0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-P6WKNFWX.js → chunk-2OQOQ2FZ.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/review/sanitizer-log.js
 var ASAN_CATEGORY_BY_KIND = {
@@ -297,7 +297,7 @@ When the target's input filter strips letters or digits (alphanumerics) but stil
 - NoSQL injection: username[$ne]=x&password[$ne]=x
 - Check for CORS misconfig allowing credential theft
 - Try parameter pollution: add role=admin, is_admin=true to registration/profile update
-- **HTTP method tampering on Apache \`<Limit>\` blocks (XBEN-054 vector):** if the target uses HTTP basic auth or returns 401/403 on a GET, also try \`curl -X BOGUS https://target/\` (or any non-standard HTTP verb such as FAKEMETHOD or 0SEC). Apache \`<Limit GET POST>\` directives only restrict the listed methods, so any other verb bypasses the auth check entirely and the page renders as if authenticated. Always probe at least one bogus method before giving up on a basic-auth wall.`,
+- **HTTP method tampering on Apache \`<Limit>\` blocks (XBEN-054 vector):** if the target uses HTTP basic auth or returns 401/403 on a GET, also try \`curl -X BOGUS https://target/\` (or any non-standard HTTP verb such as FAKEMETHOD or ZERO). Apache \`<Limit GET POST>\` directives only restrict the listed methods, so any other verb bypasses the auth check entirely and the page renders as if authenticated. Always probe at least one bogus method before giving up on a basic-auth wall.`,
   blind_exploitation: `## Blind Exploitation Playbook
 
 When injection works but you can't see the output directly (blind SSTI, blind SQLi, blind LFI with WAF), use side-channels to confirm and extract data.
@@ -746,7 +746,7 @@ Target is an LLM-backed app (chatbot, agent, assistant). Goal: make the model ig
 
 ### Indirect injection (the high-value variant)
 - If the app summarizes, browses, reads files, or answers over documents, plant the instruction in that *data* source, not the chat box. The model executes it when it ingests the content.
-- Confirm via a benign canary: get the model to emit a unique token (e.g. \`0SEC-INJ-OK\`) only an injected instruction would produce.
+- Confirm via a benign canary: get the model to emit a unique token (e.g. \`ZERO-INJ-OK\`) only an injected instruction would produce.
 
 ### Confirm and pivot
 - A successful injection is the entry point \u2014 pivot to the breadth playbooks: \`insecure_output_handling\` (does the output get rendered downstream?), \`excessive_agency\` (can you reach a tool call?), \`rag_poisoning\` (is there a writable retrieval surface?).
@@ -866,7 +866,7 @@ Python interpreter / sandbox such as Pydantic Monty). The bug class is memory
 corruption reachable from attacker-controlled scripting: use-after-free,
 double-free, type confusion, OOB, and **GC-root gaps**. This is discovery +
 classification, NOT autonomous exploit synthesis (see
-docs/0sec-rust-memsafety-pipeline.md).
+docs/0-rust-memsafety-pipeline.md).
 
 ### HARD CONSTRAINTS \u2014 bounty rules (never violate)
 1. **Never open a PR or change code** in the target or any of its dependencies.
@@ -990,7 +990,7 @@ var INDICATORS = [
     ]
   },
   {
-    // Multi-identity access-control surface (0sec#564). Distinct from `idor`:
+    // Multi-identity access-control surface (0#564). Distinct from `idor`:
     // these patterns point at object/function references that should be tested
     // with the access_control_probe tool across identities, plus the authz
     // signals (admin endpoints, role params, allow/deny status codes).
@@ -1323,7 +1323,7 @@ var INDICATORS = [
     ]
   },
   {
-    // AI prompt-layer write target (0sec#775). Fires when a DB foothold
+    // AI prompt-layer write target (0#775). Fires when a DB foothold
     // coincides with LLM-app + prompt-store signals: the system prompt /
     // guardrails / model config live in a writable DB row. Distinct from
     // rag_poisoning (writable retrieval docs) — this is the *control* layer.
@@ -1352,7 +1352,7 @@ var INDICATORS = [
     ]
   },
   {
-    // Rust / userspace memory-safety + sandbox-escape (0sec#696, Monty-mode).
+    // Rust / userspace memory-safety + sandbox-escape (0#696, Monty-mode).
     // Fires on Rust unsafe / FFI surface, memory-corruption signals (sanitizer
     // and miri output, GC-root / refcount language), and the language-runtime
     // sandbox context the round-1 UAF lived in.

package/chunks/{chunk-5G3ZXFBW.js → chunk-2WNCI664.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   getDetectorById,
   resolveDetectors,
   runDetectorOnPackage
-} from "./chunk-RWONANDA.js";
+} from "./chunk-DQTNI3KY.js";
 
 // packages/core/dist/stages/npm-dynamic-discovery.js
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-DW5UWPFY.js → chunk-4VGLO2YS.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/shared-analysis.js
 import { execFileSync } from "node:child_process";
@@ -101,7 +101,7 @@ function runSemgrepScan(targetPath, emit, opts) {
   return findings;
 }
 function selectedStaticScanner() {
-  return process.env["0SEC_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
+  return process.env["ZERO_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
 }
 function runFoxguardScan(targetPath, emit, opts) {
   emit({
@@ -130,7 +130,7 @@ function runFoxguardScan(targetPath, emit, opts) {
         }
         return selected.split(sep).join("/");
       });
-      selectionDir = mkdtempSync(join(tmpdir(), "0sec-foxguard-"));
+      selectionDir = mkdtempSync(join(tmpdir(), "0-foxguard-"));
       selectionFile = join(selectionDir, "changed-files.txt");
       writeFileSync(selectionFile, `${paths.join("\n")}
 `, { mode: 384 });
@@ -178,7 +178,7 @@ function runFoxguardScan(targetPath, emit, opts) {
     }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    logger(`[0sec] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set 0SEC_STATIC=semgrep to use semgrep.`);
+    logger(`[0] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set ZERO_STATIC=semgrep to use semgrep.`);
     emit({ type: "error", stage: "source-analysis", message: `Foxguard scan failed: ${message}` });
     throw err;
   } finally {
@@ -271,5 +271,6 @@ export {
   CLI_RUNTIME_TYPES,
   bufferToString,
   selectedStaticScanner,
+  runFoxguardScan,
   runSelectedStaticScan
 };

package/chunks/{chunk-KLTNTE2Z.js → chunk-5IBCBQEH.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/agent/sanitized-env.js
 var SENSITIVE_ENV_PATTERNS = [
@@ -51,20 +51,20 @@ var SENSITIVE_ENV_PATTERNS = [
   "NVD_API",
   "E2B_API",
   "WPSCAN_API_TOKEN",
-  "0SEC_WPSCAN_API_TOKEN",
+  "ZERO_WPSCAN_API_TOKEN",
   "GITHUB_TOKEN",
   "GITLAB_TOKEN",
   "GH_TOKEN",
   "GL_TOKEN",
   // Per-dispatch secrets injected by 0cloud's worker-controller.
-  "0SEC_CLOUD_TOKEN",
-  "0SEC_CHATGPT_ACCESS_TOKEN",
-  "0SEC_CHATGPT_OAUTH_REFRESH_TOKEN",
-  "0SEC_GITHUB_TOKEN",
-  "0SEC_GITLAB_TOKEN",
-  "0SEC_TARGET_AUTH_JSON",
-  "0SEC_GRAPH_ACCESS_TOKEN",
-  "0SEC_LLM_TARGET_KEY"
+  "ZERO_CLOUD_TOKEN",
+  "ZERO_CHATGPT_ACCESS_TOKEN",
+  "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN",
+  "ZERO_GITHUB_TOKEN",
+  "ZERO_GITLAB_TOKEN",
+  "ZERO_TARGET_AUTH_JSON",
+  "ZERO_GRAPH_ACCESS_TOKEN",
+  "ZERO_LLM_TARGET_KEY"
 ];
 function sanitizedEnv(env = process.env) {
   return allowlistedChildEnv({}, env);
@@ -95,9 +95,8 @@ var CHILD_ENV_ALLOWLIST = [
   "AUTH_VALUE",
   "AUTH_CURL_FLAG",
   // Existing child-runtime configuration contract; each name is non-secret.
-  "0SEC_FEATURE_JIT_SKILLS",
-  "0SEC_BASH_TIMEOUT_MS",
-  "0SEC_CLOUD_SCAN_ID"
+  "ZERO_FEATURE_JIT_SKILLS",
+  "ZERO_BASH_TIMEOUT_MS"
 ];
 function allowlistedChildEnv(extras = {}, env = process.env) {
   const out = {};

package/chunks/{chunk-N7BOUYEV.js → chunk-5MWAG3FT.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
-import {
-  LlmApiRuntime
-} from "./chunk-UR4ELX2Y.js";
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   ProcessRuntime
-} from "./chunk-ATATQACO.js";
+} from "./chunk-W6UWZFKL.js";
+import {
+  LlmApiRuntime
+} from "./chunk-2GV4HQKE.js";
 
 // packages/core/dist/runtime/cli-native.js
 import { spawn } from "node:child_process";
@@ -215,7 +215,7 @@ function buildClaudePromptFromLastUser(messages) {
   }
   const parts = [];
   if (toolResults.length > 0) {
-    parts.push(`[0sec:tool_results]
+    parts.push(`[0:tool_results]
 ${JSON.stringify(toolResults, null, 2)}`);
   }
   if (textParts.length > 0) {
@@ -327,7 +327,7 @@ var OpenRouterRuntime = class _OpenRouterRuntime {
         });
       }
     } else {
-      const model = config.model ?? process.env["0SEC_MODEL"] ?? "anthropic/claude-sonnet-4.6";
+      const model = config.model ?? process.env["ZERO_MODEL"] ?? "anthropic/claude-sonnet-4.6";
       this.singleRuntime = this.createModelRuntime(model);
     }
   }
@@ -345,7 +345,7 @@ var OpenRouterRuntime = class _OpenRouterRuntime {
     if (this.ensembleRuntimes.length > 0) {
       return this.ensembleRuntimes.map((e) => e.model);
     }
-    return [this.config.model ?? process.env["0SEC_MODEL"] ?? "anthropic/claude-sonnet-4.6"];
+    return [this.config.model ?? process.env["ZERO_MODEL"] ?? "anthropic/claude-sonnet-4.6"];
   }
   /** Whether this runtime is in ensemble mode. */
   get isEnsemble() {
@@ -638,7 +638,7 @@ var OllamaRuntime = class {
    * Behaviour:
    *  - Each non-terminal frame's `message.content` is treated as a delta and
    *    forwarded to `callbacks.onDelta("assistant_response", delta)` exactly
-   *    once (no accumulation passed to the callback — 0sec's contract is
+   *    once (no accumulation passed to the callback — 0's contract is
    *    "incremental fragment only", see types.ts:88).
    *  - The terminal frame (`done: true`) is taken as authoritative for
    *    `tool_calls`, `done_reason`, and usage stats. Tool-call shape across
@@ -767,7 +767,7 @@ var RUNTIME_REGISTRY = [
   {
     type: "codex",
     command: "codex",
-    description: "Codex CLI / direct ChatGPT Codex provider \u2014 full parity across web scans, package audits (npm/pypi/cargo/oci), and source code review (incl. linux-kernel). Set 0SEC_CHATGPT_OAUTH_REFRESH_TOKEN to enable subscription auth without the local CLI binary (#402).",
+    description: "Codex CLI / direct ChatGPT Codex provider \u2014 full parity across web scans, package audits (npm/pypi/cargo/oci), and source code review (incl. linux-kernel). Set ZERO_CHATGPT_OAUTH_REFRESH_TOKEN to enable subscription auth without the local CLI binary (#402).",
     strengths: ["verify", "source-analysis", "discovery"],
     supportsSystemPrompt: false
   },
@@ -784,7 +784,7 @@ var RUNTIME_REGISTRY = [
     // so detection tools that key off `command` don't crash; the registry
     // uses `isAvailable()` not `which(command)` for ollama.
     command: "ollama",
-    description: "Ollama (local) \u2014 Gemma 4 27B via /api/chat with native function-calling. Pairs with `--seed-findings` for full-local hunts. See 0sec#369.",
+    description: "Ollama (local) \u2014 Gemma 4 27B via /api/chat with native function-calling. Pairs with `--seed-findings` for full-local hunts. See 0#369.",
     strengths: ["source-analysis", "discovery"],
     supportsSystemPrompt: true
   }
@@ -806,7 +806,7 @@ function pickRuntimeForStage(stage, availableRuntimes) {
   return first.done ? "claude" : first.value;
 }
 async function detectAvailableRuntimes() {
-  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-LQRCS5OY.js");
+  const { ProcessRuntime: ProcessRuntime2 } = await import("./process-N245QIQG.js");
   const available = /* @__PURE__ */ new Set();
   const checks = RUNTIME_REGISTRY.map(async (info) => {
     const rt = new ProcessRuntime2({ type: info.type, timeout: 5e3 });
@@ -832,7 +832,7 @@ function createRuntime(config) {
       return new ProcessRuntime(config);
     case "ollama":
       return new OllamaRuntime({
-        model: config.model ?? process.env["0SEC_OLLAMA_MODEL"] ?? "gemma4:27b",
+        model: config.model ?? process.env["ZERO_OLLAMA_MODEL"] ?? "gemma4:27b",
         timeout: config.timeout,
         host: process.env.OLLAMA_HOST
       });

package/chunks/{chunk-OEFNRYI2.js → chunk-6GHSR47F.js}

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   expandHomePath,
   isExistingLocalTargetPath,
   isExplicitLocalTargetPath
-} from "./chunk-WU6AFRAZ.js";
+} from "./chunk-V36HVTUL.js";
 
 // packages/cli/src/herdr-state.ts
 var sink = null;
@@ -88,7 +88,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target: expandHomePath(target),
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${target}`
       }
     };
@@ -100,7 +99,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target: raw,
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${raw}`
       }
     };
@@ -124,7 +122,6 @@ function resolveEngagement(rawTarget) {
         kind: "source",
         target,
         targetType: "source-code",
-        reviewStrategy: "lenses",
         label: `source review ${target}`
       }
     };