0sec-cli 0.18.0 → 0.21.4

package/chunks/{chunk-3KPWWJCI.js → chunk-5T6D5BVY.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-PC6RCKQV.js";
 
 // packages/core/dist/triage/kernel-vm-runner.js
 import { execFileSync, spawn } from "node:child_process";
@@ -196,7 +196,7 @@ function inferDiskFormat(diskImage) {
   return diskImage.endsWith(".qcow2") || diskImage.endsWith(".qcow") ? "qcow2" : "raw";
 }
 function defaultKernelCacheDir() {
-  return process.env["0SEC_KERNEL_BUILD_CACHE"]?.trim() || join(homeStateDir(), "kernel-cache");
+  return process.env["ZERO_KERNEL_BUILD_CACHE"]?.trim() || join(homeStateDir(), "kernel-cache");
 }
 function kernelTreeFingerprint(kernelTree) {
   try {
@@ -232,7 +232,7 @@ function sha256File(path) {
   return createHash("sha256").update(readFileSync(path)).digest("hex");
 }
 function expectedKernelRelease(kernelTree, explicit, requireExplicit = false) {
-  const fromEnv = explicit?.trim() || process.env["0SEC_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
+  const fromEnv = explicit?.trim() || process.env["ZERO_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
   if (fromEnv) {
     if (!RELEASE_RE.test(fromEnv))
       throw new Error("invalid expected kernel release");
@@ -251,7 +251,7 @@ function expectedKernelRelease(kernelTree, explicit, requireExplicit = false) {
   const version = part("VERSION"), patch = part("PATCHLEVEL"), sub = part("SUBLEVEL") ?? "0", extra = part("EXTRAVERSION") ?? "";
   const release = version && patch ? `${version}.${patch}.${sub}${extra}` : "";
   if (!RELEASE_RE.test(release))
-    throw new Error("cannot determine expected kernel release; set 0SEC_KERNEL_QEMU_EXPECTED_RELEASE");
+    throw new Error("cannot determine expected kernel release; set ZERO_KERNEL_QEMU_EXPECTED_RELEASE");
   return release;
 }
 function kernelBuildCacheKey(kernelTree, configProfile) {
@@ -270,7 +270,7 @@ function defaultBuildRunner(input) {
     join(process.cwd(), "src/triage/kernel-vm/build-from-tree.sh")
   ].find((candidate) => existsSync(candidate));
   if (!script) {
-    throw new Error("kernel build script not found; set 0SEC_KERNEL_QEMU_KERNEL/0SEC_KERNEL_QEMU_DISK to prebuilt artifacts or run from a source checkout");
+    throw new Error("kernel build script not found; set ZERO_KERNEL_QEMU_KERNEL/ZERO_KERNEL_QEMU_DISK to prebuilt artifacts or run from a source checkout");
   }
   execFileSync("bash", [script, input.kernelTree, input.outDir, input.configProfile], {
     stdio: "inherit"
@@ -279,14 +279,14 @@ function defaultBuildRunner(input) {
 function prepareKernelVmArtifacts(opts) {
   const configProfile = opts.configProfile ?? "kasan";
   const log = opts.logger ?? ((line) => console.log(line));
-  const envKernel = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
-  const envDisk = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  const envKernel = process.env["ZERO_KERNEL_QEMU_KERNEL"]?.trim();
+  const envDisk = process.env["ZERO_KERNEL_QEMU_DISK"]?.trim();
   if (!opts.force && envKernel && envDisk && existsSync(envKernel) && existsSync(envDisk)) {
-    log(`[kernel-cache] env-override: using 0SEC_KERNEL_QEMU_KERNEL/DISK (skipping build)`);
+    log(`[kernel-cache] env-override: using ZERO_KERNEL_QEMU_KERNEL/DISK (skipping build)`);
     return {
       kernelImage: envKernel,
       diskImage: envDisk,
-      kernelConfig: process.env["0SEC_KERNEL_QEMU_CONFIG"]?.trim() || "",
+      kernelConfig: process.env["ZERO_KERNEL_QEMU_CONFIG"]?.trim() || "",
       cacheKey: "env",
       cacheDir: "",
       cacheStatus: "env",
@@ -343,45 +343,45 @@ function warnIfKcsanUnsupported(configProfile, kernelConfigPath, log) {
   }
 }
 function loadKernelVmConfigFromEnv() {
-  const kernelImage = process.env["0SEC_KERNEL_QEMU_KERNEL"]?.trim();
-  const diskImage = process.env["0SEC_KERNEL_QEMU_DISK"]?.trim();
+  const kernelImage = process.env["ZERO_KERNEL_QEMU_KERNEL"]?.trim();
+  const diskImage = process.env["ZERO_KERNEL_QEMU_DISK"]?.trim();
   const missing = [
-    !kernelImage ? "0SEC_KERNEL_QEMU_KERNEL" : "",
-    !diskImage ? "0SEC_KERNEL_QEMU_DISK" : ""
+    !kernelImage ? "ZERO_KERNEL_QEMU_KERNEL" : "",
+    !diskImage ? "ZERO_KERNEL_QEMU_DISK" : ""
   ].filter(Boolean);
   if (missing.length > 0) {
     throw new Error(`kernel VM runner is enabled but missing required env vars: ${missing.join(", ")}`);
   }
   const resolvedKernelImage = kernelImage;
   const resolvedDiskImage = diskImage;
-  const kaslr = /^(1|true|on|yes)$/i.test(process.env["0SEC_KERNEL_QEMU_KASLR"]?.trim() ?? "");
-  const explicitAppend = process.env["0SEC_KERNEL_QEMU_APPEND"]?.trim();
+  const kaslr = /^(1|true|on|yes)$/i.test(process.env["ZERO_KERNEL_QEMU_KASLR"]?.trim() ?? "");
+  const explicitAppend = process.env["ZERO_KERNEL_QEMU_APPEND"]?.trim();
   const kernelAppend = explicitAppend || buildKernelAppend(kaslr);
-  const widenSymbol = process.env["0SEC_KERNEL_QEMU_WIDEN_SYMBOL"]?.trim() || void 0;
-  const widenOffsetRaw = process.env["0SEC_KERNEL_QEMU_WIDEN_OFFSET"]?.trim();
-  const widenDelayRaw = process.env["0SEC_KERNEL_QEMU_WIDEN_DELAY_MS"]?.trim();
-  const weaponizeInitramfs = /^(1|true|on|yes)$/i.test(process.env["0SEC_KERNEL_QEMU_INITRAMFS"]?.trim() ?? "") || /^(1|true|on|yes)$/i.test(process.env.USE_KERNEL_WEAPONIZE?.trim() ?? "");
-  const initramfsModules = (process.env["0SEC_KERNEL_QEMU_INITRAMFS_MODULES"]?.trim() || "").split(/[:,\s]+/).map((m) => m.trim()).filter(Boolean);
-  const busyboxPath = process.env["0SEC_KERNEL_QEMU_BUSYBOX"]?.trim() || void 0;
+  const widenSymbol = process.env["ZERO_KERNEL_QEMU_WIDEN_SYMBOL"]?.trim() || void 0;
+  const widenOffsetRaw = process.env["ZERO_KERNEL_QEMU_WIDEN_OFFSET"]?.trim();
+  const widenDelayRaw = process.env["ZERO_KERNEL_QEMU_WIDEN_DELAY_MS"]?.trim();
+  const weaponizeInitramfs = /^(1|true|on|yes)$/i.test(process.env["ZERO_KERNEL_QEMU_INITRAMFS"]?.trim() ?? "") || /^(1|true|on|yes)$/i.test(process.env.USE_KERNEL_WEAPONIZE?.trim() ?? "");
+  const initramfsModules = (process.env["ZERO_KERNEL_QEMU_INITRAMFS_MODULES"]?.trim() || "").split(/[:,\s]+/).map((m) => m.trim()).filter(Boolean);
+  const busyboxPath = process.env["ZERO_KERNEL_QEMU_BUSYBOX"]?.trim() || void 0;
   return {
-    qemuBinary: process.env["0SEC_KERNEL_QEMU_BINARY"]?.trim() || "qemu-system-x86_64",
+    qemuBinary: process.env["ZERO_KERNEL_QEMU_BINARY"]?.trim() || "qemu-system-x86_64",
     kernelImage: resolvedKernelImage,
     diskImage: resolvedDiskImage,
-    diskFormat: process.env["0SEC_KERNEL_QEMU_DISK_FORMAT"]?.trim() || inferDiskFormat(resolvedDiskImage),
-    bootTimeoutSec: parseInt(process.env["0SEC_KERNEL_QEMU_BOOT_TIMEOUT_SEC"]?.trim() || "120", 10),
-    memoryMb: parseInt(process.env["0SEC_KERNEL_QEMU_MEMORY_MB"]?.trim() || "2048", 10),
-    smp: parseInt(process.env["0SEC_KERNEL_QEMU_SMP"]?.trim() || "2", 10),
+    diskFormat: process.env["ZERO_KERNEL_QEMU_DISK_FORMAT"]?.trim() || inferDiskFormat(resolvedDiskImage),
+    bootTimeoutSec: parseInt(process.env["ZERO_KERNEL_QEMU_BOOT_TIMEOUT_SEC"]?.trim() || "120", 10),
+    memoryMb: parseInt(process.env["ZERO_KERNEL_QEMU_MEMORY_MB"]?.trim() || "2048", 10),
+    smp: parseInt(process.env["ZERO_KERNEL_QEMU_SMP"]?.trim() || "2", 10),
     kernelAppend,
-    qemuAccel: process.env["0SEC_KERNEL_QEMU_ACCEL"]?.trim() || void 0,
-    initrdPath: process.env["0SEC_KERNEL_QEMU_INITRD"]?.trim() || void 0,
-    timeoutSec: parseInt(process.env["0SEC_KERNEL_QEMU_TIMEOUT_SEC"]?.trim() || "60", 10),
-    shareTag: process.env["0SEC_KERNEL_QEMU_SHARE_TAG"]?.trim() || "osecshare",
-    artifactDir: process.env["0SEC_KERNEL_QEMU_ARTIFACT_DIR"]?.trim() || void 0,
+    qemuAccel: process.env["ZERO_KERNEL_QEMU_ACCEL"]?.trim() || void 0,
+    initrdPath: process.env["ZERO_KERNEL_QEMU_INITRD"]?.trim() || void 0,
+    timeoutSec: parseInt(process.env["ZERO_KERNEL_QEMU_TIMEOUT_SEC"]?.trim() || "60", 10),
+    shareTag: process.env["ZERO_KERNEL_QEMU_SHARE_TAG"]?.trim() || "osecshare",
+    artifactDir: process.env["ZERO_KERNEL_QEMU_ARTIFACT_DIR"]?.trim() || void 0,
     kaslr,
     ...widenSymbol ? { widenSymbol } : {},
     ...widenOffsetRaw && Number.isFinite(parseInt(widenOffsetRaw, 16)) ? { widenOffset: parseInt(widenOffsetRaw, 16) } : {},
     ...widenDelayRaw && Number.isFinite(parseInt(widenDelayRaw, 10)) ? { widenDelayMs: parseInt(widenDelayRaw, 10) } : {},
-    ...process.env["0SEC_KERNEL_QEMU_GUEST_BUILD_DIR"]?.trim() ? { guestKernelBuildDir: process.env["0SEC_KERNEL_QEMU_GUEST_BUILD_DIR"].trim() } : {},
+    ...process.env["ZERO_KERNEL_QEMU_GUEST_BUILD_DIR"]?.trim() ? { guestKernelBuildDir: process.env["ZERO_KERNEL_QEMU_GUEST_BUILD_DIR"].trim() } : {},
     weaponizeInitramfs,
     ...initramfsModules.length > 0 ? { initramfsModules } : {},
     ...busyboxPath ? { busyboxPath } : {}
@@ -389,13 +389,13 @@ function loadKernelVmConfigFromEnv() {
 }
 function buildKernelAppend(kaslr) {
   const base = "console=ttyS0 root=/dev/vda rw";
-  const tail = "panic=-1 init=/sbin/0sec-init";
+  const tail = "panic=-1 init=/sbin/0-init";
   return `${base} ${kaslr ? "kaslr" : "nokaslr"} ${tail}`;
 }
 function renderRaceWidenModuleSource(symbol, offset, delayMs) {
   const off = `0x${offset.toString(16)}`;
   return [
-    "// 0sec race-widening kprobe: inject mdelay() at the faulting PC to widen",
+    "// 0 race-widening kprobe: inject mdelay() at the faulting PC to widen",
     "// the UAF/race window. Best-effort; harmless if the probe fails to register.",
     "#include <linux/module.h>",
     "#include <linux/kernel.h>",
@@ -419,7 +419,7 @@ function renderRaceWidenModuleSource(symbol, offset, delayMs) {
     "",
     "static int __init widen_init(void) {",
     "    kp.pre_handler = handler_pre;",
-    `    pr_info("0sec-widen: probing ${symbol}+${off} delay=%lums\\n", widen_delay_ms);`,
+    `    pr_info("0-widen: probing ${symbol}+${off} delay=%lums\\n", widen_delay_ms);`,
     "    return register_kprobe(&kp);",
     "}",
     "",
@@ -500,8 +500,8 @@ function renderRealIpiRaceHarness(spec) {
     "}",
     "",
     "int main(void) {",
-    `  long retries = osec_env_long("0SEC_RACE_RETRIES", ${maxIters});`,
-    `  long seconds = osec_env_long("0SEC_RACE_SECONDS", ${seconds});`,
+    `  long retries = osec_env_long("ZERO_RACE_RETRIES", ${maxIters});`,
+    `  long seconds = osec_env_long("ZERO_RACE_SECONDS", ${seconds});`,
     "  time_t deadline = time(NULL) + seconds;",
     "",
     "  /* Arm the widening tactics ONCE (freeze/register + IPI bursts). */",
@@ -519,9 +519,9 @@ function renderRealIpiRaceHarness(spec) {
     "    g_stop = 1;",
     "    pthread_join(ta, NULL);",
     "    pthread_join(tb, NULL);",
-    '    if ((iter & 0x3ff) == 0) { printf("0SEC-RACE iter=%ld\\n", iter); fflush(stdout); }',
+    '    if ((iter & 0x3ff) == 0) { printf("ZERO-RACE iter=%ld\\n", iter); fflush(stdout); }',
     "  }",
-    '  printf("0SEC-RACE done (budget exhausted, no splat)\\n");',
+    '  printf("ZERO-RACE done (budget exhausted, no splat)\\n");',
     "  fflush(stdout);",
     "  return 0;",
     "}"
@@ -571,7 +571,7 @@ function buildInitramfsKernelAppend(kaslr) {
   ].join(" ");
 }
 function renderInitramfsInitScript(moduleNames, raceEnv, timeoutSec) {
-  const raceEnvEntries = Object.entries(raceEnv).filter(([key]) => /^0SEC_RACE_[A-Z0-9_]+$/.test(key));
+  const raceEnvEntries = Object.entries(raceEnv).filter(([key]) => /^ZERO_RACE_[A-Z0-9_]+$/.test(key));
   const envAssignments = raceEnvEntries.map(([key, value]) => `${key}=${shellQuote(value)}`).join(" ");
   const exploitCommand = [
     envAssignments ? `/bin/busybox env ${envAssignments}` : "",
@@ -585,10 +585,10 @@ function renderInitramfsInitScript(moduleNames, raceEnv, timeoutSec) {
     "/bin/busybox mount -t sysfs none /sys",
     "/bin/busybox mount -t devtmpfs none /dev 2>/dev/null",
     "/bin/busybox --install -s /bin 2>/dev/null",
-    'echo "=== 0SEC-INITRAMFS weaponize lane up ==="',
+    'echo "=== ZERO-INITRAMFS weaponize lane up ==="',
     "cat /proc/version",
     insmods,
-    'echo "=== 0SEC-INITRAMFS run (env: ' + raceEnvEntries.map(([key]) => key).join(",") + ') ==="',
+    'echo "=== ZERO-INITRAMFS run (env: ' + raceEnvEntries.map(([key]) => key).join(",") + ') ==="',
     // CRITICAL: the engine's emitted exploit prints a RECLAIM marker on EVERY
     // spray-loop iteration (thousands/sec). Streaming that to the slow 8250 UART
     // wedges the CPU in io_serial_in and STARVES the race (NMI watchdog fires,
@@ -598,13 +598,13 @@ function renderInitramfsInitScript(moduleNames, raceEnv, timeoutSec) {
     // stream either way, and the KASAN splats (kernel printk, a separate path)
     // still interleave live. `timeout` caps a hung flood; busybox `timeout` takes
     // the seconds as a POSITIONAL arg (`timeout SECS PROG`), NOT GNU `-t SECS`.
-    `${exploitCommand} || echo "0SEC-INITRAMFS exploit exit=$?" >> /tmp/run.log`,
-    'echo "=== 0SEC-INITRAMFS exploit output (batched off the UART hot path) ==="',
+    `${exploitCommand} || echo "ZERO-INITRAMFS exploit exit=$?" >> /tmp/run.log`,
+    'echo "=== ZERO-INITRAMFS exploit output (batched off the UART hot path) ==="',
     "cat /tmp/run.log",
-    'echo "=== 0SEC-INITRAMFS post-run ==="',
+    'echo "=== ZERO-INITRAMFS post-run ==="',
     "sync",
-    "cat /tmp/pwned 2>/dev/null && echo 0SEC-INITRAMFS-PWNED-FILE-PRESENT",
-    'echo "=== 0SEC-INITRAMFS done; powering off ==="',
+    "cat /tmp/pwned 2>/dev/null && echo ZERO-INITRAMFS-PWNED-FILE-PRESENT",
+    'echo "=== ZERO-INITRAMFS done; powering off ==="',
     "/bin/busybox poweroff -f"
   ].join("\n");
 }
@@ -623,7 +623,7 @@ function buildWeaponizeInitramfs(config, exploitC, workDir, raceEnv) {
     }
   })();
   if (!busybox || !existsSync(busybox)) {
-    throw new Error("weaponize-initramfs lane: no busybox found (set 0SEC_KERNEL_QEMU_BUSYBOX to a STATIC busybox)");
+    throw new Error("weaponize-initramfs lane: no busybox found (set ZERO_KERNEL_QEMU_BUSYBOX to a STATIC busybox)");
   }
   execFileSync("cp", [busybox, join(rootDir, "bin", "busybox")]);
   chmodSync(join(rootDir, "bin", "busybox"), 493);
@@ -686,11 +686,11 @@ function buildInitramfsQemuCommand(config, serialLogPath, initramfsPath, kernelA
 function collectRaceEnv() {
   const out = {};
   for (const key of [
-    "0SEC_RACE_FLOOD_THREADS",
-    "0SEC_RACE_SPRAY_THREADS",
-    "0SEC_RACE_PARK_US",
-    "0SEC_RACE_SECONDS",
-    "0SEC_RACE_SAME_CPU"
+    "ZERO_RACE_FLOOD_THREADS",
+    "ZERO_RACE_SPRAY_THREADS",
+    "ZERO_RACE_PARK_US",
+    "ZERO_RACE_SECONDS",
+    "ZERO_RACE_SAME_CPU"
   ]) {
     const v = process.env[key]?.trim();
     if (v)
@@ -721,8 +721,8 @@ function renderGuestRunnerScript(config, language, request) {
     return [
       "#!/bin/sh",
       "set -eu",
-      "SHARE_DIR=/mnt/0sec",
-      "WORK_DIR=/tmp/0sec-run",
+      "SHARE_DIR=/mnt/0",
+      "WORK_DIR=/tmp/0-run",
       'mkdir -p "$WORK_DIR"',
       "compiled=0",
       "executed=0",
@@ -782,12 +782,12 @@ function renderGuestRunnerScript(config, language, request) {
     '  if make -C "$KBUILD_DIR" M="$WORK_DIR" modules >"$SHARE_DIR/widen.log" 2>&1 \\',
     '     && insmod "$WORK_DIR/osec_widen.ko" >>"$SHARE_DIR/widen.log" 2>&1; then',
     "    widened=1",
-    '    printf "%s\\n" "0sec-widen: insmod ok" >> "$SHARE_DIR/widen.log"',
+    '    printf "%s\\n" "0-widen: insmod ok" >> "$SHARE_DIR/widen.log"',
     "  else",
-    '    printf "%s\\n" "0sec-widen: build/insmod failed \u2014 running WITHOUT widening" >> "$SHARE_DIR/widen.log"',
+    '    printf "%s\\n" "0-widen: build/insmod failed \u2014 running WITHOUT widening" >> "$SHARE_DIR/widen.log"',
     "  fi",
     "else",
-    '  printf "%s\\n" "0sec-widen: no kernel build tree in guest \u2014 running WITHOUT widening" > "$SHARE_DIR/widen.log"',
+    '  printf "%s\\n" "0-widen: no kernel build tree in guest \u2014 running WITHOUT widening" > "$SHARE_DIR/widen.log"',
     "fi",
     'printf "%s\\n" "$widened" > "$SHARE_DIR/widened.ok"'
   ] : [];
@@ -800,8 +800,8 @@ function renderGuestRunnerScript(config, language, request) {
     "# after \u2014 so the captured output carries an ordered DROP(uid!=0)\u2192ROOT(uid=0)",
     "# witness the oracle uses to confirm a genuine escalation. We must therefore",
     "# run it directly (as root), NOT via su/sudo to a lower uid.",
-    "SHARE_DIR=/mnt/0sec",
-    "WORK_DIR=/tmp/0sec-run",
+    "SHARE_DIR=/mnt/0",
+    "WORK_DIR=/tmp/0-run",
     'mkdir -p "$WORK_DIR"',
     "compiled=0",
     "executed=0",
@@ -887,7 +887,7 @@ async function waitForInitramfsVm(config, proc, serialLogPath) {
       return { poweredOff: true };
     if (existsSync(serialLogPath)) {
       const tail = readFileSync(serialLogPath, "utf-8").slice(-2e3);
-      if (tail.includes("0SEC-INITRAMFS done"))
+      if (tail.includes("ZERO-INITRAMFS done"))
         return { poweredOff: true };
     }
     await sleep(1e3);
@@ -897,8 +897,8 @@ async function waitForInitramfsVm(config, proc, serialLogPath) {
 async function runWeaponizeInitramfs(config, exploitC) {
   const hostTmpDir = config.artifactDir ? (() => {
     mkdirSync(config.artifactDir, { recursive: true });
-    return mkdtempSync(join(config.artifactDir, "0sec-initramfs-"));
-  })() : mkdtempSync(join(tmpdir(), "0sec-initramfs-"));
+    return mkdtempSync(join(config.artifactDir, "0-initramfs-"));
+  })() : mkdtempSync(join(tmpdir(), "0-initramfs-"));
   const serialLogPath = join(hostTmpDir, "serial.log");
   const raceEnv = collectRaceEnv();
   let initramfsPath;
@@ -922,7 +922,7 @@ async function runWeaponizeInitramfs(config, exploitC) {
   try {
     const { poweredOff } = await waitForInitramfsVm(config, vmProc, serialLogPath);
     const serial = existsSync(serialLogPath) ? readFileSync(serialLogPath, "utf-8") : "";
-    const executed = serial.includes("0SEC-INITRAMFS run");
+    const executed = serial.includes("ZERO-INITRAMFS run");
     const timedOut = !poweredOff;
     if (executed) {
       assertBugAttribution({
@@ -964,19 +964,19 @@ async function runReproducerInKernelVm(report) {
   }
   const hostTmpDir = config.artifactDir ? (() => {
     mkdirSync(config.artifactDir, { recursive: true });
-    return mkdtempSync(join(config.artifactDir, "0sec-kvm-"));
-  })() : mkdtempSync(join(tmpdir(), "0sec-kvm-"));
+    return mkdtempSync(join(config.artifactDir, "0-kvm-"));
+  })() : mkdtempSync(join(tmpdir(), "0-kvm-"));
   const language = report.reproducerLanguage ?? "c";
   const request = report.executionAttestationRequest ?? (() => {
-    const release = process.env["0SEC_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
+    const release = process.env["ZERO_KERNEL_QEMU_EXPECTED_RELEASE"]?.trim();
     if (!release || !RELEASE_RE.test(release))
-      throw new Error("direct kernel VM execution requires 0SEC_KERNEL_QEMU_EXPECTED_RELEASE");
+      throw new Error("direct kernel VM execution requires ZERO_KERNEL_QEMU_EXPECTED_RELEASE");
     return {
       nonce: randomBytes(16).toString("hex"),
       reproducerSha256: createHash("sha256").update(report.reproducer).digest("hex"),
       expectedKernelRelease: release,
       kernelImageSha256: sha256File(config.kernelImage),
-      kernelConfigSha256: sha256File(process.env["0SEC_KERNEL_QEMU_CONFIG"]?.trim() || "")
+      kernelConfigSha256: sha256File(process.env["ZERO_KERNEL_QEMU_CONFIG"]?.trim() || "")
     };
   })();
   const sourcePath = join(hostTmpDir, language === "syz" ? "repro.syz" : "repro.c");
@@ -1061,7 +1061,7 @@ function detectKernelSignature(dmesg) {
 function defaultDmesgOutPath() {
   const ns = process.hrtime.bigint().toString();
   const random = Math.random().toString(36).slice(2, 10);
-  return join(tmpdir(), `0sec-verify-${ns}-${random}.dmesg`);
+  return join(tmpdir(), `0-verify-${ns}-${random}.dmesg`);
 }
 function writeProofFileReadOnly(path, content) {
   mkdirSync(dirname(path), { recursive: true });
@@ -1112,7 +1112,7 @@ async function verifyKernelFinding(opts) {
   }
   const build_cache_hit = artifacts.cacheStatus === "hit" || artifacts.cacheStatus === "env";
   mkdirSync(dirname(dmesgOutPath), { recursive: true });
-  const launchDir = mkdtempSync(join(dirname(dmesgOutPath), ".0sec-kernel-launch-"));
+  const launchDir = mkdtempSync(join(dirname(dmesgOutPath), ".0-kernel-launch-"));
   const stagedKernelImage = join(launchDir, "kernel.image");
   const stagedKernelConfig = join(launchDir, "kernel.config");
   let attestationRequest;
@@ -1136,20 +1136,20 @@ async function verifyKernelFinding(opts) {
     return { status: "build_failed", dmesg_path: dmesgOutPath, build_cache_hit };
   }
   const previousEnv = {
-    qemu: process.env["0SEC_KERNEL_QEMU"],
-    kernel: process.env["0SEC_KERNEL_QEMU_KERNEL"],
-    disk: process.env["0SEC_KERNEL_QEMU_DISK"],
-    cfg: process.env["0SEC_KERNEL_QEMU_CONFIG"],
-    cacheKey: process.env["0SEC_KERNEL_QEMU_CACHEKEY"]
+    qemu: process.env["ZERO_KERNEL_QEMU"],
+    kernel: process.env["ZERO_KERNEL_QEMU_KERNEL"],
+    disk: process.env["ZERO_KERNEL_QEMU_DISK"],
+    cfg: process.env["ZERO_KERNEL_QEMU_CONFIG"],
+    cacheKey: process.env["ZERO_KERNEL_QEMU_CACHEKEY"]
   };
-  process.env["0SEC_KERNEL_QEMU"] = "1";
-  process.env["0SEC_KERNEL_QEMU_KERNEL"] = stagedKernelImage;
-  process.env["0SEC_KERNEL_QEMU_DISK"] = artifacts.diskImage;
+  process.env["ZERO_KERNEL_QEMU"] = "1";
+  process.env["ZERO_KERNEL_QEMU_KERNEL"] = stagedKernelImage;
+  process.env["ZERO_KERNEL_QEMU_DISK"] = artifacts.diskImage;
   if (artifacts.kernelConfig) {
-    process.env["0SEC_KERNEL_QEMU_CONFIG"] = stagedKernelConfig;
+    process.env["ZERO_KERNEL_QEMU_CONFIG"] = stagedKernelConfig;
   }
   if (artifacts.cacheKey) {
-    process.env["0SEC_KERNEL_QEMU_CACHEKEY"] = artifacts.cacheKey;
+    process.env["ZERO_KERNEL_QEMU_CACHEKEY"] = artifacts.cacheKey;
   }
   let runResult;
   try {
@@ -1176,11 +1176,11 @@ async function verifyKernelFinding(opts) {
       build_cache_hit
     };
   } finally {
-    process.env["0SEC_KERNEL_QEMU"] = previousEnv.qemu;
-    process.env["0SEC_KERNEL_QEMU_KERNEL"] = previousEnv.kernel;
-    process.env["0SEC_KERNEL_QEMU_DISK"] = previousEnv.disk;
-    process.env["0SEC_KERNEL_QEMU_CONFIG"] = previousEnv.cfg;
-    process.env["0SEC_KERNEL_QEMU_CACHEKEY"] = previousEnv.cacheKey;
+    process.env["ZERO_KERNEL_QEMU"] = previousEnv.qemu;
+    process.env["ZERO_KERNEL_QEMU_KERNEL"] = previousEnv.kernel;
+    process.env["ZERO_KERNEL_QEMU_DISK"] = previousEnv.disk;
+    process.env["ZERO_KERNEL_QEMU_CONFIG"] = previousEnv.cfg;
+    process.env["ZERO_KERNEL_QEMU_CACHEKEY"] = previousEnv.cacheKey;
     rmSync(launchDir, { recursive: true, force: true });
   }
   const dmesgContent = runResult.dmesg || runResult.output || "";

package/chunks/{chunk-OEFNRYI2.js → chunk-6GHSR47F.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   expandHomePath,
   isExistingLocalTargetPath,
   isExplicitLocalTargetPath
-} from "./chunk-WU6AFRAZ.js";
+} from "./chunk-V36HVTUL.js";
 
 // packages/cli/src/herdr-state.ts
 var sink = null;
@@ -88,7 +88,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target: expandHomePath(target),
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${target}`
       }
     };
@@ -100,7 +99,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target: raw,
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${raw}`
       }
     };
@@ -124,7 +122,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target,
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${target}`
       }
     };