0sec-cli 0.18.0 → 0.21.4

package/chunks/corpus-v1.json

@@ -1,7 +1,7 @@
 {
-  "id": "0sec-bench-corpus-v1",
+  "id": "0-bench-corpus-v1",
   "version": 1,
-  "_comment": "LABELED, UNCONTAMINATED REGRESSION CORPUS v1 (0sec#657). Ground truth the #656 A/B tournament + CI gate measures against. REFERENCES ONLY — no exploit material. A source-audit case is a PUBLIC registry coordinate (package@version) the engine installs at run time; a kernel case is a reproducerRef resolved OUTSIDE the repo. Positives are sourced from our own confirmed disclosures (disclosure/*.md); sinkMarkers are literal file/symbol substrings drawn from those writeups, used for DETERMINISTIC marker-based grading (never LLM-judged). Known-negatives are (a) real triage false-positive controls — findings the maintainer rejected as by-design / unreachable / superseded / refuted, where a 'verified' verdict is itself a false positive — and (b) PUBLIC fixed-CVE packages pinned at a PATCHED version: re-reporting the historical class there is a false positive. EMBARGO: references pending-disclosure findings; do not publish externally without operator approval (disclosure/AGENTS.md rules apply). Provenance + full label table: docs/operations/bench-corpus-v1.md.",
+  "_comment": "LABELED, UNCONTAMINATED REGRESSION CORPUS v1 (0#657). Ground truth the #656 A/B tournament + CI gate measures against. REFERENCES ONLY — no exploit material. A source-audit case is a PUBLIC registry coordinate (package@version) the engine installs at run time; a kernel case is a reproducerRef resolved OUTSIDE the repo. Positives are sourced from our own confirmed disclosures (disclosure/*.md); sinkMarkers are literal file/symbol substrings drawn from those writeups, used for DETERMINISTIC marker-based grading (never LLM-judged). Known-negatives are (a) real triage false-positive controls — findings the maintainer rejected as by-design / unreachable / superseded / refuted, where a 'verified' verdict is itself a false positive — and (b) PUBLIC fixed-CVE packages pinned at a PATCHED version: re-reporting the historical class there is a false positive. EMBARGO: references pending-disclosure findings; do not publish externally without operator approval (disclosure/AGENTS.md rules apply). Provenance + full label table: docs/operations/bench-corpus-v1.md.",
   "cases": [
     {
       "id": "src-sequelize-set-sqli",

package/chunks/data/appsec-archetypes.json

@@ -1,5 +1,5 @@
 {
-  "provenance": "0sec-authored appsec bug-class registry, 2026-07-21. Mirrors the SCHEMA of kernel-archetypes.json but is a SEPARATE, cross-language application-security pack (domain: appsec), NOT ported from 0verse (0verse's registry is Linux-kernel-only). Grounded in OWASP Top-10 / CWE and in the concrete misses these lenses were built to close: the Swiss engagement's gever OS-command-injection CRITICAL and the sibling-route authz / template-XSS / SSO-trust / resource-exhaustion classes the four generic finder lenses (memory-safety, input-validation, auth-logic, secrets-crypto) under-weighted. Unlike the kernel pack there is NO build/boot/sanitizer lane for these — every entry is route 'appsec-source-static': a grep/read hit is a hypothesis for the skeptic + multi-lens verify quorum, never an auto-confirmed finding. The load-bearing field for the finder surface is 'challenge_hint' (the cross-language, sink-shape-citing hunt angle), which the loader maps directly onto FinderLens.challengeHint; 'detection_signature' is the human/skeptic-facing grep evidence. 'engine_lens' is null for every entry (no pre-existing engine lens implements these — this registry IS their implementation).",
+  "provenance": "0-authored appsec bug-class registry, 2026-07-21. Mirrors the SCHEMA of kernel-archetypes.json but is a SEPARATE, cross-language application-security pack (domain: appsec), NOT ported from 0verse (0verse's registry is Linux-kernel-only). Grounded in OWASP Top-10 / CWE and in the concrete misses these lenses were built to close: the Swiss engagement's gever OS-command-injection CRITICAL and the sibling-route authz / template-XSS / SSO-trust / resource-exhaustion classes the four generic finder lenses (memory-safety, input-validation, auth-logic, secrets-crypto) under-weighted. Unlike the kernel pack there is NO build/boot/sanitizer lane for these — every entry is route 'appsec-source-static': a grep/read hit is a hypothesis for the skeptic + multi-lens verify quorum, never an auto-confirmed finding. The load-bearing field for the finder surface is 'challenge_hint' (the cross-language, sink-shape-citing hunt angle), which the loader maps directly onto FinderLens.challengeHint; 'detection_signature' is the human/skeptic-facing grep evidence. 'engine_lens' is null for every entry (no pre-existing engine lens implements these — this registry IS their implementation).",
   "archetypes": [
     {
       "id": "os-command-injection",
@@ -13,7 +13,7 @@
       "grounding": [
         "CWE-78: Improper Neutralization of Special Elements used in an OS Command",
         "OWASP Top 10 A03:2021 Injection",
-        "0sec Swiss engagement: gever OS-command-injection CRITICAL (missed by the generic input-validation lens)"
+        "0 Swiss engagement: gever OS-command-injection CRITICAL (missed by the generic input-validation lens)"
       ],
       "confirmable": "Source-static hypothesis. A grep/read hit needs the skeptic + multi-lens verify quorum to confirm the argument is genuinely attacker-reachable and not escaped/tokenized upstream; no build/exec lane proves it in this repo.",
       "uid": "appsec/os-command-injection",

package/chunks/data/chromium-archetypes.json

@@ -1,5 +1,5 @@
 {
-  "provenance": "0sec-authored (NOT ported from 0verse — 0verse's archetypes.json is Linux-kernel-only, no browser registry exists). Grounded in public Chrome VRP writeups, Project Zero, v8CTF blogs, and CVE/NVD entries, several confirmed by fetching the writeup text directly, 2026-07-05. IMPORTANT HONEST CAVEAT: unlike the Linux kernel pack, this repo has NO Chromium build lane (no `out/Release` compile, no ASan/libFuzzer harness, no v8CTF live-instance submit path) today — every archetype below is SOURCE-STATIC ONLY: a grep/read hit is a hypothesis for human/skeptic review, never a proven-confirmable claim, and several entries below explicitly flag where the cited symbol name comes from a third-party writeup rather than an independently-verified read of chromium/v8 source (no local checkout existed at authoring time). Chromium/V8 C++ identifiers are PascalCase/camelCase, NOT snake_case like Linux/FreeBSD kernel C — see CHROMIUM_BARE_WORDS in archetype-catalog.ts; without it `symbolsFromDetectionSignature`'s underscore heuristic would yield zero candidates for nearly every entry here.",
+  "provenance": "0-authored (NOT ported from 0verse — 0verse's archetypes.json is Linux-kernel-only, no browser registry exists). Grounded in public Chrome VRP writeups, Project Zero, v8CTF blogs, and CVE/NVD entries, several confirmed by fetching the writeup text directly, 2026-07-05. IMPORTANT HONEST CAVEAT: unlike the Linux kernel pack, this repo has NO Chromium build lane (no `out/Release` compile, no ASan/libFuzzer harness, no v8CTF live-instance submit path) today — every archetype below is SOURCE-STATIC ONLY: a grep/read hit is a hypothesis for human/skeptic review, never a proven-confirmable claim, and several entries below explicitly flag where the cited symbol name comes from a third-party writeup rather than an independently-verified read of chromium/v8 source (no local checkout existed at authoring time). Chromium/V8 C++ identifiers are PascalCase/camelCase, NOT snake_case like Linux/FreeBSD kernel C — see CHROMIUM_BARE_WORDS in archetype-catalog.ts; without it `symbolsFromDetectionSignature`'s underscore heuristic would yield zero candidates for nearly every entry here.",
   "archetypes": [
     {
       "id": "V8-01",

package/chunks/data/freebsd-archetypes.json

@@ -1,5 +1,5 @@
 {
-  "provenance": "0sec-authored (NOT ported from 0verse — 0verse's archetypes.json is Linux-only, no FreeBSD registry exists). Grounded independently in public FreeBSD-SA advisories / CVEs, several confirmed by fetching the advisory text directly, 2026-07-05. IMPORTANT HONEST CAVEAT: unlike the Linux pack, this repo has NO FreeBSD build+boot+KASAN kernel-verify lane today — every 'kernel-verify' route entry below is a hypothesis that needs a human/skeptic read (or a future FreeBSD prover lane), not a proven-confirmable claim.",
+  "provenance": "0-authored (NOT ported from 0verse — 0verse's archetypes.json is Linux-only, no FreeBSD registry exists). Grounded independently in public FreeBSD-SA advisories / CVEs, several confirmed by fetching the advisory text directly, 2026-07-05. IMPORTANT HONEST CAVEAT: unlike the Linux pack, this repo has NO FreeBSD build+boot+KASAN kernel-verify lane today — every 'kernel-verify' route entry below is a hypothesis that needs a human/skeptic read (or a future FreeBSD prover lane), not a proven-confirmable claim.",
   "archetypes": [
     {
       "id": "CP-01",

package/chunks/data/kernel-archetypes.json

@@ -298,7 +298,7 @@
       "pattern": "Less-audited protocols mismanage a per-socket list/timer/fragment-reassembly buffer on teardown or concurrent op -> UAF / double-free / OOB. These are reachable by unprivileged users and historically under-fuzzed.",
       "detection_signature": "Relocations to del_timer / hrtimer_cancel / list_del / kfree_skb / call_rcu survive. Shape: timer or list entry freed but not removed, or reassembly buffer reused. Maps to L5/L8/L12. MEDIUM-HARD.",
       "grounding": [
-        "tipc / nfc-llcp / nfc-digital / bluetooth fixes (0sec-disclosed, merged)",
+        "tipc / nfc-llcp / nfc-digital / bluetooth fixes (0-disclosed, merged)",
         "CAN bcm UAF family",
         "n_gsm UAF"
       ],
@@ -564,7 +564,7 @@
       "pattern": "A key or key_ref refcount is mishandled on an error/assoc path (request_key_auth UAF, key GC vs use) -> UAF on a key object reachable from an unprivileged keyctl call.",
       "detection_signature": "Relocations to key_put / key_ref_put / refcount_dec survive. Shape: put-without-get or use-after-put on a key. Maps to L5 + L8. MEDIUM-HARD.",
       "grounding": [
-        "request_key_auth UAF (contested, unpatched 6.12.93 per 0sec notes)",
+        "request_key_auth UAF (contested, unpatched 6.12.93 per 0 notes)",
         "keyctl refcount CVEs"
       ],
       "confirmable": "NO; kernel-verify lane (bench has the keyctl harness).",

package/chunks/db-U3WQZVAO.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  registerDbCommand,
+  seedVerificationWorkbench
+} from "./chunk-HBKCGJAV.js";
+import "./chunk-HLFS6WV2.js";
+import "./chunk-WZISK5VC.js";
+import "./chunk-PC6RCKQV.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
+export {
+  registerDbCommand,
+  seedVerificationWorkbench
+};

package/chunks/{disclose-EKTWSCGW.js → disclose-67GZCDBO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   DEFAULT_STEP_TIMEOUT_MS,
   DISCLOSURE_STATUSES,
@@ -39,7 +39,7 @@ import {
   sanitizeWriteup,
   setRuntimeDeps,
   transition
-} from "./chunk-U5FLXGHT.js";
+} from "./chunk-VOAXLO4A.js";
 import {
   Cvss4ParseError,
   EmptyPocError,
@@ -65,8 +65,8 @@ import {
   suggestCvss4,
   suggestCwesForCategory,
   verifyAgainstRef
-} from "./chunk-WEBMRWEG.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-W4JOXE4N.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   Cvss4ParseError,
   DEFAULT_STEP_TIMEOUT_MS,

package/chunks/{dist-FMGSR3DW.js → dist-ACC3DZUZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   AGENT_ACTION_ASSURANCE_SCHEMA_VERSION,
   AgentActionEvidenceManifestSchema,
@@ -33,6 +33,7 @@ import {
   VerificationModeSchema,
   VerificationResultSchema,
   VerificationStatusSchema,
+  cloudStateDir,
   compareRoles,
   conditionCmpOpSchema,
   conditionCmpSchema,
@@ -40,6 +41,7 @@ import {
   conditionLhsSchema,
   conditionRhsSchema,
   createAuditReportDocument,
+  createJevEvaluator,
   createPresentationEvent,
   createReviewReportDocument,
   createScanReportDocument,
@@ -52,6 +54,7 @@ import {
   hasMultipleIdentities,
   homeStateDir,
   isPresentationEvent,
+  jevConfigFromEnvironment,
   meetsSeverityFloor,
   modelProvider,
   normalizeResearchNovelty,
@@ -77,9 +80,9 @@ import {
   transitionRuleSchema,
   transitionTargetSchema,
   workflowDefinitionSchema
-} from "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-PC6RCKQV.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   AGENT_ACTION_ASSURANCE_SCHEMA_VERSION,
   AgentActionEvidenceManifestSchema,
@@ -112,6 +115,7 @@ export {
   VerificationModeSchema,
   VerificationResultSchema,
   VerificationStatusSchema,
+  cloudStateDir,
   compareRoles,
   conditionCmpOpSchema,
   conditionCmpSchema,
@@ -119,6 +123,7 @@ export {
   conditionLhsSchema,
   conditionRhsSchema,
   createAuditReportDocument,
+  createJevEvaluator,
   createPresentationEvent,
   createReviewReportDocument,
   createScanReportDocument,
@@ -131,6 +136,7 @@ export {
   hasMultipleIdentities,
   homeStateDir,
   isPresentationEvent,
+  jevConfigFromEnvironment,
   meetsSeverityFloor,
   modelProvider,
   normalizeResearchNovelty,

package/chunks/{dist-4MAW5X6L.js → dist-EVTN3UTT.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   agentSessions,
   artifactKinds,
@@ -34,10 +34,10 @@ import {
   workerStatuses,
   workers,
   writeOsecRunReport
-} from "./chunk-72CISA2D.js";
-import "./chunk-6L26OBWI.js";
-import "./chunk-YLMN3N25.js";
-import "./chunk-IR537GON.js";
+} from "./chunk-WZISK5VC.js";
+import "./chunk-PC6RCKQV.js";
+import "./chunk-VIT5ALXF.js";
+import "./chunk-VCSFCHAJ.js";
 export {
   agentSessions,
   artifactKinds,