0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-U5FLXGHT.js → chunk-TO35Y326.js}

@@ -1,16 +1,18 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   analyzeFindingForKnownMarkers,
   detectKnownMarkers,
-  extractFileRefs,
-  redactSensitiveHeaders,
   require_dist
-} from "./chunk-WEBMRWEG.js";
+} from "./chunk-IXT64DV5.js";
+import {
+  extractFileRefs,
+  redactSensitiveHeaders
+} from "./chunk-UELXHK2Y.js";
 import {
   __toESM
-} from "./chunk-IR537GON.js";
+} from "./chunk-VCSFCHAJ.js";
 
 // packages/core/dist/disclose/screenshots.js
 import { execFileSync } from "node:child_process";
@@ -380,720 +382,6 @@ function extractSiblingFix(finding, options) {
   };
 }
 
-// packages/core/dist/disclose/poc-runtime.js
-import { spawn } from "node:child_process";
-var MAX_CAPTURE_BYTES = 1024 * 1024;
-var DEFAULT_STEP_TIMEOUT_MS = 3e4;
-var PERSONA_HEADER = "X-0sec-Persona";
-var TRUNCATION_MARKER = "\n\u2026[truncated at 1MiB]";
-var DEFAULT_RPS_PER_HOST = 2;
-var MAX_REDIRECT_HOPS = 5;
-var hostBuckets = /* @__PURE__ */ new Map();
-function getOrInitBucket(host, rps) {
-  let bucket = hostBuckets.get(host);
-  if (!bucket) {
-    bucket = {
-      tokens: rps,
-      // full bucket on first use
-      refillRatePerMs: rps / 1e3,
-      capacity: rps,
-      lastRefill: Date.now(),
-      retryUntil: 0
-    };
-    hostBuckets.set(host, bucket);
-  }
-  return bucket;
-}
-function refill(bucket) {
-  const now = Date.now();
-  const elapsed = now - bucket.lastRefill;
-  if (elapsed > 0) {
-    bucket.tokens = Math.min(bucket.capacity, bucket.tokens + elapsed * bucket.refillRatePerMs);
-    bucket.lastRefill = now;
-  }
-}
-async function acquireHostToken(host, rps) {
-  const bucket = getOrInitBucket(host, rps);
-  while (Date.now() < bucket.retryUntil) {
-    const waitMs = bucket.retryUntil - Date.now();
-    await sleep(Math.min(waitMs, 1e3));
-  }
-  while (true) {
-    refill(bucket);
-    if (bucket.tokens >= 1) {
-      bucket.tokens -= 1;
-      return;
-    }
-    const tokensNeeded = 1 - bucket.tokens;
-    const waitMs = Math.max(1, Math.ceil(tokensNeeded / bucket.refillRatePerMs));
-    await sleep(waitMs);
-  }
-}
-function markHostRateLimited(host, retryAfterHeader) {
-  const bucket = hostBuckets.get(host);
-  if (!bucket)
-    return;
-  const parsed = retryAfterHeader ? parseInt(retryAfterHeader, 10) : NaN;
-  const retryAfterMs = Number.isFinite(parsed) && parsed > 0 ? parsed * 1e3 : 0;
-  bucket.retryUntil = Date.now() + Math.max(retryAfterMs, 6e4);
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-function normalizeHostForMatch(value) {
-  const trimmed = value.trim().toLowerCase();
-  if (trimmed.startsWith("[")) {
-    const end = trimmed.indexOf("]");
-    return end === -1 ? trimmed : trimmed.slice(1, end);
-  }
-  if ((trimmed.match(/:/g) ?? []).length >= 2)
-    return trimmed;
-  return trimmed.replace(/:\d+$/, "");
-}
-function hostMatchesAllowlist(host, allowlist) {
-  if (!allowlist || allowlist.length === 0)
-    return true;
-  const target = normalizeHostForMatch(host);
-  for (const raw of allowlist) {
-    const pattern = normalizeHostForMatch(raw);
-    if (!pattern)
-      continue;
-    if (pattern.startsWith("*.")) {
-      const suffix = pattern.slice(1);
-      if (target.endsWith(suffix) && target.length > suffix.length)
-        return true;
-    } else if (target === pattern) {
-      return true;
-    }
-  }
-  return false;
-}
-function scopeRequiredResult(step, target, start) {
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0)
-    return void 0;
-  return {
-    stepId: step.id,
-    kind: "errored",
-    durationMs: Date.now() - start,
-    error: "PoC reverify requires a non-empty scope allowlist"
-  };
-}
-function extractUrlsFromShellCommand(cmd) {
-  const matches = cmd.match(/https?:\/\/[^\s'"]+/g);
-  return matches ?? [];
-}
-function dockerRegistryHost(image) {
-  const separator = image.indexOf("/");
-  if (separator === -1)
-    return void 0;
-  const firstSegment = image.slice(0, separator);
-  return firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost" ? firstSegment : void 0;
-}
-var deps = { spawn, fetch: globalThis.fetch };
-function setRuntimeDeps(overrides) {
-  const previous = deps;
-  deps = { ...previous, ...overrides };
-  return () => {
-    deps = previous;
-  };
-}
-async function executePocSteps(finding, target) {
-  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
-  const steps = [];
-  const graph = finding.pocSteps ?? [];
-  for (const step of graph) {
-    const result = await executeStep(step, target);
-    steps.push(result);
-    if (result.kind === "errored" && step.kind !== "verify") {
-      for (let i = graph.indexOf(step) + 1; i < graph.length; i++) {
-        steps.push({
-          stepId: graph[i].id,
-          kind: "skipped",
-          durationMs: 0,
-          error: "skipped: an earlier step errored"
-        });
-      }
-      break;
-    }
-  }
-  const endedAt = (/* @__PURE__ */ new Date()).toISOString();
-  return {
-    findingId: finding.id,
-    startedAt,
-    endedAt,
-    steps,
-    overallVerdict: aggregateVerdict(graph, steps)
-  };
-}
-async function executeStep(step, target) {
-  const start = Date.now();
-  if (target.allowProcessActions === false && (step.action.type === "shell" || step.action.type === "docker")) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `PoC ${step.action.type} actions require an isolated execution environment`
-    };
-  }
-  try {
-    switch (step.action.type) {
-      case "shell":
-        return await runShellStep(step, step.action, target, start);
-      case "http":
-        return await runHttpStep(step, step.action, target, start);
-      case "docker":
-        return await runDockerStep(step, step.action, target, start);
-      case "note":
-        return {
-          stepId: step.id,
-          kind: "skipped",
-          durationMs: Date.now() - start
-        };
-      default: {
-        const _exhaustive = step.action;
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `unknown action type: ${JSON.stringify(_exhaustive)}`
-        };
-      }
-    }
-  } catch (err) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: errMessage(err)
-    };
-  }
-}
-async function runShellStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0) {
-    for (const u of extractUrlsFromShellCommand(action.cmd)) {
-      let host;
-      try {
-        host = new URL(u).host;
-      } catch {
-        continue;
-      }
-      if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `out-of-scope url in shell cmd: ${u} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-    }
-  }
-  const env = { ...process.env, ...target.env ?? {} };
-  const cwd = action.cwd ?? target.cwd;
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const spawned = await spawnAndCapture("/bin/sh", ["-c", action.cmd], { env, cwd, timeoutMs });
-  return finaliseProcessStep(step, spawned, start);
-}
-async function runDockerStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  const registryHost = dockerRegistryHost(action.image);
-  if (registryHost && !hostMatchesAllowlist(registryHost, target.scopeAllowlist)) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `out-of-scope docker registry: ${registryHost} (allowlist: ${target.scopeAllowlist.join(", ")})`
-    };
-  }
-  if (target.scopeAllowlist && target.scopeAllowlist.length > 0) {
-    const dockerTokens = [action.image, ...action.args].join(" ");
-    for (const u of extractUrlsFromShellCommand(dockerTokens)) {
-      let host;
-      try {
-        host = new URL(u).host;
-      } catch {
-        continue;
-      }
-      if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `out-of-scope url in docker action: ${u} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-    }
-  }
-  const env = { ...process.env, ...target.env ?? {} };
-  const cwd = target.cwd;
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const spawned = await spawnAndCapture("docker", ["run", "--rm", ...action.args, action.image], { env, cwd, timeoutMs });
-  return finaliseProcessStep(step, spawned, start);
-}
-async function runHttpStep(step, action, target, start) {
-  const scopeError = scopeRequiredResult(step, target, start);
-  if (scopeError)
-    return scopeError;
-  const url = resolveUrl(action.url, target.baseUrl);
-  if (!url) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `http step has a relative url (${action.url}) but no target.baseUrl was provided`
-    };
-  }
-  let host;
-  try {
-    host = new URL(url).host;
-  } catch {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `http step url is not a valid URL: ${url}`
-    };
-  }
-  if (!hostMatchesAllowlist(host, target.scopeAllowlist)) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: `out-of-scope host: ${host} (allowlist: ${target.scopeAllowlist.join(", ")})`
-    };
-  }
-  const rps = target.rpsPerHost ?? DEFAULT_RPS_PER_HOST;
-  await acquireHostToken(host, rps);
-  const headers = mergePersonaHeaders(action.headers ?? {}, target);
-  const timeoutMs = target.timeoutMs ?? DEFAULT_STEP_TIMEOUT_MS;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), timeoutMs);
-  let finalResponse;
-  let body = "";
-  let currentUrl = url;
-  let redirectCount = 0;
-  try {
-    while (true) {
-      finalResponse = await deps.fetch(currentUrl, {
-        method: action.method,
-        headers,
-        body: action.body,
-        signal: ac.signal,
-        redirect: "manual"
-      });
-      const status = finalResponse.status;
-      const isRedirect = [301, 302, 303, 307, 308].includes(status);
-      if (!isRedirect) {
-        body = await readBodyCapped(finalResponse);
-        if (status === 429) {
-          const retryAfter = finalResponse.headers.get("retry-after");
-          markHostRateLimited(host, retryAfter);
-        }
-        break;
-      }
-      redirectCount++;
-      if (redirectCount > MAX_REDIRECT_HOPS) {
-        try {
-          finalResponse.body?.cancel();
-        } catch {
-        }
-        clearTimeout(timer);
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `too many redirects (exceeded ${MAX_REDIRECT_HOPS} hops)`
-        };
-      }
-      const location = finalResponse.headers.get("location");
-      if (!location) {
-        body = await readBodyCapped(finalResponse);
-        break;
-      }
-      const nextUrlStr = new URL(location, currentUrl).toString();
-      const nextHost = new URL(nextUrlStr).host;
-      if (!hostMatchesAllowlist(nextHost, target.scopeAllowlist)) {
-        try {
-          finalResponse.body?.cancel();
-        } catch {
-        }
-        clearTimeout(timer);
-        return {
-          stepId: step.id,
-          kind: "errored",
-          durationMs: Date.now() - start,
-          error: `redirect to out-of-scope host: ${nextHost} (allowlist: ${target.scopeAllowlist.join(", ")})`
-        };
-      }
-      try {
-        finalResponse.body?.cancel();
-      } catch {
-      }
-      currentUrl = nextUrlStr;
-    }
-  } catch (err) {
-    clearTimeout(timer);
-    const aborted = ac.signal.aborted;
-    return {
-      stepId: step.id,
-      kind: "errored",
-      durationMs: Date.now() - start,
-      error: aborted ? `timeout after ${timeoutMs}ms` : errMessage(err)
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-  const verdict = evaluateExpect(step.expect, {
-    status: finalResponse.status,
-    body
-  });
-  return {
-    stepId: step.id,
-    kind: verdict.kind,
-    observedStatus: finalResponse.status,
-    observedResponseBody: body,
-    durationMs: Date.now() - start,
-    ...verdict.error ? { error: verdict.error } : {}
-  };
-}
-function resolveUrl(stepUrl, baseUrl) {
-  try {
-    new URL(stepUrl);
-    return stepUrl;
-  } catch {
-  }
-  if (!baseUrl)
-    return null;
-  try {
-    return new URL(stepUrl, baseUrl).toString();
-  } catch {
-    return null;
-  }
-}
-function mergePersonaHeaders(stepHeaders, target) {
-  const merged = {};
-  let personaName;
-  for (const [k, v] of Object.entries(stepHeaders)) {
-    if (k.toLowerCase() === PERSONA_HEADER.toLowerCase()) {
-      personaName = v;
-      continue;
-    }
-    merged[k] = v;
-  }
-  if (!personaName)
-    return merged;
-  const persona = target.personas?.[personaName];
-  if (!persona)
-    return merged;
-  if (persona.headers) {
-    for (const [k, v] of Object.entries(persona.headers)) {
-      if (!(k in merged))
-        merged[k] = v;
-    }
-  }
-  if (persona.cookies && !("cookie" in lowerKeys(merged))) {
-    merged["Cookie"] = persona.cookies;
-  }
-  return merged;
-}
-function lowerKeys(obj) {
-  const out = {};
-  for (const [k, v] of Object.entries(obj))
-    out[k.toLowerCase()] = v;
-  return out;
-}
-async function readBodyCapped(response) {
-  if (!response.body)
-    return "";
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder("utf-8", { fatal: false });
-  let captured = "";
-  let truncated = false;
-  while (true) {
-    const { value, done } = await reader.read();
-    if (done)
-      break;
-    if (value) {
-      const chunk = decoder.decode(value, { stream: true });
-      if (captured.length + chunk.length > MAX_CAPTURE_BYTES) {
-        captured += chunk.slice(0, MAX_CAPTURE_BYTES - captured.length);
-        truncated = true;
-        try {
-          await reader.cancel();
-        } catch {
-        }
-        break;
-      }
-      captured += chunk;
-    }
-  }
-  return truncated ? captured + TRUNCATION_MARKER : captured;
-}
-function spawnAndCapture(cmd, args, opts) {
-  return new Promise((resolveP) => {
-    let child;
-    try {
-      child = deps.spawn(cmd, args, {
-        env: opts.env,
-        cwd: opts.cwd,
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-    } catch (err) {
-      resolveP({
-        exitCode: null,
-        stdout: "",
-        stderr: "",
-        timedOut: false,
-        error: errMessage(err)
-      });
-      return;
-    }
-    let stdout = "";
-    let stderr = "";
-    let stdoutTruncated = false;
-    let stderrTruncated = false;
-    let timedOut = false;
-    let settled = false;
-    const timer = setTimeout(() => {
-      timedOut = true;
-      try {
-        child.kill("SIGKILL");
-      } catch {
-      }
-    }, opts.timeoutMs);
-    child.stdout?.on("data", (chunk) => {
-      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      if (stdout.length + s.length > MAX_CAPTURE_BYTES) {
-        if (!stdoutTruncated) {
-          stdout += s.slice(0, MAX_CAPTURE_BYTES - stdout.length);
-          stdoutTruncated = true;
-        }
-        return;
-      }
-      stdout += s;
-    });
-    child.stderr?.on("data", (chunk) => {
-      const s = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-      if (stderr.length + s.length > MAX_CAPTURE_BYTES) {
-        if (!stderrTruncated) {
-          stderr += s.slice(0, MAX_CAPTURE_BYTES - stderr.length);
-          stderrTruncated = true;
-        }
-        return;
-      }
-      stderr += s;
-    });
-    const settle = (exit, errorMsg) => {
-      if (settled)
-        return;
-      settled = true;
-      clearTimeout(timer);
-      resolveP({
-        exitCode: exit,
-        stdout: stdoutTruncated ? stdout + TRUNCATION_MARKER : stdout,
-        stderr: stderrTruncated ? stderr + TRUNCATION_MARKER : stderr,
-        timedOut,
-        error: errorMsg
-      });
-    };
-    child.on("error", (err) => {
-      settle(null, errMessage(err));
-    });
-    child.on("close", (code) => {
-      settle(code);
-    });
-  });
-}
-function finaliseProcessStep(step, spawned, start) {
-  const durationMs = Date.now() - start;
-  if (spawned.timedOut) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      observedStdout: spawned.stdout,
-      observedStderr: spawned.stderr,
-      durationMs,
-      error: `timeout after ${durationMs}ms`
-    };
-  }
-  if (spawned.error && spawned.exitCode === null) {
-    return {
-      stepId: step.id,
-      kind: "errored",
-      observedStdout: spawned.stdout,
-      observedStderr: spawned.stderr,
-      durationMs,
-      error: spawned.error
-    };
-  }
-  const verdict = evaluateExpect(step.expect, {
-    exitCode: spawned.exitCode,
-    stdout: spawned.stdout
-  });
-  const result = {
-    stepId: step.id,
-    kind: verdict.kind,
-    observedStdout: spawned.stdout,
-    observedStderr: spawned.stderr,
-    durationMs
-  };
-  if (spawned.exitCode !== null)
-    result.observedExit = spawned.exitCode;
-  if (verdict.error)
-    result.error = verdict.error;
-  return result;
-}
-function evaluateExpect(expect, obs) {
-  if (!expect) {
-    return { kind: "passed" };
-  }
-  switch (expect.type) {
-    case "exit-zero": {
-      if (obs.exitCode === 0)
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected exit-zero, got exitCode=${String(obs.exitCode ?? "unknown")}`
-      };
-    }
-    case "http-status": {
-      const wanted = Array.isArray(expect.status) ? expect.status : [expect.status];
-      if (typeof obs.status === "number" && wanted.includes(obs.status)) {
-        return { kind: "passed" };
-      }
-      return {
-        kind: "failed",
-        error: `expected http-status in [${wanted.join(",")}], got ${String(obs.status ?? "no-response")}`
-      };
-    }
-    case "body-contains": {
-      const haystack = obs.body ?? obs.stdout ?? "";
-      if (haystack.includes(expect.text))
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected body-contains '${expect.text}', not found in observed output`
-      };
-    }
-    case "body-matches": {
-      const haystack = obs.body ?? obs.stdout ?? "";
-      let re;
-      try {
-        re = new RegExp(expect.pattern);
-      } catch (err) {
-        return { kind: "errored", error: `invalid regex: ${errMessage(err)}` };
-      }
-      if (re.test(haystack))
-        return { kind: "passed" };
-      return {
-        kind: "failed",
-        error: `expected body-matches /${expect.pattern}/, no match in observed output`
-      };
-    }
-    case "file-exists": {
-      return {
-        kind: "errored",
-        error: "file-exists predicate cannot be evaluated against a network target; rewrite as a shell action with `[ -e <path> ]`"
-      };
-    }
-    default: {
-      const _exhaustive = expect;
-      return {
-        kind: "errored",
-        error: `unknown expect type: ${JSON.stringify(_exhaustive)}`
-      };
-    }
-  }
-}
-function aggregateVerdict(graph, steps) {
-  if (graph.length === 0) {
-    return "could_not_run";
-  }
-  const byId = new Map(steps.map((s) => [s.stepId, s]));
-  let reachedExploitOrVerify = false;
-  for (const step of graph) {
-    const result = byId.get(step.id);
-    if (!result)
-      continue;
-    if (step.kind === "exploit" || step.kind === "verify") {
-      reachedExploitOrVerify = true;
-    }
-    if (result.kind === "errored" && (step.kind === "setup" || step.kind === "auth" || step.kind === "prerequisite")) {
-      return "could_not_run";
-    }
-  }
-  const verifySteps = graph.filter((s) => s.kind === "verify");
-  if (verifySteps.length > 0) {
-    let anyFailed = false;
-    let anyErrored = false;
-    let allPassed = true;
-    for (const v of verifySteps) {
-      const result = byId.get(v.id);
-      if (!result || result.kind === "skipped") {
-        allPassed = false;
-        anyErrored = true;
-        continue;
-      }
-      if (result.kind === "failed") {
-        anyFailed = true;
-        allPassed = false;
-      } else if (result.kind === "errored") {
-        anyErrored = true;
-        allPassed = false;
-      }
-    }
-    if (allPassed)
-      return "exploit_still_works";
-    if (anyFailed)
-      return "exploit_broken";
-    if (anyErrored)
-      return "could_not_run";
-  }
-  const exploitSteps = graph.filter((s) => s.kind === "exploit");
-  if (exploitSteps.length > 0) {
-    let anyFailed = false;
-    let anyErrored = false;
-    let allPassed = true;
-    for (const e of exploitSteps) {
-      const result = byId.get(e.id);
-      if (!result || result.kind === "skipped") {
-        allPassed = false;
-        anyErrored = true;
-        continue;
-      }
-      if (result.kind === "failed") {
-        anyFailed = true;
-        allPassed = false;
-      } else if (result.kind === "errored") {
-        anyErrored = true;
-        allPassed = false;
-      }
-    }
-    if (allPassed)
-      return "exploit_still_works";
-    if (anyFailed)
-      return "exploit_broken";
-    if (anyErrored)
-      return "could_not_run";
-  }
-  return reachedExploitOrVerify ? "exploit_still_works" : "could_not_run";
-}
-function errMessage(err) {
-  if (err instanceof Error)
-    return err.message;
-  if (typeof err === "string")
-    return err;
-  try {
-    return JSON.stringify(err);
-  } catch {
-    return String(err);
-  }
-}
-
 // packages/core/dist/disclose/bundle.js
 function decideFilingState(inputs) {
   const { patchStatus, behaviouralReport, dropFixed, keepUnrun, emptyPoc } = inputs;
@@ -1221,7 +509,7 @@ function assembleBundleIndex(entries, options) {
       lines.push(`| \`${id}\` | ${e.finding.severity} | ${titleCell} | ${e.patchStatus ?? "\u2014"} | ${e.behaviouralVerdict ?? "\u2014"} | ${redactReason(e)} | ${formatProvenance(e)} |`);
     }
   }
-  lines.push("", "## Before filing each advisory", "", "1. Re-read the draft \u2014 the PoC and Patch Status sections are auto-populated from the scan but you should sanity-check against the current upstream HEAD.", "2. Verify the CVSS vector suggested by 0sec is still appropriate for your deployment model.", "3. Attach or replace screenshots in the PoC section as needed.", "4. File at https://github.com/<owner>/<repo>/security/advisories/new", "");
+  lines.push("", "## Before filing each advisory", "", "1. Re-read the draft \u2014 the PoC and Patch Status sections are auto-populated from the scan but you should sanity-check against the current upstream HEAD.", "2. Verify the CVSS vector suggested by 0 is still appropriate for your deployment model.", "3. Attach or replace screenshots in the PoC section as needed.", "4. File at https://github.com/<owner>/<repo>/security/advisories/new", "");
   return lines.join("\n");
 }
 
@@ -1376,7 +664,7 @@ function generateWriteup(parsed, opts = {}) {
     out.push(sanitizeWriteup(parts.join("\n\n")), "");
   }
   out.push("## Credits", "");
-  out.push("Found by 0sec's automated security-research tooling ([0sec.ai](https://0sec.ai)).", "");
+  out.push("Found by 0.security's automated security-research tooling ([0.security](https://0.security)).", "");
   const slug = slugify2(fm.short_name ? `${fm.package ?? ""}-${fm.short_name}` : title);
   const filename = `${slug || "writeup"}-${dateStamp}.md`;
   return {
@@ -1540,7 +828,7 @@ var HIGH_IMPACT_CATEGORIES = /* @__PURE__ */ new Set([
   // HS-vs-RS), and predictable RNG for secrets are direct key-leak / auth-bypass
   // primitives, so the class is protected from score-only auto-drop.
   "crypto-misuse",
-  // AI-system adversarial classes — the core 0sec "adversarial reliability"
+  // AI-system adversarial classes — the core 0 "adversarial reliability"
   // thesis (authorization-boundary break, unsafe tool use, data exfiltration,
   // prompt hijack). A missed one of these is a disclosure-grade loss.
   "prompt-injection",
@@ -1728,7 +1016,7 @@ function assembleEvidencePack(finding, opts = {}) {
 function renderVendorNotificationMarkdown(draft) {
   const out = [];
   out.push(`# Vulnerability report: ${draft.title}`, "");
-  out.push("> **DRAFT \u2014 NOT SENT.** Auto-assembled vendor-notification draft. An operator must review, fill in any `to be filled in` fields, and send it manually. Nothing here is transmitted to a vendor by 0sec. Embargo rules in `disclosure/AGENTS.md` apply.", "");
+  out.push("> **DRAFT \u2014 NOT SENT.** Auto-assembled vendor-notification draft. An operator must review, fill in any `to be filled in` fields, and send it manually. Nothing here is transmitted to a vendor by 0. Embargo rules in `disclosure/AGENTS.md` apply.", "");
   if (!draft.reproduced) {
     out.push("> \u26A0\uFE0F This finding's PoC did **not** reproduce in an isolated env (`evidenceKind !== reproduced-poc`). Staged as an internal draft only \u2014 do not send to a vendor without a working PoC.", "");
   }
@@ -1866,7 +1154,7 @@ function assembleReproducibilityManifest(finding, opts = {}) {
     redactionsApplied.push("replay-verified-impact");
   const target = opts.targetIdentifier ? redactManifestValue(opts.targetIdentifier) : extractTarget(finding);
   const modelConfig = opts.modelConfig ? redactManifestValue(opts.modelConfig) : null;
-  const toolVersion = opts.toolVersion ?? process.env["0SEC_VERSION"] ?? "unknown";
+  const toolVersion = opts.toolVersion ?? process.env["ZERO_VERSION"] ?? "unknown";
   const timestamp = opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const sanitizedTitle = redactManifestValue(finding.title);
   const evidenceReq = finding.evidence?.request ?? null;
@@ -1972,10 +1260,6 @@ export {
   composeStepSession,
   renderExploitScreenshot,
   extractSiblingFix,
-  MAX_CAPTURE_BYTES,
-  DEFAULT_STEP_TIMEOUT_MS,
-  setRuntimeDeps,
-  executePocSteps,
   decideFilingState,
   dropSlug,
   droppedFilename,