0sec-cli 0.21.4 → 0.22.1

package/0.js

@@ -3,8 +3,9 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   Command,
+  launchConfiguredWorkbench,
   runStartupUpdate
-} from "./chunks/chunk-CL5KAUM6.js";
+} from "./chunks/chunk-V6GHX34G.js";
 import {
   resolveEngagement,
   setHerdrSink
@@ -15,67 +16,64 @@ import {
   installProcessPresentationStreamBridge,
   maybeLoadCodexAuth,
   presentationEventBus
-} from "./chunks/chunk-YPOA3W4O.js";
-import {
-  source_default
-} from "./chunks/chunk-HLFS6WV2.js";
+} from "./chunks/chunk-GOEA3NW6.js";
 import {
   createHerdrEventSink,
   maybeSubscribeOperationalEventSink
-} from "./chunks/chunk-FAH6V4QM.js";
-import "./chunks/chunk-RF5QGKLR.js";
-import "./chunks/chunk-Y5H6E24H.js";
-import "./chunks/chunk-GVD6SJGH.js";
+} from "./chunks/chunk-LGCASF2C.js";
+import "./chunks/chunk-XCISCI4T.js";
+import {
+  source_default
+} from "./chunks/chunk-HLFS6WV2.js";
 import "./chunks/chunk-QCUFBVIZ.js";
-import "./chunks/chunk-2WSXFFJZ.js";
-import "./chunks/chunk-G34QP2XW.js";
+import "./chunks/chunk-3E2KALZ5.js";
+import "./chunks/chunk-TM74SSHC.js";
 import "./chunks/chunk-2WNCI664.js";
-import "./chunks/chunk-Z3IKZX3X.js";
+import "./chunks/chunk-23DG5YKS.js";
 import "./chunks/chunk-DQTNI3KY.js";
-import "./chunks/chunk-YA4PUM4H.js";
-import "./chunks/chunk-O6SD4A36.js";
-import "./chunks/chunk-TF46UWFU.js";
+import "./chunks/chunk-7XCKYNLO.js";
+import "./chunks/chunk-ZKQ2I3S2.js";
+import "./chunks/chunk-CPWA6RWE.js";
+import "./chunks/chunk-4G7OVYJX.js";
 import "./chunks/chunk-AZ7L3HFD.js";
-import "./chunks/chunk-YHWWF4QY.js";
-import "./chunks/chunk-E2UOY5PJ.js";
-import {
-  analyticsPipeline,
-  configureRunContributionsFromEnvironment
-} from "./chunks/chunk-ANDKY54G.js";
-import "./chunks/chunk-CAJJRUTV.js";
+import "./chunks/chunk-OSBPGWTE.js";
+import "./chunks/chunk-5BTJMINS.js";
+import "./chunks/chunk-HHPWRY2M.js";
 import "./chunks/chunk-K2PWUPUI.js";
-import "./chunks/chunk-SBMB4OL3.js";
+import "./chunks/chunk-YL6YAGLL.js";
 import "./chunks/chunk-2OQOQ2FZ.js";
 import "./chunks/chunk-UEX7PFSE.js";
-import "./chunks/chunk-5T6D5BVY.js";
-import "./chunks/chunk-GIQKESMN.js";
-import "./chunks/chunk-PD2BBBKT.js";
-import "./chunks/chunk-WF5W75WY.js";
-import "./chunks/chunk-QZVG3BG4.js";
-import "./chunks/chunk-SQCBHFWN.js";
-import "./chunks/chunk-NDJU5ZZ7.js";
-import "./chunks/chunk-ER3SUMYJ.js";
+import "./chunks/chunk-NLH4LMWH.js";
+import "./chunks/chunk-WZRVS7SB.js";
+import "./chunks/chunk-XA2O4WXA.js";
 import {
+  analyticsPipeline,
+  configureRunContributionsFromEnvironment,
   eventBus,
-  maybeSubscribeCloudEventSink,
   presentationEventSink
-} from "./chunks/chunk-CXKDWFNO.js";
+} from "./chunks/chunk-OHHCGDJ2.js";
+import "./chunks/chunk-SQCBHFWN.js";
+import "./chunks/chunk-GVD6SJGH.js";
+import "./chunks/chunk-IFME676H.js";
+import "./chunks/chunk-W6UWZFKL.js";
 import "./chunks/chunk-FHC2B7LN.js";
-import "./chunks/chunk-P6YG6TEZ.js";
+import "./chunks/chunk-DKSCN2AB.js";
 import "./chunks/chunk-UFHN6RIU.js";
-import "./chunks/chunk-WZISK5VC.js";
-import "./chunks/chunk-VOAXLO4A.js";
-import "./chunks/chunk-W4JOXE4N.js";
-import "./chunks/chunk-WPQLBN4S.js";
+import "./chunks/chunk-VWITLWXB.js";
+import "./chunks/chunk-TO35Y326.js";
+import "./chunks/chunk-IXT64DV5.js";
+import "./chunks/chunk-UELXHK2Y.js";
+import "./chunks/chunk-XDKB2P5X.js";
 import "./chunks/chunk-V36HVTUL.js";
 import "./chunks/chunk-4VGLO2YS.js";
 import "./chunks/chunk-6YNKRUMC.js";
-import "./chunks/chunk-CGHCEN7W.js";
-import "./chunks/chunk-HPQZHOIU.js";
-import "./chunks/chunk-BACXRTQ4.js";
+import "./chunks/chunk-X7LAEEUW.js";
+import "./chunks/chunk-5IBCBQEH.js";
+import "./chunks/chunk-WSDDGFA6.js";
+import "./chunks/chunk-AV2LG2L7.js";
 import {
   VERSION
-} from "./chunks/chunk-PC6RCKQV.js";
+} from "./chunks/chunk-KAU6NLGP.js";
 import "./chunks/chunk-VIT5ALXF.js";
 import "./chunks/chunk-VCSFCHAJ.js";
 
@@ -101,7 +99,7 @@ import { fileURLToPath } from "node:url";
 var BYPASS_ENV = "ZERO_ALLOW_STALE_SOURCE_DIST";
 function currentBuildCommit() {
   if (true) {
-    return "27671f61aa4861a39c52482b3f65603deb8fbee8";
+    return "d29fd0b05ad8414024f6f030e31a8155c467ef96";
   }
   return void 0;
 }
@@ -187,10 +185,18 @@ function enforceSourceDistFreshness(opts = {}) {
 }
 
 // packages/cli/src/index.ts
+try {
+  const workbenchExitCode = await launchConfiguredWorkbench(process.argv.slice(2));
+  if (workbenchExitCode !== void 0) process.exit(workbenchExitCode);
+} catch (error) {
+  process.stderr.write(`[0] ${error instanceof Error ? error.message : String(error)}
+`);
+  process.exit(125);
+}
+var isWorkbenchManagement = process.argv[2] === "workbench" || process.argv[2] === "config";
 installConsolePresentationBridge();
 installProcessPresentationStreamBridge();
-maybeLoadCodexAuth();
-maybeSubscribeCloudEventSink();
+if (!isWorkbenchManagement) maybeLoadCodexAuth();
 try {
   getSettings();
 } catch {
@@ -207,9 +213,9 @@ var herdrSink = createHerdrEventSink();
 if (herdrSink) eventBus.subscribe(herdrSink);
 setHerdrSink(herdrSink);
 enforceSourceDistFreshness({ entryUrl: import.meta.url });
-await runStartupUpdate(VERSION);
+if (!isWorkbenchManagement) await runStartupUpdate(VERSION);
 async function buildProgram() {
-  const c = await import("./chunks/commands-WF5RG4I2.js");
+  const c = await import("./chunks/commands-N6GN5SBF.js");
   const program = new Command();
   program.name("0").description("Open-source multi-model security research harness").version(VERSION).enablePositionalOptions();
   c.registerScanCommand(program);
@@ -220,8 +226,6 @@ async function buildProgram() {
   c.registerSecureCommand(program);
   c.registerReviewCommand(program);
   c.registerFixCommand(program);
-  c.registerConnectCommand(program);
-  c.registerGuideCommand(program);
   c.registerAuditCommand(program);
   c.registerDoctorCommand(program);
   c.registerDashboardCommand(program);
@@ -249,8 +253,6 @@ async function buildProgram() {
   c.registerUpgradeCommand(program);
   c.registerDepsCommand(program);
   c.registerH1Command(program);
-  c.registerAuthCommand(program);
-  c.registerHostedCommand(program);
   c.registerIntelCommand(program);
   c.registerReconCommand(program);
   c.registerConsoleCommand(program);
@@ -270,16 +272,14 @@ async function buildProgram() {
   c.registerThemeCommand(program);
   c.registerEvolveCommand(program);
   c.registerConfigCommand(program);
-  c.registerServiceCommand(program);
-  c.registerProjectSetupCommand(program);
-  c.registerAuditSkillsCommand(program);
+  c.registerWorkbenchCommand(program);
   c.registerHackstoreCommand(program);
   return program;
 }
 async function showInteractiveMenu() {
   const { isBunRuntime } = await import("./chunks/runtime-XFWJTBUO.js");
   if (isBunRuntime()) {
-    const { showOpenTuiHome } = await import("./chunks/run-CBGE6DRQ.js");
+    const { showOpenTuiHome } = await import("./chunks/run-GAFKBCTN.js");
     await showOpenTuiHome();
     return;
   }
@@ -302,7 +302,7 @@ process.once("beforeExit", () => {
   });
 });
 var userArgs = process.argv.slice(2);
-var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "connect", "guide", "review", "fix", "audit", "deps", "doctor", "dashboard", "tui", "watch", "orchestrate", "db", "mcp-server", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "auth", "login", "models", "balance", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "service", "project", "skills", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "evolve", "hackstore", "hack", "store", "help"];
+var knownCommands = ["scan", "resume", "replay", "history", "findings", "secure", "review", "fix", "audit", "deps", "doctor", "dashboard", "tui", "watch", "orchestrate", "db", "mcp-server", "triage", "eval", "bench", "ingest", "kernel", "disclose", "verify", "exploit", "hunt", "recency-hunt", "deep-review", "lens-synth", "memsafety", "assumption-hunt", "specdrift", "protocol-check", "cve", "upgrade", "update", "h1", "intel", "recon", "js-recon", "npm-discovery", "identity", "adgraph", "entragraph", "cloud", "xnu-fuzz", "research", "radar", "timeline", "console", "agent-assure", "binary", "plugin", "theme", "config", "workbench", "evolve", "hackstore", "hack", "store", "help"];
 if (userArgs.length === 0) {
   showInteractiveMenu().catch((err) => {
     console.error(source_default.red(err instanceof Error ? err.message : String(err)));

package/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://0.security/">
-    <img src="assets/readme-cover.png" alt="Software already builds software. Now it can secure itself, too." width="100%">
+    <img src="assets/readme-cover.png" alt="0security terminal security research workflow" width="100%">
   </a>
 </p>
 
@@ -13,13 +13,12 @@
 
 <p align="center">
   <strong>The open-source, self-evolving, multi-model harness for security research.</strong><br/>
-  <sub>The Swiss Applied AI &amp; Cybersecurity Research Lab</sub><br/>
+  <sub>Backed by Y Combinator · The Swiss Applied AI &amp; Cybersecurity Research Lab</sub><br/>
   <a href="https://0.security/">0.security</a> ·
   <a href="https://docs.0.security/">Documentation</a> ·
   <a href="https://github.com/0sec-labs/foxguard">FoxGuard</a>
 </p>
 
-
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT%20OR%20Apache--2.0-1A1815?style=flat-square&labelColor=1A1815" alt="License: MIT OR Apache-2.0"></a>
   <a href="https://github.com/0sec-labs/0/releases/latest"><img src="https://img.shields.io/github/v/release/0sec-labs/0?style=flat-square&labelColor=1A1815&color=1A1815" alt="Latest release"></a>
@@ -30,88 +29,74 @@
   <img src="assets/security-cycle-diagram.webp" alt="Zero studies, finds, fixes, reports, and improves." width="100%">
 </p>
 
+## Security research, in your workspace
 
-## The harness behind our research breakthroughs.
-
-Find novel vulnerabilities in the deepest layers of software. Explore our
-[public disclosures and upstream fixes](https://0.security/research/#disclosures),
-including research in the Linux kernel.
+0 is an open-source, multi-model harness for investigating software security:
+read code, run tools, investigate findings and review proposed fixes.
+Built by the Swiss Applied AI & Cybersecurity Research Lab, it supports our
+[public disclosures and upstream fixes](https://0.security/research/#disclosures).
 
 ## Get started
 
-### Docs for your agent
-
-Copy this prompt into your coding agent:
-
-> Set up the 0.security harness using https://0.security/harness/setup.md and read https://0.security/llms.txt for the documentation index. Confirm my targets and scope before testing, and ask before changing files.
-
-### Quick install
+Install on Apple Silicon macOS or x64/ARM64 Linux, then open 0:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash
+export PATH="$HOME/.0/bin:$PATH"
 0
 ```
 
-Bring your model access and configure connections in the terminal. Run locally
-or through the CLI in CI/CD, inspect findings and verification results, and
-export reports as JSON, Markdown or SARIF.
-
-[Setup guide](https://0.security/harness/setup.md) ·
-[Research workflows](https://docs.0.security/research-workflows/) ·
-[Documentation](https://docs.0.security/)
-
-## Built for security research
 
-- **Open research.** Benchmark-led agent design and A/B-tested attack strategies,
-  with public findings that others can inspect.
-- **Extensible tools.** Use the in-house security linter, connect your own tools,
-  and let agents write and run tools for the investigation.
-- **Adaptive agents.** Delegate focused investigations to subagents with fresh
-  context and bounded budgets, then collect their findings. See the
-  [agent loop](https://docs.0.security/agent-loop/) and
-  [worker monitoring](https://docs.0.security/console/#monitoring-subagents).
-- **Multi-model harness.** Bring the models you prefer into one security workflow.
-  Combine deterministic steps with adaptive investigations.
-- **Evaluated self-improvement.** Propose changes, evaluate them, and select better
-  versions for future runs. Learn more about the
-  [improvement plane](https://docs.0.security/improvement-plane/).
 
-### Available on 0.security
+## Work locally, extend deliberately
 
-**Optimized Model Routing: The best LLM for each step**
+- Describe an authorized repository and investigation goal in chat, or use
+  `0 review ./authorized-repo` for a source review.
+- Review findings and proposed changes.
+  Follow the [research workflows](https://docs.0.security/research-workflows/)
+  for deeper investigations.
+- Connect your tools through [MCP and integrations](https://docs.0.security/integrations/).
+  Browse `/hackstore`, or [build and locally install an extension](https://docs.0.security/hackstore/).
+  Community plugins run as local processes; review them before enabling.
 
-The managed service adds model routing, non-public frontier cyber models,
-a purpose-built attack runtime and a curated offensive toolchain. These hosted
-capabilities are separate from running the open-source harness with your own
-model access. [Explore 0.security](https://0.security/).
+## Why 0?
 
-## Make software secure itself.
+Use the models you want. Bring the tools you need. Make the workflow your own.
+0 brings security investigations and fixes into one terminal workspace, with
+focused agents and an extensible toolchain. The harness is open source and
+runs under your control.
 
-The world's best security should belong to everyone. Software already writes
-itself; we believe it should secure itself, too. Our goal is security that
-finds and fixes vulnerabilities as software changes, so people can focus on
-what they want to create.
+## Guides
 
-Research comes first. Public disclosures, upstream fixes and reproducible
-results let people check our work. Open tools let them question it, extend it
-and build something better. Self-securing software is the future we're working
-toward.
+- [Quick start and installation](https://docs.0.security/getting-started/)
+- [Models and provider connections](https://docs.0.security/api-keys/)
+- [Console, sessions and agents](https://docs.0.security/console/)
+- [Plugins and Hackstore publishing](https://docs.0.security/hackstore/)
+- [Scope and authorization](https://docs.0.security/scope/)
+- [GitHub Actions](https://docs.0.security/ci/github-action/)
+- [Troubleshooting](https://docs.0.security/troubleshooting/)
 
-[Read our manifesto](https://0.security/about/) ·
-[Explore our research](https://0.security/research/)
+## Status and safety
 
-## Status
+This is a **research preview**, not a guarantee of coverage or correctness.
+Review results and generated fixes before applying them. Tool making and
+[evaluated self-improvement](https://docs.0.security/improvement-plane/) are research workflows.
 
-This is a research preview. Coverage and verification depth vary by workflow;
-inspect the evidence and review generated fixes before applying them.
-Tool making and evaluated self-improvement are developing research workflows.
-Only test systems you own or are authorized to assess.
+Only test systems you own or are authorized to assess. The optional
+[scope plugin](https://docs.0.security/scope/) is disabled by default:
+enable it explicitly with `0 plugin enable scope` and configure your boundaries.
+The default console uses YOLO mode; use `0 console --mode standard` for
 
-## Contributing
+## Contributing and license
 
-Read [CONTRIBUTING.md](CONTRIBUTING.md) to build and extend the harness.
+Build and extend the harness with [CONTRIBUTING.md](CONTRIBUTING.md).
 Report security issues through [SECURITY.md](SECURITY.md).
+Licensed under [MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
 
-## License
+## Acknowledgments
 
-[MIT](LICENSE-MIT) OR [Apache-2.0](LICENSE).
+Thanks to the teams behind [OpenTUI](https://github.com/anomalyco/opentui),
+[Bun](https://bun.sh/) and [React](https://react.dev/) for the interface stack,
+and [Models.dev](https://models.dev/) and [LiteLLM](https://github.com/BerriAI/litellm)
+for model metadata and pricing estimates. Thank you to everyone contributing
+code, reporting bugs and sharing ideas.

package/chunks/{adapt-loop-IGBRQAXO.js → adapt-loop-J6QCZZTB.js}

@@ -5,10 +5,10 @@ import {
   adaptAndVerify,
   applyUnifiedDiff,
   renderAdaptationPrompt
-} from "./chunk-RF5QGKLR.js";
-import "./chunk-CAJJRUTV.js";
-import "./chunk-5T6D5BVY.js";
-import "./chunk-PC6RCKQV.js";
+} from "./chunk-CPWA6RWE.js";
+import "./chunk-NLH4LMWH.js";
+import "./chunk-WZRVS7SB.js";
+import "./chunk-KAU6NLGP.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{artifact-scraper-LNQJUORS.js → artifact-scraper-MFKT6OI4.js}

@@ -14,8 +14,8 @@ import {
   parseUbuntuTracker,
   scoreCodeCandidate,
   scoreRepoCandidate
-} from "./chunk-WPQLBN4S.js";
-import "./chunk-PC6RCKQV.js";
+} from "./chunk-XDKB2P5X.js";
+import "./chunk-KAU6NLGP.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{assumption-mining-4MJTP6H5.js → assumption-mining-646LYSJY.js}

@@ -24,29 +24,29 @@ import {
   scoreDualViewWeaponizability,
   storeAssumptionModel,
   subjectSelfEnforces
-} from "./chunk-YHWWF4QY.js";
+} from "./chunk-OSBPGWTE.js";
 import {
   composeGate,
   makeSkepticVerifier
-} from "./chunk-E2UOY5PJ.js";
-import "./chunk-ANDKY54G.js";
-import "./chunk-CAJJRUTV.js";
+} from "./chunk-5BTJMINS.js";
+import "./chunk-HHPWRY2M.js";
 import "./chunk-K2PWUPUI.js";
-import "./chunk-SBMB4OL3.js";
+import "./chunk-YL6YAGLL.js";
 import "./chunk-2OQOQ2FZ.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-5T6D5BVY.js";
-import "./chunk-PD2BBBKT.js";
-import "./chunk-QZVG3BG4.js";
-import "./chunk-NDJU5ZZ7.js";
-import "./chunk-ER3SUMYJ.js";
-import "./chunk-CXKDWFNO.js";
-import "./chunk-WZISK5VC.js";
-import "./chunk-W4JOXE4N.js";
+import "./chunk-NLH4LMWH.js";
+import "./chunk-WZRVS7SB.js";
+import "./chunk-OHHCGDJ2.js";
+import "./chunk-IFME676H.js";
+import "./chunk-W6UWZFKL.js";
+import "./chunk-VWITLWXB.js";
+import "./chunk-IXT64DV5.js";
+import "./chunk-UELXHK2Y.js";
 import "./chunk-4VGLO2YS.js";
-import "./chunk-CGHCEN7W.js";
-import "./chunk-BACXRTQ4.js";
-import "./chunk-PC6RCKQV.js";
+import "./chunk-X7LAEEUW.js";
+import "./chunk-5IBCBQEH.js";
+import "./chunk-AV2LG2L7.js";
+import "./chunk-KAU6NLGP.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{chunk-Z3IKZX3X.js → chunk-23DG5YKS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   allowlistedChildEnv
-} from "./chunk-QZVG3BG4.js";
+} from "./chunk-5IBCBQEH.js";
 
 // packages/core/dist/stages/npm-detectors/osv-lookup.js
 var DEFAULT_ENDPOINT = "https://api.osv.dev/v1/querybatch";

package/chunks/{chunk-2WSXFFJZ.js → chunk-3E2KALZ5.js}

@@ -4,10 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   getToolsForRole,
   runNativeAgentLoop
-} from "./chunk-ANDKY54G.js";
+} from "./chunk-HHPWRY2M.js";
 import {
   LlmApiRuntime
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-AV2LG2L7.js";
 
 // packages/core/dist/eval-runner.js
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-TF46UWFU.js → chunk-4G7OVYJX.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-AV2LG2L7.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-E2UOY5PJ.js → chunk-5BTJMINS.js}

@@ -5,46 +5,46 @@ import {
   BUDGET_WARNING_HARD,
   BUDGET_WARNING_SOFT,
   ToolExecutor,
-  analyticsPipeline,
   buildToolCallLogEntry,
   buildToolCallsPayload,
   computeBudgetWarningTurns,
   formatJitSkillsInstruction,
-  getCloudSinkConfig,
   getToolsForRole,
   newCorrelationId,
   parseFindingsFromCliOutput,
-  postFinding,
   registerSignalCleanup,
-  reportUnsupportedContributionMode,
   runNativeAgentLoop,
   toolCallPreview
-} from "./chunk-ANDKY54G.js";
+} from "./chunk-HHPWRY2M.js";
 import {
   WafDetector
-} from "./chunk-SBMB4OL3.js";
+} from "./chunk-YL6YAGLL.js";
 import {
   RECIPE_LIBRARY
 } from "./chunk-UEX7PFSE.js";
+import {
+  analyticsPipeline,
+  reportUnsupportedContributionMode
+} from "./chunk-OHHCGDJ2.js";
 import {
   createRuntime,
   detectAvailableRuntimes,
   pickRuntimeForStage
-} from "./chunk-NDJU5ZZ7.js";
+} from "./chunk-IFME676H.js";
 import {
   osecDB
-} from "./chunk-WZISK5VC.js";
+} from "./chunk-VWITLWXB.js";
 import {
   CLI_RUNTIME_TYPES
 } from "./chunk-4VGLO2YS.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-BACXRTQ4.js";
+} from "./chunk-AV2LG2L7.js";
 import {
   estimateCost,
   modelProvider
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-KAU6NLGP.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -3919,59 +3919,6 @@ function persistSession(db, state, config, sessionId, status) {
   });
 }
 
-// packages/core/dist/agent/cloud-inbox.js
-var POLL_MS = 3e3;
-function startCloudInboxPoller(config) {
-  const buffer = [];
-  let stopped = false;
-  const headers = {
-    "X-0-Scan-Id": config.scanId
-  };
-  if (config.token)
-    headers["Authorization"] = `Bearer ${config.token}`;
-  const url = `${config.sinkUrl.replace(/\/+$/, "")}/scans/${encodeURIComponent(config.scanId)}/inbox`;
-  const poll = async () => {
-    if (stopped)
-      return;
-    try {
-      const res = await fetch(url, { headers });
-      if (!res.ok)
-        return;
-      const rows = await res.json();
-      if (!Array.isArray(rows))
-        return;
-      for (const r of rows) {
-        if (r.role === "human" && typeof r.body === "string" && r.body.trim().length > 0) {
-          const prefix = r.kind === "approval" ? "[Operator approval]" : "[Operator steer]";
-          buffer.push(`${prefix}: ${r.body.trim()}`);
-        }
-      }
-    } catch {
-    }
-  };
-  const handle = setInterval(() => void poll(), POLL_MS);
-  if (typeof handle.unref === "function") {
-    handle.unref();
-  }
-  return {
-    drain() {
-      if (buffer.length === 0)
-        return [];
-      return buffer.splice(0, buffer.length);
-    },
-    stop() {
-      stopped = true;
-      clearInterval(handle);
-    }
-  };
-}
-function maybeStartCloudInboxPoller() {
-  const cfg = getCloudSinkConfig();
-  if (!cfg)
-    return null;
-  return startCloudInboxPoller(cfg);
-}
-
 // packages/core/dist/secure/project-context.js
 import { createHash as createHash2 } from "node:crypto";
 import { execFileSync as execFileSync2 } from "node:child_process";
@@ -4207,7 +4154,7 @@ async function runAnalysisAgent(opts) {
       },
       required: ["findings", "summary"]
     };
-    const { ProcessRuntime } = await import("./process-PNMC36JI.js");
+    const { ProcessRuntime } = await import("./process-N245QIQG.js");
     const codexHome = runtimeType === "codex" && isEphemeralScope(scopePath) ? createEphemeralCodexHome() : void 0;
     const cliRuntime = new ProcessRuntime({
       type: runtimeType,
@@ -4316,7 +4263,6 @@ async function runAnalysisAgent(opts) {
     if (supportsNative) {
       const turnBudget = getMaxTurns(role, config.depth, "native", purpose);
       const maxTurns2 = Math.min(opts.maxTurns ?? turnBudget, opts.singleAgent ? 20 : turnBudget);
-      const cloudInbox = maybeStartCloudInboxPoller();
       const agentState2 = await runNativeAgentLoop({
         config: {
           role,
@@ -4329,7 +4275,7 @@ async function runAnalysisAgent(opts) {
           target,
           scanId,
           scopePath,
-          codebaseLearning: !!getCloudSinkConfig() && scopedSourceAudit && purpose === "research",
+          codebaseLearning: scopedSourceAudit && purpose === "research",
           sessionId,
           costCeilingUsd: config.costCeilingUsd,
           costModel: config.model,
@@ -4337,7 +4283,6 @@ async function runAnalysisAgent(opts) {
         },
         runtime: apiRuntime,
         db,
-        getPendingUserMessages: cloudInbox?.drain,
         onFindingSaved: (finding) => {
           if (purpose === "verify" && opts.singleAgent)
             return;
@@ -4346,7 +4291,6 @@ async function runAnalysisAgent(opts) {
             message: `[${finding.severity}] ${finding.title}`,
             data: finding
           });
-          void postFinding(finding, getCloudSinkConfig());
           try {
             analyticsPipeline.recordFinding({
               severity: finding.severity,
@@ -4477,7 +4421,6 @@ async function runAnalysisAgent(opts) {
         message: `[${finding.severity}] ${finding.title}`,
         data: finding
       });
-      void postFinding(finding, getCloudSinkConfig());
       try {
         analyticsPipeline.recordFinding({
           severity: finding.severity,
@@ -5908,7 +5851,6 @@ export {
   describeRefuterChoice,
   scoreGeometry,
   runAgentLoop,
-  maybeStartCloudInboxPoller,
   prepareProjectContext,
   PROJECT_OBSERVATION_PROMPT,
   captureProjectSuggestions,

package/chunks/{chunk-QZVG3BG4.js → chunk-5IBCBQEH.js}

@@ -96,8 +96,7 @@ var CHILD_ENV_ALLOWLIST = [
   "AUTH_CURL_FLAG",
   // Existing child-runtime configuration contract; each name is non-secret.
   "ZERO_FEATURE_JIT_SKILLS",
-  "ZERO_BASH_TIMEOUT_MS",
-  "ZERO_CLOUD_SCAN_ID"
+  "ZERO_BASH_TIMEOUT_MS"
 ];
 function allowlistedChildEnv(extras = {}, env = process.env) {
   const out = {};