0sec-cli 0.21.4 → 0.22.1

package/chunks/{chunk-CL5KAUM6.js → chunk-V6GHX34G.js}

@@ -2,11 +2,30 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
-  loadLayeredSettings
-} from "./chunk-YPOA3W4O.js";
+  FEEDBACK_OPT_OUT_ENV,
+  PROVIDERS,
+  accountEnvPatch,
+  loadAccountStore,
+  loadGlobalSettings,
+  loadLayeredSettings,
+  maybeLoadCodexAuth,
+  normalizeSettings,
+  saveSettings,
+  submissionBlockedReason
+} from "./chunk-GOEA3NW6.js";
+import {
+  runSmolvmWorkbench
+} from "./chunk-LGCASF2C.js";
+import {
+  ANALYTICS_LEVEL_ENV,
+  getSmolvmWorkbenchStatus,
+  isAdmittedSmolvmWorkbench,
+  levelAtLeast,
+  resolveAnalyticsLevel
+} from "./chunk-OHHCGDJ2.js";
 import {
   homeStateDir
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-KAU6NLGP.js";
 import {
   __commonJS,
   __require,
@@ -3023,9 +3042,247 @@ var {
   Help
 } = import_index.default;
 
+// packages/cli/src/workbench.ts
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var WORKBENCH_INNER_ARGUMENT = "--workbench-inner";
+function workbenchConfigPath(home = process.env.HOME || homedir()) {
+  return join(homeStateDir(home), "workbench.json");
+}
+function defaultWorkbenchStateRoot(home = process.env.HOME || homedir()) {
+  return join(homeStateDir(home), "workbench");
+}
+function positiveInteger(value, maximum) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 && value <= maximum;
+}
+function isPinnedWorkbenchImageReference(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/.test(value) && !value.slice(0, value.indexOf("@")).slice(value.lastIndexOf("/") + 1).includes(":");
+}
+function normalizeWorkbenchConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("Invalid workbench operator choices.");
+  const config = raw;
+  const approvedImages = [];
+  if (config.approvedImages !== void 0) {
+    if (!Array.isArray(config.approvedImages)) throw new Error("Invalid workbench sandbox image catalog.");
+    const references = /* @__PURE__ */ new Set();
+    for (const rawImage of config.approvedImages) {
+      if (typeof rawImage !== "object" || rawImage === null || Array.isArray(rawImage)) throw new Error("Invalid workbench sandbox image catalog.");
+      const image = rawImage;
+      if (!isPinnedWorkbenchImageReference(image.reference) || typeof image.archive !== "string" || !isAbsolute(image.archive) || typeof image.digest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(image.digest) || references.has(image.reference)) throw new Error("Sandbox image grants require unique immutable repository@sha256 references and approved local archives.");
+      references.add(image.reference);
+      approvedImages.push({ reference: image.reference, archive: image.archive, digest: image.digest });
+    }
+  }
+  if (config.schemaVersion !== 1 || typeof config.image !== "string" || !isAbsolute(config.image) || typeof config.imageDigest !== "string" || !/^sha256:[a-f0-9]{64}$/.test(config.imageDigest) || typeof config.stateRoot !== "string" || !isAbsolute(config.stateRoot) || config.workspaceRoot !== void 0 && (typeof config.workspaceRoot !== "string" || !isAbsolute(config.workspaceRoot)) || !Array.isArray(config.providers) || config.providers.some((id) => typeof id !== "string" || !PROVIDERS.some((provider) => provider.id === id)) || typeof config.github !== "boolean" || !positiveInteger(config.cpus, 64) || !positiveInteger(config.memoryMb, 262144) || !positiveInteger(config.storageGb, 1024)) {
+    throw new Error("Invalid workbench operator choices.");
+  }
+  return {
+    schemaVersion: 1,
+    image: config.image,
+    imageDigest: config.imageDigest,
+    stateRoot: config.stateRoot,
+    ...config.workspaceRoot === void 0 ? {} : { workspaceRoot: config.workspaceRoot },
+    providers: [...new Set(config.providers)],
+    github: config.github,
+    cpus: config.cpus,
+    memoryMb: config.memoryMb,
+    storageGb: config.storageGb,
+    ...approvedImages.length ? { approvedImages } : {}
+  };
+}
+function loadWorkbenchConfig(home) {
+  const file = workbenchConfigPath(home);
+  if (!existsSync(file)) return void 0;
+  try {
+    const stat = lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.()) {
+      throw new Error("Workbench configuration must be an operator-owned, private regular file (mode 0600).");
+    }
+    return normalizeWorkbenchConfig(JSON.parse(readFileSync(file, "utf8")));
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("Workbench configuration must")) throw error;
+    throw new Error(`Unreadable or invalid workbench configuration at ${file}. Repair the operator choices before setup or launch; no profile fallback is allowed.`);
+  }
+}
+function saveWorkbenchConfig(config, home) {
+  const path = workbenchConfigPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, `${JSON.stringify(normalizeWorkbenchConfig(config), null, 2)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+  renameSync(temporary, path);
+  chmodSync(path, 384);
+}
+var PROVIDER_CONFIGURATION = {
+  "chatgpt-codex": ["ZERO_CHATGPT_ACCOUNT_ID", "ZERO_CHATGPT_BASE_URL"],
+  deepseek: ["DEEPSEEK_BASE_URL"],
+  openrouter: ["OPENROUTER_BASE_URL"],
+  azure: ["AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_API_VERSION", "AZURE_OPENAI_DEPLOYMENT", "OPENAI_BASE_URL"],
+  openai: ["OPENAI_BASE_URL"],
+  "z-ai": ["Z_AI_BASE_URL"],
+  kimi: ["KIMI_BASE_URL"],
+  qwen: ["QWEN_BASE_URL"],
+  xai: ["XAI_BASE_URL"],
+  opencode: ["OPENCODE_BASE_URL"],
+  copilot: ["COPILOT_BASE_URL"],
+  google: ["GOOGLE_CLOUD_PROJECT", "ZERO_GEMINI_PROJECT"],
+  anthropic: ["ANTHROPIC_BASE_URL"]
+};
+function selectedWorkbenchEnvironment(config, env, accounts) {
+  const selected = { version: 2, providers: {} };
+  const result = {};
+  for (const id of config.providers) {
+    const provider = PROVIDERS.find((candidate) => candidate.id === id);
+    if (!provider) throw new Error(`Unknown workbench provider grant: ${id}`);
+    const account = accounts.providers[id];
+    if (account) selected.providers[id] = account;
+    for (const name of [...provider.envVars, ...PROVIDER_CONFIGURATION[id] ?? []]) {
+      const value = env[name];
+      if (value?.trim()) result[name] = value;
+    }
+  }
+  Object.assign(result, accountEnvPatch(selected, result));
+  if (config.github) {
+    const token = env.GH_TOKEN?.trim() || env.GITHUB_TOKEN?.trim();
+    if (token) result.GH_TOKEN = token;
+  }
+  for (const name of ["TERM", "COLORTERM", "NO_COLOR", "LANG", "LC_ALL"]) {
+    const value = env[name];
+    if (value !== void 0) result[name] = value;
+  }
+  return result;
+}
+async function integrationEnvironment(config, home) {
+  const accounts = config.providers.length ? loadAccountStore(home) : { version: 2, providers: {} };
+  const environment = selectedWorkbenchEnvironment(config, process.env, accounts);
+  if (config.providers.includes("chatgpt-codex")) {
+    const codexEnvironment = {
+      ...environment,
+      ZERO_CHATGPT_AUTH_FILE: process.env.ZERO_CHATGPT_AUTH_FILE,
+      ZERO_CODEX_AUTH_JSON_PATH: process.env.ZERO_CODEX_AUTH_JSON_PATH
+    };
+    maybeLoadCodexAuth({ env: codexEnvironment, home });
+    for (const name of ["ZERO_CHATGPT_ACCESS_TOKEN", "ZERO_CHATGPT_OAUTH_REFRESH_TOKEN"]) {
+      const value = codexEnvironment[name];
+      if (value) environment[name] = value;
+    }
+  }
+  if (config.github && !environment.GH_TOKEN) {
+    try {
+      const { stdout } = await execFileAsync("gh", ["auth", "token"], { encoding: "utf8", timeout: 1e4, maxBuffer: 65536 });
+      if (stdout.trim()) environment.GH_TOKEN = stdout.trim();
+    } catch {
+      throw new Error("GitHub grant is enabled but no token is available. Connect gh on the host or run 0 workbench setup --no-github.");
+    }
+  }
+  return environment;
+}
+function resolveWorkbenchGuestSettings(settings, env = process.env) {
+  const privacy = { [ANALYTICS_LEVEL_ENV]: env[ANALYTICS_LEVEL_ENV] ?? settings.analyticsLevel };
+  for (const name of FEEDBACK_OPT_OUT_ENV) privacy[name] = env[name];
+  const environmentLevel = resolveAnalyticsLevel(privacy);
+  return normalizeSettings({
+    ...settings,
+    executionProfile: "local",
+    updatePolicy: "off",
+    analyticsLevel: levelAtLeast(environmentLevel, settings.analyticsLevel) ? settings.analyticsLevel : environmentLevel,
+    diagnosticReporting: submissionBlockedReason(privacy, { allowCloud: false }) === "opt-out" ? "off" : settings.diagnosticReporting
+  });
+}
+function workbenchNetworkEnabled(env = process.env) {
+  return submissionBlockedReason({ ZERO_OFFLINE: env.ZERO_OFFLINE }, { allowCloud: false }) !== "opt-out";
+}
+async function launchConfiguredWorkbench(args) {
+  const home = process.env.HOME || homedir();
+  if (args[0] === WORKBENCH_INNER_ARGUMENT) {
+    if (process.platform !== "linux" || !isAdmittedSmolvmWorkbench()) {
+      throw new Error("Missing authenticated SmolVM broker admission; refusing internal invocation.");
+    }
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    return void 0;
+  }
+  if (process.platform === "linux" && isAdmittedSmolvmWorkbench()) return void 0;
+  if (args[0] === "workbench" || args[0] === "config") return void 0;
+  const hostSettings = loadGlobalSettings(home, { requireExecutionProfile: existsSync(workbenchConfigPath(home)) });
+  if (hostSettings.executionProfile !== "smolvm") return void 0;
+  const config = loadWorkbenchConfig(home);
+  if (!config) throw new Error("SmolVM profile is selected but no workbench is configured. Run 0 workbench setup --image <approved-archive>.");
+  const workspaceRoot = realpathSync(config.workspaceRoot ?? process.cwd());
+  if (!lstatSync(workspaceRoot).isDirectory()) throw new Error("The configured workbench workspace is not a directory.");
+  const status = await getSmolvmWorkbenchStatus({ stateRoot: config.stateRoot, image: config.image });
+  if (status.retainedRuns.length) throw new Error("SmolVM has retained admission from an unproven cleanup. Resolve it before launching another workbench.");
+  if (!status.platformSupported || !status.runtimeReady || !status.imageApproved) {
+    throw new Error(status.error ?? "SmolVM runtime or approved image is unavailable. Run 0 workbench setup; host fallback is refused.");
+  }
+  const environment = await integrationEnvironment(config, home);
+  const network = workbenchNetworkEnabled();
+  if (!network) environment.ZERO_OFFLINE = "1";
+  const guestState = join(config.stateRoot, "guest-state");
+  mkdirSync(guestState, { recursive: true, mode: 448 });
+  if (!lstatSync(guestState).isDirectory() || lstatSync(guestState).isSymbolicLink()) throw new Error("Workbench guest-state must be a real private directory.");
+  const settingsFile = join(guestState, "tui-settings.json");
+  const temporarySettings = `${settingsFile}.${process.pid}.tmp`;
+  writeFileSync(temporarySettings, `${JSON.stringify(resolveWorkbenchGuestSettings(hostSettings), null, 2)}
+`, { mode: 384, flag: "wx" });
+  renameSync(temporarySettings, settingsFile);
+  const controller = new AbortController();
+  let signalCode;
+  const interrupt = () => {
+    signalCode = 130;
+    controller.abort();
+  };
+  const terminate = () => {
+    signalCode = 143;
+    controller.abort();
+  };
+  const hangup = () => {
+    signalCode = 129;
+    controller.abort();
+  };
+  process.once("SIGINT", interrupt);
+  process.once("SIGTERM", terminate);
+  process.once("SIGHUP", hangup);
+  let result;
+  try {
+    result = await runSmolvmWorkbench({
+      image: config.image,
+      workspaceRoot,
+      stateRoot: config.stateRoot,
+      command: ["/usr/local/bin/0", WORKBENCH_INNER_ARGUMENT, ...args],
+      environment,
+      network,
+      tty: !!process.stdin.isTTY && !!process.stdout.isTTY,
+      cpus: config.cpus,
+      memoryMb: config.memoryMb,
+      storageGb: config.storageGb,
+      signal: controller.signal,
+      approvedImages: config.approvedImages ?? []
+    });
+  } finally {
+    process.removeListener("SIGINT", interrupt);
+    process.removeListener("SIGTERM", terminate);
+    process.removeListener("SIGHUP", hangup);
+  }
+  if (result.cleanupFailed) {
+    process.stderr.write("[0] SmolVM cleanup could not be proven. Workbench admission/state is retained; host execution is refused.\n");
+    return 125;
+  }
+  if (result.error) process.stderr.write(`[0] ${result.error}
+`);
+  if (result.timedOut) return 124;
+  return signalCode ?? result.exitCode ?? 125;
+}
+function selectWorkbenchProfile(profile, home) {
+  if (!saveSettings({ ...loadGlobalSettings(home), executionProfile: profile }, home)) throw new Error("Could not persist the operator execution profile.");
+}
+
 // packages/cli/src/utils/update-check.ts
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join2 } from "node:path";
 import { spawn } from "node:child_process";
 var REPO = "0sec-labs/0";
 var INSTALL_URL = `https://raw.githubusercontent.com/${REPO}/main/install.sh`;
@@ -3080,7 +3337,7 @@ function recent(timestamp, now) {
 }
 function readCache() {
   try {
-    const raw = JSON.parse(readFileSync(join(homeStateDir(), "last-update-check"), "utf8"));
+    const raw = JSON.parse(readFileSync2(join2(homeStateDir(), "last-update-check"), "utf8"));
     if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
     const value = raw;
     if (typeof value.lastCheckedAt !== "string") return null;
@@ -3096,8 +3353,8 @@ function readCache() {
 }
 function writeCache(cache) {
   try {
-    mkdirSync(homeStateDir(), { recursive: true });
-    writeFileSync(join(homeStateDir(), "last-update-check"), JSON.stringify(cache));
+    mkdirSync2(homeStateDir(), { recursive: true });
+    writeFileSync2(join2(homeStateDir(), "last-update-check"), JSON.stringify(cache));
   } catch {
   }
 }
@@ -3245,6 +3502,15 @@ export {
   InvalidArgumentError,
   Command,
   Option,
+  workbenchConfigPath,
+  defaultWorkbenchStateRoot,
+  isPinnedWorkbenchImageReference,
+  loadWorkbenchConfig,
+  saveWorkbenchConfig,
+  resolveWorkbenchGuestSettings,
+  workbenchNetworkEnabled,
+  launchConfiguredWorkbench,
+  selectWorkbenchProfile,
   performAutoUpdate,
   runStartupUpdate
 };

package/chunks/{chunk-WZISK5VC.js → chunk-VWITLWXB.js}

@@ -4,7 +4,7 @@ const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir,
   runStateDir
-} from "./chunk-PC6RCKQV.js";
+} from "./chunk-KAU6NLGP.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";
@@ -409,6 +409,12 @@ var findings = sqliteTable("findings", {
    * `verificationSpec`: the blob is read and written whole.
    */
   verificationResult: text("verificationResult"),
+  /**
+   * JSON-stringified safe code-only source-verification summary. NULL when
+   * no scoped source workspace/spec was available or data is unusable; it
+   * never carries canonical replay status.
+   */
+  sourceVerification: text("sourceVerification"),
   /**
    * JSON-stringified Finding["reviewAnnotation"] — the scoped source
    * reference (`path` + line range, optional suggestion / knownMarker)
@@ -873,6 +879,9 @@ var osecDB = class {
     if (!colNames.has("reviewAnnotation")) {
       this.sqlite.exec("ALTER TABLE findings ADD COLUMN reviewAnnotation TEXT");
     }
+    if (!colNames.has("sourceVerification")) {
+      this.sqlite.exec("ALTER TABLE findings ADD COLUMN sourceVerification TEXT");
+    }
     this.sqlite.exec("UPDATE findings SET fingerprint = id WHERE fingerprint IS NULL OR fingerprint = ''");
     this.sqlite.exec("UPDATE findings SET triageStatus = 'new' WHERE triageStatus IS NULL OR triageStatus = ''");
     this.sqlite.exec(`
@@ -1364,6 +1373,7 @@ var osecDB = class {
     const semanticDedupeJson = finding.semanticDedupe ? JSON.stringify(finding.semanticDedupe) : null;
     const verificationResultJson = serializeFindingVerificationResult(finding.verification_result);
     const reviewAnnotationJson = serializeFindingReviewAnnotation(finding.reviewAnnotation);
+    const sourceVerificationJson = serializeFindingSourceVerification(finding.sourceVerification);
     const candidateFindingRank = finding.findingRank;
     const findingRank = typeof candidateFindingRank === "number" && Number.isSafeInteger(candidateFindingRank) && candidateFindingRank > 0 ? candidateFindingRank : null;
     const derivedEvidence = deriveEvidenceFromPocSteps(finding);
@@ -1400,6 +1410,7 @@ var osecDB = class {
       findingRank,
       verificationResult: verificationResultJson,
       reviewAnnotation: reviewAnnotationJson,
+      sourceVerification: sourceVerificationJson,
       timestamp: finding.timestamp
     }).onConflictDoUpdate({
       target: findings.id,
@@ -1431,6 +1442,7 @@ var osecDB = class {
         findingRank,
         verificationResult: verificationResultJson,
         reviewAnnotation: reviewAnnotationJson,
+        sourceVerification: sourceVerificationJson,
         timestamp: finding.timestamp
       }
     }).run();
@@ -1440,11 +1452,10 @@ var osecDB = class {
     return this.db.select().from(findings).where(eq(findings.id, findingId)).get();
   }
   /**
-   * Read path for the two source-fix gate fields. Returns the hydrated
-   * `verification_result` / `reviewAnnotation` for a finding, with each key
-   * omitted when the finding has none (including rows written before the
-   * columns existed). Callers building a `Finding` spread this over the row:
-   * `{ ...mapped, ...db.getFindingReviewFields(id) }`.
+   * Read path for the persisted `verification_result`, `reviewAnnotation`,
+   * and `sourceVerification` fields. The first two retain their existing
+   * source-fix gate semantics; a source-only check is never replay evidence.
+   * Each key is omitted when absent, including for pre-migration rows.
    */
   getFindingReviewFields(findingId) {
     return restoreFindingReviewFields(this.getFinding(findingId));
@@ -2169,6 +2180,38 @@ function parseFindingReviewAnnotation(value) {
     return void 0;
   return parsed;
 }
+function parseFindingSourceVerification(value) {
+  const parsed = parseJsonObjectColumn(value);
+  if (!parsed)
+    return void 0;
+  const status = parsed.status;
+  const totalPredicates = parsed.totalPredicates;
+  const matchedPredicates = parsed.matchedPredicates;
+  const notMatchedPredicates = parsed.notMatchedPredicates;
+  const inconclusivePredicates = parsed.inconclusivePredicates;
+  const behaviorPending = parsed.behaviorPending;
+  if (status !== "matched" && status !== "not_confirmed" && status !== "inconclusive" || typeof totalPredicates !== "number" || !Number.isSafeInteger(totalPredicates) || totalPredicates < 0 || typeof matchedPredicates !== "number" || !Number.isSafeInteger(matchedPredicates) || matchedPredicates < 0 || typeof notMatchedPredicates !== "number" || !Number.isSafeInteger(notMatchedPredicates) || notMatchedPredicates < 0 || typeof inconclusivePredicates !== "number" || !Number.isSafeInteger(inconclusivePredicates) || inconclusivePredicates < 0 || typeof behaviorPending !== "boolean") {
+    return void 0;
+  }
+  const countSum = matchedPredicates + notMatchedPredicates + inconclusivePredicates;
+  if (!Number.isSafeInteger(countSum) || countSum !== totalPredicates)
+    return void 0;
+  if (status === "matched" && (totalPredicates === 0 || matchedPredicates !== totalPredicates || notMatchedPredicates !== 0 || inconclusivePredicates !== 0) || status === "not_confirmed" && (notMatchedPredicates === 0 || inconclusivePredicates !== 0) || status === "inconclusive" && inconclusivePredicates === 0 && totalPredicates !== 0) {
+    return void 0;
+  }
+  return {
+    status,
+    totalPredicates,
+    matchedPredicates,
+    notMatchedPredicates,
+    inconclusivePredicates,
+    behaviorPending
+  };
+}
+function serializeFindingSourceVerification(value) {
+  const usable = parseFindingSourceVerification(value);
+  return usable ? JSON.stringify(usable) : null;
+}
 function serializeFindingVerificationResult(value) {
   const usable = parseFindingVerificationResult(value);
   return usable ? JSON.stringify(usable) : null;
@@ -2182,9 +2225,11 @@ function restoreFindingReviewFields(row) {
     return {};
   const verificationResult = parseFindingVerificationResult(row.verificationResult);
   const reviewAnnotation = parseFindingReviewAnnotation(row.reviewAnnotation);
+  const sourceVerification = parseFindingSourceVerification(row.sourceVerification);
   return {
     ...verificationResult ? { verification_result: verificationResult } : {},
-    ...reviewAnnotation ? { reviewAnnotation } : {}
+    ...reviewAnnotation ? { reviewAnnotation } : {},
+    ...sourceVerification ? { sourceVerification } : {}
   };
 }
 function deriveEvidenceFromPocSteps(finding) {
@@ -2278,6 +2323,7 @@ CREATE TABLE IF NOT EXISTS findings (
   findingRank INTEGER,
   verificationResult TEXT,
   reviewAnnotation TEXT,
+  sourceVerification TEXT,
   timestamp INTEGER NOT NULL
 );
 

package/chunks/{chunk-ER3SUMYJ.js → chunk-W6UWZFKL.js}

@@ -1,10 +1,6 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  eventBus,
-  isCloudEventSinkActive
-} from "./chunk-CXKDWFNO.js";
 
 // packages/core/dist/runtime/process.js
 import { spawn } from "node:child_process";
@@ -76,21 +72,6 @@ function buildOsecMcpCommandArgs(context) {
   }
   return args;
 }
-function numericField(obj, key) {
-  const v = obj[key];
-  if (typeof v === "number" && Number.isFinite(v))
-    return v;
-  if (typeof v === "string" && /^\d+$/.test(v))
-    return Number(v);
-  return void 0;
-}
-function safeJsonStringify(v) {
-  try {
-    return JSON.stringify(v) ?? "";
-  } catch {
-    return "(unserialisable)";
-  }
-}
 function buildClaudeMcpConfig(context) {
   return JSON.stringify({
     mcpServers: {
@@ -124,180 +105,6 @@ var ProcessRuntime = class {
     const args = this.buildArgs(prompt, context);
     const env = this.buildEnv(context);
     const onToolCall = this.config.onToolCall;
-    const scanId = context?.scanId;
-    const emitScanEvents = this.type === "codex" && isCloudEventSinkActive();
-    const maxTurnsHint = 40;
-    let turnNumber = 0;
-    let toolCallSeq = 0;
-    let deltaSeq = 0;
-    let turnStartedAt = 0;
-    const toolCallStartedAt = /* @__PURE__ */ new Map();
-    const seenSequenceNumbers = /* @__PURE__ */ new Set();
-    const isSeenSequence = (event) => {
-      const seq = event.sequence_number;
-      if (typeof seq !== "number" && typeof seq !== "string")
-        return false;
-      const key = `${event.type ?? "?"}|${seq}`;
-      if (seenSequenceNumbers.has(key))
-        return true;
-      seenSequenceNumbers.add(key);
-      return false;
-    };
-    const emitCodexCloudEvents = (event) => {
-      if (isSeenSequence(event))
-        return;
-      const eventType = typeof event.type === "string" ? event.type : "";
-      switch (eventType) {
-        case "thread.started": {
-          eventBus.emit("llm_planner_invoked", {
-            turn: 0,
-            model: this.config.model,
-            role: "attack"
-          });
-          return;
-        }
-        case "turn.started": {
-          turnNumber += 1;
-          turnStartedAt = Date.now();
-          deltaSeq = 0;
-          eventBus.emit("agent_turn_started", {
-            turn: turnNumber,
-            max_turns: maxTurnsHint,
-            role: "attack"
-          });
-          eventBus.emit("llm_planner_invoked", {
-            turn: turnNumber,
-            model: this.config.model,
-            role: "attack"
-          });
-          return;
-        }
-        case "turn.completed": {
-          const usage = event.usage ?? {};
-          const inputTokens = numericField(usage, "input_tokens");
-          const cachedInputTokens = numericField(usage, "cached_input_tokens");
-          const outputTokens = numericField(usage, "output_tokens");
-          const reasoningTokens = numericField(usage, "reasoning_output_tokens");
-          const durationMs = turnStartedAt > 0 ? Date.now() - turnStartedAt : 0;
-          eventBus.emit("agent_turn_completed", {
-            turn: turnNumber,
-            duration_ms: durationMs,
-            reason: "continue",
-            role: "attack"
-          });
-          eventBus.emit("cost_update", {
-            turn: turnNumber,
-            cost_usd: 0,
-            input_tokens: inputTokens,
-            output_tokens: outputTokens,
-            token_input: inputTokens,
-            token_output: outputTokens,
-            cached_input_tokens: cachedInputTokens,
-            reasoning_output_tokens: reasoningTokens
-          });
-          return;
-        }
-        case "item.started": {
-          const item = event.item ?? {};
-          const itemType = typeof item.type === "string" ? item.type : "";
-          if (itemType === "command_execution" && typeof item.command === "string") {
-            toolCallSeq += 1;
-            toolCallStartedAt.set(toolCallSeq, Date.now());
-            eventBus.emit("tool_call_started", {
-              tool: "shell",
-              turn: turnNumber,
-              args_preview: item.command.slice(0, 200),
-              ts: Date.now()
-            });
-          } else if (itemType === "mcp_tool_call") {
-            toolCallSeq += 1;
-            toolCallStartedAt.set(toolCallSeq, Date.now());
-            const server = typeof item.server === "string" ? item.server : "?";
-            const tool = typeof item.tool === "string" ? item.tool : "?";
-            const argsRaw = item.arguments ?? {};
-            const argsPreview = typeof argsRaw === "string" ? argsRaw : safeJsonStringify(argsRaw);
-            eventBus.emit("tool_call_started", {
-              tool: `${server}__${tool}`,
-              turn: turnNumber,
-              args_preview: argsPreview.slice(0, 200),
-              ts: Date.now()
-            });
-          }
-          return;
-        }
-        case "item.completed": {
-          const item = event.item ?? {};
-          const itemType = typeof item.type === "string" ? item.type : "";
-          if (itemType === "command_execution") {
-            const startedAt = toolCallStartedAt.get(toolCallSeq);
-            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
-            toolCallStartedAt.delete(toolCallSeq);
-            eventBus.emit("tool_call_completed", {
-              tool: "shell",
-              turn: turnNumber,
-              duration_ms: durationMs,
-              status: "ok",
-              ts: Date.now()
-            });
-          } else if (itemType === "mcp_tool_call") {
-            const startedAt = toolCallStartedAt.get(toolCallSeq);
-            const durationMs = startedAt != null ? Date.now() - startedAt : 0;
-            toolCallStartedAt.delete(toolCallSeq);
-            const server = typeof item.server === "string" ? item.server : "?";
-            const tool = typeof item.tool === "string" ? item.tool : "?";
-            const status = item.status === "success" || item.status === "completed" ? "ok" : "error";
-            const errorMsg = status === "error" ? typeof item.error === "string" ? item.error : safeJsonStringify(item.error ?? null) : void 0;
-            eventBus.emit("tool_call_completed", {
-              tool: `${server}__${tool}`,
-              turn: turnNumber,
-              duration_ms: durationMs,
-              status,
-              ...errorMsg ? { error: errorMsg.slice(0, 400) } : {},
-              ts: Date.now()
-            });
-          } else if (itemType === "function_call" || itemType === "tool_call") {
-            toolCallSeq += 1;
-            const toolName = typeof item.tool_name === "string" && item.tool_name || typeof item.name === "string" && item.name || "mcp_tool";
-            const argsField = item.arguments ?? item.input ?? "";
-            const detail = typeof argsField === "string" ? argsField : safeJsonStringify(argsField);
-            eventBus.emit("tool_call_started", {
-              tool: toolName,
-              turn: turnNumber,
-              args_preview: detail.slice(0, 200),
-              ts: Date.now()
-            });
-            eventBus.emit("tool_call_completed", {
-              tool: toolName,
-              turn: turnNumber,
-              duration_ms: 0,
-              status: "ok",
-              ts: Date.now()
-            });
-          } else if (itemType === "reasoning") {
-            const reasoningText = typeof item.text === "string" && item.text || typeof item.summary === "string" && item.summary || "";
-            if (reasoningText.length > 0) {
-              eventBus.emit("reasoning_summary", {
-                turn: turnNumber,
-                summary: reasoningText.slice(0, 2e3)
-              });
-            }
-          } else if (itemType === "agent_message") {
-            const messageText = typeof item.text === "string" ? item.text : "";
-            if (messageText.length > 0) {
-              deltaSeq += 1;
-              eventBus.emit("delta", {
-                turn: turnNumber,
-                scope: "assistant_response",
-                text: messageText.slice(0, 2e3),
-                seq: deltaSeq,
-                role: "attack"
-              });
-            }
-          }
-          return;
-        }
-      }
-    };
     return new Promise((resolve2) => {
       let stdout = "";
       let stderr = "";
@@ -352,8 +159,6 @@ var ProcessRuntime = class {
                 } else if (event.item.type === "command_execution" && event.item.command) {
                 }
               }
-              if (emitScanEvents)
-                emitCodexCloudEvents(event);
             } catch {
             }
           }