFiles,
   collectTenantSnapshot,
   compareScorecards,
   compileAndRunReproducer,
-  compileMatchers,
   composeExploitSession,
   composeGadgetSetup,
   composeGate,
@@ -1880,11 +1846,17 @@ export {
   computeEstablisherSets,
   computeEstablisherWrappers,
   computePriorityScore,
-  computeReviewFindingId,
   computeSurfaceScore,
+  configureRunContributionsFromEnvironment,
   confirmedMissToCandidate,
   connectMcpServers,
   consolidateMemory,
+  contributionChunkSchema,
+  contributionClientPolicySchema,
+  contributionManifestSchema,
+  contributionPurposeSchema,
+  contributionReceiptSchema,
+  contributionTransitionSchema,
   controlRungForDemo,
   corpusV1Path,
   countCommits,
@@ -1895,10 +1867,12 @@ export {
   crashSeverity,
   crashSignatureFromReport,
   crashSignatureFromText,
+  crashSummaryFromTriage,
   crashToFinding,
   crashTypeToCategory,
   createAgenticScanAdapter,
   createBenchIntegrationRegistry,
+  createConsoleJevRuntime,
   createConsoleRuntime,
   createConsoleSession,
   createCoreBenchIntegration,
@@ -1932,6 +1906,7 @@ export {
   createXnuFuzzReceipt,
   crossCheckAssumptions,
   crossFamilyRefuteEnabled,
+  currentRunContribution,
   cvss4Severity,
   decideAddressing,
   decideFilingState,
@@ -2014,7 +1989,6 @@ export {
   encodePluginMessage,
   encodeProgram,
   ensurePluginsRoot,
-  ensureReviewFindingIds,
   entraAnchors,
   entraNodeId,
   enumerateAttackSurfaces,
@@ -2032,7 +2006,6 @@ export {
   evaluateGuards,
   evaluateImprovementPromotion,
   evaluateRegression,
-  evaluateReviewCoverage,
   evaluateSignature,
   evaluateVerificationSpec,
   eventBus,
@@ -2045,8 +2018,6 @@ export {
   executeKernelRun,
   executePocSteps,
   expandHomePath,
-  expandSurfaceInventory,
-  expectedFindingsForBatch,
   extractAttributionFromScopeJson,
   extractCFromLlmOutput,
   extractCorpus,
@@ -2054,10 +2025,10 @@ export {
   extractDupeSignature,
   extractEngagementFromScopeJson,
   extractFeatures,
-  extractFencedJson,
   extractFileRefs,
   extractInlineCodeBlock,
   extractKernelFindingMetadata,
+  extractKernelFunctions,
   extractResponseText,
   extractSiblingFix,
   extractSpecInvariants,
@@ -2098,7 +2069,6 @@ export {
   findUbuntuTrackerUrls,
   findUnconstrainedDelegation,
   findViolationsDataflow,
-  findingSignature,
   findingToQuery,
   findingTokens,
   fnv1a64,
@@ -2135,10 +2105,10 @@ export {
   generateRaceSmellCandidates,
   generateRemediation,
   generateRemediationWithLLM,
-  generateSurfaceInventory,
   generateSyzChoiceWeights,
   generateVariantCandidates,
   getCloudSinkConfig,
+  getConfiguredRunContributionClient,
   getDetectorById,
   getEvalCategories,
   getObservation,
@@ -2150,9 +2120,7 @@ export {
   getTechnique,
   getToolsForRole,
   getWorkspaceHarnessTrust,
-  globToRegex,
   grantedPermissionNames,
-  groundSurfaceInventory,
   guardApprovalUnavailable,
   guardNetworkRequiresScope,
   guardPackage,
@@ -2256,6 +2224,7 @@ export {
   loadAssumptionModel,
   loadChromiumArchetypes,
   loadCloudCredentials,
+  loadCodexModelCatalog,
   loadCpg,
   loadEvolutionConfigFile,
   loadEvolutionRegistry,
@@ -2314,10 +2283,7 @@ export {
   markProcessed,
   markerFired,
   markerLine,
-  matchAnyGlob,
   matchCrashSignature,
-  matchFileContent,
-  matchGlob,
   matchNegative,
   matchTriggers,
   matchUrl,
@@ -2332,9 +2298,7 @@ export {
   memCorruptionVerdict,
   memPrimitiveToCategory,
   memoryTokens,
-  mergeCandidates,
   mergeCraftEvidence,
-  mergeFindings,
   mergeHarvestedMisses,
   mergeIntel,
   migrateJournalEntry,
@@ -2353,7 +2317,6 @@ export {
   networkScopeRequiredRefusal,
   newCorrelationId,
   newMessageId,
-  newRunId,
   nodeChildSpawner,
   nodeOrStub,
   normaliseCveId,
@@ -2364,10 +2327,8 @@ export {
   normalizeGuid,
   normalizeId,
   normalizeProposalPath,
-  normalizeRelPath,
   normalizeStageAction,
   normalizeStageEndDetail,
-  normalizeTitle,
   objectTypeToken,
   objectiveOracle,
   objectiveOracleEvaluatorAttestation,
@@ -2399,7 +2360,6 @@ export {
   parseHarnessGenerationSpec,
   parseNvdResponse as parseIntelNvdResponse,
   parseOsvResponse as parseIntelOsvResponse,
-  parseInvestigateResults,
   parseKcsanReport,
   parseKernelConfig,
   parseListing,
@@ -2414,10 +2374,8 @@ export {
   parseOsvResponse2 as parseOsvResponse,
   parseRateLimitFlag,
   parseRedHatTracker,
-  parseRefusalReport,
   parseRegistryIndex,
   parseRetryAfter,
-  parseRevalidateVerdicts,
   parseSanitizerLog,
   parseSeedFindings,
   parseSelectorMapText,
@@ -2471,10 +2429,14 @@ export {
   raceStrategies,
   raceWidenEnv,
   raceWithDefaults,
+  radarCandidatesToSeedFindings,
   rankAndDedupeFoxguardLeads,
   rankBugsByProvenRung,
   rankCandidates,
+  rankCrashesWithJev,
   rankDanger,
+  rankKernelCommitsWithJev,
+  rankKernelHypothesesWithJev,
   rankResearchProposals,
   ratchet,
   reachabilityGate,
@@ -2490,7 +2452,6 @@ export {
   readUnstableDetector,
   recentDiagnostics,
   reconcile,
-  reconcileVerdicts,
   recordEvolutionVersion,
   redactRecordStrings,
   redactSecrets,
@@ -2557,6 +2518,7 @@ export {
   runAllAnalyzers,
   runAnalysisAgent,
   runAssumptionHunt,
+  runBehavioralRepair,
   runBenchCase,
   runBenchSuite,
   runCliPathTraversalReplayFixture,
@@ -2571,13 +2533,13 @@ export {
   runEval,
   runEvolution,
   runExploitScan,
-  runFileReviewPipeline,
   runHttpConformanceCheck,
   runHuntScan,
   runHybridPathAnalysis,
   runIdentityAssessment,
   runJsRecon,
   runKernelExploitChain,
+  runKernelSourceJevPrepass,
   runKernelVariantHunt,
   runLensSynthesisLoop,
   runLlmIpiAudit,
@@ -2594,10 +2556,8 @@ export {
   runRecon,
   runReproductionBundle,
   runResearch,
-  runReviewProcess,
-  runReviewRevalidate,
-  runReviewScan,
   runSecondAudit,
+  runSecureProject,
   runSelfConsistencyVerify,
   runSourceFix,
   runSpecdriftPlan,
@@ -2624,6 +2584,7 @@ export {
   scanDualViewContexts,
   scanForModuleInit,
   scanForPatchGapCandidates,
+  scanRepoCommitsWithJev,
   scanReportToBenchResult,
   scanViolatingContexts,
   scopeRequiredRefusal,
@@ -2698,6 +2659,7 @@ export {
   syncLoreMirror,
   synthesizeArchetypes,
   syzChoiceWeightsFromPlan,
+  syzWeightingContextFromJev,
   syzbotQueueBrief,
   tableMetrics,
   tallyConsensus,
@@ -2716,6 +2678,7 @@ export {
   toOsvEcosystem,
   toScopeFile,
   toScopeJson,
+  toToolContextJevRuntime,
   toVerifyVerdict,
   tokenFingerprint,
   toolCallPreview,
@@ -2738,7 +2701,6 @@ export {
   validateProposalAttempt,
   validateProposalReplay,
   validateResearchProposal,
-  validateSurfaceInventory,
   validateUpdateTodosArgs,
   validateXnuFuzzReceipt,
   variableLengthSchedule,
@@ -2762,6 +2724,7 @@ export {
   widenEnvFor,
   wilson95,
   withEnvOverrides,
+  withRunContribution,
   withVariantFeatureFlags,
   witnessAssumptionViolation,
   witnessDualViewContexts,