0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-TSK2AG6J.js → chunk-CAYANSH6.js}

@@ -1,68 +1,45 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   isValidSessionId,
   listSessions,
   loadSession
-} from "./chunk-BVAZO4WA.js";
+} from "./chunk-MICHDTBK.js";
 import {
-  consolePresentationOutput,
   getSettings,
   maybeLoadCodexAuth
-} from "./chunk-GMT2AZKM.js";
+} from "./chunk-YIQSGNAA.js";
 import {
-  captureObservation,
+  createConsoleJevRuntime,
   createConsoleSession,
-  createEvolvedFinder,
   inspectLensRegistry,
   lastGreen,
   loadLedger,
   loadManifest,
   makeFinderLensProbe,
   retireArchetype,
-  runLensSynthesisLoop
-} from "./chunk-5JI7L7KV.js";
+  runLensSynthesisLoop,
+  toToolContextJevRuntime
+} from "./chunk-EGZGZFAH.js";
 import {
   source_default
-} from "./chunk-SF4KZ4O3.js";
-import {
-  stampDeploymentContext
-} from "./chunk-BFR2CDV5.js";
+} from "./chunk-HLFS6WV2.js";
 import {
   harvestMissesFromLedgerEntry,
-  loadEvolutionConfigFile,
   mergeHarvestedMisses
-} from "./chunk-BZNEY2ZS.js";
+} from "./chunk-SJBCK2EI.js";
+import {
+  eventBus
+} from "./chunk-RE5EZDG2.js";
 import {
   listOsecRunDatabasePaths,
   osecDB,
-  resolveOsecDbPath,
-  resolveOsecRunStorage,
-  writeOsecRunReport
-} from "./chunk-72CISA2D.js";
-import {
-  loadAppsecFinderLenses
-} from "./chunk-QI233I24.js";
-import {
-  ScanCostLedger
-} from "./chunk-242TMK6G.js";
+  resolveOsecDbPath
+} from "./chunk-VNRY6AWF.js";
 import {
   redactSensitiveHeaders
-} from "./chunk-WEBMRWEG.js";
-import {
-  CloudAuthMissingError,
-  CloudClient,
-  CloudError,
-  CloudForbiddenError,
-  CloudNetworkError,
-  CloudUnauthorizedError,
-  DEFAULT_CLOUD_HOST,
-  loadCloudCredentials
-} from "./chunk-UR4ELX2Y.js";
-import {
-  eventBus
-} from "./chunk-ADOLI6DT.js";
+} from "./chunk-UELXHK2Y.js";
 import {
   SEVERITY_RANK,
   VERSION,
@@ -71,14 +48,13 @@ import {
   createScanReportDocument,
   findingSchema,
   formatZodError,
-  homeStateDir,
   severityRank
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-76KSBWOQ.js";
 
 // packages/cli/src/utils.ts
 import { gzipSync } from "zlib";
 async function getRuntimeAvailability() {
-  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-4YICS2J2.js");
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-3FNZIBB4.js");
   const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
   const hasApiKey = apiRuntimeDiagnostics.valid;
   const availableRuntimes = [...await detectAvailableRuntimes()];
@@ -110,1094 +86,14 @@ async function checkRuntimeAvailability(runtime) {
   } else {
     console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
   }
-  console.log(source_default.gray("  Provider credentials: 0SEC_CHATGPT_ACCESS_TOKEN | 0SEC_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
+  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
   console.log("");
 }
 function buildShareUrl(report) {
   const json = JSON.stringify(report);
   const compressed = gzipSync(Buffer.from(json, "utf-8"));
   const b64 = compressed.toString("base64url");
-  return `https://0sec.ai/r#${b64}`;
-}
-
-// packages/cli/src/commands/hunt.ts
-import { readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-function leadToCandidateFinding(finding, bugClass, seedRef, candidatePath) {
-  const evidence = finding.evidence ?? {};
-  const provenance = `Variant-hunt LEAD (bug class: ${bugClass}; seed: ${seedRef}). Surfaced by the recency hunt and gated by the adversarial skeptic \u2014 a HYPOTHESIS, not a confirmed bug. Verify the real sink + upstream-fix status (novelty) before any disclosure.`;
-  if (candidatePath) stampDeploymentContext(finding, candidatePath);
-  return {
-    ...finding,
-    // LEADS are never confirmed/sendable: force candidate status so the cloud
-    // ingests them as verify candidates, never as confirmed findings.
-    status: "discovered",
-    templateId: "recency-hunt-lead",
-    evidence: {
-      request: evidence.request ?? "",
-      response: evidence.response ?? "",
-      analysis: evidence.analysis ? `${evidence.analysis}
-
-${provenance}` : provenance
-    }
-  };
-}
-function parsePositive(flag, raw, dflt) {
-  if (raw === void 0) return dflt;
-  const n = parseInt(raw, 10);
-  if (!Number.isFinite(n) || n <= 0) throw new Error(`invalid ${flag} '${raw}' (expected positive integer)`);
-  return n;
-}
-var IMPACT_CEILINGS = ["dos-only", "info-leak", "oob-write", "uaf-control"];
-function parseCeiling(raw) {
-  const v = raw.trim();
-  if (!IMPACT_CEILINGS.includes(v)) {
-    throw new Error(`invalid --prove-min-ceiling '${raw}' (expected one of: ${IMPACT_CEILINGS.join(", ")})`);
-  }
-  return v;
-}
-function parseNonNegative(flag, raw, dflt) {
-  if (raw === void 0) return dflt;
-  const n = parseInt(raw, 10);
-  if (!Number.isFinite(n) || n < 0) throw new Error(`invalid ${flag} '${raw}' (expected non-negative integer)`);
-  return n;
-}
-function parseEnvBestOfN(raw) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const n = Number.parseInt(raw, 10);
-  return Number.isFinite(n) && n > 1 ? n : void 0;
-}
-function parseEnvPositiveInt(raw) {
-  if (raw === void 0 || raw.trim() === "") return void 0;
-  const n = Number.parseInt(raw, 10);
-  return Number.isFinite(n) && n > 0 ? n : void 0;
-}
-async function runHunt(opts) {
-  const {
-    generateVariantCandidates,
-    runHuntScan,
-    makeSkepticVerifier,
-    loadKnownNegativesFromEnv,
-    buildInvariantHuntContext,
-    buildGraphSliceHuntContext,
-    localMirrors,
-    syncLoreMirror,
-    makeLloreJudge,
-    makeHuntProveStage,
-    prepare,
-    getCloudSinkConfig,
-    postFinding
-  } = await import("./dist-4YICS2J2.js");
-  const log = opts.log ?? (() => {
-  });
-  const runtime = opts.runtime ?? "api";
-  const seedDiff = readFileSync(resolve(opts.seedPath), "utf8");
-  const prepared = await prepare(opts.sourceRoot, "source-code", { ...opts.timeoutMs ? { timeout: opts.timeoutMs } : {} }, (e) => {
-    if (e.message) log(`[hunt:source] ${e.message}`);
-  });
-  const sourceRoot = resolve(prepared.resolvedTarget);
-  const noveltyRoot = opts.novelty?.rootDir ?? process.env["0SEC_LORE_MIRROR_ROOT"] ?? "/root/lore-mirror";
-  const noveltyLists = opts.novelty?.lists ?? (process.env["0SEC_LORE_LISTS"] ?? "linux-media").split(",").map((s) => s.trim()).filter(Boolean);
-  const noveltyRecentEpochs = opts.novelty?.recentEpochs ?? 1;
-  const noveltyWarnings = [];
-  const sinkCfg = getCloudSinkConfig();
-  const savedCloudSink = process.env["0SEC_CLOUD_SINK"];
-  if (sinkCfg) delete process.env["0SEC_CLOUD_SINK"];
-  try {
-    let noveltyMirrors = [];
-    if (opts.novelty && noveltyLists.length > 0) {
-      try {
-        noveltyMirrors = opts.novelty.sync ? await syncLoreMirror({
-          rootDir: noveltyRoot,
-          lists: noveltyLists,
-          recentEpochs: noveltyRecentEpochs,
-          log
-        }) : localMirrors(noveltyRoot, noveltyLists);
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        noveltyWarnings.push(`hunt: novelty sync failed: ${reason.slice(0, 160)}`);
-        log(`[hunt] ${noveltyWarnings[noveltyWarnings.length - 1]}`);
-      }
-    }
-    if (opts.novelty && noveltyMirrors.length === 0) {
-      const message = `novelty requested but no lore mirrors found under ${noveltyRoot} for ${noveltyLists.join(",") || "(no lists)"}`;
-      return {
-        exitCode: 3,
-        result: {
-          mode: "hunt",
-          seed: opts.ref ?? opts.seedPath,
-          candidates: 0,
-          novelty: { enabled: true, required: true, mirrors: [] },
-          warnings: [...noveltyWarnings, `hunt: ${message}; aborting fail-closed`],
-          note: "Discovery did not run because requested novelty evidence was unavailable."
-        }
-      };
-    }
-    const skipCandidates = opts.skipCandidates ?? 0;
-    const maxCandidates = opts.maxCandidates ?? 40;
-    const reachableOnly = opts.reachableOnly ?? process.env.HUNT_REACHABLE_ONLY === "1";
-    const reachablePrefer = opts.reachablePrefer ?? (opts.methodology ? true : process.env.HUNT_REACHABLE_PREFER === "1");
-    let invariantCtx = null;
-    const invariantWarnings = [];
-    if (opts.invariant) {
-      try {
-        invariantCtx = await buildInvariantHuntContext({ sourceRoot, seedDiff, runtime, log });
-        if (!invariantCtx) {
-          invariantWarnings.push("hunt: --invariant set but no subsystem scope/files derivable from the seed \u2014 continuing without invariant context");
-          log(`[hunt] ${invariantWarnings[invariantWarnings.length - 1]}`);
-        }
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        invariantWarnings.push(`hunt: invariant-model stage failed, continuing without it: ${reason.slice(0, 160)}`);
-        log(`[hunt] ${invariantWarnings[invariantWarnings.length - 1]}`);
-      }
-    }
-    let graphSliceCtx = null;
-    const graphSliceWarnings = [];
-    if (opts.graphSlice) {
-      try {
-        graphSliceCtx = buildGraphSliceHuntContext({
-          sourceRoot,
-          seedDiff,
-          ...opts.cpgPath ? { cpgPath: opts.cpgPath } : {},
-          log,
-          ...opts.opsHarvestSourceFiles !== void 0 ? { opsHarvestSourceFiles: opts.opsHarvestSourceFiles } : {},
-          ...opts.graphSliceHops !== void 0 ? { hops: opts.graphSliceHops } : {}
-        });
-        if (!graphSliceCtx) {
-          graphSliceWarnings.push("hunt: --graph-slice set but no CPG/scope/slice derivable \u2014 continuing with the flat-text finder");
-          log(`[hunt] ${graphSliceWarnings[graphSliceWarnings.length - 1]}`);
-        }
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        graphSliceWarnings.push(`hunt: graph-slice stage failed, continuing without it: ${reason.slice(0, 160)}`);
-        log(`[hunt] ${graphSliceWarnings[graphSliceWarnings.length - 1]}`);
-      }
-    }
-    const plan = await generateVariantCandidates({
-      sourceRoot,
-      fix: { diff: seedDiff, reference: opts.ref ?? opts.seedPath },
-      runtime,
-      maxCandidates: skipCandidates + maxCandidates,
-      ...opts.models ? { models: opts.models } : {},
-      ...reachableOnly ? { reachableOnly } : {},
-      ...reachablePrefer ? { reachablePrefer } : {},
-      log
-    });
-    const selectedCandidates = plan.candidates.slice(skipCandidates, skipCandidates + maxCandidates);
-    if (selectedCandidates.length === 0) {
-      return {
-        exitCode: 2,
-        result: {
-          mode: "hunt",
-          seed: opts.ref ?? opts.seedPath,
-          bug_class: plan.brief.bugClass,
-          grep_patterns: plan.grepPatterns,
-          candidates: 0,
-          skipped_candidates: Math.min(skipCandidates, plan.candidates.length),
-          warnings: [...noveltyWarnings, ...plan.warnings],
-          note: plan.candidates.length === 0 ? "no candidate sites generated \u2014 seed too narrow or surface already clean" : "no candidate sites left after --skip-candidates"
-        }
-      };
-    }
-    const candidates = selectedCandidates.map((c) => ({ ...c, path: `${sourceRoot}/${c.path}` }));
-    const attemptsPerCandidate = opts.attemptsPerCandidate ?? parseEnvBestOfN(process.env.HUNT_BEST_OF_N) ?? (opts.methodology ? 4 : void 0);
-    const judgeTopK = opts.judgeTopK ?? parseEnvPositiveInt(process.env.HUNT_JUDGE_TOP_K) ?? (opts.methodology ? 2 : void 0);
-    const judgeModel = opts.judgeModel ?? process.env.HUNT_JUDGE_MODEL;
-    const baseBrief = opts.methodology ? {
-      ...plan.brief,
-      pattern: `${plan.brief.pattern}
-
-METHODOLOGY LENSES: map the full object lifecycle across handlers, callbacks, error/teardown paths and concurrent sessions; trace buffer/page provenance across zero-copy and in-place subsystem boundaries; look for a fix applied to one sibling path but bypassed by another. Refute capability, configuration and state-machine reachability before claiming impact. Treat source reasoning as a hypothesis until a sanitizer-backed reproducer proves it.`
-    } : plan.brief;
-    let huntPattern = baseBrief.pattern;
-    if (invariantCtx) huntPattern = `${huntPattern}
-
-${invariantCtx.promptBlock}`;
-    if (graphSliceCtx) huntPattern = `${huntPattern}
-
-${graphSliceCtx.promptBlock}`;
-    const huntBrief = huntPattern === baseBrief.pattern ? baseBrief : { ...baseBrief, pattern: huntPattern };
-    const res = await runHuntScan({
-      sourceRoot,
-      candidates,
-      brief: huntBrief,
-      runtime,
-      concurrency: opts.concurrency ?? 4,
-      ...opts.models ? { models: opts.models } : {},
-      ...attemptsPerCandidate ? { attemptsPerCandidate } : {},
-      ...judgeTopK ? { judgeTopK } : {},
-      ...judgeModel ? { judgeModel } : {},
-      // The skeptic is handed `models[0]` — i.e. by default the refute pass runs
-      // on the SAME MODEL that found the bug, which is the correlated-error
-      // problem in #661. `finderModels` lets the cross-family selector avoid
-      // every family in the finder fan-out (not just the first) and swap the
-      // refuter to a different family when one is configured; when only one
-      // provider is configured it passes through to exactly this model. `log`
-      // makes that decision visible in the run log instead of implicit.
-      ...opts.verify === false ? {} : {
-        verify: makeSkepticVerifier({
-          sourceRoot,
-          runtime,
-          ...opts.models?.[0] ? { model: opts.models[0] } : {},
-          ...opts.models && opts.models.length > 0 ? { finderModels: opts.models } : {},
-          negatives: loadKnownNegativesFromEnv(),
-          log
-        })
-      },
-      // PROVE stage (#1119) — the terminal gate. Only wired on --exploitability,
-      // because it boots REAL QEMU per confirmed finding. runHuntScan itself
-      // ignores it (with a warning) when `verify` is absent, so --no-verify
-      // --exploitability degrades safely instead of booting anything.
-      ...opts.exploitability ? {
-        exploitability: makeHuntProveStage({
-          // Cheap VM-free pre-filter: never spend a QEMU slot on a dos-only bug.
-          escalation: opts.proveMinCeiling ? { minCeiling: opts.proveMinCeiling } : {},
-          onVerdict: (f, _c, v) => log(
-            `[hunt:prove] ${f.title}: maxObserved=${v.maxObservedClass} upgraded=${v.upgraded} reachesPrivesc=${v.reachesPrivesc} proven=${v.provenExploitability}`
-          ),
-          onEscalation: (f, _c, v) => log(`[hunt:prove] ${f.title}: impact ceiling ${v.ceiling} (${v.basis}, conf ${v.confidence})`),
-          log
-        })
-      } : {},
-      ...opts.novelty && noveltyMirrors.length > 0 ? {
-        novelty: {
-          mirrors: noveltyMirrors,
-          ...opts.novelty.model ? { judge: makeLloreJudge({ model: opts.novelty.model }) } : {}
-        }
-      } : {},
-      log
-    });
-    const gated = opts.verify !== false;
-    const leads = gated ? res.confirmed : res.findings;
-    let ingested = 0;
-    if (sinkCfg) {
-      const seedRef = opts.ref ?? opts.seedPath;
-      const pathForId = /* @__PURE__ */ new Map();
-      for (const rec of res.records) pathForId.set(rec.finding.id, rec.candidatePath);
-      for (const lead of leads) {
-        const candidatePath = pathForId.get(lead.id);
-        await postFinding(leadToCandidateFinding(lead, plan.brief.bugClass, seedRef, candidatePath), sinkCfg);
-        ingested++;
-      }
-      log(`[hunt] posted ${ingested} lead(s) to the cloud-sink as candidate findings`);
-    }
-    return {
-      exitCode: leads.length > 0 ? 0 : 1,
-      result: {
-        mode: "hunt",
-        seed: opts.ref ?? opts.seedPath,
-        bug_class: plan.brief.bugClass,
-        source: sourceRoot,
-        candidate_sites: selectedCandidates.map((c) => c.path),
-        skipped_candidates: skipCandidates,
-        scanned: res.scanned,
-        findings: res.findings.length,
-        confirmed: gated ? res.confirmed.length : null,
-        novelty: opts.novelty ? {
-          enabled: true,
-          required: true,
-          root: noveltyRoot,
-          lists: noveltyLists,
-          mirrors: noveltyMirrors.map((m) => ({ list: m.list, epoch: m.epoch, dir: m.dir })),
-          duplicates: res.duplicates.map((d) => ({
-            title: d.finding.title,
-            matches: d.novelty.duplicates
-          }))
-        } : { enabled: false },
-        leads: leads.map((f) => ({
-          title: f.title,
-          severity: f.severity,
-          analysis: f.evidence.analysis ?? ""
-        })),
-        dropped: res.dropped.map((d) => ({
-          title: d.finding.title,
-          severity: d.finding.severity,
-          candidatePath: d.candidatePath,
-          lensId: d.lensId,
-          dropReason: d.dropReason,
-          detail: d.detail
-        })),
-        invariant: invariantCtx ? {
-          enabled: true,
-          subsystem: invariantCtx.subsystem,
-          model_path: invariantCtx.modelPath,
-          model_loaded: invariantCtx.modelLoaded,
-          objects: invariantCtx.model.objects.length,
-          violations: invariantCtx.violations.length
-        } : { enabled: false },
-        graph_slice: graphSliceCtx ? {
-          enabled: true,
-          subsystem: graphSliceCtx.subsystem,
-          cpg_path: graphSliceCtx.cpgPath,
-          target_functions: graphSliceCtx.targetFunctions,
-          resolved_targets: graphSliceCtx.resolvedTargets,
-          ops_edges: graphSliceCtx.opsEdges,
-          functions: graphSliceCtx.stats.functions,
-          files: graphSliceCtx.stats.files.length,
-          call_edges: graphSliceCtx.stats.callEdges,
-          slice_chars: graphSliceCtx.stats.chars
-        } : { enabled: false },
-        ingested: sinkCfg ? ingested : null,
-        gated,
-        methodology: opts.methodology === true,
-        warnings: [...invariantWarnings, ...graphSliceWarnings, ...noveltyWarnings, ...plan.warnings, ...res.warnings].slice(0, 10),
-        note: opts.novelty ? "LEADS, not confirmed 0-days. Novelty-duplicate leads were dropped when lore mirrors matched; still verify the real sink before disclosure." : "LEADS, not confirmed 0-days. Verify the real sink + upstream-fix (novelty) before disclosure."
-      }
-    };
-  } finally {
-    if (savedCloudSink !== void 0) process.env["0SEC_CLOUD_SINK"] = savedCloudSink;
-    prepared.cleanup();
-  }
-}
-async function huntAction(opts) {
-  if (!opts.source) throw new Error("missing required flag: --source <kernel/src tree>");
-  if (!opts.seed) throw new Error("missing required flag: --seed <fix diff/patch to hunt variants of>");
-  const outcome = await runHunt({
-    sourceRoot: opts.source,
-    seedPath: opts.seed,
-    ...opts.ref ? { ref: opts.ref } : {},
-    concurrency: parsePositive("--concurrency", opts.concurrency, 4),
-    skipCandidates: parseNonNegative("--skip-candidates", opts.skipCandidates, 0),
-    ...opts.models ? { models: opts.models.split(",").map((s) => s.trim()).filter(Boolean) } : {},
-    ...opts.reachableOnly ? { reachableOnly: true } : {},
-    ...opts.reachablePrefer ? { reachablePrefer: true } : {},
-    verify: opts.verify,
-    ...opts.novelty || opts.noveltyRequired || opts.methodology ? {
-      novelty: {
-        ...opts.noveltyRoot ? { rootDir: opts.noveltyRoot } : {},
-        ...opts.noveltyLists ? { lists: opts.noveltyLists.split(",").map((s) => s.trim()).filter(Boolean) } : {},
-        recentEpochs: parsePositive("--novelty-recent-epochs", opts.noveltyRecentEpochs, 1),
-        sync: opts.noveltySync === true || opts.methodology === true,
-        ...opts.noveltyModel ? { model: opts.noveltyModel } : {},
-        required: opts.noveltyRequired === true || opts.methodology === true
-      }
-    } : {},
-    methodology: opts.methodology === true,
-    invariant: opts.invariant === true,
-    graphSlice: opts.graphSlice === true,
-    ...opts.cpg ? { cpgPath: opts.cpg } : {},
-    ...opts.opsHarvest !== void 0 ? {
-      opsHarvestSourceFiles: opts.opsHarvest.split(",").map((path) => path.trim()).filter(Boolean)
-    } : {},
-    ...opts.graphSliceHops ? { graphSliceHops: parsePositive("--graph-slice-hops", opts.graphSliceHops, 3) } : {},
-    exploitability: opts.exploitability === true,
-    ...opts.proveMinCeiling ? { proveMinCeiling: parseCeiling(opts.proveMinCeiling) } : {},
-    ...opts.runtime ? { runtime: opts.runtime } : {},
-    timeoutMs: parsePositive("--timeout", opts.timeout, 6e5),
-    log: (m) => process.stderr.write(m + "\n")
-  });
-  const json = JSON.stringify(outcome.result, null, 2);
-  if (opts.output) writeFileSync(resolve(opts.output), json + "\n", "utf8");
-  else process.stdout.write(json + "\n");
-  process.exitCode = outcome.exitCode;
-}
-function registerHuntCommand(program) {
-  program.command("hunt").description(
-    "Hunt a bug CLASS across a source tree, seeded by a proven fix: generate variant candidate sites from the fix, fan finders out over them, and gate each finding through an adversarial skeptic. Emits LEADS to verify (not confirmed 0-days). Exit 0=lead(s), 1=none, 2=no candidates, 3=error."
-  ).requiredOption("--source <path>", "Source tree to hunt in (e.g. a linux checkout)").requiredOption("--seed <path>", "Fix diff / .patch whose bug class to hunt variants of").option("--ref <name>", "Provenance label for the seed (e.g. the CVE / commit)").option("--concurrency <N>", "Max finders in flight (default 4)").option("--max-candidates <N>", "Cap candidate sites hunted (default 40)").option("--skip-candidates <N>", "Skip the first N ranked candidate sites before hunting (default 0)").option("--models <a,b>", "Comma-separated finder models for diversity (default: provider default)").option("--reachable-only", "Restrict candidates to paths built + zero-cap reachable on the kernelCTF COS target (default: HUNT_REACHABLE_ONLY env)").option("--reachable-prefer", "Sort kernelCTF-reachable candidates first, without dropping any (default: HUNT_REACHABLE_PREFER env)").option("--no-verify", "Skip the skeptic gate (emit all raw findings \u2014 triage only, never disclosure)").option("--novelty", "Require lore.kernel.org duplicate suppression; abort before discovery when evidence is unavailable").option("--novelty-root <path>", "Lore mirror root (default: 0SEC_LORE_MIRROR_ROOT or /root/lore-mirror)").option("--novelty-lists <a,b>", "Comma-separated lore lists to search (default: 0SEC_LORE_LISTS or linux-media)").option("--novelty-recent-epochs <N>", "Newest public-inbox epochs to sync per list when --novelty-sync is set (default 1)").option("--novelty-sync", "Clone/fetch lore mirrors before running the novelty gate").option("--novelty-model <model>", "Optional model override for the lore duplicate judge").option("--novelty-required", "Legacy alias; --novelty already aborts when evidence is unavailable").option("--methodology", "Use the kernel-LPE methodology preset: lifecycle/provenance lenses, best-of-4, top-2 skeptic gate, reachable-first").option("--invariant", "Engine A: build (or load) the seed-touched subsystem's stored invariant model and inject its rules + deterministic violation hypotheses into every finder prompt").option("--graph-slice", "Load the seed-touched subsystem's pre-exported Joern CPG and inject a compact interprocedural reachability slice around the fix site into every finder prompt (needs scripts/provision-cpg.sh; fail-open to flat-text)").option("--cpg <path>", "Explicit CPG graphson JSON path for --graph-slice (default: <source>/.0sec/cpg/<subsystem>.json)").option(
-    "--ops-harvest <paths>",
-    "[--graph-slice] Comma-separated repo-relative C files to harvest static ops-struct initializers from; overrides a precomputed .ops.json"
-  ).option(
-    "--graph-slice-hops <N>",
-    "[--graph-slice] Call-graph radius around the seed functions (default 3; use 8 for the exp527 known answer)"
-  ).option(
-    "--exploitability",
-    "PROVE stage: after the skeptic+prover gate, run the execution-verified exploitability oracle on each confirmed finding (GREBE diversify + SCAVY differential). BOOTS REAL QEMU VMs \u2014 requires staged kernel-VM artifacts and is ignored under --no-verify. Never rejects a finding; it stamps a proven verdict and gates the weaponize budget."
-  ).option(
-    "--prove-min-ceiling <ceiling>",
-    "[--exploitability] Minimum assessed impact ceiling worth a VM slot: dos-only|info-leak|oob-write|uaf-control (default info-leak \u2014 filters out dos-only before QEMU is touched)"
-  ).option("--output <path>", "Write the hunt result JSON to this path instead of stdout").option("--runtime <mode>", "Engine runtime (default api)").option("--timeout <ms>", "Accepted cloud agent timeout budget in milliseconds", "600000").action(async (opts) => {
-    try {
-      await huntAction(opts);
-    } catch (err) {
-      const reason = err instanceof Error ? err.message : String(err);
-      const json = JSON.stringify({ mode: "hunt", error: reason }, null, 2);
-      if (opts.output) {
-        try {
-          writeFileSync(resolve(opts.output), json + "\n", "utf8");
-        } catch {
-          process.stderr.write(json + "\n");
-        }
-      } else process.stdout.write(json + "\n");
-      process.exitCode = 3;
-    }
-  });
-}
-
-// packages/cli/src/commands/deep-review.ts
-import { readFileSync as readFileSync2, realpathSync, statSync } from "node:fs";
-import { resolve as resolve2, join, sep, relative } from "node:path";
-import { createHash, randomUUID } from "node:crypto";
-var DEEP_REVIEW_FILE_CAP = 5e3;
-var DEFAULT_MAX_CANDIDATES = 8;
-function defaultMaxCandidates() {
-  const raw = process.env["0SEC_DEEP_REVIEW_MAX_CANDIDATES"];
-  if (!raw) return DEFAULT_MAX_CANDIDATES;
-  const n = Number.parseInt(raw, 10);
-  return Number.isFinite(n) && n > 0 ? n : DEFAULT_MAX_CANDIDATES;
-}
-function scaleMaxCandidates(fileCount) {
-  if (fileCount > 2e3) return 20;
-  if (fileCount > 500) return 16;
-  if (fileCount > 200) return 12;
-  return DEFAULT_MAX_CANDIDATES;
-}
-var DEFAULT_ATTEMPTS = 1;
-function defaultAttempts() {
-  const raw = process.env["0SEC_DEEP_REVIEW_ATTEMPTS"];
-  if (!raw) return DEFAULT_ATTEMPTS;
-  const n = Number.parseInt(raw, 10);
-  return Number.isFinite(n) && n > 0 ? n : DEFAULT_ATTEMPTS;
-}
-function defaultModels() {
-  const raw = process.env["0SEC_DEEP_REVIEW_MODELS"];
-  if (!raw) return void 0;
-  const models = raw.split(",").map((s) => s.trim()).filter(Boolean);
-  return models.length > 0 ? models : void 0;
-}
-var DEFAULT_CONCURRENCY = 8;
-var genericFinderLenses = [
-  {
-    id: "memory-safety",
-    challengeHint: "Hunt MEMORY-SAFETY bugs only: out-of-bounds read/write, use-after-free, double-free, uninitialized read, integer overflow feeding an allocation or index, and unchecked length/size arithmetic before a copy. Cite the exact unguarded sink (file:line) and the attacker-controlled path that reaches it."
-  },
-  {
-    id: "input-validation",
-    challengeHint: "Hunt INPUT-VALIDATION and injection bugs only: untrusted input reaching a dangerous sink without validation \u2014 command/SQL/path/template injection, unsafe deserialization, SSRF, unchecked redirects, or a parser that trusts attacker-supplied structure. Trace the taint from the entry point to the sink."
-  },
-  {
-    id: "auth-logic",
-    challengeHint: "Hunt AUTHZ / LOGIC bugs only: a missing or wrong permission/ownership check, a broken state machine, a TOCTOU race, an off-by-one or boundary error in a security-relevant decision, or a check that can be bypassed. Prove the guard is absent or mis-scoped, not merely that the keywords appear."
-  },
-  {
-    id: "secrets-crypto",
-    challengeHint: "Hunt SECRETS / CRYPTO misuse only: hardcoded credentials, a weak/predictable RNG used for security, a broken or misused cryptographic primitive (ECB, static IV/nonce, missing MAC verification, non-constant-time compare), or a signature/token check that can be forged or replayed. Cite the exact misuse."
-  },
-  {
-    id: "cross-component",
-    challengeHint: "Hunt CROSS-COMPONENT bugs only: a bug whose exploit path spans two or more subsystems touching DIFFERENT trust boundaries \u2014 e.g. an API layer that passes unvalidated user input to a kernel driver, a storage layer whose consistency assumptions are violated by a separate async path, or a UX component whose state bleeds into an auth decision in a sibling module. Trace the path ACROSS the boundary and prove the attacker can reach BOTH sides. Ignore bugs fully contained within a single component."
-  }
-];
-function lensSetDigest(lenses) {
-  return createHash("sha256").update(JSON.stringify(lenses.map(({ id, challengeHint }) => ({ id, challengeHint })))).digest("hex");
-}
-function createDefaultFinderLenses() {
-  return [...genericFinderLenses, ...loadAppsecFinderLenses()];
-}
-var defaultFinderLenses = createDefaultFinderLenses();
-var defaultVerifyLenses = [
-  {
-    id: "reachability",
-    challengeHint: "REACHABILITY: is the vulnerable code actually reachable by an attacker from a real entry point (exported/public API, request handler, CLI, parser) with no gate it cannot pass? Trace the concrete path from the entry to the sink. If the path is dead code, disabled, or privileged-only, refute it."
-  },
-  {
-    id: "completeness",
-    challengeHint: "COMPLETENESS: is the 'missing' check actually enforced elsewhere on the path \u2014 a validation earlier in the flow, a guard in the only caller, a wrapper that sanitizes first? Read the whole call path and the full file/module. If the guard is present AND correctly scoped, refute it; keep it only if genuinely absent or mis-scoped."
-  },
-  {
-    id: "novelty-known-issue",
-    challengeHint: "NOVELTY / KNOWN-GUARD: is the standard guard for this class present and correct (a framework escaper, a safe API, a bounds check, a working auth middleware)? Is this a well-known already-mitigated pattern in this codebase or its dependencies? If a correct standard guard covers it, refute it."
-  },
-  {
-    id: "scope",
-    challengeHint: "SCOPE / IMPACT: does exploiting this actually corrupt memory, leak secrets, escalate privilege, execute code, or move value / break a security invariant? A cosmetic missing check with no real impact is info/low, not a high-severity finding \u2014 refute it as such."
-  },
-  {
-    id: "deployment-context",
-    challengeHint: "DEPLOYMENT CONTEXT: is this finding's vulnerable code path actually deployed to a production runtime, or is it restricted to development, test, or build-only surfaces? \n\nYour job is to examine the finding's evidence AND your own reading of the candidate source to decide: can an attacker reach this code from a production entry point? \n\n- If the code is in a test file, a dev-only config (seeds, .dev.vars, dev-server), or build scaffolding (webpack, CI, vendored deps) with NO trust-boundary crossing from prod, refute it as dev/test/build-only.\n- If you find a trust-boundary bypass \u2014 a prod-routed entry point that reaches this code despite it being in a dev/test/build file \u2014 DO NOT refute; the finding is valid per the HackerOne rule.\n- If you are UNCERTAIN (the evidence is ambiguous or you cannot assess the deployment topology), ABSTAIN by returning an error. Never falsely refute a finding with weak evidence.\nPRIORITY: the mechanical path heuristic (file path classification) is the DETERMINISTIC FLOOR and overrides this lens on conflict. If the heuristic already tagged the finding as dev_only/test_only/build_only, the severity cap has already been applied \u2014 this lens exists to catch cases the heuristic misses (ambiguous paths, model-extracted evidence, cross-boundary reachability)."
-  }
-];
-function selectProfileLenses(profile, sets, defaultFinderSnapshot = defaultFinderLenses) {
-  switch ((profile ?? "").trim().toLowerCase()) {
-    case "evm-onchain":
-      return { finderLenses: sets.evmFinderLenses, verifyLenses: sets.evmVerifyLenses, matchedProfile: "evm-onchain" };
-    case "solana-onchain":
-      return { finderLenses: sets.solanaFinderLenses, verifyLenses: sets.solanaVerifyLenses, matchedProfile: "solana-onchain" };
-    case "cardano-onchain":
-      return { finderLenses: sets.cardanoFinderLenses, verifyLenses: sets.cardanoVerifyLenses, matchedProfile: "cardano-onchain" };
-    case "cairo-onchain":
-      return { finderLenses: sets.cairoFinderLenses, verifyLenses: sets.cairoVerifyLenses, matchedProfile: "cairo-onchain" };
-    case "move-onchain":
-      return { finderLenses: sets.moveFinderLenses, verifyLenses: sets.moveVerifyLenses, matchedProfile: "move-onchain" };
-    default:
-      return { finderLenses: defaultFinderSnapshot, verifyLenses: defaultVerifyLenses, matchedProfile: "default" };
-  }
-}
-var NATIVE_SOURCE_EXTS = /* @__PURE__ */ new Set([
-  "c",
-  "h",
-  "cc",
-  "cpp",
-  "cxx",
-  "hpp",
-  "hh",
-  "hxx",
-  "rs"
-]);
-var MANAGED_WEB_EXTS = /* @__PURE__ */ new Set([
-  "cs",
-  "csproj",
-  "sln",
-  "vbproj",
-  "fsproj",
-  // .NET / C#
-  "ts",
-  "tsx",
-  "js",
-  "jsx",
-  "mjs",
-  "cjs",
-  "vue",
-  "svelte",
-  // JS/TS front+back
-  "java",
-  "kt",
-  "kts",
-  "scala",
-  // JVM
-  "py",
-  "rb",
-  "php",
-  "go",
-  // scripting / Go
-  "html",
-  "htm",
-  "cshtml",
-  "razor",
-  "aspx",
-  "jsp"
-  // web templates
-]);
-function fileExt(path) {
-  const base = path.split(/[/\\]+/).pop() ?? path;
-  const dot = base.lastIndexOf(".");
-  return dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
-}
-function detectStack(files) {
-  let native = 0;
-  let managed = 0;
-  for (const f of files) {
-    const ext = fileExt(f);
-    if (NATIVE_SOURCE_EXTS.has(ext)) native++;
-    else if (MANAGED_WEB_EXTS.has(ext)) managed++;
-  }
-  if (native === 0 && managed === 0) return "unknown";
-  if (native === 0) return "managed-web";
-  if (managed === 0) return "native";
-  return "mixed";
-}
-var MEMORY_SAFETY_LENS_ID = "memory-safety";
-function selectDefaultFinderLensesForStack(files, defaultFinder) {
-  if (detectStack(files) === "managed-web") {
-    return defaultFinder.filter((l) => l.id !== MEMORY_SAFETY_LENS_ID);
-  }
-  return defaultFinder;
-}
-var EVM_EXCLUDE_DIR_SEGMENTS = /* @__PURE__ */ new Set([
-  "test",
-  "tests",
-  "mock",
-  "mocks",
-  "script",
-  "scripts",
-  // Foundry deploy scripts
-  "lib",
-  // Foundry vendored deps (forge-std / openzeppelin / solmate …)
-  "node_modules"
-  // Hardhat/JS vendored deps (also skipped by the core walker)
-]);
-function isNonProtocolEvmPath(absPath, scopeRoot) {
-  const rel = relative(scopeRoot, absPath);
-  if (rel === "" || rel.startsWith("..")) return false;
-  const segments = rel.split(/[/\\]+/).filter(Boolean);
-  if (segments.length === 0) return false;
-  for (let i = 0; i < segments.length - 1; i++) {
-    if (EVM_EXCLUDE_DIR_SEGMENTS.has(segments[i].toLowerCase())) return true;
-  }
-  const fileName = segments[segments.length - 1].toLowerCase();
-  if (fileName.endsWith(".t.sol")) return true;
-  if (fileName.includes(".test.") || fileName.includes(".spec.")) return true;
-  return false;
-}
-function topLevelModule(absPath, scopeRoot) {
-  const rel = relative(scopeRoot, absPath);
-  if (rel === "" || rel.startsWith("..")) return ".";
-  const segments = rel.split(/[/\\]+/).filter(Boolean);
-  return segments.length > 1 ? segments[0] : ".";
-}
-function selectCandidatesModuleSpread(entries, scopeRoot, maxCandidates) {
-  const cmp = (a, b) => b.size - a.size || a.p.localeCompare(b.p);
-  const byModule = /* @__PURE__ */ new Map();
-  for (const e of entries) {
-    const key = topLevelModule(e.p, scopeRoot);
-    let group = byModule.get(key);
-    if (!group) byModule.set(key, group = []);
-    group.push(e);
-  }
-  const groups = [...byModule.values()];
-  for (const g of groups) g.sort(cmp);
-  groups.sort((a, b) => cmp(a[0], b[0]));
-  const cap = Math.max(1, maxCandidates);
-  const out = [];
-  for (let round = 0; out.length < cap; round++) {
-    let advanced = false;
-    for (const g of groups) {
-      if (round >= g.length) continue;
-      out.push(g[round].p);
-      advanced = true;
-      if (out.length >= cap) break;
-    }
-    if (!advanced) break;
-  }
-  return out;
-}
-function enumerateDeepReviewCandidates(scopeRoot, helpers, opts) {
-  const fileCap = opts.fileCap ?? DEEP_REVIEW_FILE_CAP;
-  const exclude = opts.exclude ?? (() => false);
-  const fileSize = helpers.fileSize ?? ((p) => {
-    try {
-      return statSync(p).size;
-    } catch {
-      return 0;
-    }
-  });
-  const totalFiles = helpers.countScopeFilesUpTo(scopeRoot, fileCap);
-  const overCap = totalFiles > fileCap;
-  const files = helpers.collectScopeFiles(scopeRoot, { maxFiles: fileCap });
-  const entries = files.filter((p) => !exclude(p)).map((p) => ({ p, size: fileSize(p) }));
-  const candidates = selectCandidatesModuleSpread(entries, scopeRoot, opts.maxCandidates);
-  return { candidates, totalFiles, overCap };
-}
-async function runDeepReview(opts) {
-  const defaultFinderSnapshot = createDefaultFinderLenses();
-  const evolvedFinder = opts.evolutionConfig ? await createEvolvedFinder(opts.evolutionConfig, `deep-review-${randomUUID()}`) : void 0;
-  const {
-    runHuntScan,
-    makeMultiLensVerifier,
-    prepare,
-    collectScopeFiles,
-    countScopeFilesUpTo,
-    getCloudSinkConfig,
-    postFinding,
-    evmFinderLenses,
-    evmVerifyLenses,
-    solanaFinderLenses,
-    solanaVerifyLenses,
-    cardanoFinderLenses,
-    cardanoVerifyLenses,
-    cairoFinderLenses,
-    cairoVerifyLenses,
-    moveFinderLenses,
-    moveVerifyLenses
-  } = await import("./dist-4YICS2J2.js");
-  const costLedger = new ScanCostLedger();
-  const scanStartedAt = Date.now();
-  const log = opts.log ?? (() => {
-  });
-  const runtime = opts.runtime ?? "api";
-  const explicitMaxCandidates = opts.maxCandidates;
-  const hasEnvMaxOverride = !!process.env["0SEC_DEEP_REVIEW_MAX_CANDIDATES"];
-  const baseMaxCandidates = explicitMaxCandidates ?? defaultMaxCandidates();
-  if (evolvedFinder && opts.models?.length) throw new Error("--models selects native finders and cannot be combined with --evolution-config");
-  const models = evolvedFinder ? ["evolved-source"] : opts.models ?? defaultModels();
-  const attemptsPerCandidate = opts.attemptsPerCandidate ?? defaultAttempts();
-  const prepared = await prepare(opts.target, "source-code", { ...opts.timeoutMs ? { timeout: opts.timeoutMs } : {} }, (e) => {
-    if (e.message) log(`[deep-review:source] ${e.message}`);
-  });
-  const sourceRoot = resolve2(prepared.resolvedTarget);
-  let scopeRoot = sourceRoot;
-  if (opts.subsystem && opts.subsystem.trim() !== "") {
-    const scoped = resolve2(join(sourceRoot, opts.subsystem));
-    if (scoped !== sourceRoot && !scoped.startsWith(sourceRoot + sep)) {
-      prepared.cleanup();
-      throw new Error(`--subsystem '${opts.subsystem}' escapes the source tree`);
-    }
-    try {
-      const realRoot = realpathSync(sourceRoot);
-      const realScoped = realpathSync(scoped);
-      if (realScoped !== realRoot && !realScoped.startsWith(realRoot + sep)) {
-        throw new Error(`--subsystem '${opts.subsystem}' escapes the source tree`);
-      }
-      scopeRoot = scoped;
-    } catch (error) {
-      prepared.cleanup();
-      throw error;
-    }
-  }
-  const sinkCfg = getCloudSinkConfig();
-  const savedCloudSink = process.env["0SEC_CLOUD_SINK"];
-  if (sinkCfg) delete process.env["0SEC_CLOUD_SINK"];
-  try {
-    const isEvmProfile = (opts.profile ?? "").trim().toLowerCase() === "evm-onchain";
-    const totalFiles = countScopeFilesUpTo(scopeRoot, DEEP_REVIEW_FILE_CAP);
-    const maxCandidates = explicitMaxCandidates ?? (hasEnvMaxOverride ? baseMaxCandidates : scaleMaxCandidates(totalFiles));
-    const overCap = totalFiles > DEEP_REVIEW_FILE_CAP;
-    if (explicitMaxCandidates === void 0 && maxCandidates !== baseMaxCandidates) {
-      log(`[deep-review] auto-scaled candidate cap from ${baseMaxCandidates} to ${maxCandidates} (${totalFiles} scope files)`);
-    }
-    let lanes = null;
-    let allocateAcrossLanes;
-    if (opts.useThreatModel) {
-      const threatModule = await import("./dist-4YICS2J2.js");
-      allocateAcrossLanes = threatModule.allocateCandidatesAcrossLanes;
-      const rtType = runtime !== "auto" ? runtime : "api";
-      const plannerRuntime = threatModule.createRuntime({
-        type: rtType,
-        timeout: opts.timeoutMs ?? 6e5,
-        model: models?.[0]
-      });
-      lanes = await threatModule.runThreatModelPlanner(sourceRoot, plannerRuntime, log);
-      if (!lanes || lanes.length === 0) {
-        log("[threat-model] no lanes produced \u2014 continuing with default selection");
-      } else {
-        log(`[threat-model] planner returned ${lanes.length} lane(s) \u2014 will allocate candidates across boundaries`);
-      }
-    }
-    if (overCap) {
-      return {
-        exitCode: 2,
-        result: {
-          mode: "deep_review",
-          source: sourceRoot,
-          subsystem: opts.subsystem ?? null,
-          scope_files: totalFiles,
-          note: `scope exceeds the ${DEEP_REVIEW_FILE_CAP}-file review cap \u2014 narrow it with --subsystem <path> to a specific directory.`
-        }
-      };
-    }
-    const { candidates: initialCandidates } = enumerateDeepReviewCandidates(
-      scopeRoot,
-      { collectScopeFiles, countScopeFilesUpTo },
-      {
-        maxCandidates,
-        fileCap: DEEP_REVIEW_FILE_CAP,
-        ...isEvmProfile ? { exclude: (p) => isNonProtocolEvmPath(p, scopeRoot) } : {}
-      }
-    );
-    const candidatePaths = initialCandidates.slice();
-    if (lanes && lanes.length > 0 && allocateAcrossLanes) {
-      const allFiles = collectScopeFiles(scopeRoot, { maxFiles: DEEP_REVIEW_FILE_CAP });
-      const exclude = isEvmProfile ? (p) => isNonProtocolEvmPath(p, scopeRoot) : () => false;
-      const entries = allFiles.filter((p) => !exclude(p)).map((p) => {
-        try {
-          return { p, size: statSync(p).size };
-        } catch {
-          return { p, size: 0 };
-        }
-      });
-      const laneCandidates = allocateAcrossLanes(entries, lanes, scopeRoot, maxCandidates, log);
-      if (laneCandidates.length > 0) {
-        const prevModules = new Set(initialCandidates.map((p) => relative(scopeRoot, p).split(/[/\\]+/)[0]));
-        const laneModules = new Set(laneCandidates.map((p) => relative(scopeRoot, p).split(/[/\\]+/)[0]));
-        log(`[deep-review] threat-model re-allocated ${initialCandidates.length} \u2192 ${laneCandidates.length} candidate(s); modules ${prevModules.size} \u2192 ${laneModules.size}`);
-        candidatePaths.length = 0;
-        candidatePaths.push(...laneCandidates);
-      }
-    }
-    if (candidatePaths.length === 0) {
-      return {
-        exitCode: 2,
-        result: {
-          mode: "deep_review",
-          source: sourceRoot,
-          subsystem: opts.subsystem ?? null,
-          scope_files: totalFiles,
-          candidates: 0,
-          note: "no reviewable source files found under the scope (empty tree or all filtered)."
-        }
-      };
-    }
-    const { finderLenses: selectedFinderLenses, verifyLenses, matchedProfile } = selectProfileLenses(opts.profile, {
-      evmFinderLenses,
-      evmVerifyLenses,
-      solanaFinderLenses,
-      solanaVerifyLenses,
-      cardanoFinderLenses,
-      cardanoVerifyLenses,
-      cairoFinderLenses,
-      cairoVerifyLenses,
-      moveFinderLenses,
-      moveVerifyLenses
-    }, defaultFinderSnapshot);
-    const finderLenses = matchedProfile === "default" ? selectDefaultFinderLensesForStack(candidatePaths, selectedFinderLenses) : selectedFinderLenses;
-    const lensDigest = lensSetDigest(finderLenses);
-    const scanId = randomUUID();
-    let sourceRevisionDigest = null;
-    let sourceFingerprintWarning;
-    try {
-      const files = [...candidatePaths].sort().map((path) => ({
-        path: relative(sourceRoot, path),
-        digest: createHash("sha256").update(readFileSync2(path)).digest("hex")
-      }));
-      sourceRevisionDigest = `sha256:${createHash("sha256").update(JSON.stringify(files)).digest("hex")}`;
-    } catch (error) {
-      sourceFingerprintWarning = `learning feedback skipped: reviewed inputs could not be fingerprinted (${error instanceof Error ? error.message : String(error)})`;
-      log(`[deep-review] ${sourceFingerprintWarning}`);
-    }
-    log(
-      `[deep-review] ${candidatePaths.length} candidate file(s) (of ${totalFiles}${overCap ? "+" : ""}) \xD7 ${finderLenses.length} finder-lens(es); verify quorum over ${verifyLenses.length} lens(es); profile=${matchedProfile}; lens-snapshot=${lensDigest.slice(0, 12)}`
-    );
-    const verify = makeMultiLensVerifier(verifyLenses, {
-      sourceRoot,
-      runtime,
-      ...!evolvedFinder && models?.[0] ? { model: models[0] } : {},
-      // Every verify lens is a refute pass on `models[0]` — the same model the
-      // finders ran on. Passing the full finder set lets the cross-family
-      // selector move the refutation off ALL finder families when a second
-      // provider is configured (#661), and `log` records what it decided —
-      // including "it could not", which is the case worth knowing about.
-      ...opts.costCeilingUsd !== void 0 ? { costCeilingUsd: opts.costCeilingUsd } : {},
-      costLedger,
-      ...!evolvedFinder && models && models.length > 0 ? { finderModels: models } : {},
-      ...opts.quorum ? { quorum: opts.quorum } : {},
-      log
-    });
-    const postedIds = /* @__PURE__ */ new Set();
-    let ingested = 0;
-    const provenance = `deep_review (${matchedProfile} lenses)`;
-    const postLead = async (lead) => {
-      if (!sinkCfg || postedIds.has(lead.id)) return;
-      postedIds.add(lead.id);
-      await postFinding(leadToCandidateFinding(lead, `deep-review:${matchedProfile}`, provenance), sinkCfg);
-      ingested++;
-    };
-    const res = await runHuntScan({
-      sourceRoot,
-      candidates: candidatePaths.map((path) => ({ path })),
-      lenses: finderLenses,
-      runtime,
-      ...evolvedFinder ? { finder: (input) => evolvedFinder.find(sourceRoot, input) } : {},
-      concurrency: opts.concurrency ?? DEFAULT_CONCURRENCY,
-      ...opts.costCeilingUsd !== void 0 ? { costCeilingUsd: opts.costCeilingUsd } : {},
-      costLedger,
-      attemptsPerCandidate,
-      ...models ? { models } : {},
-      verify,
-      ...sinkCfg ? { onConfirmed: postLead } : {},
-      log
-    });
-    const leads = res.confirmed;
-    if (sourceFingerprintWarning) res.warnings.push(sourceFingerprintWarning);
-    if (sourceRevisionDigest) {
-      try {
-        for (const gap of res.incompleteCoverage ?? []) {
-          captureObservation({
-            classHint: gap.lensId || "generic-finder-timeout",
-            sinkPattern: "",
-            exampleFileLine: gap.file,
-            whyMissed: `finder ${gap.reason}; budget ${gap.budgetMs}ms`,
-            source: "incomplete-coverage",
-            scanId,
-            sourceRevisionDigest,
-            consent: false,
-            detectorLensId: gap.lensId || void 0,
-            detectorLensVersionDigest: gap.lensVersionDigest
-          });
-        }
-        for (const dropped of res.dropped ?? []) {
-          if (dropped.dropReason === "verify_refuted" || dropped.dropReason === "novelty_duplicate" || dropped.dropReason === "judge_truncation" || dropped.dropReason === "late_resolution") continue;
-          captureObservation({
-            classHint: dropped.lensId || "unknown-lens",
-            sinkPattern: "",
-            exampleFileLine: dropped.candidatePath,
-            whyMissed: `dropped: ${dropped.dropReason}`,
-            source: "incomplete-coverage",
-            scanId,
-            sourceRevisionDigest,
-            consent: false,
-            detectorLensId: dropped.lensId || void 0,
-            detectorLensVersionDigest: dropped.lensVersionDigest
-          });
-        }
-      } catch (error) {
-        const warning = `learning feedback was not persisted: ${error instanceof Error ? error.message : String(error)}`;
-        res.warnings.push(warning);
-        log(`[deep-review] ${warning}`);
-      }
-    }
-    if (sinkCfg) {
-      for (const lead of leads) await postLead(lead);
-      log(`[deep-review] posted ${ingested} lead(s) to the cloud-sink as candidate findings (incremental)`);
-    }
-    const sweptNothing = res.scanned > 0 && typeof res.finderCompleted === "number" && res.finderCompleted === 0;
-    const cost = costLedger.costBreakdown();
-    eventBus.emit("scan_completed", {
-      exit_reason: sweptNothing ? "failed" : res.costCeilingExceeded ? "cost_exceeded" : "completed",
-      findings: res.findings.length,
-      findings_count: res.findings.length,
-      duration_ms: Date.now() - scanStartedAt,
-      summary: res.costCeilingExceeded ? `Deep review stopped at the $${opts.costCeilingUsd?.toFixed(2) ?? "configured"} cost ceiling.` : `Deep review completed: ${res.scanned} finder runs, ${res.findings.length} findings, ${leads.length} leads.`,
-      ...cost ? { cost_usd: cost.costUsd, cost_breakdown: cost.breakdown } : {}
-    });
-    if (sweptNothing) {
-      return {
-        exitCode: 3,
-        result: {
-          mode: "deep_review",
-          profile: matchedProfile,
-          scan_id: scanId,
-          source_revision_digest: sourceRevisionDigest,
-          lens_snapshot_digest: lensDigest,
-          ...evolvedFinder ? { evolution_version_id: evolvedFinder.versionId, evolution_compute_cost_usd: evolvedFinder.computeCostUsd } : {},
-          source: sourceRoot,
-          subsystem: opts.subsystem ?? null,
-          scope_files: totalFiles,
-          candidates: candidatePaths.length,
-          scanned: res.scanned,
-          finder_completed: res.finderCompleted,
-          finder_timed_out: res.finderTimedOut ?? null,
-          finder_errored: res.finderErrored ?? null,
-          error: `every finder run failed (0 of ${res.scanned} completed) \u2014 no coverage was produced; treating as a backend/LLM failure, not a clean 0-finding result.`,
-          warnings: res.warnings.slice(0, 10)
-        }
-      };
-    }
-    const completedAt = /* @__PURE__ */ new Date();
-    const candidateFindings = leads.map((lead) => ({
-      ...lead,
-      status: "discovered"
-    }));
-    const report = {
-      target: opts.target,
-      scanDepth: "deep",
-      startedAt: new Date(scanStartedAt).toISOString(),
-      completedAt: completedAt.toISOString(),
-      durationMs: completedAt.getTime() - scanStartedAt,
-      summary: {
-        totalAttacks: res.scanned,
-        totalFindings: candidateFindings.length,
-        critical: candidateFindings.filter((finding) => finding.severity === "critical").length,
-        high: candidateFindings.filter((finding) => finding.severity === "high").length,
-        medium: candidateFindings.filter((finding) => finding.severity === "medium").length,
-        low: candidateFindings.filter((finding) => finding.severity === "low").length,
-        info: candidateFindings.filter((finding) => finding.severity === "info").length
-      },
-      findings: candidateFindings,
-      warnings: res.warnings.slice(0, 10).map((message) => ({
-        stage: "attack",
-        message
-      })),
-      ...res.costCeilingExceeded ? { costCeilingExceeded: true, exitReason: "cost_ceiling_exceeded" } : {}
-    };
-    return {
-      exitCode: 0,
-      report,
-      result: {
-        mode: "deep_review",
-        profile: matchedProfile,
-        scan_id: scanId,
-        source_revision_digest: sourceRevisionDigest,
-        source: sourceRoot,
-        subsystem: opts.subsystem ?? null,
-        scope_files: totalFiles,
-        lens_snapshot_digest: lensDigest,
-        ...evolvedFinder ? { evolution_version_id: evolvedFinder.versionId, evolution_compute_cost_usd: evolvedFinder.computeCostUsd } : {},
-        candidates: candidatePaths.length,
-        finder_lenses: finderLenses.map((l) => l.id),
-        verify_lenses: verifyLenses.map((l) => l.id),
-        scanned: res.scanned,
-        findings: res.findings.length,
-        confirmed: leads.length,
-        leads: leads.map((f) => ({
-          title: f.title,
-          severity: f.severity,
-          analysis: f.evidence.analysis ?? ""
-        })),
-        dropped: res.dropped.map((d) => ({
-          title: d.finding.title,
-          severity: d.finding.severity,
-          candidatePath: d.candidatePath,
-          lensId: d.lensId,
-          dropReason: d.dropReason,
-          detail: d.detail
-        })),
-        ingested: sinkCfg ? ingested : null,
-        warnings: res.warnings.slice(0, 10),
-        note: "LEADS, not confirmed bugs. Each survived the multi-lens refute quorum; verify the real sink + impact before disclosure."
-      }
-    };
-  } catch (error) {
-    const cost = costLedger.costBreakdown();
-    eventBus.emit("scan_completed", {
-      exit_reason: "failed",
-      findings: 0,
-      findings_count: 0,
-      duration_ms: Date.now() - scanStartedAt,
-      summary: `Deep review failed: ${error instanceof Error ? error.message : String(error)}`,
-      ...cost ? { cost_usd: cost.costUsd, cost_breakdown: cost.breakdown } : {}
-    });
-    throw error;
-  } finally {
-    if (savedCloudSink !== void 0) process.env["0SEC_CLOUD_SINK"] = savedCloudSink;
-    prepared.cleanup();
-  }
-}
-function parsePositive2(flag, raw, dflt) {
-  if (raw === void 0) return dflt;
-  const n = parseInt(raw, 10);
-  if (!Number.isFinite(n) || n <= 0) throw new Error(`invalid ${flag} '${raw}' (expected positive integer)`);
-  return n;
-}
-async function deepReviewAction(target, opts) {
-  if (!target || target.trim() === "") throw new Error("missing required argument: <target> (source tree path or git URL)");
-  const ceilingSource = opts.costCeiling ?? process.env["0SEC_COST_CEILING_USD"];
-  let costCeilingUsd;
-  if (ceilingSource !== void 0 && ceilingSource !== "") {
-    const parsed = Number(ceilingSource);
-    if (!Number.isFinite(parsed) || parsed <= 0) {
-      throw new Error(`invalid --cost-ceiling '${ceilingSource}' (expected positive USD amount)`);
-    }
-    costCeilingUsd = parsed;
-  }
-  const { writeFileSync: writeFileSync3 } = await import("node:fs");
-  const outcome = await runDeepReview({
-    target,
-    ...costCeilingUsd !== void 0 ? { costCeilingUsd } : {},
-    ...opts.profile ? { profile: opts.profile } : {},
-    ...opts.subsystem ? { subsystem: opts.subsystem } : {},
-    // Flag > env > single provider-default model. Only pass `models` when the
-    // flag is set; otherwise let runDeepReview resolve $0SEC_DEEP_REVIEW_MODELS.
-    ...opts.models ? { models: opts.models.split(",").map((s) => s.trim()).filter(Boolean) } : {},
-    ...opts.attempts ? { attemptsPerCandidate: parsePositive2("--attempts", opts.attempts, defaultAttempts()) } : {},
-    concurrency: parsePositive2("--concurrency", opts.concurrency, DEFAULT_CONCURRENCY),
-    maxCandidates: parsePositive2("--max-candidates", opts.maxCandidates, defaultMaxCandidates()),
-    ...opts.quorum ? { quorum: parsePositive2("--quorum", opts.quorum, 1) } : {},
-    ...opts.threatModel ? { useThreatModel: true } : {},
-    ...opts.runtime ? { runtime: opts.runtime } : {},
-    ...opts.evolutionConfig ? { evolutionConfig: loadEvolutionConfigFile(opts.evolutionConfig) } : {},
-    timeoutMs: parsePositive2("--timeout", opts.timeout, 6e5),
-    log: (m) => process.stderr.write(m + "\n")
-  });
-  if (outcome.report) {
-    const storage = resolveOsecRunStorage();
-    writeOsecRunReport(storage, outcome.report);
-  }
-  const json = JSON.stringify(outcome.result, null, 2);
-  if (opts.output) writeFileSync3(resolve2(opts.output), json + "\n", "utf8");
-  else process.stdout.write(json + "\n");
-  process.exitCode = outcome.exitCode;
-}
-function registerDeepReviewCommand(program) {
-  program.command("deep-review").description(
-    "Seedless DEPTH review of a source tree: enumerate candidate files, re-hunt each through the profile's specialized finder lenses, and gate survivors through the multi-lens verify quorum. Emits LEADS to verify (not confirmed bugs). Exit 0=sweep completed (with or without leads), 2=skipped (no files / over the review cap), 3=error (bad flags / unreadable target / all finders failed)."
-  ).argument("<target>", "Source tree to review (a local path or a git URL)").option("--profile <p>", "Lens profile: evm-onchain | solana-onchain | cardano-onchain | cairo-onchain | move-onchain (else a generic default lens set)").option("--subsystem <path>", "Narrow the review scope to a subdirectory (respects the 5000-file review cap)").option("--evolution-config <path>", "Use the active source finder with private local execution receipts").option("--models <a,b>", "Comma-separated finder models for diversity (default: single provider model, or $0SEC_DEEP_REVIEW_MODELS)").option("--attempts <N>", `Finder attempts per candidate\xD7lens\xD7model, best-of-N (default ${DEFAULT_ATTEMPTS}, or $0SEC_DEEP_REVIEW_ATTEMPTS)`).option("--concurrency <N>", `Max finders in flight (default ${DEFAULT_CONCURRENCY})`).option("--cost-ceiling <usd>", "Hard scan-wide USD ceiling. Overrides $0SEC_COST_CEILING_USD.").option("--max-candidates <N>", `Cap candidate files hunted, largest-first (default ${DEFAULT_MAX_CANDIDATES}, or $0SEC_DEEP_REVIEW_MAX_CANDIDATES)`).option("--threat-model", "Enable pre-selection threat-model planner pass (trust-boundary lanes); default OFF").option("--quorum <N>", "Multi-lens verify quorum (default: majority of the verify-lens count)").option("--format <fmt>", "Output format (json)", "json").option("--output <path>", "Write the result JSON to this path instead of stdout").option("--runtime <mode>", "Engine runtime (default api)").option("--timeout <ms>", "Cloud agent timeout budget in milliseconds", "600000").action(async (target, opts) => {
-    try {
-      await deepReviewAction(target, opts);
-    } catch (err) {
-      const reason = err instanceof Error ? err.message : String(err);
-      const json = JSON.stringify({ mode: "deep_review", error: reason }, null, 2);
-      if (opts.output) {
-        const { writeFileSync: writeFileSync3 } = await import("node:fs");
-        try {
-          writeFileSync3(resolve2(opts.output), json + "\n", "utf8");
-        } catch {
-          process.stderr.write(json + "\n");
-        }
-      } else process.stdout.write(json + "\n");
-      process.exitCode = 3;
-    }
-  });
+  return `https://0.security/r#${b64}`;
 }
 
 // packages/cli/src/finding-handoff.ts
@@ -1285,7 +181,7 @@ function shellQuote(value) {
 }
 function buildFindingConsoleCommand(finding, dbPath, intent = "investigate") {
   const args = [
-    "0sec console",
+    "0 console",
     "--finding",
     shellQuote(finding.id),
     "--finding-intent",
@@ -1296,7 +192,7 @@ function buildFindingConsoleCommand(finding, dbPath, intent = "investigate") {
 }
 
 // packages/cli/src/finding-focus.ts
-import { resolve as resolve3 } from "node:path";
+import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 function parseJson(value) {
   if (value == null) return void 0;
@@ -1308,11 +204,11 @@ function parseJson(value) {
   }
 }
 function databasePaths(dbPath) {
-  if (dbPath?.trim()) return [resolve3(dbPath)];
+  if (dbPath?.trim()) return [resolve(dbPath)];
   return [...new Set([
     ...listOsecRunDatabasePaths(),
     resolveOsecDbPath()
-  ].map((path) => resolve3(path)))];
+  ].map((path) => resolve(path)))];
 }
 function findingFromRow(row, reviewFields) {
   const id = typeof row.id === "string" ? row.id : "";
@@ -1408,9 +304,9 @@ function loadFindingFocus(id, options = {}) {
 }
 
 // packages/cli/src/commands/lens-synth.ts
-import { createHash as createHash2 } from "node:crypto";
-import { readFileSync as readFileSync3 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { resolve as resolve2 } from "node:path";
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -1466,10 +362,10 @@ function parseMissInputFile(raw) {
   return { misses, corpus };
 }
 async function harvestBenchMisses(fromBench, manifestPath) {
-  const ledger = await loadLedger(resolve4(fromBench));
+  const ledger = await loadLedger(resolve2(fromBench));
   const entry = lastGreen(ledger) ?? ledger.entries[ledger.entries.length - 1];
   if (!entry) throw new Error(`--from-bench: ledger ${fromBench} has no entries to harvest`);
-  const manifest = await loadManifest(resolve4(manifestPath));
+  const manifest = await loadManifest(resolve2(manifestPath));
   const result = harvestMissesFromLedgerEntry(entry, manifest);
   return { misses: result.misses, result };
 }
@@ -1487,7 +383,7 @@ async function runLensSynthesisInput(input, opts, deps = {}) {
     ...deps.model ? { model: deps.model } : {},
     ...opts.model ? { modelId: opts.model } : {},
     probe,
-    ...opts.registry ? { registryPath: resolve4(opts.registry) } : {},
+    ...opts.registry ? { registryPath: resolve2(opts.registry) } : {},
     maxRegistrations: opts.maxRegister ?? 1,
     dryRun: !opts.promote,
     trials,
@@ -1496,7 +392,7 @@ async function runLensSynthesisInput(input, opts, deps = {}) {
   });
 }
 async function runLensSynthCommand(opts, deps = {}) {
-  const raw = JSON.parse(readFileSync3(resolve4(opts.missInput), "utf8"));
+  const raw = JSON.parse(readFileSync(resolve2(opts.missInput), "utf8"));
   let input = parseMissInputFile(raw);
   if (opts.fromBench) {
     if (!opts.manifest) throw new Error("--from-bench requires --manifest");
@@ -1507,7 +403,7 @@ async function runLensSynthCommand(opts, deps = {}) {
   return runLensSynthesisInput(input, opts, deps);
 }
 async function watchLensSynthCommand(opts, deps = {}) {
-  const inputPath = resolve4(opts.missInput);
+  const inputPath = resolve2(opts.missInput);
   const log = deps.log ?? (() => {
   });
   const requestedInterval = opts.pollIntervalMs ?? 2e3;
@@ -1516,8 +412,8 @@ async function watchLensSynthCommand(opts, deps = {}) {
   let previousRevision;
   while (!deps.signal?.aborted) {
     try {
-      const bytes = readFileSync3(inputPath);
-      const revision = createHash2("sha256").update(bytes).digest("hex");
+      const bytes = readFileSync(inputPath);
+      const revision = createHash("sha256").update(bytes).digest("hex");
       if (revision !== previousRevision) {
         previousRevision = revision;
         const input = parseMissInputFile(JSON.parse(bytes.toString("utf8")));
@@ -1584,9 +480,9 @@ function formatLensRegistryStatus(status) {
   return lines.join("\n");
 }
 function registerLensSynthCommand(program) {
-  program.command("lens-synth").description("Evolve appsec finder coverage from curated misses; promotion is corpus-gated and active reviews stay pinned").option("--miss-input <path>", "curated miss-input JSON ({ misses, corpus })").option("--registry <path>", "durable overlay path (default: ~/.0sec/lenses/appsec-archetypes.json)").option("--max-register <n>", "cap promoted champions per input revision", (value) => Number.parseInt(value, 10)).option("-m, --model <id>", "synthesis model override").option("--promote", "persist a validated champion to the durable overlay", false).option("--trials <n>", "repeated validation trials (2\u201310; default 2)", Number).option("--from-bench <ledger>", "harvest the champion's false-negatives from a benchmark ledger into the curated misses (requires --manifest)").option("--manifest <path>", "bench manifest path (ground-truth vuln class + sink); required with --from-bench").option("--watch", "poll the miss-input and process each new content revision", false).option("--poll-interval <ms>", "watch polling interval (minimum 100ms)", "2000").option("--status", "show the active durable overlay and promotion ledger", false).option("--rollback <lens-id>", "retire one previously promoted overlay lens").option("--json", "print machine-readable output", false).action(async (opts) => {
+  program.command("lens-synth").description("Evolve appsec finder coverage from curated misses; promotion is corpus-gated and active reviews stay pinned").option("--miss-input <path>", "curated miss-input JSON ({ misses, corpus })").option("--registry <path>", "durable overlay path (default: ~/.0/lenses/appsec-archetypes.json)").option("--max-register <n>", "cap promoted champions per input revision", (value) => Number.parseInt(value, 10)).option("-m, --model <id>", "synthesis model override").option("--promote", "persist a validated champion to the durable overlay", false).option("--trials <n>", "repeated validation trials (2\u201310; default 2)", Number).option("--from-bench <ledger>", "harvest the champion's false-negatives from a benchmark ledger into the curated misses (requires --manifest)").option("--manifest <path>", "bench manifest path (ground-truth vuln class + sink); required with --from-bench").option("--watch", "poll the miss-input and process each new content revision", false).option("--poll-interval <ms>", "watch polling interval (minimum 100ms)", "2000").option("--status", "show the active durable overlay and promotion ledger", false).option("--rollback <lens-id>", "retire one previously promoted overlay lens").option("--json", "print machine-readable output", false).action(async (opts) => {
     try {
-      const registry = opts.registry ? resolve4(opts.registry) : void 0;
+      const registry = opts.registry ? resolve2(opts.registry) : void 0;
       if (opts.status && opts.rollback) throw new Error("--status and --rollback cannot be combined");
       if (opts.status) {
         const status = inspectLensRegistry(registry);
@@ -1625,7 +521,7 @@ function registerLensSynthCommand(program) {
         promote: Boolean(opts.promote),
         trials: trialCount(opts.trials),
         ...opts.fromBench ? { fromBench: String(opts.fromBench) } : {},
-        ...opts.manifest ? { manifest: resolve4(String(opts.manifest)) } : {}
+        ...opts.manifest ? { manifest: resolve2(String(opts.manifest)) } : {}
       };
       const printResult = (result) => {
         process.stdout.write(
@@ -1669,388 +565,12 @@ function registerLensSynthCommand(program) {
   });
 }
 
-// packages/cli/src/commands/auth.ts
-import { spawn } from "node:child_process";
-import { mkdirSync, writeFileSync as writeFileSync2, chmodSync, unlinkSync, existsSync as existsSync2 } from "node:fs";
-import { homedir, platform } from "node:os";
-import { join as join2 } from "node:path";
-import { randomBytes } from "node:crypto";
-import { setTimeout as delay } from "node:timers/promises";
-var EXIT_OK = 0;
-var EXIT_USER_ERROR = 1;
-var EXIT_AUTH = 2;
-var EXIT_NET = 3;
-function registerAuthCommand(program) {
-  const auth = program.command("auth").description("0sec-cloud authentication");
-  auth.command("login").description("Log in to 0sec-cloud (opens browser; --token to paste directly)").option("--host <url>", `Cloud host (default ${DEFAULT_CLOUD_HOST})`).option("--token <value>", "Skip the browser flow and persist this token directly").action(async (opts) => {
-    await runLogin(opts);
-  });
-  auth.command("logout").description("Delete ~/.0sec/cloud.env").action(() => {
-    runLogout({});
-  });
-  auth.command("status").description("Verify 0sec-cloud credentials against /health").action(async () => {
-    await runStatus({});
-  });
-}
-async function hostedBrowserLoginFlow(opts = {}) {
-  const host = normaliseHostArg(opts.host ?? DEFAULT_CLOUD_HOST);
-  if (host === null) {
-    return { ok: false, error: "Cloud host must be an http(s) URL without credentials, query or fragment." };
-  }
-  const attempts = opts.pollAttempts ?? 150;
-  const intervalMs = opts.pollIntervalMs ?? 2e3;
-  if (!Number.isSafeInteger(attempts) || attempts <= 0 || !Number.isFinite(intervalMs) || intervalMs < 0) {
-    return { ok: false, error: "Invalid sign-in polling budget." };
-  }
-  const cancelled = () => {
-    opts.onStatus?.("cancelled", "Sign-in cancelled.");
-    return { ok: false, error: "Sign-in cancelled.", recoverable: true, cancelled: true };
-  };
-  if (opts.signal?.aborted) return cancelled();
-  const deadline = new AbortController();
-  const timer = setTimeout(() => deadline.abort(), 3e5);
-  const signal = opts.signal ? AbortSignal.any([opts.signal, deadline.signal]) : deadline.signal;
-  const session = randomBytes(9).toString("base64url").slice(0, 12);
-  const loginUrl = `${host}/cli-auth?session=${session}`;
-  const pollUrl = `${host}/cli-auth/sessions/${session}`;
-  const timedOut = () => {
-    opts.onStatus?.("timeout", "Sign-in timed out. Try again.");
-    return { ok: false, error: "Sign-in timed out. Try again.", recoverable: true };
-  };
-  try {
-    opts.onStatus?.("opening", "Opening browser for 0sec Cloud sign-in.", loginUrl);
-    signal.throwIfAborted();
-    try {
-      await awaitLoginStep(Promise.resolve().then(() => {
-        signal.throwIfAborted();
-        return (opts.openBrowser ?? defaultOpenBrowser)(loginUrl);
-      }), signal);
-    } catch {
-      signal.throwIfAborted();
-      opts.onStatus?.("opener-failed", "Could not open a browser. Open this sign-in URL manually.", loginUrl);
-    }
-    const fetcher = opts.fetchImpl ?? fetch;
-    for (let i = 0; i < attempts; i++) {
-      signal.throwIfAborted();
-      opts.onStatus?.("polling", "Waiting for browser sign-in.", loginUrl);
-      signal.throwIfAborted();
-      await awaitLoginStep(
-        opts.sleep ? opts.sleep(intervalMs) : delay(intervalMs, void 0, { signal }),
-        signal
-      );
-      signal.throwIfAborted();
-      const request = new AbortController();
-      const requestTimer = setTimeout(() => request.abort(), 1e4);
-      const requestSignal = AbortSignal.any([signal, request.signal]);
-      try {
-        let res;
-        try {
-          res = await awaitLoginStep(fetcher(pollUrl, {
-            method: "GET",
-            headers: { Accept: "application/json" },
-            signal: requestSignal,
-            redirect: "error"
-          }), requestSignal);
-        } catch {
-          signal.throwIfAborted();
-          continue;
-        }
-        signal.throwIfAborted();
-        if (res.status === 200) {
-          let body;
-          try {
-            body = await awaitLoginStep(res.json(), requestSignal);
-          } catch {
-            signal.throwIfAborted();
-            if (requestSignal.aborted) continue;
-            return { ok: false, error: "Login response was not valid JSON." };
-          }
-          signal.throwIfAborted();
-          const rawStatus = body && typeof body === "object" ? body.status : void 0;
-          const status = sessionStatus(body);
-          const token = extractToken(body);
-          if (token) {
-            if (rawStatus !== void 0 && status !== "ready") {
-              return { ok: false, error: "Login returned credentials before the session was ready." };
-            }
-            try {
-              persistCredentials(host, token, opts.homeDir);
-            } catch {
-              return { ok: false, error: "Could not save 0sec Cloud credentials." };
-            }
-            opts.onStatus?.("ready", "Signed in to 0sec Cloud.");
-            return { ok: true, host };
-          }
-          if (status === "pending") continue;
-          if (status === "expired") return { ok: false, error: "Sign-in request expired. Try again.", recoverable: true };
-          return { ok: false, error: "Login response did not contain valid credentials." };
-        }
-        if ([202, 204, 404].includes(res.status)) continue;
-        if (res.status === 410) return { ok: false, error: "Sign-in request expired. Try again.", recoverable: true };
-        return {
-          ok: false,
-          error: `0sec Cloud sign-in unavailable (HTTP ${res.status}). Use your own provider or try again later.`,
-          recoverable: res.status === 429 || res.status >= 500
-        };
-      } finally {
-        clearTimeout(requestTimer);
-        request.abort();
-      }
-    }
-    return timedOut();
-  } catch (error) {
-    if (opts.signal?.aborted) return cancelled();
-    if (deadline.signal.aborted) return timedOut();
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function awaitLoginStep(operation, signal) {
-  return new Promise((resolve6, reject) => {
-    const onAbort = () => {
-      signal.removeEventListener("abort", onAbort);
-      reject(signal.reason);
-    };
-    operation.then(
-      (value) => {
-        signal.removeEventListener("abort", onAbort);
-        resolve6(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", onAbort);
-        reject(error);
-      }
-    );
-    if (signal.aborted) onAbort();
-    else signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function runLogin(opts) {
-  const host = normaliseHostArg(opts.host ?? DEFAULT_CLOUD_HOST);
-  if (host === null) {
-    consolePresentationOutput.stderr(source_default.red("Error: Cloud host must be an http(s) URL without credentials, query or fragment."), "auth.login.host-error");
-    process.exitCode = EXIT_USER_ERROR;
-    return;
-  }
-  if (opts.token !== void 0) {
-    const tok = opts.token.trim();
-    if (!validCloudToken(tok)) {
-      consolePresentationOutput.stderr(source_default.red("Error: --token must be a nonempty credential without whitespace."), "auth.login.token-empty");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-    try {
-      persistCredentials(host, tok, opts.homeDir);
-    } catch {
-      consolePresentationOutput.stderr(source_default.red("Could not save 0sec Cloud credentials."), "auth.login.save-error");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-    consolePresentationOutput.stdout(`Logged in (host=${host})`, "auth.login.logged-in");
-    process.exitCode = EXIT_OK;
-    return;
-  }
-  const result = await hostedBrowserLoginFlow({
-    host,
-    pollAttempts: opts.pollAttempts,
-    pollIntervalMs: opts.pollIntervalMs,
-    openBrowser: opts.openBrowser,
-    fetchImpl: opts.fetchImpl,
-    homeDir: opts.homeDir,
-    sleep: opts.sleep,
-    onStatus: (phase, msg, url) => {
-      if (phase === "opening") {
-        consolePresentationOutput.stdout(source_default.dim("Opening browser..."), "auth.login.opening");
-        if (url) consolePresentationOutput.stdout(source_default.dim(`  ${url}`), "auth.login.url");
-        consolePresentationOutput.stdout("", "auth.login.empty-line");
-        consolePresentationOutput.stdout(source_default.dim("Complete sign-in in the opened browser, then return here."), "auth.login.browser-hint");
-        consolePresentationOutput.stdout("", "auth.login.empty-line");
-      }
-      if (phase === "opener-failed") {
-        consolePresentationOutput.stderr(source_default.yellow(msg), "auth.login.browser-error");
-      }
-    }
-  });
-  if (result.ok) {
-    consolePresentationOutput.stdout(`Logged in (host=${result.host})`, "auth.login.logged-in");
-    process.exitCode = EXIT_OK;
-  } else {
-    consolePresentationOutput.stderr(source_default.red(result.error), "auth.login.error");
-    process.exitCode = result.recoverable ? EXIT_NET : EXIT_USER_ERROR;
-  }
-}
-function runLogout(opts) {
-  const home = opts.homeDir ?? homedir();
-  const osecPath = join2(homeStateDir(opts.homeDir), "cloud.env");
-  const cloudCredsPath = join2(home, ".0cloud", "credentials.json");
-  let deletedAny = false;
-  try {
-    unlinkSync(osecPath);
-    deletedAny = true;
-  } catch (err) {
-    const code = err.code;
-    if (code !== "ENOENT") {
-      consolePresentationOutput.stderr(source_default.red(`Could not delete ${osecPath}: ${err instanceof Error ? err.message : String(err)}`), "auth.logout.delete-error");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-  }
-  try {
-    unlinkSync(cloudCredsPath);
-    deletedAny = true;
-  } catch (err) {
-    const code = err.code;
-    if (code !== "ENOENT") {
-      consolePresentationOutput.stderr(source_default.red(`Could not delete ${cloudCredsPath}: ${err instanceof Error ? err.message : String(err)}`), "auth.logout.delete-error");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-  }
-  if (deletedAny) {
-    consolePresentationOutput.stdout("Logged out", "auth.logout.deleted");
-  } else {
-    consolePresentationOutput.stdout("Logged out (no credentials file was present)", "auth.logout.not-found");
-  }
-  process.exitCode = EXIT_OK;
-}
-async function runStatus(opts) {
-  let creds;
-  try {
-    const c = loadCloudCredentials();
-    creds = { host: c.host, token: c.token };
-  } catch (err) {
-    if (err instanceof CloudAuthMissingError) {
-      consolePresentationOutput.stderr(source_default.red(err.message), "auth.status.auth-missing");
-      process.exitCode = EXIT_AUTH;
-      return;
-    }
-    consolePresentationOutput.stderr(source_default.red(err instanceof Error ? err.message : String(err)), "auth.status.load-error");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  const client = new CloudClient({ ...creds, fetchImpl: opts.fetchImpl });
-  try {
-    await client.pingHealth();
-    consolePresentationOutput.stdout(`OK (host=${creds.host})`, "auth.status.ok");
-    process.exitCode = EXIT_OK;
-  } catch (err) {
-    handleStatusError(err);
-  }
-}
-function handleStatusError(err) {
-  if (err instanceof CloudUnauthorizedError) {
-    consolePresentationOutput.stderr("FAIL (HTTP 401)", "auth.status.unauthorized");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  if (err instanceof CloudForbiddenError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (HTTP 403) \u2014 status: ${err.message}`), "auth.status.forbidden");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  if (err instanceof CloudNetworkError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (network) \u2014 status: ${err.message}`), "auth.status.network-error");
-    process.exitCode = EXIT_NET;
-    return;
-  }
-  if (err instanceof CloudError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (HTTP ${err.status ?? "?"}) \u2014 status`), "auth.status.cloud-error");
-    process.exitCode = EXIT_USER_ERROR;
-    return;
-  }
-  consolePresentationOutput.stderr(source_default.red(`FAIL \u2014 status: ${err instanceof Error ? err.message : String(err)}`), "auth.status.error");
-  process.exitCode = EXIT_USER_ERROR;
-}
-function normaliseHostArg(host) {
-  if (!host?.trim()) return null;
-  try {
-    const url = new URL(host.trim());
-    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null;
-    return url.href.replace(/\/+$/, "");
-  } catch {
-    return null;
-  }
-}
-function persistCredentials(host, token, homeDirOverride) {
-  if (!validCloudToken(token)) throw new Error("Invalid Cloud credential");
-  const home = homeDirOverride ?? homedir();
-  const dir = homeStateDir(homeDirOverride);
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  const path = join2(dir, "cloud.env");
-  const body = `# 0sec-cloud credentials. Managed by \`0sec auth\`.
-# DO NOT commit this file or share its contents.
-0SEC_CLOUD_HOST=${host}
-0SEC_CLOUD_TOKEN=${token}
-`;
-  writeFileSync2(path, body, { mode: 384 });
-  chmodSync(path, 384);
-  if (!existsSync2(path)) {
-    return;
-  }
-  try {
-    const cloudDir = join2(home, ".0cloud");
-    mkdirSync(cloudDir, { recursive: true });
-    const cloudCredsPath = join2(cloudDir, "credentials.json");
-    const trimmedHost = host.replace(/\/+$/, "");
-    const apiEndpoint = trimmedHost.endsWith("/api") ? trimmedHost : `${trimmedHost}/api`;
-    const cloudCreds = JSON.stringify(
-      {
-        token,
-        orgId: "",
-        endpoint: apiEndpoint,
-        dashboardUrl: host,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      },
-      null,
-      2
-    ) + "\n";
-    writeFileSync2(cloudCredsPath, cloudCreds, { mode: 384 });
-    chmodSync(cloudCredsPath, 384);
-  } catch {
-  }
-}
-function sessionStatus(body) {
-  if (!body || typeof body !== "object") return void 0;
-  const status = body.status;
-  return status === "pending" || status === "ready" || status === "expired" ? status : void 0;
-}
-function validCloudToken(value) {
-  return typeof value === "string" && value.trim().length > 0 && !/[\s\x00-\x1f\x7f]/.test(value.trim());
-}
-function extractToken(body) {
-  if (!body || typeof body !== "object") return null;
-  const obj = body;
-  const candidates = [obj.token, obj.access_token];
-  for (const c of candidates) {
-    if (validCloudToken(c)) return c.trim();
-  }
-  return null;
-}
-function defaultOpenBrowser(url) {
-  const plat = platform();
-  return new Promise((resolve6, reject) => {
-    const options = { detached: true, stdio: "ignore", shell: false };
-    const child = plat === "darwin" ? spawn("open", [url], options) : plat === "win32" ? spawn("powershell.exe", [
-      "-NoProfile",
-      "-NonInteractive",
-      "-Command",
-      "Start-Process -FilePath $env:OSEC_BROWSER_LOGIN_URL"
-    ], { ...options, env: { ...process.env, OSEC_BROWSER_LOGIN_URL: url } }) : spawn("xdg-open", [url], options);
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve6();
-    });
-  });
-}
-
 // packages/cli/src/commands/run.ts
 import { writeFile } from "node:fs/promises";
-import { join as join3, resolve as resolve5 } from "node:path";
+import { join, resolve as resolve3 } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // packages/cli/src/formatters/terminal.ts
@@ -2177,7 +697,7 @@ var EVIDENCE_BLOCK_LIMIT = 4e3;
 var POC_STEP_LIMIT = 20;
 function formatMarkdown(report) {
   const lines = [];
-  lines.push("# 0sec Scan Report");
+  lines.push("# 0 Scan Report");
   lines.push("");
   lines.push(`| Field | Value |`);
   lines.push(`|-------|-------|`);
@@ -2434,7 +954,7 @@ function formatHtml(report) {
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
-<title>0sec Report \u2014 ${escapeHtml(report.target)}</title>
+<title>0 Report \u2014 ${escapeHtml(report.target)}</title>
 <style>
   * { margin: 0; padding: 0; box-sizing: border-box; }
   body {
@@ -2698,7 +1218,7 @@ function formatHtml(report) {
   <div class="header">
     <div class="header-top">
       <div>
-        <div class="brand">0SEC</div>
+        <div class="brand">ZERO</div>
         <div class="brand-sub">Security Scan Report</div>
       </div>
       <div class="risk-badge" style="background:${risk.color};color:#fff">${risk.label} RISK</div>
@@ -2739,7 +1259,7 @@ function formatHtml(report) {
   </div>
 
   <div class="footer">
-    Generated by 0sec &middot; ${escapeHtml((/* @__PURE__ */ new Date()).toISOString())}
+    Generated by 0 &middot; ${escapeHtml((/* @__PURE__ */ new Date()).toISOString())}
   </div>
 </body>
 </html>`;
@@ -2875,9 +1395,9 @@ function formatSarif(report) {
       {
         tool: {
           driver: {
-            name: "0sec",
+            name: "0",
             version: VERSION,
-            informationUri: "https://github.com/0sec-labs/0sec",
+            informationUri: "https://github.com/0sec-labs/0",
             rules: Array.from(rulesMap.values())
           }
         },
@@ -2953,13 +1473,13 @@ function truncate(text, maxLen) {
 async function generatePdfReport(report, outputPath) {
   const require_ = createRequire(import.meta.url);
   const PDFDocument = require_("pdfkit");
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve4, reject) => {
     const doc = new PDFDocument({
       size: "LETTER",
       margins: { top: PAGE_MARGIN, bottom: PAGE_MARGIN, left: PAGE_MARGIN, right: PAGE_MARGIN },
       info: {
-        Title: `0sec Pentest Report - ${report.target}`,
-        Author: "0sec",
+        Title: `0 Pentest Report - ${report.target}`,
+        Author: "0",
         Subject: "Automated Penetration Test Report",
         CreationDate: /* @__PURE__ */ new Date()
       },
@@ -2967,7 +1487,7 @@ async function generatePdfReport(report, outputPath) {
     });
     const stream = createWriteStream(outputPath);
     stream.on("error", reject);
-    stream.on("finish", resolve6);
+    stream.on("finish", resolve4);
     doc.pipe(stream);
     renderCoverPage(doc, report);
     renderExecutiveSummary(doc, report);
@@ -2980,7 +1500,7 @@ async function generatePdfReport(report, outputPath) {
 }
 function renderCoverPage(doc, report) {
   doc.rect(0, 0, 612, 792).fill(COLORS.primary);
-  doc.fontSize(48).font("Helvetica-Bold").fillColor(COLORS.accent).text("0sec", PAGE_MARGIN, 200, { align: "center" });
+  doc.fontSize(48).font("Helvetica-Bold").fillColor(COLORS.accent).text("0", PAGE_MARGIN, 200, { align: "center" });
   doc.fontSize(14).font("Helvetica").fillColor(COLORS.white).text("Automated Penetration Test Report", PAGE_MARGIN, 260, { align: "center" });
   doc.moveTo(200, 300).lineTo(412, 300).strokeColor(COLORS.accent).lineWidth(2).stroke();
   doc.fontSize(18).font("Helvetica-Bold").fillColor(COLORS.white).text(report.target, PAGE_MARGIN, 330, { align: "center" });
@@ -3107,7 +1627,7 @@ function renderMethodology(doc, report) {
   doc.addPage();
   sectionTitle(doc, "Methodology");
   doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(
-    "This report was generated by 0sec, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.",
+    "This report was generated by 0, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.",
     PAGE_MARGIN,
     doc.y + 10,
     { width: CONTENT_WIDTH }
@@ -3184,7 +1704,7 @@ function renderFooters(doc) {
     doc.switchToPage(i);
     if (i === 0) continue;
     doc.fontSize(8).font("Helvetica").fillColor(COLORS.textLight).text(
-      `0sec Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`,
+      `0 Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`,
       PAGE_MARGIN,
       760,
       { width: CONTENT_WIDTH, align: "center" }
@@ -3194,7 +1714,7 @@ function renderFooters(doc) {
 
 // packages/cli/src/formatters/replay.ts
 function sleep(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
 }
 function stripAnsi(s) {
   return s.replace(/\x1b\[[0-9;]*m/g, "");
@@ -3383,7 +1903,7 @@ function buildReplayLines(data) {
   const duration = data.durationMs < 1e3 ? `${data.durationMs}ms` : `${(data.durationMs / 1e3).toFixed(1)}s`;
   lines.push({
     text: boxRow(
-      source_default.white(`Completed in ${duration}`) + source_default.dim(" \u2192 ") + source_default.gray("./0sec-report.json")
+      source_default.white(`Completed in ${duration}`) + source_default.dim(" \u2192 ") + source_default.gray("./0-report.json")
     ),
     delay: MED
   });
@@ -3394,7 +1914,7 @@ async function renderReplay(data) {
   const lines = buildReplayLines(data);
   process.stdout.write("\n");
   process.stdout.write(
-    source_default.red.bold("  \u25C6 0sec") + source_default.gray(" attack replay") + "\n"
+    source_default.red.bold("  \u25C6 0") + source_default.gray(" attack replay") + "\n"
   );
   process.stdout.write(
     source_default.dim("  " + "\u2500".repeat(BOX_WIDTH + 1)) + "\n"
@@ -3619,8 +2139,8 @@ var coreModulePromise = null;
 async function loadCoreModule() {
   if (!coreModulePromise) {
     const srcUrl = new URL("../../../core/src/index.ts", import.meta.url);
-    const srcExists = process.versions.bun && existsSync3(fileURLToPath(srcUrl));
-    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-4YICS2J2.js");
+    const srcExists = process.versions.bun && existsSync2(fileURLToPath(srcUrl));
+    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-3FNZIBB4.js");
   }
   return coreModulePromise;
 }
@@ -3664,16 +2184,8 @@ function getTargetType(report, opts) {
   return report?.targetType ?? opts.targetType;
 }
 function emitResultLine(payload) {
-  if (process.env["0SEC_EMIT_RESULT_LINE"] !== "1" && !process.env["0SEC_CLOUD_SINK"]) return;
-  console.log(`0SEC_RESULT=${JSON.stringify(payload)}`);
-}
-function getCloudFinalSinkConfig() {
-  if (process.env["0SEC_FEATURE_CLOUD_SINK"] === "0") return null;
-  const sinkUrl = process.env["0SEC_CLOUD_SINK"]?.trim();
-  const scanId = process.env["0SEC_CLOUD_SCAN_ID"]?.trim();
-  if (!sinkUrl || !scanId) return null;
-  const token = process.env["0SEC_CLOUD_TOKEN"]?.trim() || void 0;
-  return { sinkUrl, scanId, token };
+  if (process.env["ZERO_EMIT_RESULT_LINE"] !== "1") return;
+  console.log(`ZERO_RESULT=${JSON.stringify(payload)}`);
 }
 function isCostBreakdownEntry(value) {
   if (!value || typeof value !== "object") return false;
@@ -3746,55 +2258,6 @@ function printCrossValidatedLeads(summary) {
     console.log(source_default.gray(`  +${summary.moreCount} more`));
   }
 }
-async function postFinalResultToCloud(report) {
-  const config = getCloudFinalSinkConfig();
-  if (!config) return;
-  const url = `${config.sinkUrl.replace(/\/+$/, "")}/scans/${encodeURIComponent(config.scanId)}/findings`;
-  const headers = {
-    "Content-Type": "application/json",
-    "X-0sec-Scan-Id": config.scanId
-  };
-  if (config.token) headers.Authorization = `Bearer ${config.token}`;
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ report, final: true })
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      process.stderr.write(
-        `[0sec cloud-sink] report POST ${url} returned ${res.status}: ${text.slice(0, 200)}
-`
-      );
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`[0sec cloud-sink] report POST ${url} failed: ${msg}
-`);
-  }
-}
-function skippedLensReviewReport(target, message) {
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  return {
-    target,
-    scanDepth: "deep",
-    startedAt: now,
-    completedAt: now,
-    durationMs: 0,
-    summary: {
-      totalAttacks: 0,
-      totalFindings: 0,
-      critical: 0,
-      high: 0,
-      medium: 0,
-      low: 0,
-      info: 0
-    },
-    findings: [],
-    warnings: [{ stage: "attack", message }]
-  };
-}
 async function runUnified(opts) {
   const { target, depth, format, runtime, timeout } = opts;
   const core = await loadCoreModule();
@@ -3804,7 +2267,7 @@ async function runUnified(opts) {
       console.error(source_default.red("--branch-from requires --resume <run-id>"));
       process.exit(2);
     }
-    const { branchJournal } = await import("./dist-4YICS2J2.js");
+    const { branchJournal } = await import("./dist-3FNZIBB4.js");
     const result = branchJournal({
       runId: effectiveResumeScanId,
       fromEntry: opts.branchFromEntry
@@ -3840,7 +2303,7 @@ async function runUnified(opts) {
     console.error(source_default.red(`Unknown runtime '${runtime}'. Valid: ${validRuntimes.join(", ")}`));
     process.exit(2);
   }
-  const directCodexProviderConfigured = runtime === "codex" && (!!process.env["0SEC_CHATGPT_ACCESS_TOKEN"]?.trim() || !!process.env["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"]?.trim());
+  const directCodexProviderConfigured = runtime === "codex" && (!!process.env["ZERO_CHATGPT_ACCESS_TOKEN"]?.trim() || !!process.env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]?.trim());
   if (runtime !== "api" && runtime !== "auto" && !directCodexProviderConfigured) {
     const rt = core.createRuntime({ type: runtime, timeout });
     const available = await rt.isAvailable();
@@ -3859,9 +2322,9 @@ async function runUnified(opts) {
     if (opts.sessionUiFactory) {
       inkUI = await opts.sessionUiFactory({ target, depth, mode });
     } else {
-      const { isBunRuntime } = await import("./runtime-J7PLXZNM.js");
+      const { isBunRuntime } = await import("./runtime-XFWJTBUO.js");
       if (isBunRuntime()) {
-        const { createOpenTuiSession } = await import("./run-D56MPDKY.js");
+        const { createOpenTuiSession } = await import("./run-U3XU4CTC.js");
         const availability = await getRuntimeAvailability();
         inkUI = await createOpenTuiSession({
           target,
@@ -3875,7 +2338,7 @@ async function runUnified(opts) {
           model: opts.model
         });
       } else {
-        const { renderScanStream } = await import("./scan-stream-FHI2FYZE.js");
+        const { renderScanStream } = await import("./scan-stream-BMOCPKQX.js");
         inkUI = renderScanStream({ version: VERSION, target, depth, mode });
       }
     }
@@ -3883,44 +2346,8 @@ async function runUnified(opts) {
     getPendingUserMessages = inkUI.getPendingUserMessages;
   }
   try {
-    let runnerExitCode = 0;
     let report;
-    if (opts.targetType === "source-code" && opts.reviewStrategy === "lenses") {
-      eventHandler({
-        type: "stage:start",
-        stage: "source-analysis",
-        message: "capturing the validated finder-lens snapshot"
-      });
-      const outcome = await runDeepReview({
-        target,
-        profile: opts.reviewProfile,
-        subsystem: opts.subsystem,
-        models: opts.model ? [opts.model] : void 0,
-        runtime,
-        timeoutMs: timeout,
-        costCeilingUsd: opts.costCeilingUsd,
-        log: (message) => eventHandler({
-          type: "stage:start",
-          stage: "attack",
-          message
-        })
-      });
-      runnerExitCode = outcome.exitCode;
-      const lensReport = outcome.report ?? skippedLensReviewReport(
-        target,
-        typeof outcome.result === "object" && outcome.result !== null && "note" in outcome.result ? String(outcome.result.note) : `lens review ended with exit code ${outcome.exitCode}`
-      );
-      report = lensReport;
-      writeOsecRunReport(
-        resolveOsecRunStorage({ ...opts.dbPath ? { dbPath: opts.dbPath } : {} }),
-        lensReport
-      );
-      eventHandler({
-        type: "stage:end",
-        stage: "attack",
-        message: outcome.exitCode === 0 ? "validated finder-lens review completed" : `validated finder-lens review ended with exit code ${outcome.exitCode}`
-      });
-    } else if (opts.targetType === "url" || opts.targetType === "web-app") {
+    if (opts.targetType === "url" || opts.targetType === "web-app") {
       report = await core.agenticScan({
         config: {
           target,
@@ -3986,16 +2413,13 @@ async function runUnified(opts) {
     }
     const reportAny = report;
     const canonicalReport = toScanReport(report);
-    if (opts.targetType !== "url" && opts.targetType !== "web-app") {
-      await postFinalResultToCloud(reportAny);
-    }
     if (inkUI) {
       inkUI.setReport(report);
       await inkUI.waitForExit();
     } else {
       if (format === "html" || format === "pdf") {
         const extension = format === "pdf" ? "pdf" : "html";
-        const filePath = opts.reportPath ? resolve5(opts.reportPath) : join3(tmpdir(), `0sec-report-${Date.now()}.${extension}`);
+        const filePath = opts.reportPath ? resolve3(opts.reportPath) : join(tmpdir(), `0-report-${Date.now()}.${extension}`);
         if (format === "pdf") {
           await generatePdfReport(toScanReport(reportAny), filePath);
         } else {
@@ -4015,7 +2439,7 @@ async function runUnified(opts) {
       console.log("");
       console.log(source_default.gray("  --tui post-scan view is no longer bundled in the npm package."));
       console.log(source_default.gray("  Install the standalone binary for the full OpenTUI experience:"));
-      console.log(source_default.gray("    curl -fsSL https://raw.githubusercontent.com/0sec-labs/0sec/main/install.sh | bash"));
+      console.log(source_default.gray("    curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash"));
       console.log("");
     }
     if (crossValidatedLeads) {
@@ -4025,14 +2449,14 @@ async function runUnified(opts) {
       printCostSummary(scanCompletedCost);
     }
     unsubscribeCost();
-    let exitCode = runnerExitCode;
+    let exitCode = 0;
     const estimatedCostUsd = getEstimatedCost(reportAny);
     const usage = getUsage(reportAny);
     if (opts.emit === "pr") {
       const findings = report.findings ?? [];
       const core2 = await loadCoreModule();
-      const repoRoot = opts.targetType === "source-code" && existsSync3(target) ? resolve5(target) : process.cwd();
-      const outDir = opts.emitOutDir ?? join3(tmpdir(), `0sec-emit-${Date.now()}`);
+      const repoRoot = opts.targetType === "source-code" && existsSync2(target) ? resolve3(target) : process.cwd();
+      const outDir = opts.emitOutDir ?? join(tmpdir(), `0-emit-${Date.now()}`);
       console.log(source_default.blue(`[emit pr] ${findings.length} finding(s); repo=${repoRoot} base=${opts.emitPrBase ?? "main"}${opts.emitPrDryRun ? " (dry-run)" : ""}`));
       const emitReport = await core2.emitFindingsAsPRs(findings, {
         repoRoot,
@@ -4063,7 +2487,7 @@ async function runUnified(opts) {
       if (findings.length === 0) {
         console.log(source_default.yellow("No findings to export."));
       } else {
-        const { exportToGitHubIssues } = await import("./github-issues-MJ6OYOOU.js");
+        const { exportToGitHubIssues } = await import("./github-issues-IGTTWM7V.js");
         console.log(source_default.blue(`Exporting ${findings.length} finding(s) to GitHub Issues on ${repo}...`));
         const result = await exportToGitHubIssues(findings, repo);
         console.log(
@@ -4071,7 +2495,7 @@ async function runUnified(opts) {
         );
       }
     }
-    const ceilingRaw = process.env["0SEC_COST_CEILING_USD"]?.trim();
+    const ceilingRaw = process.env["ZERO_COST_CEILING_USD"]?.trim();
     if (ceilingRaw) {
       const ceiling = Number(ceilingRaw);
       if (Number.isFinite(ceiling) && estimatedCostUsd !== void 0 && estimatedCostUsd > ceiling) {
@@ -4143,13 +2567,18 @@ var DEFAULT_ENCODED_RUN_MAX = 140;
 var ENCODED_RUN_MAX_CAP = 1e6;
 var ELLIPSIS = "...";
 var ENCODED_PLACEHOLDER = "[encoded payload omitted]";
+var DEFAULT_ENCODED_SEGMENT = new RegExp(`[A-Za-z0-9+_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "g");
+var DEFAULT_ENCODED_DATA_URI = new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "gi");
 function stripTerminalControl(text) {
   return text.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
 }
 function replaceLargeEncodedChunks(text, maxEncodedRun) {
   const normalized = Number.isFinite(maxEncodedRun) ? Math.trunc(maxEncodedRun) : DEFAULT_ENCODED_RUN_MAX;
   const minRun = Math.min(Math.max(32, normalized), ENCODED_RUN_MAX_CAP);
-  return text.replace(new RegExp(`[A-Za-z0-9+/_-]{${minRun},}={0,2}`, "g"), ENCODED_PLACEHOLDER);
+  if (text.length < minRun) return text;
+  const segment = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_SEGMENT : new RegExp(`[A-Za-z0-9+_-]{${minRun},}={0,2}`, "g");
+  const dataUri = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_DATA_URI : new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${minRun},}={0,2}`, "gi");
+  return text.replace(dataUri, `$1${ENCODED_PLACEHOLDER}`).replace(segment, ENCODED_PLACEHOLDER);
 }
 function sanitizeTuiText(value, options = {}) {
   return stripTerminalControl(replaceLargeEncodedChunks(String(value ?? ""), options.maxEncodedRun ?? DEFAULT_ENCODED_RUN_MAX)).replace(/\s+/g, " ").trim();
@@ -4287,20 +2716,6 @@ var SLASH_COMMANDS = [
     category: "info",
     description: "List available tools"
   },
-  {
-    name: "agents",
-    aliases: [],
-    category: "info",
-    description: "List available agents",
-    tuiOnly: true
-  },
-  {
-    name: "harness",
-    aliases: [],
-    category: "navigation",
-    description: "Live harness: views, commands, settings, rollback and workspace trust",
-    tuiOnly: true
-  },
   {
     name: "new-chat",
     aliases: ["new"],
@@ -4308,13 +2723,6 @@ var SLASH_COMMANDS = [
     description: "Create an independent audit using the staged model and connection",
     tuiOnly: true
   },
-  {
-    name: "audits",
-    aliases: [],
-    category: "navigation",
-    description: "Switch between live audits without stopping their work",
-    tuiOnly: true
-  },
   {
     name: "onboard",
     aliases: [],
@@ -4322,14 +2730,6 @@ var SLASH_COMMANDS = [
     description: "Reopen guided setup without replacing the current audit",
     tuiOnly: true
   },
-  {
-    name: "stop",
-    aliases: [],
-    category: "session",
-    description: "Stop this audit's work or one owned worker and its descendants",
-    usage: "/stop audit | /stop worker <exact name or id>",
-    tuiOnly: true
-  },
   // ── session ─────────────────────────────────────────────────────────────
   {
     name: "clear",
@@ -4344,13 +2744,6 @@ var SLASH_COMMANDS = [
     description: "Browse previous scan runs and their results",
     tuiOnly: true
   },
-  {
-    name: "transcript",
-    aliases: ["review"],
-    category: "session",
-    description: "Show this conversation, including tool details",
-    tuiOnly: true
-  },
   {
     name: "findings",
     aliases: ["finds"],
@@ -4359,11 +2752,11 @@ var SLASH_COMMANDS = [
     tuiOnly: true
   },
   {
-    name: "finding",
-    aliases: ["finding-detail"],
+    name: "fix",
+    aliases: [],
     category: "session",
-    description: "Open one finding in full detail to read and act on it",
-    usage: "/finding [id]",
+    description: "Generate a verified local source fix; review before explicitly publishing a draft PR",
+    usage: "/fix [finding-id] | /fix publish <finding-id> | /fix cancel",
     tuiOnly: true
   },
   {
@@ -4383,33 +2776,11 @@ var SLASH_COMMANDS = [
     tuiOnly: true
   },
   {
-    name: "replay",
-    aliases: [],
-    category: "session",
-    description: "Replay a previous turn or session",
-    tuiOnly: true
-  },
-  // ── mode ────────────────────────────────────────────────────────────────
-  {
-    name: "mode",
+    name: "sessions",
     aliases: [],
-    category: "mode",
-    description: "Set Standard (approve actions), Co-pilot (in scope), YOLO (public-network autonomy), or Recon (passive)",
-    usage: "/mode [standard|copilot|yolo|recon]"
-  },
-  {
-    name: "resume",
-    aliases: ["sessions"],
     category: "session",
-    description: "Find and resume saved conversations",
-    usage: "/resume"
-  },
-  {
-    name: "providers",
-    aliases: [],
-    category: "system",
-    description: "Connection: 0sec Cloud, API keys, or provider subscriptions",
-    usage: "/providers",
+    description: "Switch open sessions or resume saved conversations",
+    usage: "/sessions",
     tuiOnly: true
   },
   {
@@ -4423,7 +2794,7 @@ var SLASH_COMMANDS = [
     name: "feedback",
     aliases: [],
     category: "system",
-    description: "Record feedback about 0sec to a local file you control, with optional HTTPS submission",
+    description: "Record feedback about 0 to a local file you control, with optional HTTPS submission",
     usage: "/feedback <message> | /feedback submit <message> | /feedback send | /feedback cancel"
   },
   {
@@ -4452,7 +2823,7 @@ var SLASH_COMMANDS = [
   {
     name: "model",
     aliases: ["models"],
-    category: "mode",
+    category: "session",
     description: "Show or select a model (TUI: applies to New chat)",
     usage: "/model [id]"
   },
@@ -4478,13 +2849,6 @@ var SLASH_COMMANDS = [
     description: "View active and recent operations",
     tuiOnly: true
   },
-  {
-    name: "herd",
-    aliases: ["workers"],
-    category: "navigation",
-    description: "Inspect the active harness worker herd",
-    tuiOnly: true
-  },
   {
     name: "comms",
     aliases: ["messages"],
@@ -4501,9 +2865,9 @@ var SLASH_COMMANDS = [
   },
   {
     name: "connect",
-    aliases: ["login", "auth"],
+    aliases: [],
     category: "navigation",
-    description: "Connect to 0sec Cloud, or use your own API key or provider subscription",
+    description: "Connect your API key or provider subscription",
     usage: "/connect",
     tuiOnly: true
   },
@@ -4605,7 +2969,7 @@ function filterCommands(query) {
 }
 
 // packages/cli/src/console-session.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 
 // packages/cli/src/conversation-history.ts
 var MAX_PAGE_CHARS = 16e3;
@@ -4677,10 +3041,10 @@ function createConversationHistory(options = {}) {
 
 // packages/cli/src/dev-engine-updates.ts
 import { execFile as execFile2 } from "node:child_process";
-import { createHash as createHash3 } from "node:crypto";
-import { appendFileSync, readFileSync as readFileSync4, readdirSync, realpathSync as realpathSync2, statSync as statSync2 } from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { appendFileSync, readFileSync as readFileSync2, readdirSync, realpathSync, statSync } from "node:fs";
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
-import { isAbsolute, join as join4, relative as relative2, sep as sep2 } from "node:path";
+import { isAbsolute, join as join2, relative, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { isDeepStrictEqual, promisify } from "node:util";
 var execute = promisify(execFile2);
@@ -4708,12 +3072,12 @@ function assertSessionContract(session) {
   }
 }
 function sourceDigest(root) {
-  const hash = createHash3("sha256");
+  const hash = createHash2("sha256");
   const visit = (directory) => {
     const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.name.startsWith(".") || Object.hasOwn(ignoredSourceNames, entry.name)) continue;
-      const path = join4(directory, entry.name);
+      const path = join2(directory, entry.name);
       if (entry.isDirectory()) {
         visit(path);
         continue;
@@ -4721,23 +3085,23 @@ function sourceDigest(root) {
       if (!entry.isFile() && !entry.isSymbolicLink() || /\.(test|spec)\.[cm]?[jt]sx?$/.test(entry.name) || entry.name.endsWith(".d.ts")) continue;
       let readable = path;
       if (entry.isSymbolicLink()) {
-        readable = realpathSync2(path);
-        const target = relative2(root, readable);
-        if (target === ".." || target.startsWith(`..${sep2}`) || isAbsolute(target) || !statSync2(readable).isFile()) {
+        readable = realpathSync(path);
+        const target = relative(root, readable);
+        if (target === ".." || target.startsWith(`..${sep}`) || isAbsolute(target) || !statSync(readable).isFile()) {
           throw new Error(`Source links must resolve to files inside the core source tree: ${path}`);
         }
       }
-      hash.update(relative2(root, path)).update("\0").update(readFileSync4(readable)).update("\0");
+      hash.update(relative(root, path)).update("\0").update(readFileSync2(readable)).update("\0");
     }
   };
   visit(root);
   return hash.digest("hex");
 }
 function withDevEngineUpdates(initial, config, closeStore) {
-  const requestedRoot = process.env["0SEC_DEV_SOURCE_ROOT"];
-  const root = requestedRoot ? realpathSync2(requestedRoot) : void 0;
-  if (root && JSON.parse(readFileSync4(join4(root, "packages/core/package.json"), "utf8")).name !== "@0sec/core") {
-    throw new Error("0SEC_DEV_SOURCE_ROOT must identify a 0sec development checkout");
+  const requestedRoot = process.env["ZERO_DEV_SOURCE_ROOT"];
+  const root = requestedRoot ? realpathSync(requestedRoot) : void 0;
+  if (root && JSON.parse(readFileSync2(join2(root, "packages/core/package.json"), "utf8")).name !== "@0/core") {
+    throw new Error("ZERO_DEV_SOURCE_ROOT must identify a 0 development checkout");
   }
   let current = initial;
   let activeDigest;
@@ -4763,15 +3127,15 @@ function withDevEngineUpdates(initial, config, closeStore) {
     let committed = false;
     let pendingHarnessSnapshot;
     try {
-      const source = join4(root, "packages/core/src");
+      const source = join2(root, "packages/core/src");
       const digest = sourceDigest(source);
       if (digest === activeDigest || digest === rejectedDigest) return;
       rejectedDigest = digest;
       notify("Building changed development engine source; the current session remains active until handoff.");
-      const generationRoot = join4(root, "packages/core/.0sec/dev-engines");
+      const generationRoot = join2(root, "packages/core/.0/dev-engines");
       await mkdir(generationRoot, { recursive: true, mode: 448 });
-      directory = await mkdtemp(join4(generationRoot, "generation-"));
-      const result = await execute(process.execPath, [join4(root, "scripts/build-dev-engine.mjs"), source, directory], {
+      directory = await mkdtemp(join2(generationRoot, "generation-"));
+      const result = await execute(process.execPath, [join2(root, "scripts/build-dev-engine.mjs"), source, directory], {
         cwd: root,
         timeout: 12e4,
         maxBuffer: 2 * 1024 * 1024,
@@ -4801,7 +3165,7 @@ function withDevEngineUpdates(initial, config, closeStore) {
       if (!isDeepStrictEqual(comparableCheckpoint(candidate.exportCheckpoint()), comparableCheckpoint(checkpoint))) {
         throw new Error("Candidate engine did not preserve the session checkpoint");
       }
-      const candidateBus = await import(pathToFileURL(join4(directory, "runtime/events/bus.js")).href);
+      const candidateBus = await import(pathToFileURL(join2(directory, "runtime/events/bus.js")).href);
       signal?.throwIfAborted();
       if (closingStarted || !getSettings().allowDevSourceUpdates) throw new Error("Development engine update cancelled before handoff");
       if (!isDeepStrictEqual(current.exportCheckpoint(), checkpoint)) throw new Error("Session changed during candidate preparation; keeping the current engine");
@@ -4879,7 +3243,7 @@ function withDevEngineUpdates(initial, config, closeStore) {
   };
   const devlog = (o) => {
     try {
-      appendFileSync(process.env["0SEC_TUI_LOG"] ?? "/tmp/0sec-tui.log", JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), kind: "dev-engine", ...o }) + "\n");
+      appendFileSync(process.env["ZERO_TUI_LOG"] ?? "/tmp/0-tui.log", JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), kind: "dev-engine", ...o }) + "\n");
     } catch {
     }
   };
@@ -4946,9 +3310,25 @@ function withDevEngineUpdates(initial, config, closeStore) {
 }
 
 // packages/cli/src/console-session.ts
+var CONSOLE_JEV_FEATURES = /* @__PURE__ */ new Set([
+  "browser",
+  "memory",
+  "dedupe",
+  "redteam",
+  "kernel",
+  "crash",
+  "radar",
+  "foxguard"
+]);
+function consoleJevRuntimeFromEnvironment() {
+  const features = [...new Set(
+    (process.env["ZERO_JEV_FEATURES"] ?? "").split(",").map((feature) => feature.trim()).filter((feature) => CONSOLE_JEV_FEATURES.has(feature))
+  )];
+  return toToolContextJevRuntime(createConsoleJevRuntime({ provider: "direct", features }));
+}
 function createLocalConsoleSession(config, dbPath) {
   const db = new osecDB(dbPath);
-  const scanId = config.scanId ?? `console-${randomUUID2()}`;
+  const scanId = config.scanId ?? `console-${randomUUID()}`;
   let ownsScan = false;
   try {
     if (!db.getScan(scanId)) {
@@ -4964,7 +3344,8 @@ function createLocalConsoleSession(config, dbPath) {
       ...config,
       scanId,
       db,
-      conversationHistory: config.conversationHistory ?? createConversationHistory()
+      conversationHistory: config.conversationHistory ?? createConversationHistory(),
+      jevRuntime: config.jevRuntime ?? consoleJevRuntimeFromEnvironment()
     };
     const session = createConsoleSession(engineConfig);
     return withDevEngineUpdates(session, engineConfig, (completed) => {
@@ -4986,6 +3367,29 @@ function createLocalConsoleSession(config, dbPath) {
 
 // packages/cli/src/tui/codex-device-auth.ts
 import { spawn as spawn2 } from "node:child_process";
+
+// packages/cli/src/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function defaultOpenBrowser(url) {
+  const plat = platform();
+  return new Promise((resolve4, reject) => {
+    const options = { detached: true, stdio: "ignore", shell: false };
+    const child = plat === "darwin" ? spawn("open", [url], options) : plat === "win32" ? spawn("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      "Start-Process -FilePath $env:OSEC_BROWSER_LOGIN_URL"
+    ], { ...options, env: { ...process.env, OSEC_BROWSER_LOGIN_URL: url } }) : spawn("xdg-open", [url], options);
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve4();
+    });
+  });
+}
+
+// packages/cli/src/tui/codex-device-auth.ts
 var MAX_VISIBLE_LINES = 8;
 function defaultSpawnCodexDeviceAuth(command, args, options) {
   const child = spawn2(command, args, {
@@ -5001,22 +3405,39 @@ function defaultSpawnCodexDeviceAuth(command, args, options) {
 function startCodexDeviceAuth(options) {
   const env = options.env ?? process.env;
   const launch = options.spawn ?? defaultSpawnCodexDeviceAuth;
+  const openBrowser = options.openBrowser ?? defaultOpenBrowser;
   const lines = [];
   let pending = "";
   let settled = false;
   let cancelled = false;
+  let browserOpened = false;
   const publish = (phase, message) => {
     options.onUpdate({ phase, lines: [...lines], message });
   };
+  const tryOpenBrowser = (text) => {
+    if (browserOpened) return;
+    const rawUrl = text.match(/https:\/\/auth\.openai\.com\/codex\/device[^\s\x1b]*/)?.[0];
+    if (!rawUrl) return;
+    const url = rawUrl.replace(/[),.;]+$/, "");
+    browserOpened = true;
+    void Promise.resolve(openBrowser(url)).catch(() => {
+      lines.push("Could not open a browser automatically; open the URL above.");
+      if (lines.length > MAX_VISIBLE_LINES) lines.shift();
+      publish("running", "Complete the ChatGPT Codex device sign-in in your browser.");
+    });
+  };
   const pushOutput = (chunk) => {
-    const normalized = sanitizeTuiText(`${pending}${chunk.toString("utf8")}`);
-    const parts = normalized.split("\n");
+    const text = chunk.toString("utf8");
+    tryOpenBrowser(text);
+    const raw = `${pending}${text}`;
+    const parts = raw.split(/\r?\n/);
     pending = parts.pop() ?? "";
     for (const line of parts) {
-      const value = line.trim();
+      const value = sanitizeTuiText(line);
       if (value.length === 0) continue;
       lines.push(value);
       if (lines.length > MAX_VISIBLE_LINES) lines.shift();
+      tryOpenBrowser(value);
     }
     publish("running", "Complete the ChatGPT Codex device sign-in in your browser.");
   };
@@ -5052,7 +3473,7 @@ function startCodexDeviceAuth(options) {
       return;
     }
     maybeLoadCodexAuth({ env, home: options.homeDir, force: true });
-    if (!env["0SEC_CHATGPT_ACCESS_TOKEN"] && !env["0SEC_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
+    if (!env["ZERO_CHATGPT_ACCESS_TOKEN"] && !env["ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
       finish("failed", "Codex completed without a readable ChatGPT subscription credential.");
       return;
     }
@@ -5077,8 +3498,6 @@ export {
   TIMELINE_FORMATS,
   isTimelineFormat,
   formatTimeline,
-  registerHuntCommand,
-  registerDeepReviewCommand,
   resolveFindingChatIntent,
   buildFindingChatPrompt,
   buildFindingConsoleCommand,
@@ -5099,10 +3518,7 @@ export {
   watchLensSynthCommand,
   registerLensSynthCommand,
   createLocalConsoleSession,
-  startCodexDeviceAuth,
-  registerAuthCommand,
-  hostedBrowserLoginFlow,
-  runLogin,
   defaultOpenBrowser,
+  startCodexDeviceAuth,
   runUnified
 };