0sec-cli 0.21.4 → 0.22.0

package/chunks/{dist-F6X62TQK.js → dist-3FNZIBB4.js}

@@ -18,8 +18,6 @@ import {
   Cpg,
   CraftMemoryStore,
   CraftStagedOrchestrator,
-  DEFAULT_CALL_TIMEOUT_MS,
-  DEFAULT_HANDSHAKE_TIMEOUT_MS,
   DEFAULT_MAX_TOOL_ITERATIONS,
   DEFAULT_RACE_WIDEN_DELAY_MS,
   DEFAULT_REGISTRY_URL,
@@ -28,14 +26,9 @@ import {
   DEFAULT_TARGET_SUBSYSTEMS,
   DISPATCH2022,
   DISTRO_DEFAULTS,
-  ENABLEMENT_DIR_MODE,
-  ENABLEMENT_DIR_NAME,
-  ENABLEMENT_FILE_MODE,
-  ENABLEMENT_SCHEMA_VERSION,
   EnforcementTracker,
   FEATURE_NAMES,
   FindingMatchObjectiveSchema,
-  FixTemplateRegistry,
   FlagCaptureObjectiveSchema,
   GADGET_FACTORIES,
   GADGET_KINDS,
@@ -65,24 +58,16 @@ import {
   LinuxBootMatrixImportAdapter,
   LinuxKernelResearchAdapter,
   LiveAgenticScanResearchAdapter,
-  MAX_INFLIGHT_CALLS,
   MAX_OBJECTIVE_CHARS,
   MAX_OBJECTIVE_WORDS,
-  MAX_PROTOCOL_ERRORS,
   McpHost,
   MemoryStore,
   MobileStaticResearchAdapter,
   OPT_IN_MOAT_LAYERS,
   ObjectiveOracle,
-  PLUGINS_ROOT_NAME,
-  PLUGIN_DIR_MODE,
-  PLUGIN_ENTRY_FILE,
-  PLUGIN_FILE_MODE,
-  PLUGIN_MANIFEST_FILE,
   PROGRAM_MAGIC,
   PROGRAM_VERSION,
   PathPolicy,
-  PluginHost,
   ProtocolHttpResearchAdapter,
   RECENCY_DENYLIST,
   RECENCY_DETECTORS_ALL,
@@ -118,7 +103,6 @@ import {
   addAttackResult,
   addFinding,
   agenticScan,
-  aggregateCapabilities,
   allocateCandidatesAcrossLanes,
   alreadyFixedInTarget,
   appFixVariantsToSeedFindings,
@@ -146,7 +130,6 @@ import {
   automationVerdict,
   autonomousClimb,
   breakRecordToFinding,
-  buildBranchName,
   buildCandidateJudgePrompt,
   buildCompositionGraph,
   buildConsoleSystemPrompt,
@@ -154,17 +137,12 @@ import {
   buildCraftTargetSpec,
   buildDeepScanPrompt,
   buildGraphSliceHuntContext,
-  buildHypothesesMarkdown,
   buildInvariantHuntContext,
   buildKernelPromotionEnvelope,
   buildKernelVerifyInitialPrompt,
   buildKernelVerifySystemPrompt,
   buildMcpAuditPrompt,
-  buildPluginEnv,
-  buildPrBody,
-  buildPrTitle,
   buildRegistryEntry,
-  buildReproReadme,
   buildSlice,
   buildSourceAnalysisPrompt,
   buildTier1Harness,
@@ -193,7 +171,6 @@ import {
   classifyToolRisk,
   classifyVerifyOutcome,
   clusterCandidates,
-  coerceEnablementRecord,
   compareScorecards,
   compileAndRunReproducer,
   composeGadgetSetup,
@@ -219,7 +196,6 @@ import {
   createConsoleRuntime,
   createConsoleSession,
   createCoreBenchIntegration,
-  createDefaultFixTemplateRegistry,
   createDefaultResearchRegistry,
   createDefaultVariantScan,
   createDockerWebProvisioner,
@@ -258,19 +234,12 @@ import {
   detectBuildSystem,
   detectKasanSplat,
   digestBenchManifest,
-  disable,
   discoverMcpTarget,
   discoverObjectSubset,
   dispatchTableByteLength,
-  emitFindingsAsPRs,
   emitMarkerHelper,
-  emptyEnablement,
   emptyLedger,
-  enable,
-  enablementDir,
-  enablementFilePath,
   encodeProgram,
-  ensurePluginsRoot,
   enumerateAttackSurfaces,
   enumerateTargetModel,
   enumerateTargetModelFromKext,
@@ -318,7 +287,6 @@ import {
   getProgram,
   getStructuredScopes,
   getTechnique,
-  hardCodedSecretTemplate,
   harvestEvidenceText,
   hasLiveAgentState,
   hasValidValidation,
@@ -335,17 +303,13 @@ import {
   inspectLensRegistry,
   installableFromEntry,
   instantiateGadget,
-  integerTruncationGuardTemplate,
   isConfirmed,
   isCrossLanguageHint,
   isDispatchTableSymbol,
-  isEnabled,
   isHardToFuzzSurface,
   isHypothesisOnly,
   isPlannable,
   isReachablePath,
-  isReproduced,
-  isSafePluginId,
   isVariable,
   judgeCraftCandidatesWithLlm,
   kcsanRaceToBrief,
@@ -354,7 +318,6 @@ import {
   lastGreen,
   lengthBoundaryValues,
   lifetimeTokenSignal,
-  listInstalledPluginIds,
   listMcpTools,
   listObservations,
   listPrograms,
@@ -365,7 +328,6 @@ import {
   loadLedger,
   loadManifest,
   loadVulnsFeedFromDir,
-  loadableIds,
   makeDefaultLensSynthesisModel,
   makeDifferentialGate,
   makeDifferentialOracle,
@@ -387,7 +349,6 @@ import {
   makeTargetTreeLookup,
   makeTemplateRacePocSynth,
   makeWeaponizeHook,
-  manifestDrift,
   mapVerificationToOutcome,
   markProcessed,
   matchCrashSignature,
@@ -397,13 +358,11 @@ import {
   mergeCraftEvidence,
   mineSyzbotQueue,
   mintRootProofChallenge,
-  missingInputValidationTemplate,
   moveFinderLenses,
   moveVerifyLenses,
   mutantBudget,
   mutateStructured,
   mutexSleepWidenGadget,
-  nodeChildSpawner,
   normalizeFrame,
   normalizeStageAction,
   normalizeStageEndDetail,
@@ -447,7 +406,6 @@ import {
   pickChampion,
   planChains,
   planSingleShardRun,
-  pluginsRootDir,
   prepareValidationCorpus,
   preseedMemory,
   primitiveBaselineClass,
@@ -471,11 +429,8 @@ import {
   rankResearchProposals,
   reachabilityGate,
   reachableTargets,
-  readEnablement,
-  readInstalledPlugin,
   readProposalReplay,
   readSeedFindings,
-  reconcile,
   reduceLiveAgentState,
   registerArchetype,
   rejectObservation,
@@ -490,7 +445,6 @@ import {
   renderScoreboard,
   renderSlice,
   renderTriggerSeed,
-  renderUnifiedDiff,
   researchCandidateChangeDigest,
   researchExecutionEvidenceDigest,
   researchExecutionEvidenceRef,
@@ -530,6 +484,7 @@ import {
   runSecondAudit,
   runSecureProject,
   runSelfConsistencyVerify,
+  runSmolvmWorkbench,
   runStaticAnalysis,
   runStructuredVerify,
   runThreatModelPlanner,
@@ -538,7 +493,6 @@ import {
   rungRankingEnabled,
   sameCrash,
   sanitizerOutputFromCraftResult,
-  satisfiesMinVersion,
   saveLedger,
   scaffoldTier1Harness,
   scaffoldTier2Harness,
@@ -582,7 +536,6 @@ import {
   techniquesForBug,
   techniquesForCategory,
   techniquesForEvent,
-  templateIdForCategory,
   timerfdInterruptGadget,
   toCrossValidatedLeads,
   toHuntCandidate,
@@ -616,28 +569,15 @@ import {
   widenEnvFor,
   withEnvOverrides,
   withVariantFeatureFlags,
-  writeEnablement,
   xnuArtifactDigest
-} from "./chunk-FAH6V4QM.js";
-import {
-  MAX_POC_BYTES,
-  PocFetchError,
-  adaptAndVerify,
-  applyUnifiedDiff,
-  extractInlineCodeBlock,
-  fetchPoc,
-  renderAdaptationPrompt
-} from "./chunk-RF5QGKLR.js";
+} from "./chunk-EGZGZFAH.js";
 import {
   RateLimiter,
   TokenBucket,
   enumerateJsChunkUrls,
   parseRateLimitFlag,
   parseRetryAfter
-} from "./chunk-Y5H6E24H.js";
-import {
-  createLiveHttpSender
-} from "./chunk-GVD6SJGH.js";
+} from "./chunk-LYUAM3TG.js";
 import {
   extractSpecInvariants,
   mapInvariantsToImplementation,
@@ -648,7 +588,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-2WSXFFJZ.js";
+} from "./chunk-RSIUX3RW.js";
 import {
   classifyUserspacePrimitive,
   crashArtifactToFinding,
@@ -664,7 +604,7 @@ import {
   runMemSafetyScan,
   runUserspaceFuzzLoop,
   sniffMemPrimitive
-} from "./chunk-G34QP2XW.js";
+} from "./chunk-TM74SSHC.js";
 import {
   leadToFinding,
   runNpmDynamicDiscovery
@@ -677,7 +617,7 @@ import {
   inProcessProbe,
   localSandboxProvider,
   staticProbe
-} from "./chunk-Z3IKZX3X.js";
+} from "./chunk-23DG5YKS.js";
 import {
   DETECTOR_REGISTRY,
   DETECTOR_REGISTRY_BY_ID,
@@ -706,7 +646,7 @@ import {
   runStrategy,
   runWeaponization,
   selectStrategies
-} from "./chunk-YA4PUM4H.js";
+} from "./chunk-VMRRNRMR.js";
 import {
   BENIGN_MAX_CLASS,
   UPGRADE_MIN_CLASS,
@@ -717,12 +657,21 @@ import {
   isDangerUpgrade,
   maxDangerClass,
   rankDanger
-} from "./chunk-O6SD4A36.js";
+} from "./chunk-DM5C5L5D.js";
+import {
+  MAX_POC_BYTES,
+  PocFetchError,
+  adaptAndVerify,
+  applyUnifiedDiff,
+  extractInlineCodeBlock,
+  fetchPoc,
+  renderAdaptationPrompt
+} from "./chunk-RRD4XXPU.js";
 import {
   applyReachabilityGate,
   classifyPathReachability,
   generateVariantCandidates
-} from "./chunk-TF46UWFU.js";
+} from "./chunk-HUNAPTKV.js";
 import {
   collectScopeFiles,
   countScopeFilesUpTo
@@ -767,7 +716,7 @@ import {
   violationsToHuntPlan,
   witnessAssumptionViolation,
   witnessDualViewContexts
-} from "./chunk-YHWWF4QY.js";
+} from "./chunk-UU7PQP6N.js";
 import {
   CHROMIUM_BARE_WORDS,
   FREEBSD_BARE_KERNEL_WORDS,
@@ -852,65 +801,58 @@ import {
   unresolvedHuntClaims,
   validateHuntClaimRecord,
   validateResearchProposal
-} from "./chunk-E2UOY5PJ.js";
+} from "./chunk-UV5QWZGE.js";
 import {
   ACTION_LOG_ARGS_MAX,
   ACTION_LOG_ARG_VALUE_MAX,
-  ANALYTICS_ENDPOINT,
-  ANALYTICS_LEVEL_ENV,
-  ANALYTICS_SCHEMA_VERSION,
-  ANALYTICS_SENT_LOG_FILENAME,
   BROADCAST_ID,
   BUILTIN_GUARDS,
   CONSERVATIVE_JITTER_MS,
   CONSERVATIVE_RPS,
-  CONTRIBUTION_ENDPOINT,
   DEFAULT_CONCURRENCY,
-  DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
   DEFAULT_MAX_DURATION_MS,
   DEFAULT_MCP_PATHS,
   DEFAULT_SPEC_PATHS,
+  DEFAULT_STEP_TIMEOUT_MS as DEFAULT_STEP_TIMEOUT_MS2,
   DEFAULT_SUBDOMAIN_WORDLIST,
+  DockerRunner,
   ENGAGEMENT_PROFILE_NAMES,
   ExecutablePluginManager,
-  FrameReader,
   HUNT_MEMORY_SCHEMA_VERSION,
   HUNT_REDACTED,
   HuntMemoryStore,
   LiveHarnessHost,
+  LocalShellRunner,
   MAX_BODY_CHARS,
   MAX_CANDIDATES,
   MAX_EXTENSIONS_PER_SESSION,
-  MAX_FRAME_CHARS,
   MAX_GUARDS_PER_EXTENSION,
   MAX_INBOX_MESSAGES,
   MAX_JS_FILES,
   MAX_MANIFEST_BYTES,
-  MAX_RESULT_CHARS,
-  MAX_TOOLS_IN_LIST,
+  MAX_STREAM_CAPTURE_BYTES,
   MAX_TOOLS_PER_EXTENSION,
   MAX_TOOLS_PER_SESSION,
-  PLUGIN_CAPABILITIES,
-  PROTOCOL_VERSION,
-  RESULT_TRUNCATION_MARKER,
-  RunCapture,
-  RunContributionClient,
+  QemuRunner,
   SCOPE_DEPENDENT_BASH_GUARDS,
   SCOPE_GUARDS_INERT_EVENT,
   SELF_EXTENSION_SETTING_DEF,
   STANDARD_RPS,
+  STREAM_EXCERPT_BYTES,
   SelfExtensionRegistry,
+  SmolvmRunner,
   TOOL_DEFINITIONS,
   TodoTracker,
   ToolExecutor,
   ToolHealthTracker,
+  agentTaskLabel,
   aggregateScorecard,
-  analyticsPipeline,
   apiSpecToAssets,
-  appendImprovementLedgerEntry,
   applyAttribution,
   approveEvolutionCandidate,
+  argvForStep,
   assertReadOnlyAction,
+  assertionFromStepExpect,
   attackPrompt,
   authorizeEvolutionArtifact,
   blindVerifyPrompt,
@@ -920,44 +862,32 @@ import {
   buildTodosPayload,
   buildToolCallLogEntry,
   buildToolCallsPayload,
-  canonicalEvolutionJson,
   clampOutboundBody,
-  clampResultContent,
   classifyTakeover,
   clearSkillRegistry,
   composeGuards,
-  configureRunContributionsFromEnvironment,
-  contributionChunkSchema,
-  contributionClientPolicySchema,
-  contributionManifestSchema,
-  contributionPurposeSchema,
-  contributionReceiptSchema,
-  contributionTransitionSchema,
   createDockerEvolutionSandbox,
   createEvolutionCandidate,
   createEvolutionSandbox,
   createSmolvmEvolutionSandbox,
-  currentRunContribution,
+  createSmolvmPocTargetRunner,
   decideAddressing,
-  decodeHostMessage,
   decodeMessage,
-  decodePluginMessage,
   dedupeAssets,
   describeEngagementPosture,
   describeScopeGuards,
   discoveryPrompt,
   drainInbox,
   effectiveFallbackRps,
-  encodeHostMessage,
   encodeMessage,
-  encodePluginMessage,
   enumerateSubdomains,
   enumerateSubdomainsActive,
+  evaluateAssertion,
   evaluateEvolutionCandidate,
   evaluateGate,
   evaluateGuards,
-  evaluateImprovementPromotion,
   evolutionDigest,
+  excerpt,
   executeEvolutionVersion,
   extractAttributionFromScopeJson,
   extractEngagementFromScopeJson,
@@ -966,9 +896,6 @@ import {
   formatJitSkillsInstruction,
   formatScorecardSummary,
   formatUserAgent,
-  gateFlagsFor,
-  getCloudSinkConfig,
-  getConfiguredRunContributionClient,
   getSkillById,
   getToolsForRole,
   getWorkspaceHarnessTrust,
@@ -985,13 +912,10 @@ import {
   isScopeRequired,
   isValidPeerId,
   isWafEvasionLadderEnabled,
-  levelAtLeast,
   listSkillSummaries,
-  loadEvolutionConfigFile,
   loadEvolutionRegistry,
   loadSkillRegistry,
   matchTriggers,
-  maybeSubscribeAnalyticsPipeline,
   mergeHarvestedMisses,
   networkScopeRequiredRefusal,
   newCorrelationId,
@@ -999,32 +923,31 @@ import {
   normalizeDomain,
   parseApiSpec,
   parseEngagementProfileName,
-  parseEvolutionConfig,
   parseHarnessGenerationSpec,
   peekInbox,
+  persistArtifact,
   pinEvolutionVersion,
-  postFinding,
   probeS3Bucket,
   promoteEvolutionVersion,
   proposeEvolutionEdits,
   readToolCallNames,
   recordEvolutionVersion,
-  redactRecordStrings,
   redactSecrets,
   redactedArgsPreview,
   renderInboundMessage,
   reportPrompt,
   researchPrompt,
-  resolveAnalyticsLevel,
   resolveAttribution,
   resolveEngagementProfile,
   resolveEvolutionConfigImage,
   resolveEvolutionImage,
   rollbackEvolutionVersion,
+  runDeterministicReplay,
   runEvolution,
   runJsRecon,
   runNativeAgentLoop,
   runRecon,
+  runSmolvmPocSteps,
   sanitizeReason,
   scopeRequiredRefusal,
   selectEvolutionAlternativeParent,
@@ -1041,26 +964,11 @@ import {
   toolCallPreview,
   tryRecoverPreviousFeedback,
   validateAwsCredentials,
-  validatePluginManifest,
   validateUpdateTodosArgs,
   verifyEvolutionSnapshot,
-  verifyImprovementLedger,
   verifyPrompt,
-  wilson95,
-  withRunContribution
-} from "./chunk-ANDKY54G.js";
-import {
-  DEFAULT_JOURNAL_SIDECAR_THRESHOLD_BYTES,
-  JOURNAL_SCHEMA_VERSION,
-  branchJournal,
-  createJournalWriter,
-  defaultJournalRootDir,
-  loadJournal,
-  migrateJournalEntry,
-  rehydrateContext,
-  resolveJournalPaths,
-  streamJournal
-} from "./chunk-CAJJRUTV.js";
+  wilson95
+} from "./chunk-SJBCK2EI.js";
 import "./chunk-K2PWUPUI.js";
 import {
   IntelCache,
@@ -1093,7 +1001,7 @@ import {
   searchTargetHistory,
   toGraphSnapshot,
   toOsvEcosystem
-} from "./chunk-SBMB4OL3.js";
+} from "./chunk-TZFIAMWZ.js";
 import {
   parseSanitizerLog,
   renderSanitizerVerdict
@@ -1106,6 +1014,18 @@ import {
   rungAtLeast,
   rungRank
 } from "./chunk-UEX7PFSE.js";
+import {
+  DEFAULT_JOURNAL_SIDECAR_THRESHOLD_BYTES,
+  JOURNAL_SCHEMA_VERSION,
+  branchJournal,
+  createJournalWriter,
+  defaultJournalRootDir,
+  loadJournal,
+  migrateJournalEntry,
+  rehydrateContext,
+  resolveJournalPaths,
+  streamJournal
+} from "./chunk-OAYUPGF6.js";
 import {
   defaultDmesgOutPath,
   detectOutOfBandModuleLoad,
@@ -1113,33 +1033,85 @@ import {
   prepareKernelVmArtifacts,
   verifyKernelFinding,
   writeProofFileReadOnly
-} from "./chunk-5T6D5BVY.js";
+} from "./chunk-XFCTUKXR.js";
 import {
-  evaluateVerificationSpec,
-  runSourceFix
-} from "./chunk-GIQKESMN.js";
-import "./chunk-PD2BBBKT.js";
+  FixTemplateRegistry,
+  buildBranchName,
+  buildHypothesesMarkdown,
+  buildPrBody,
+  buildPrTitle,
+  buildReproReadme,
+  createDefaultFixTemplateRegistry,
+  emitFindingsAsPRs,
+  hardCodedSecretTemplate,
+  integerTruncationGuardTemplate,
+  isReproduced,
+  loadSourceFixProjectInputs,
+  missingInputValidationTemplate,
+  planSourceFixPublication,
+  publishSourceFixDraftPR,
+  renderUnifiedDiff,
+  resolveSourceFixRepository,
+  runSourceFix,
+  saveSourceFixProjectInputs,
+  templateIdForCategory
+} from "./chunk-HR2TU42B.js";
 import {
-  DEFAULT_STEP_TIMEOUT_MS as DEFAULT_STEP_TIMEOUT_MS2,
-  DockerRunner,
-  LocalShellRunner,
-  MAX_STREAM_CAPTURE_BYTES,
-  QemuRunner,
-  STREAM_EXCERPT_BYTES,
-  argvForStep,
-  assertionFromStepExpect,
-  evaluateAssertion,
-  excerpt,
-  persistArtifact,
-  runDeterministicReplay
-} from "./chunk-WF5W75WY.js";
-import "./chunk-QZVG3BG4.js";
+  ANALYTICS_ENDPOINT,
+  ANALYTICS_LEVEL_ENV,
+  ANALYTICS_SCHEMA_VERSION,
+  ANALYTICS_SENT_LOG_FILENAME,
+  CONTRIBUTION_ENDPOINT,
+  CloudAuthError,
+  CloudAuthMissingError,
+  DEFAULT_CLOUD_HOST,
+  DEFAULT_IMPROVEMENT_PROMOTION_POLICY,
+  DEFAULT_WORKBENCH_BROKER_LIMITS,
+  RunCapture,
+  RunContributionClient,
+  analyticsPipeline,
+  appendImprovementLedgerEntry,
+  approveSmolvmWorkbenchImage,
+  canonicalEvolutionJson,
+  configureRunContributionsFromEnvironment,
+  contributionChunkSchema,
+  contributionClientPolicySchema,
+  contributionManifestSchema,
+  contributionPurposeSchema,
+  contributionReceiptSchema,
+  contributionTransitionSchema,
+  currentRunContribution,
+  evaluateImprovementPromotion,
+  evaluateVerificationSpec,
+  eventBus,
+  getConfiguredRunContributionClient,
+  getSmolvmWorkbenchStatus,
+  getWorkbenchBrokerLimits,
+  isAdmittedSmolvmWorkbench,
+  levelAtLeast,
+  loadCloudCredentials,
+  loadEvolutionConfigFile,
+  maybeSubscribeAnalyticsPipeline,
+  parseEvolutionConfig,
+  presentationEventSink,
+  redactRecordStrings,
+  resolveAnalyticsLevel,
+  resolveSmolvmRuntime,
+  resolveWorkbenchBrokerImage,
+  runWorkbenchBrokerProgram,
+  startWorkbenchBroker,
+  verifyImprovementLedger,
+  withRunContribution
+} from "./chunk-RE5EZDG2.js";
 import {
   generateConformanceModel,
   judgeHttpDivergence,
   runHttpConformanceCheck,
   structurallyValidateConformanceModel
 } from "./chunk-SQCBHFWN.js";
+import {
+  createLiveHttpSender
+} from "./chunk-GVD6SJGH.js";
 import {
   DEFAULT_ENSEMBLE_MODELS,
   OpenRouterRuntime,
@@ -1148,17 +1120,10 @@ import {
   detectAvailableRuntimes,
   getRuntimeInfo,
   pickRuntimeForStage
-} from "./chunk-NDJU5ZZ7.js";
+} from "./chunk-5MWAG3FT.js";
 import {
   ProcessRuntime
-} from "./chunk-ER3SUMYJ.js";
-import {
-  cloudEventSink,
-  eventBus,
-  isCloudEventSinkActive,
-  maybeSubscribeCloudEventSink,
-  presentationEventSink
-} from "./chunk-CXKDWFNO.js";
+} from "./chunk-W6UWZFKL.js";
 import {
   AD_ANALYZERS_BY_ID,
   buildAdGraph,
@@ -1259,7 +1224,7 @@ import {
   tier0TargetIds,
   tokenFingerprint,
   writebackEnabled
-} from "./chunk-P6YG6TEZ.js";
+} from "./chunk-DKSCN2AB.js";
 import {
   AD_ANALYZERS,
   AD_EDGE_TECHNIQUES,
@@ -1278,13 +1243,11 @@ import {
   reachableTo,
   shortestPaths
 } from "./chunk-UFHN6RIU.js";
-import "./chunk-WZISK5VC.js";
+import "./chunk-VNRY6AWF.js";
 import {
-  DEFAULT_STEP_TIMEOUT_MS,
   DISCLOSURE_STATUSES,
   IllegalTransitionError,
   IncompleteEvidenceError,
-  MAX_CAPTURE_BYTES,
   PUBLIC_STATUSES,
   TERMINAL_STATUSES,
   UnreproducedFindingError,
@@ -1301,7 +1264,6 @@ import {
   dropSlug,
   droppedFilename,
   evidenceKindForFinding,
-  executePocSteps,
   extractSiblingFix,
   formatDroppedReason,
   isDisclosureWorthy,
@@ -1310,9 +1272,14 @@ import {
   renderExploitScreenshot,
   renderReproducibilityManifest,
   renderVendorNotificationMarkdown,
-  setRuntimeDeps,
   transition
-} from "./chunk-VOAXLO4A.js";
+} from "./chunk-TO35Y326.js";
+import {
+  DEFAULT_STEP_TIMEOUT_MS,
+  MAX_CAPTURE_BYTES,
+  executePocSteps,
+  setRuntimeDeps
+} from "./chunk-IXT64DV5.js";
 import {
   Cvss4ParseError,
   EmptyPocError,
@@ -1336,7 +1303,7 @@ import {
   suggestCvss4,
   suggestCwesForCategory,
   verifyAgainstRef
-} from "./chunk-W4JOXE4N.js";
+} from "./chunk-UELXHK2Y.js";
 import {
   classifyReferences,
   findCveArtifacts,
@@ -1350,7 +1317,7 @@ import {
   parseUbuntuTracker,
   scoreCodeCandidate,
   scoreRepoCandidate
-} from "./chunk-WPQLBN4S.js";
+} from "./chunk-LPTRPRZR.js";
 import {
   detectTargetType,
   expandHomePath,
@@ -1362,23 +1329,72 @@ import {
 import "./chunk-4VGLO2YS.js";
 import "./chunk-6YNKRUMC.js";
 import {
+  BUILTIN_PLUGINS,
+  DEFAULT_CALL_TIMEOUT_MS,
+  DEFAULT_HANDSHAKE_TIMEOUT_MS,
+  ENABLEMENT_DIR_MODE,
+  ENABLEMENT_DIR_NAME,
+  ENABLEMENT_FILE_MODE,
+  ENABLEMENT_SCHEMA_VERSION,
+  FrameReader,
+  MAX_FRAME_CHARS,
+  MAX_INFLIGHT_CALLS,
+  MAX_PROTOCOL_ERRORS,
+  MAX_RESULT_CHARS,
+  MAX_TOOLS_IN_LIST,
+  PLUGINS_ROOT_NAME,
+  PLUGIN_CAPABILITIES,
+  PLUGIN_DIR_MODE,
+  PLUGIN_ENTRY_FILE,
+  PLUGIN_FILE_MODE,
+  PLUGIN_MANIFEST_FILE,
+  PROTOCOL_VERSION,
+  PluginHost,
+  RESULT_TRUNCATION_MARKER,
+  SCOPE_PLUGIN_ID,
   ScopePolicy,
+  aggregateCapabilities,
+  buildPluginEnv,
+  clampResultContent,
+  coerceEnablementRecord,
+  decodeHostMessage,
+  decodePluginMessage,
+  disable,
+  emptyEnablement,
+  enable,
+  enablementDir,
+  enablementFilePath,
+  encodeHostMessage,
+  encodePluginMessage,
+  ensurePluginsRoot,
   extractUrls,
+  gateFlagsFor,
+  getBuiltinPlugin,
+  getScopeEnforcementState,
+  isEnabled,
+  isSafePluginId,
+  isScopeEnforcementEnabled,
+  listInstalledPluginIds,
   loadScope,
-  matchUrl
-} from "./chunk-CGHCEN7W.js";
+  loadableIds,
+  manifestDrift,
+  matchUrl,
+  nodeChildSpawner,
+  pluginsRootDir,
+  readEnablement,
+  readInstalledPlugin,
+  reconcile,
+  satisfiesMinVersion,
+  validatePluginManifest,
+  withScopeEnforcement,
+  writeEnablement
+} from "./chunk-7DEHG7YT.js";
+import "./chunk-5IBCBQEH.js";
 import {
+  CodexCatalogRefreshError,
   loadCodexModelCatalog
-} from "./chunk-HPQZHOIU.js";
+} from "./chunk-IO7R7WBM.js";
 import {
-  CloudAuthError,
-  CloudAuthMissingError,
-  CloudClient,
-  CloudError,
-  CloudForbiddenError,
-  CloudNetworkError,
-  CloudUnauthorizedError,
-  DEFAULT_CLOUD_HOST,
   FEATURE_PRESETS,
   LlmApiRuntime,
   MAX_BUFFERED,
@@ -1396,16 +1412,15 @@ import {
   features,
   formatDiagnosticLine,
   isDiagnosticsClaimed,
-  loadCloudCredentials,
   parseUsageLimitReached,
   recentDiagnostics,
   resolveFeaturePreset,
   stderrDiagnosticSink,
   subscribeDiagnostics
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-2GV4HQKE.js";
 import {
   estimateCost
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-76KSBWOQ.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {
@@ -1423,6 +1438,7 @@ export {
   BENIGN_MAX_CLASS,
   BROADCAST_ID,
   BUILTIN_GUARDS,
+  BUILTIN_PLUGINS,
   BenchCaseSchema,
   BenchIntegrationRegistry,
   BenchManifestSchema,
@@ -1442,11 +1458,7 @@ export {
   CONTRIBUTION_ENDPOINT,
   CloudAuthError,
   CloudAuthMissingError,
-  CloudClient,
-  CloudError,
-  CloudForbiddenError,
-  CloudNetworkError,
-  CloudUnauthorizedError,
+  CodexCatalogRefreshError,
   Cpg,
   CraftMemoryStore,
   CraftStagedOrchestrator,
@@ -1469,6 +1481,7 @@ export {
   DEFAULT_STRATEGIES,
   DEFAULT_SUBDOMAIN_WORDLIST,
   DEFAULT_TARGET_SUBSYSTEMS,
+  DEFAULT_WORKBENCH_BROKER_LIMITS,
   DETECTOR_REGISTRY,
   DETECTOR_REGISTRY_BY_ID,
   DISCLOSURE_STATUSES,
@@ -1623,6 +1636,7 @@ export {
   RunContributionClient,
   SCOPE_DEPENDENT_BASH_GUARDS,
   SCOPE_GUARDS_INERT_EVENT,
+  SCOPE_PLUGIN_ID,
   SELF_EXTENSION_SETTING_DEF,
   SEMANTIC_COSMETIC_RUBRIC,
   STAGE_ACTION_HISTORY_CAP,
@@ -1632,6 +1646,7 @@ export {
   ScanCostLedger,
   ScopePolicy,
   SelfExtensionRegistry,
+  SmolvmRunner,
   SourceAuditTargetSchema,
   SuiteOracleObjectiveSchema,
   SuiteTaskTargetSchema,
@@ -1676,6 +1691,7 @@ export {
   addFinding,
   adjudicate,
   advisorySweep,
+  agentTaskLabel,
   agenticScan,
   aggregateCapabilities,
   aggregateScorecard,
@@ -1708,6 +1724,7 @@ export {
   applyVerificationToFinding,
   approveEvolutionCandidate,
   approveObservation,
+  approveSmolvmWorkbenchImage,
   appsecArchetypeDigest,
   appsecArchetypeToFinderLens,
   appsecArchetypesPath,
@@ -1830,7 +1847,6 @@ export {
   classifyUserspacePrimitive,
   classifyVerifyOutcome,
   clearSkillRegistry,
-  cloudEventSink,
   clusterCandidates,
   coerceEnablementRecord,
   collectScopeFiles,
@@ -1901,6 +1917,7 @@ export {
   createScanContext,
   createSessionObjectiveService,
   createSmolvmEvolutionSandbox,
+  createSmolvmPocTargetRunner,
   createStubSignatureVerifier,
   createVariantExecutionFactory,
   createXnuFuzzReceipt,
@@ -2107,18 +2124,21 @@ export {
   generateRemediationWithLLM,
   generateSyzChoiceWeights,
   generateVariantCandidates,
-  getCloudSinkConfig,
+  getBuiltinPlugin,
   getConfiguredRunContributionClient,
   getDetectorById,
   getEvalCategories,
   getObservation,
   getProgram,
   getRuntimeInfo,
+  getScopeEnforcementState,
   getSkillById,
+  getSmolvmWorkbenchStatus,
   getStrategy,
   getStructuredScopes,
   getTechnique,
   getToolsForRole,
+  getWorkbenchBrokerLimits,
   getWorkspaceHarnessTrust,
   grantedPermissionNames,
   guardApprovalUnavailable,
@@ -2169,7 +2189,7 @@ export {
   instantiateGadget,
   integerTruncationGuardTemplate,
   introspectExploitConfig,
-  isCloudEventSinkActive,
+  isAdmittedSmolvmWorkbench,
   isConfirmed,
   isCrossApiAssumption,
   isCrossLanguageHint,
@@ -2191,6 +2211,7 @@ export {
   isReproduced,
   isReproducedMemCorruption,
   isSafePluginId,
+  isScopeEnforcementEnabled,
   isScopeRequired,
   isValidPeerId,
   isVariable,
@@ -2243,6 +2264,7 @@ export {
   loadManifest,
   loadScope,
   loadSkillRegistry,
+  loadSourceFixProjectInputs,
   loadVulnsFeedFromDir,
   loadableIds,
   localMirrors,
@@ -2293,7 +2315,6 @@ export {
   maxMemSeverity,
   maxRung,
   maybeSubscribeAnalyticsPipeline,
-  maybeSubscribeCloudEventSink,
   maybeSubscribeOperationalEventSink,
   memCorruptionVerdict,
   memPrimitiveToCategory,
@@ -2397,11 +2418,11 @@ export {
   planArchetypeSweep,
   planChains,
   planSingleShardRun,
+  planSourceFixPublication,
   planSpecdriftHypotheses,
   planChains as planWebChains,
   pluginsRootDir,
   pocFabricatesSplat,
-  postFinding,
   prepare,
   prepareKernelVmArtifacts,
   prepareValidationCorpus,
@@ -2424,6 +2445,7 @@ export {
   proposeEvolutionEdits,
   provePriming,
   provenExploitabilityScore,
+  publishSourceFixDraftPR,
   queryGitHubAdvisories,
   queryOsvAdvisories,
   raceStrategies,
@@ -2506,7 +2528,10 @@ export {
   resolveMcpEndpoint,
   resolveNovelty,
   resolveRange,
+  resolveSmolvmRuntime,
+  resolveSourceFixRepository,
   resolveTargetHistoryInput,
+  resolveWorkbenchBrokerImage,
   retireArchetype,
   reviewAgentPrompt,
   reviewKernelCrashSubsystems,
@@ -2559,6 +2584,8 @@ export {
   runSecondAudit,
   runSecureProject,
   runSelfConsistencyVerify,
+  runSmolvmPocSteps,
+  runSmolvmWorkbench,
   runSourceFix,
   runSpecdriftPlan,
   runSpecdriftScan,
@@ -2571,6 +2598,7 @@ export {
   runTournament,
   runUserspaceFuzzLoop,
   runWeaponization,
+  runWorkbenchBrokerProgram,
   rungAtLeast,
   rungRankingEnabled,
   sameCrash,
@@ -2578,6 +2606,7 @@ export {
   sanitizerOutputFromCraftResult,
   satisfiesMinVersion,
   saveLedger,
+  saveSourceFixProjectInputs,
   scaffoldTier1Harness,
   scaffoldTier2Harness,
   scan,
@@ -2637,6 +2666,7 @@ export {
   staleHuntClaims,
   stampDeploymentContext,
   startEvolutionCanary,
+  startWorkbenchBroker,
   staticProbe,
   stderrDiagnosticSink,
   storeAssumptionModel,
@@ -2725,6 +2755,7 @@ export {
   wilson95,
   withEnvOverrides,
   withRunContribution,
+  withScopeEnforcement,
   withVariantFeatureFlags,
   witnessAssumptionViolation,
   witnessDualViewContexts,