0sec-cli 0.21.4 → 0.22.0

package/chunks/{chunk-IMGWPNQM.js → chunk-CAYANSH6.js}

@@ -5,15 +5,11 @@ import {
   isValidSessionId,
   listSessions,
   loadSession
-} from "./chunk-NOPBXZUV.js";
+} from "./chunk-MICHDTBK.js";
 import {
-  consolePresentationOutput,
   getSettings,
   maybeLoadCodexAuth
-} from "./chunk-YPOA3W4O.js";
-import {
-  source_default
-} from "./chunk-HLFS6WV2.js";
+} from "./chunk-YIQSGNAA.js";
 import {
   createConsoleJevRuntime,
   createConsoleSession,
@@ -25,49 +21,40 @@ import {
   retireArchetype,
   runLensSynthesisLoop,
   toToolContextJevRuntime
-} from "./chunk-FAH6V4QM.js";
+} from "./chunk-EGZGZFAH.js";
+import {
+  source_default
+} from "./chunk-HLFS6WV2.js";
 import {
   harvestMissesFromLedgerEntry,
   mergeHarvestedMisses
-} from "./chunk-ANDKY54G.js";
+} from "./chunk-SJBCK2EI.js";
 import {
   eventBus
-} from "./chunk-CXKDWFNO.js";
+} from "./chunk-RE5EZDG2.js";
 import {
   listOsecRunDatabasePaths,
   osecDB,
   resolveOsecDbPath
-} from "./chunk-WZISK5VC.js";
+} from "./chunk-VNRY6AWF.js";
 import {
   redactSensitiveHeaders
-} from "./chunk-W4JOXE4N.js";
-import {
-  CloudAuthMissingError,
-  CloudClient,
-  CloudError,
-  CloudForbiddenError,
-  CloudNetworkError,
-  CloudUnauthorizedError,
-  DEFAULT_CLOUD_HOST,
-  loadCloudCredentials
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-UELXHK2Y.js";
 import {
   SEVERITY_RANK,
   VERSION,
-  cloudStateDir,
   createAuditReportDocument,
   createReviewReportDocument,
   createScanReportDocument,
   findingSchema,
   formatZodError,
-  homeStateDir,
   severityRank
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-76KSBWOQ.js";
 
 // packages/cli/src/utils.ts
 import { gzipSync } from "zlib";
 async function getRuntimeAvailability() {
-  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-F6X62TQK.js");
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-3FNZIBB4.js");
   const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
   const hasApiKey = apiRuntimeDiagnostics.valid;
   const availableRuntimes = [...await detectAvailableRuntimes()];
@@ -578,392 +565,12 @@ function registerLensSynthCommand(program) {
   });
 }
 
-// packages/cli/src/commands/auth.ts
-import { spawn } from "node:child_process";
-import { mkdirSync, writeFileSync, chmodSync, unlinkSync, existsSync as existsSync2 } from "node:fs";
-import { homedir, platform } from "node:os";
-import { join } from "node:path";
-import { randomBytes } from "node:crypto";
-import { setTimeout as delay } from "node:timers/promises";
-var EXIT_OK = 0;
-var EXIT_USER_ERROR = 1;
-var EXIT_AUTH = 2;
-var EXIT_NET = 3;
-function registerAuthCommand(program) {
-  const auth = program.command("auth").description("0-cloud authentication");
-  auth.command("login").description("Log in to 0-cloud (opens browser; --token to paste directly)").option("--host <url>", "Cloud host (defaults to ZERO_CLOUD_HOST or production)").option("--token <value>", "Skip the browser flow and persist this token directly").action(async (opts) => {
-    await runLogin(opts);
-  });
-  auth.command("logout").description("Delete credentials for the current Cloud profile").action(() => {
-    runLogout({});
-  });
-  auth.command("status").description("Verify 0-cloud credentials and account access").action(async () => {
-    await runStatus({});
-  });
-}
-async function hostedBrowserLoginFlow(opts = {}) {
-  const host = normaliseHostArg(opts.host ?? process.env["ZERO_CLOUD_HOST"] ?? DEFAULT_CLOUD_HOST);
-  if (host === null) {
-    return { ok: false, error: "Cloud host must be an http(s) URL without credentials, query or fragment." };
-  }
-  const attempts = opts.pollAttempts ?? 150;
-  const intervalMs = opts.pollIntervalMs ?? 2e3;
-  if (!Number.isSafeInteger(attempts) || attempts <= 0 || !Number.isFinite(intervalMs) || intervalMs < 0) {
-    return { ok: false, error: "Invalid sign-in polling budget." };
-  }
-  const cancelled = () => {
-    opts.onStatus?.("cancelled", "Sign-in cancelled.");
-    return { ok: false, error: "Sign-in cancelled.", recoverable: true, cancelled: true };
-  };
-  if (opts.signal?.aborted) return cancelled();
-  const deadline = new AbortController();
-  const timer = setTimeout(() => deadline.abort(), 3e5);
-  const signal = opts.signal ? AbortSignal.any([opts.signal, deadline.signal]) : deadline.signal;
-  const session = randomBytes(9).toString("base64url").slice(0, 12);
-  const loginUrl = `${host}/cli-auth?session=${session}`;
-  const pollUrl = `${host}/cli-auth/sessions/${session}`;
-  const timedOut = () => {
-    opts.onStatus?.("timeout", "Sign-in timed out. Try again.");
-    return { ok: false, error: "Sign-in timed out. Try again.", recoverable: true };
-  };
-  try {
-    opts.onStatus?.("opening", "Opening browser for 0cloud sign-in.", loginUrl);
-    signal.throwIfAborted();
-    try {
-      await awaitLoginStep(Promise.resolve().then(() => {
-        signal.throwIfAborted();
-        return (opts.openBrowser ?? defaultOpenBrowser)(loginUrl);
-      }), signal);
-    } catch {
-      signal.throwIfAborted();
-      opts.onStatus?.("opener-failed", "Could not open a browser. Open this sign-in URL manually.", loginUrl);
-    }
-    const fetcher = opts.fetchImpl ?? fetch;
-    for (let i = 0; i < attempts; i++) {
-      signal.throwIfAborted();
-      opts.onStatus?.("polling", "Waiting for browser sign-in.", loginUrl);
-      signal.throwIfAborted();
-      await awaitLoginStep(
-        opts.sleep ? opts.sleep(intervalMs) : delay(intervalMs, void 0, { signal }),
-        signal
-      );
-      signal.throwIfAborted();
-      const request = new AbortController();
-      const requestTimer = setTimeout(() => request.abort(), 1e4);
-      const requestSignal = AbortSignal.any([signal, request.signal]);
-      try {
-        let res;
-        try {
-          res = await awaitLoginStep(fetcher(pollUrl, {
-            method: "GET",
-            headers: { Accept: "application/json" },
-            signal: requestSignal,
-            redirect: "error"
-          }), requestSignal);
-        } catch {
-          signal.throwIfAborted();
-          continue;
-        }
-        signal.throwIfAborted();
-        if (res.status === 200) {
-          let body;
-          try {
-            body = await awaitLoginStep(res.json(), requestSignal);
-          } catch {
-            signal.throwIfAborted();
-            if (requestSignal.aborted) continue;
-            return { ok: false, error: "Login response was not valid JSON." };
-          }
-          signal.throwIfAborted();
-          const rawStatus = body && typeof body === "object" ? body.status : void 0;
-          const status = sessionStatus(body);
-          const token = extractToken(body);
-          if (token) {
-            if (rawStatus !== void 0 && status !== "ready") {
-              return { ok: false, error: "Login returned credentials before the session was ready." };
-            }
-            try {
-              persistCredentials(host, token, opts.homeDir);
-            } catch {
-              return { ok: false, error: "Could not save 0cloud credentials." };
-            }
-            opts.onStatus?.("ready", "Signed in to 0cloud.");
-            return { ok: true, host };
-          }
-          if (status === "pending") continue;
-          if (status === "expired") return { ok: false, error: "Sign-in request expired. Try again.", recoverable: true };
-          return { ok: false, error: "Login response did not contain valid credentials." };
-        }
-        if ([202, 204, 404].includes(res.status)) continue;
-        if (res.status === 410) return { ok: false, error: "Sign-in request expired. Try again.", recoverable: true };
-        return {
-          ok: false,
-          error: `0cloud sign-in unavailable (HTTP ${res.status}). Use your own provider or try again later.`,
-          recoverable: res.status === 429 || res.status >= 500
-        };
-      } finally {
-        clearTimeout(requestTimer);
-        request.abort();
-      }
-    }
-    return timedOut();
-  } catch (error) {
-    if (opts.signal?.aborted) return cancelled();
-    if (deadline.signal.aborted) return timedOut();
-    throw error;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function awaitLoginStep(operation, signal) {
-  return new Promise((resolve4, reject) => {
-    const onAbort = () => {
-      signal.removeEventListener("abort", onAbort);
-      reject(signal.reason);
-    };
-    operation.then(
-      (value) => {
-        signal.removeEventListener("abort", onAbort);
-        resolve4(value);
-      },
-      (error) => {
-        signal.removeEventListener("abort", onAbort);
-        reject(error);
-      }
-    );
-    if (signal.aborted) onAbort();
-    else signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function runLogin(opts) {
-  const host = normaliseHostArg(opts.host ?? process.env["ZERO_CLOUD_HOST"] ?? DEFAULT_CLOUD_HOST);
-  if (host === null) {
-    consolePresentationOutput.stderr(source_default.red("Error: Cloud host must be an http(s) URL without credentials, query or fragment."), "auth.login.host-error");
-    process.exitCode = EXIT_USER_ERROR;
-    return;
-  }
-  if (opts.token !== void 0) {
-    const tok = opts.token.trim();
-    if (!validCloudToken(tok)) {
-      consolePresentationOutput.stderr(source_default.red("Error: --token must be a nonempty credential without whitespace."), "auth.login.token-empty");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-    try {
-      persistCredentials(host, tok, opts.homeDir);
-    } catch {
-      consolePresentationOutput.stderr(source_default.red("Could not save 0cloud credentials."), "auth.login.save-error");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-    consolePresentationOutput.stdout(`Logged in (host=${host})`, "auth.login.logged-in");
-    process.exitCode = EXIT_OK;
-    return;
-  }
-  const result = await hostedBrowserLoginFlow({
-    host,
-    pollAttempts: opts.pollAttempts,
-    pollIntervalMs: opts.pollIntervalMs,
-    openBrowser: opts.openBrowser,
-    fetchImpl: opts.fetchImpl,
-    homeDir: opts.homeDir,
-    sleep: opts.sleep,
-    onStatus: (phase, msg, url) => {
-      if (phase === "opening") {
-        consolePresentationOutput.stdout(source_default.dim("Opening browser..."), "auth.login.opening");
-        if (url) consolePresentationOutput.stdout(source_default.dim(`  ${url}`), "auth.login.url");
-        consolePresentationOutput.stdout("", "auth.login.empty-line");
-        consolePresentationOutput.stdout(source_default.dim("Complete sign-in in the opened browser, then return here."), "auth.login.browser-hint");
-        consolePresentationOutput.stdout("", "auth.login.empty-line");
-      }
-      if (phase === "opener-failed") {
-        consolePresentationOutput.stderr(source_default.yellow(msg), "auth.login.browser-error");
-      }
-    }
-  });
-  if (result.ok) {
-    consolePresentationOutput.stdout(`Logged in (host=${result.host})`, "auth.login.logged-in");
-    process.exitCode = EXIT_OK;
-  } else {
-    consolePresentationOutput.stderr(source_default.red(result.error), "auth.login.error");
-    process.exitCode = result.recoverable ? EXIT_NET : EXIT_USER_ERROR;
-  }
-}
-function runLogout(opts) {
-  const home = opts.homeDir ?? homedir();
-  const stateDir = cloudStateDir(opts.homeDir);
-  const osecPath = join(stateDir, "cloud.env");
-  const cloudCredsPath = join(home, ".0cloud", "credentials.json");
-  let deletedAny = false;
-  try {
-    unlinkSync(osecPath);
-    deletedAny = true;
-  } catch (err) {
-    const code = err.code;
-    if (code !== "ENOENT") {
-      consolePresentationOutput.stderr(source_default.red(`Could not delete ${osecPath}: ${err instanceof Error ? err.message : String(err)}`), "auth.logout.delete-error");
-      process.exitCode = EXIT_USER_ERROR;
-      return;
-    }
-  }
-  if (stateDir === homeStateDir(opts.homeDir)) {
-    try {
-      unlinkSync(cloudCredsPath);
-      deletedAny = true;
-    } catch (err) {
-      const code = err !== null && typeof err === "object" && "code" in err ? err.code : void 0;
-      if (code !== "ENOENT") {
-        consolePresentationOutput.stderr(source_default.red(`Could not delete ${cloudCredsPath}: ${err instanceof Error ? err.message : String(err)}`), "auth.logout.delete-error");
-        process.exitCode = EXIT_USER_ERROR;
-        return;
-      }
-    }
-  }
-  if (deletedAny) {
-    consolePresentationOutput.stdout("Logged out", "auth.logout.deleted");
-  } else {
-    consolePresentationOutput.stdout("Logged out (no credentials file was present)", "auth.logout.not-found");
-  }
-  process.exitCode = EXIT_OK;
-}
-async function runStatus(opts) {
-  let creds;
-  try {
-    const c = loadCloudCredentials();
-    creds = { host: c.host, token: c.token };
-  } catch (err) {
-    if (err instanceof CloudAuthMissingError) {
-      consolePresentationOutput.stderr(source_default.red(err.message), "auth.status.auth-missing");
-      process.exitCode = EXIT_AUTH;
-      return;
-    }
-    consolePresentationOutput.stderr(source_default.red(err instanceof Error ? err.message : String(err)), "auth.status.load-error");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  const client = new CloudClient({ ...creds, fetchImpl: opts.fetchImpl });
-  try {
-    await client.getInferenceAccount();
-    consolePresentationOutput.stdout(`OK (host=${creds.host})`, "auth.status.ok");
-    process.exitCode = EXIT_OK;
-  } catch (err) {
-    handleStatusError(err);
-  }
-}
-function handleStatusError(err) {
-  if (err instanceof CloudUnauthorizedError) {
-    consolePresentationOutput.stderr("FAIL (HTTP 401)", "auth.status.unauthorized");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  if (err instanceof CloudForbiddenError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (HTTP 403) \u2014 status: ${err.message}`), "auth.status.forbidden");
-    process.exitCode = EXIT_AUTH;
-    return;
-  }
-  if (err instanceof CloudNetworkError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (network) \u2014 status: ${err.message}`), "auth.status.network-error");
-    process.exitCode = EXIT_NET;
-    return;
-  }
-  if (err instanceof CloudError) {
-    consolePresentationOutput.stderr(source_default.red(`FAIL (HTTP ${err.status ?? "?"}) \u2014 status`), "auth.status.cloud-error");
-    process.exitCode = EXIT_USER_ERROR;
-    return;
-  }
-  consolePresentationOutput.stderr(source_default.red(`FAIL \u2014 status: ${err instanceof Error ? err.message : String(err)}`), "auth.status.error");
-  process.exitCode = EXIT_USER_ERROR;
-}
-function normaliseHostArg(host) {
-  if (!host?.trim()) return null;
-  try {
-    const url = new URL(host.trim());
-    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) return null;
-    return url.href.replace(/\/+$/, "");
-  } catch {
-    return null;
-  }
-}
-function persistCredentials(host, token, homeDirOverride) {
-  if (!validCloudToken(token)) throw new Error("Invalid Cloud credential");
-  const home = homeDirOverride ?? homedir();
-  const dir = cloudStateDir(homeDirOverride);
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  const path = join(dir, "cloud.env");
-  const body = `# 0-cloud credentials. Managed by \`0 auth\`.
-# DO NOT commit this file or share its contents.
-ZERO_CLOUD_HOST=${host}
-ZERO_CLOUD_TOKEN=${token}
-`;
-  writeFileSync(path, body, { mode: 384 });
-  chmodSync(path, 384);
-  if (!existsSync2(path)) {
-    return;
-  }
-  if (dir !== homeStateDir(homeDirOverride)) return;
-  try {
-    const cloudDir = join(home, ".0cloud");
-    mkdirSync(cloudDir, { recursive: true });
-    const cloudCredsPath = join(cloudDir, "credentials.json");
-    const trimmedHost = host.replace(/\/+$/, "");
-    const apiEndpoint = trimmedHost.endsWith("/api") ? trimmedHost : `${trimmedHost}/api`;
-    const cloudCreds = JSON.stringify(
-      {
-        token,
-        orgId: "",
-        endpoint: apiEndpoint,
-        dashboardUrl: host,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString()
-      },
-      null,
-      2
-    ) + "\n";
-    writeFileSync(cloudCredsPath, cloudCreds, { mode: 384 });
-    chmodSync(cloudCredsPath, 384);
-  } catch {
-  }
-}
-function sessionStatus(body) {
-  if (!body || typeof body !== "object") return void 0;
-  const status = body.status;
-  return status === "pending" || status === "ready" || status === "expired" ? status : void 0;
-}
-function validCloudToken(value) {
-  return typeof value === "string" && value.trim().length > 0 && !/[\s\x00-\x1f\x7f]/.test(value.trim());
-}
-function extractToken(body) {
-  if (!body || typeof body !== "object") return null;
-  const obj = body;
-  const candidates = [obj.token, obj.access_token];
-  for (const c of candidates) {
-    if (validCloudToken(c)) return c.trim();
-  }
-  return null;
-}
-function defaultOpenBrowser(url) {
-  const plat = platform();
-  return new Promise((resolve4, reject) => {
-    const options = { detached: true, stdio: "ignore", shell: false };
-    const child = plat === "darwin" ? spawn("open", [url], options) : plat === "win32" ? spawn("powershell.exe", [
-      "-NoProfile",
-      "-NonInteractive",
-      "-Command",
-      "Start-Process -FilePath $env:OSEC_BROWSER_LOGIN_URL"
-    ], { ...options, env: { ...process.env, OSEC_BROWSER_LOGIN_URL: url } }) : spawn("xdg-open", [url], options);
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve4();
-    });
-  });
-}
-
 // packages/cli/src/commands/run.ts
 import { writeFile } from "node:fs/promises";
-import { join as join2, resolve as resolve3 } from "node:path";
+import { join, resolve as resolve3 } from "node:path";
 import { tmpdir } from "node:os";
 import { execFile } from "node:child_process";
-import { existsSync as existsSync3 } from "node:fs";
+import { existsSync as existsSync2 } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // packages/cli/src/formatters/terminal.ts
@@ -2532,8 +2139,8 @@ var coreModulePromise = null;
 async function loadCoreModule() {
   if (!coreModulePromise) {
     const srcUrl = new URL("../../../core/src/index.ts", import.meta.url);
-    const srcExists = process.versions.bun && existsSync3(fileURLToPath(srcUrl));
-    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-F6X62TQK.js");
+    const srcExists = process.versions.bun && existsSync2(fileURLToPath(srcUrl));
+    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-3FNZIBB4.js");
   }
   return coreModulePromise;
 }
@@ -2577,17 +2184,9 @@ function getTargetType(report, opts) {
   return report?.targetType ?? opts.targetType;
 }
 function emitResultLine(payload) {
-  if (process.env["ZERO_EMIT_RESULT_LINE"] !== "1" && !process.env["ZERO_CLOUD_SINK"]) return;
+  if (process.env["ZERO_EMIT_RESULT_LINE"] !== "1") return;
   console.log(`ZERO_RESULT=${JSON.stringify(payload)}`);
 }
-function getCloudFinalSinkConfig() {
-  if (process.env["ZERO_FEATURE_CLOUD_SINK"] === "0") return null;
-  const sinkUrl = process.env["ZERO_CLOUD_SINK"]?.trim();
-  const scanId = process.env["ZERO_CLOUD_SCAN_ID"]?.trim();
-  if (!sinkUrl || !scanId) return null;
-  const token = process.env["ZERO_CLOUD_TOKEN"]?.trim() || void 0;
-  return { sinkUrl, scanId, token };
-}
 function isCostBreakdownEntry(value) {
   if (!value || typeof value !== "object") return false;
   const entry = value;
@@ -2659,34 +2258,6 @@ function printCrossValidatedLeads(summary) {
     console.log(source_default.gray(`  +${summary.moreCount} more`));
   }
 }
-async function postFinalResultToCloud(report) {
-  const config = getCloudFinalSinkConfig();
-  if (!config) return;
-  const url = `${config.sinkUrl.replace(/\/+$/, "")}/scans/${encodeURIComponent(config.scanId)}/findings`;
-  const headers = {
-    "Content-Type": "application/json",
-    "X-0-Scan-Id": config.scanId
-  };
-  if (config.token) headers.Authorization = `Bearer ${config.token}`;
-  try {
-    const res = await fetch(url, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ report, final: true })
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      process.stderr.write(
-        `[0 cloud-sink] report POST ${url} returned ${res.status}: ${text.slice(0, 200)}
-`
-      );
-    }
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`[0 cloud-sink] report POST ${url} failed: ${msg}
-`);
-  }
-}
 async function runUnified(opts) {
   const { target, depth, format, runtime, timeout } = opts;
   const core = await loadCoreModule();
@@ -2696,7 +2267,7 @@ async function runUnified(opts) {
       console.error(source_default.red("--branch-from requires --resume <run-id>"));
       process.exit(2);
     }
-    const { branchJournal } = await import("./dist-F6X62TQK.js");
+    const { branchJournal } = await import("./dist-3FNZIBB4.js");
     const result = branchJournal({
       runId: effectiveResumeScanId,
       fromEntry: opts.branchFromEntry
@@ -2753,7 +2324,7 @@ async function runUnified(opts) {
     } else {
       const { isBunRuntime } = await import("./runtime-XFWJTBUO.js");
       if (isBunRuntime()) {
-        const { createOpenTuiSession } = await import("./run-CBGE6DRQ.js");
+        const { createOpenTuiSession } = await import("./run-U3XU4CTC.js");
         const availability = await getRuntimeAvailability();
         inkUI = await createOpenTuiSession({
           target,
@@ -2842,16 +2413,13 @@ async function runUnified(opts) {
     }
     const reportAny = report;
     const canonicalReport = toScanReport(report);
-    if (opts.targetType !== "url" && opts.targetType !== "web-app") {
-      await postFinalResultToCloud(reportAny);
-    }
     if (inkUI) {
       inkUI.setReport(report);
       await inkUI.waitForExit();
     } else {
       if (format === "html" || format === "pdf") {
         const extension = format === "pdf" ? "pdf" : "html";
-        const filePath = opts.reportPath ? resolve3(opts.reportPath) : join2(tmpdir(), `0-report-${Date.now()}.${extension}`);
+        const filePath = opts.reportPath ? resolve3(opts.reportPath) : join(tmpdir(), `0-report-${Date.now()}.${extension}`);
         if (format === "pdf") {
           await generatePdfReport(toScanReport(reportAny), filePath);
         } else {
@@ -2887,8 +2455,8 @@ async function runUnified(opts) {
     if (opts.emit === "pr") {
       const findings = report.findings ?? [];
       const core2 = await loadCoreModule();
-      const repoRoot = opts.targetType === "source-code" && existsSync3(target) ? resolve3(target) : process.cwd();
-      const outDir = opts.emitOutDir ?? join2(tmpdir(), `0-emit-${Date.now()}`);
+      const repoRoot = opts.targetType === "source-code" && existsSync2(target) ? resolve3(target) : process.cwd();
+      const outDir = opts.emitOutDir ?? join(tmpdir(), `0-emit-${Date.now()}`);
       console.log(source_default.blue(`[emit pr] ${findings.length} finding(s); repo=${repoRoot} base=${opts.emitPrBase ?? "main"}${opts.emitPrDryRun ? " (dry-run)" : ""}`));
       const emitReport = await core2.emitFindingsAsPRs(findings, {
         repoRoot,
@@ -2999,13 +2567,18 @@ var DEFAULT_ENCODED_RUN_MAX = 140;
 var ENCODED_RUN_MAX_CAP = 1e6;
 var ELLIPSIS = "...";
 var ENCODED_PLACEHOLDER = "[encoded payload omitted]";
+var DEFAULT_ENCODED_SEGMENT = new RegExp(`[A-Za-z0-9+_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "g");
+var DEFAULT_ENCODED_DATA_URI = new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${DEFAULT_ENCODED_RUN_MAX},}={0,2}`, "gi");
 function stripTerminalControl(text) {
   return text.replace(/\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g, "").replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "").replace(/[\x00-\x08\x0b-\x1f\x7f]/g, "");
 }
 function replaceLargeEncodedChunks(text, maxEncodedRun) {
   const normalized = Number.isFinite(maxEncodedRun) ? Math.trunc(maxEncodedRun) : DEFAULT_ENCODED_RUN_MAX;
   const minRun = Math.min(Math.max(32, normalized), ENCODED_RUN_MAX_CAP);
-  return text.replace(new RegExp(`[A-Za-z0-9+/_-]{${minRun},}={0,2}`, "g"), ENCODED_PLACEHOLDER);
+  if (text.length < minRun) return text;
+  const segment = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_SEGMENT : new RegExp(`[A-Za-z0-9+_-]{${minRun},}={0,2}`, "g");
+  const dataUri = minRun === DEFAULT_ENCODED_RUN_MAX ? DEFAULT_ENCODED_DATA_URI : new RegExp(`(data:[^\\s,]*;base64,)[A-Za-z0-9+/_-]{${minRun},}={0,2}`, "gi");
+  return text.replace(dataUri, `$1${ENCODED_PLACEHOLDER}`).replace(segment, ENCODED_PLACEHOLDER);
 }
 function sanitizeTuiText(value, options = {}) {
   return stripTerminalControl(replaceLargeEncodedChunks(String(value ?? ""), options.maxEncodedRun ?? DEFAULT_ENCODED_RUN_MAX)).replace(/\s+/g, " ").trim();
@@ -3143,20 +2716,6 @@ var SLASH_COMMANDS = [
     category: "info",
     description: "List available tools"
   },
-  {
-    name: "agents",
-    aliases: [],
-    category: "info",
-    description: "List available agents",
-    tuiOnly: true
-  },
-  {
-    name: "harness",
-    aliases: [],
-    category: "navigation",
-    description: "Live harness: views, commands, settings, rollback and workspace trust",
-    tuiOnly: true
-  },
   {
     name: "new-chat",
     aliases: ["new"],
@@ -3164,13 +2723,6 @@ var SLASH_COMMANDS = [
     description: "Create an independent audit using the staged model and connection",
     tuiOnly: true
   },
-  {
-    name: "audits",
-    aliases: [],
-    category: "navigation",
-    description: "Switch between live audits without stopping their work",
-    tuiOnly: true
-  },
   {
     name: "onboard",
     aliases: [],
@@ -3178,14 +2730,6 @@ var SLASH_COMMANDS = [
     description: "Reopen guided setup without replacing the current audit",
     tuiOnly: true
   },
-  {
-    name: "stop",
-    aliases: [],
-    category: "session",
-    description: "Stop this audit's work or one owned worker and its descendants",
-    usage: "/stop audit | /stop worker <exact name or id>",
-    tuiOnly: true
-  },
   // ── session ─────────────────────────────────────────────────────────────
   {
     name: "clear",
@@ -3200,13 +2744,6 @@ var SLASH_COMMANDS = [
     description: "Browse previous scan runs and their results",
     tuiOnly: true
   },
-  {
-    name: "transcript",
-    aliases: ["review"],
-    category: "session",
-    description: "Show this conversation, including tool details",
-    tuiOnly: true
-  },
   {
     name: "findings",
     aliases: ["finds"],
@@ -3215,11 +2752,11 @@ var SLASH_COMMANDS = [
     tuiOnly: true
   },
   {
-    name: "finding",
-    aliases: ["finding-detail"],
+    name: "fix",
+    aliases: [],
     category: "session",
-    description: "Open one finding in full detail to read and act on it",
-    usage: "/finding [id]",
+    description: "Generate a verified local source fix; review before explicitly publishing a draft PR",
+    usage: "/fix [finding-id] | /fix publish <finding-id> | /fix cancel",
     tuiOnly: true
   },
   {
@@ -3239,25 +2776,11 @@ var SLASH_COMMANDS = [
     tuiOnly: true
   },
   {
-    name: "replay",
+    name: "sessions",
     aliases: [],
     category: "session",
-    description: "Replay a previous turn or session",
-    tuiOnly: true
-  },
-  {
-    name: "resume",
-    aliases: ["sessions"],
-    category: "session",
-    description: "Find and resume saved conversations",
-    usage: "/resume"
-  },
-  {
-    name: "providers",
-    aliases: [],
-    category: "system",
-    description: "Connection: 0cloud, API keys, or provider subscriptions",
-    usage: "/providers",
+    description: "Switch open sessions or resume saved conversations",
+    usage: "/sessions",
     tuiOnly: true
   },
   {
@@ -3326,13 +2849,6 @@ var SLASH_COMMANDS = [
     description: "View active and recent operations",
     tuiOnly: true
   },
-  {
-    name: "herd",
-    aliases: ["workers"],
-    category: "navigation",
-    description: "Inspect the active harness worker herd",
-    tuiOnly: true
-  },
   {
     name: "comms",
     aliases: ["messages"],
@@ -3349,9 +2865,9 @@ var SLASH_COMMANDS = [
   },
   {
     name: "connect",
-    aliases: ["login", "auth"],
+    aliases: [],
     category: "navigation",
-    description: "Connect to 0cloud, or use your own API key or provider subscription",
+    description: "Connect your API key or provider subscription",
     usage: "/connect",
     tuiOnly: true
   },
@@ -3528,7 +3044,7 @@ import { execFile as execFile2 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { appendFileSync, readFileSync as readFileSync2, readdirSync, realpathSync, statSync } from "node:fs";
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
-import { isAbsolute, join as join3, relative, sep } from "node:path";
+import { isAbsolute, join as join2, relative, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { isDeepStrictEqual, promisify } from "node:util";
 var execute = promisify(execFile2);
@@ -3561,7 +3077,7 @@ function sourceDigest(root) {
     const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     for (const entry of entries) {
       if (entry.name.startsWith(".") || Object.hasOwn(ignoredSourceNames, entry.name)) continue;
-      const path = join3(directory, entry.name);
+      const path = join2(directory, entry.name);
       if (entry.isDirectory()) {
         visit(path);
         continue;
@@ -3584,7 +3100,7 @@ function sourceDigest(root) {
 function withDevEngineUpdates(initial, config, closeStore) {
   const requestedRoot = process.env["ZERO_DEV_SOURCE_ROOT"];
   const root = requestedRoot ? realpathSync(requestedRoot) : void 0;
-  if (root && JSON.parse(readFileSync2(join3(root, "packages/core/package.json"), "utf8")).name !== "@0/core") {
+  if (root && JSON.parse(readFileSync2(join2(root, "packages/core/package.json"), "utf8")).name !== "@0/core") {
     throw new Error("ZERO_DEV_SOURCE_ROOT must identify a 0 development checkout");
   }
   let current = initial;
@@ -3611,15 +3127,15 @@ function withDevEngineUpdates(initial, config, closeStore) {
     let committed = false;
     let pendingHarnessSnapshot;
     try {
-      const source = join3(root, "packages/core/src");
+      const source = join2(root, "packages/core/src");
       const digest = sourceDigest(source);
       if (digest === activeDigest || digest === rejectedDigest) return;
       rejectedDigest = digest;
       notify("Building changed development engine source; the current session remains active until handoff.");
-      const generationRoot = join3(root, "packages/core/.0/dev-engines");
+      const generationRoot = join2(root, "packages/core/.0/dev-engines");
       await mkdir(generationRoot, { recursive: true, mode: 448 });
-      directory = await mkdtemp(join3(generationRoot, "generation-"));
-      const result = await execute(process.execPath, [join3(root, "scripts/build-dev-engine.mjs"), source, directory], {
+      directory = await mkdtemp(join2(generationRoot, "generation-"));
+      const result = await execute(process.execPath, [join2(root, "scripts/build-dev-engine.mjs"), source, directory], {
         cwd: root,
         timeout: 12e4,
         maxBuffer: 2 * 1024 * 1024,
@@ -3649,7 +3165,7 @@ function withDevEngineUpdates(initial, config, closeStore) {
       if (!isDeepStrictEqual(comparableCheckpoint(candidate.exportCheckpoint()), comparableCheckpoint(checkpoint))) {
         throw new Error("Candidate engine did not preserve the session checkpoint");
       }
-      const candidateBus = await import(pathToFileURL(join3(directory, "runtime/events/bus.js")).href);
+      const candidateBus = await import(pathToFileURL(join2(directory, "runtime/events/bus.js")).href);
       signal?.throwIfAborted();
       if (closingStarted || !getSettings().allowDevSourceUpdates) throw new Error("Development engine update cancelled before handoff");
       if (!isDeepStrictEqual(current.exportCheckpoint(), checkpoint)) throw new Error("Session changed during candidate preparation; keeping the current engine");
@@ -3849,48 +3365,31 @@ function createLocalConsoleSession(config, dbPath) {
   }
 }
 
-// packages/cli/src/tui/hosted-balance.ts
-function fmtUsd(usd) {
-  return usd === null ? "unavailable" : `$${usd}`;
-}
-function hostedBalanceState(account) {
-  if (!account) return { status: "unavailable" };
-  const { included, prepaid } = account;
-  const parts = [included.state === "none" ? "no included allowance" : included.state !== "unavailable" && included.usedPercent !== null ? `${included.usedPercent}% used` : "unavailable"];
-  if (included.state !== "unavailable" && included.resetsAt) {
-    parts.push(`resets ${included.resetsAt.slice(0, 10)}`);
-  }
-  if (prepaid.fallbackEnabled) parts.push(`prepaid ${fmtUsd(prepaid.balanceUsd)}`);
-  if (account.state !== "ready") {
-    parts.push(`${account.state}${account.reason ? `: ${account.reason}` : ""}`);
-  } else if (!account.admission.eligible) {
-    parts.push("access blocked");
-  }
-  return { status: "ready", display: parts.join(" \xB7 ") };
-}
-function formatHostedBalance(state) {
-  if (state.status === "loading") return "Usage: Loading\u2026";
-  if (state.status === "unavailable") return "Usage: unavailable";
-  return `Usage: ${state.display}`;
-}
-function formatBalanceDetail(account) {
-  if (!account) return "  Usage unavailable (unsupported account data).\n";
-  const { included, prepaid } = account;
-  const lines = [included.state === "none" ? "  Usage: no included allowance" : included.state !== "unavailable" && included.usedPercent !== null ? `  Usage: ${included.usedPercent}% used` : "  Usage: unavailable"];
-  if (included.state !== "unavailable" && included.resetsAt) {
-    lines.push(`  Resets: ${included.resetsAt}`);
-  }
-  if (prepaid.fallbackEnabled) lines.push(`  Prepaid balance: ${fmtUsd(prepaid.balanceUsd)}`);
-  if (account.state !== "ready" || !account.admission.eligible) {
-    lines.push(`  Access: ${account.state === "ready" ? "blocked" : account.state}`);
-    const reason = account.admission.reason ?? account.reason;
-    if (reason) lines.push(`  Reason: ${reason}`);
-  }
-  return lines.join("\n") + "\n";
+// packages/cli/src/tui/codex-device-auth.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// packages/cli/src/open-browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function defaultOpenBrowser(url) {
+  const plat = platform();
+  return new Promise((resolve4, reject) => {
+    const options = { detached: true, stdio: "ignore", shell: false };
+    const child = plat === "darwin" ? spawn("open", [url], options) : plat === "win32" ? spawn("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      "Start-Process -FilePath $env:OSEC_BROWSER_LOGIN_URL"
+    ], { ...options, env: { ...process.env, OSEC_BROWSER_LOGIN_URL: url } }) : spawn("xdg-open", [url], options);
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve4();
+    });
+  });
 }
 
 // packages/cli/src/tui/codex-device-auth.ts
-import { spawn as spawn2 } from "node:child_process";
 var MAX_VISIBLE_LINES = 8;
 function defaultSpawnCodexDeviceAuth(command, args, options) {
   const child = spawn2(command, args, {
@@ -4019,12 +3518,6 @@ export {
   watchLensSynthCommand,
   registerLensSynthCommand,
   createLocalConsoleSession,
-  hostedBalanceState,
-  formatHostedBalance,
-  formatBalanceDetail,
-  registerAuthCommand,
-  hostedBrowserLoginFlow,
-  runLogin,
   defaultOpenBrowser,
   startCodexDeviceAuth,
   runUnified