0sec-cli 0.22.0 → 0.22.1

package/chunks/{commands-NEI7L3QA.js → commands-N6GN5SBF.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   registerOrchestrateCommand
-} from "./chunk-OWLJYJ5O.js";
+} from "./chunk-TV27OWIW.js";
 import {
   registerDbCommand
-} from "./chunk-LCRTAQN2.js";
+} from "./chunk-IVQV574Y.js";
 import {
   canUseOpenTui,
   isBunRuntime
@@ -29,8 +29,8 @@ import {
   resolveFindingChatIntent,
   runUnified,
   startCodexDeviceAuth
-} from "./chunk-CAYANSH6.js";
-import "./chunk-MICHDTBK.js";
+} from "./chunk-BCSRRQG5.js";
+import "./chunk-BOUGKEKA.js";
 import {
   Command,
   InvalidArgumentError,
@@ -44,7 +44,7 @@ import {
   selectWorkbenchProfile,
   workbenchConfigPath,
   workbenchNetworkEnabled
-} from "./chunk-7UFUALR2.js";
+} from "./chunk-V6GHX34G.js";
 import {
   DEFAULT_SETTINGS,
   DEFAULT_THEME_NAME,
@@ -76,7 +76,7 @@ import {
   validateTheme,
   writeInstalledTheme,
   writePresentationLine
-} from "./chunk-YIQSGNAA.js";
+} from "./chunk-GOEA3NW6.js";
 import {
   AjvJsonSchemaValidator,
   CallToolRequestSchema,
@@ -205,12 +205,12 @@ import {
   toScopeFile,
   withVariantFeatureFlags,
   writeAgentActionEvidenceBundle
-} from "./chunk-EGZGZFAH.js";
+} from "./chunk-LGCASF2C.js";
 import {
   RateLimiter,
   enumerateJsChunkUrls,
   parseRateLimitFlag
-} from "./chunk-LYUAM3TG.js";
+} from "./chunk-XCISCI4T.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -222,7 +222,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-RSIUX3RW.js";
+} from "./chunk-3E2KALZ5.js";
 import {
   oracleForCategory
 } from "./chunk-TM74SSHC.js";
@@ -237,15 +237,15 @@ import {
   DETECTOR_REGISTRY,
   resolveDetectors
 } from "./chunk-DQTNI3KY.js";
-import "./chunk-VMRRNRMR.js";
-import "./chunk-DM5C5L5D.js";
+import "./chunk-7XCKYNLO.js";
+import "./chunk-ZKQ2I3S2.js";
 import {
   adaptAndVerify
-} from "./chunk-RRD4XXPU.js";
-import "./chunk-HUNAPTKV.js";
+} from "./chunk-CPWA6RWE.js";
+import "./chunk-4G7OVYJX.js";
 import "./chunk-AZ7L3HFD.js";
-import "./chunk-UU7PQP6N.js";
-import "./chunk-UV5QWZGE.js";
+import "./chunk-OSBPGWTE.js";
+import "./chunk-5BTJMINS.js";
 import {
   DockerRunner,
   LocalShellRunner,
@@ -277,7 +277,7 @@ import {
   runSmolvmPocSteps,
   targetRequiresScope,
   validateAwsCredentials
-} from "./chunk-SJBCK2EI.js";
+} from "./chunk-HHPWRY2M.js";
 import "./chunk-K2PWUPUI.js";
 import {
   buildIntelDossier,
@@ -285,14 +285,14 @@ import {
   searchAdvisories,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-TZFIAMWZ.js";
+} from "./chunk-YL6YAGLL.js";
 import "./chunk-2OQOQ2FZ.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-OAYUPGF6.js";
-import "./chunk-XFCTUKXR.js";
+import "./chunk-NLH4LMWH.js";
+import "./chunk-WZRVS7SB.js";
 import {
   runSourceFix
-} from "./chunk-HR2TU42B.js";
+} from "./chunk-XA2O4WXA.js";
 import {
   DEFAULT_WORKBENCH_BROKER_LIMITS,
   appendImprovementLedgerEntry,
@@ -305,7 +305,7 @@ import {
   resolveSmolvmRuntime,
   runWorkbenchBrokerProgram,
   verifyImprovementLedger
-} from "./chunk-RE5EZDG2.js";
+} from "./chunk-OHHCGDJ2.js";
 import {
   runHttpConformanceCheck
 } from "./chunk-SQCBHFWN.js";
@@ -314,7 +314,7 @@ import {
 } from "./chunk-GVD6SJGH.js";
 import {
   createRuntime
-} from "./chunk-5MWAG3FT.js";
+} from "./chunk-IFME676H.js";
 import "./chunk-W6UWZFKL.js";
 import {
   buildAdGraph,
@@ -333,7 +333,7 @@ import {
   resolveOsecDbPath,
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-VNRY6AWF.js";
+} from "./chunk-VWITLWXB.js";
 import {
   DISCLOSURE_STATUSES,
   IncompleteEvidenceError,
@@ -366,7 +366,7 @@ import {
 import {
   findCveArtifacts,
   normaliseCveId
-} from "./chunk-LPTRPRZR.js";
+} from "./chunk-XDKB2P5X.js";
 import {
   prepare
 } from "./chunk-V36HVTUL.js";
@@ -377,13 +377,13 @@ import {
   getScopeEnforcementState,
   isScopeEnforcementEnabled,
   loadScope
-} from "./chunk-7DEHG7YT.js";
+} from "./chunk-X7LAEEUW.js";
 import "./chunk-5IBCBQEH.js";
-import "./chunk-IO7R7WBM.js";
+import "./chunk-WSDDGFA6.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-2GV4HQKE.js";
+} from "./chunk-AV2LG2L7.js";
 import {
   AgentActionScenarioSchema,
   DEFAULT_AUTONOMY_MODE,
@@ -400,7 +400,7 @@ import {
   parseAgentActionEvidenceManifest,
   pocStepArraySchema,
   reportSummarySchema
-} from "./chunk-76KSBWOQ.js";
+} from "./chunk-KAU6NLGP.js";
 import {
   ZodOptional,
   external_exports
@@ -533,7 +533,7 @@ function registerScanCommand(program) {
   ).option("--base <branch>", "Base branch for `--emit pr` (default: main)").option("--dry-run", "For `--emit pr`: print git/gh commands instead of running them. Auto-enabled if `gh auth status` fails.", false).option("--emit-out-dir <path>", "Directory for `--emit pr` rollup files (default: system temp)").option("--resume <run-id>", "Resume a previous run from its journal on disk (0#374). Locates the run's journal, rehydrates agent state, and continues from the last entry.").option("--branch-from <entry-index>", "Branch the journal at the given entry index before resuming (requires --resume). Copies entries 0..N into a new run and resumes from there.").option("--verbose", "Show detailed output", false).option("--replay", "Replay the last scan's results", false).action(async (opts) => {
     if (opts.replay) {
       try {
-        const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+        const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
         const db = new osecDB2(opts.dbPath);
         const scans = db.listScans(1);
         if (scans.length === 0) {
@@ -662,7 +662,7 @@ function registerScanCommand(program) {
         process.exit(2);
       }
       try {
-        const { loadScope: loadScope2 } = await import("./dist-3FNZIBB4.js");
+        const { loadScope: loadScope2 } = await import("./dist-L3XJWWZ6.js");
         const policy = loadScope2(scopeFile);
         const verdict = scopeEnforcement.enabled ? policy.match(String(opts.target)) : void 0;
         if (verdict && !verdict.allowed) {
@@ -689,7 +689,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveAttribution: resolveAttribution2,
         extractAttributionFromScopeJson: extractAttributionFromScopeJson2
-      } = await import("./dist-3FNZIBB4.js");
+      } = await import("./dist-L3XJWWZ6.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveAttribution2({
         scopeFileBlock: policy ? extractAttributionFromScopeJson2(policy.raw) : void 0,
@@ -707,7 +707,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveEngagementProfile: resolveEngagementProfile2,
         extractEngagementFromScopeJson: extractEngagementFromScopeJson2
-      } = await import("./dist-3FNZIBB4.js");
+      } = await import("./dist-L3XJWWZ6.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveEngagementProfile2({
         scopeFileBlock: policy ? extractEngagementFromScopeJson2(policy.raw) : void 0,
@@ -736,7 +736,7 @@ function registerScanCommand(program) {
     const rateLimit = opts.rateLimit;
     if (rateLimit !== void 0 && rateLimit !== "") {
       try {
-        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-3FNZIBB4.js");
+        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-L3XJWWZ6.js");
         parseRateLimitFlag2(rateLimit);
       } catch (err) {
         console.error(source_default.red(err instanceof Error ? err.message : String(err)));
@@ -905,7 +905,7 @@ function registerResumeCommand(program) {
 
 // packages/cli/src/commands/replay.ts
 async function replayScan(opts) {
-  const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+  const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
   const db = new osecDB2(opts.dbPath);
   const requestedScan = opts.scan;
   let scanRecord;
@@ -974,7 +974,7 @@ function registerReplayCommand(program) {
     try {
       const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-XFWJTBUO.js");
       if (isBunRuntime2() && canUseOpenTui2()) {
-        const { showOpenTuiReplay } = await import("./run-U3XU4CTC.js");
+        const { showOpenTuiReplay } = await import("./run-GAFKBCTN.js");
         await showOpenTuiReplay({ dbPath: opts.dbPath, scanId: opts.scan });
         return;
       }
@@ -995,7 +995,7 @@ function registerHistoryCommand(program) {
     const limit2 = Number.parseInt(opts.limit ?? "10", 10);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-XFWJTBUO.js");
     if (opts.dbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiHistory } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiHistory } = await import("./run-GAFKBCTN.js");
       await showOpenTuiHistory({ dbPath: opts.dbPath, limit: limit2 });
       return;
     }
@@ -1186,7 +1186,7 @@ function registerFindingsCommand(program) {
     const selectedDbPath = resolveDbPath(resolved);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-XFWJTBUO.js");
     if (selectedDbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiFindings } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiFindings } = await import("./run-GAFKBCTN.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1209,7 +1209,7 @@ function registerFindingsCommand(program) {
     const selectedDbPath = resolveDbPath(resolved);
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-XFWJTBUO.js");
     if (selectedDbPath && isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiFindings } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiFindings } = await import("./run-GAFKBCTN.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1267,7 +1267,7 @@ function registerFindingsCommand(program) {
         console.log(`  ${source_default.dim(finding.evidenceAnalysis)}`);
       }
       {
-        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-3FNZIBB4.js");
+        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-L3XJWWZ6.js");
         const provenance = summarizeTriageProvenance({
           ...finding,
           layerVerdicts: parseLayerVerdicts(finding.layerVerdicts)
@@ -1387,7 +1387,7 @@ import { existsSync as existsSync3 } from "node:fs";
 var VALID_BUILD_SYSTEMS = /* @__PURE__ */ new Set(["autotools", "cmake", "meson", "auto"]);
 var VALID_SANITIZERS = /* @__PURE__ */ new Set(["asan", "ubsan", "msan"]);
 async function runHarnessTier2(args2) {
-  const { buildTier2Harness, extractCorpus } = await import("./dist-3FNZIBB4.js");
+  const { buildTier2Harness, extractCorpus } = await import("./dist-L3XJWWZ6.js");
   const repoAbs = resolve2(args2.repo);
   if (!existsSync3(repoAbs)) {
     throw new Error(`Tier-2: repo path '${repoAbs}' does not exist.`);
@@ -1483,7 +1483,7 @@ async function runHarnessTier3(args2) {
     buildTier2Harness,
     extractCorpus,
     runTier3Validation
-  } = await import("./dist-3FNZIBB4.js");
+  } = await import("./dist-L3XJWWZ6.js");
   const repoAbs = resolve3(args2.repo);
   if (!existsSync4(repoAbs)) {
     throw new Error(`Tier-3: repo path '${repoAbs}' does not exist.`);
@@ -1703,7 +1703,7 @@ function registerReviewCommand(program) {
     let seedFindings;
     const seedPath = opts.seedFindings;
     if (seedPath) {
-      const { readSeedFindings } = await import("./dist-3FNZIBB4.js");
+      const { readSeedFindings } = await import("./dist-L3XJWWZ6.js");
       seedFindings = readSeedFindings(seedPath);
       console.log(
         source_default.cyan(
@@ -1719,7 +1719,7 @@ function registerReviewCommand(program) {
       );
     }
     if (fixCommit) {
-      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-3FNZIBB4.js");
+      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-L3XJWWZ6.js");
       const result = huntAppFixVariants({
         repoPath: repo,
         fixCommit
@@ -2024,7 +2024,7 @@ function registerDoctorCommand(program) {
   program.command("doctor").description("Check local runtime prerequisites and suggest the next command").action(async () => {
     const { isBunRuntime: isBunRuntime2, canUseOpenTui: canUseOpenTui2 } = await import("./runtime-XFWJTBUO.js");
     if (isBunRuntime2() && canUseOpenTui2()) {
-      const { showOpenTuiDoctor } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiDoctor } = await import("./run-GAFKBCTN.js");
       await showOpenTuiDoctor();
       return;
     }
@@ -3351,7 +3351,7 @@ data: ${JSON.stringify(event)}
 `);
 }
 async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
-  const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+  const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
   if (isPresentationEventsStreamPath(pathname)) {
     if (req.method !== "GET") {
       json(res, 405, { error: "Method not allowed" });
@@ -3405,7 +3405,7 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
       return true;
     }
     if (controlPath.action === "recover-stale-workers") {
-      const { recoverStaleWorkers } = await import("./orchestrate-2GWGNTBF.js");
+      const { recoverStaleWorkers } = await import("./orchestrate-DWWUT5RC.js");
       const body = await readJson(req);
       const recovered = recoverStaleWorkers(
         dbPath,
@@ -3489,8 +3489,8 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken) {
       return true;
     }
     if (controlPath.action === "reset-database") {
-      const { resetOsecDatabase } = await import("./dist-5YHYNLI3.js");
-      const { seedVerificationWorkbench } = await import("./db-5AP3JB4W.js");
+      const { resetOsecDatabase } = await import("./dist-FSS7MBDF.js");
+      const { seedVerificationWorkbench } = await import("./db-5IWEJUYV.js");
       const body = await readJson(req);
       const seed = typeof body.seed === "string" ? body.seed.trim().toLowerCase() : "verification";
       if (!["verification", "empty"].includes(seed)) {
@@ -3835,7 +3835,7 @@ function registerTuiCommand(program) {
   program.command("tui").alias("watch").description("Open the unified engagement control plane (Bun-only)").action(async () => {
     const { isBunRuntime: isBunRuntime2 } = await import("./runtime-XFWJTBUO.js");
     if (isBunRuntime2()) {
-      const { showOpenTuiHome } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiHome } = await import("./run-GAFKBCTN.js");
       await showOpenTuiHome();
       return;
     }
@@ -5692,11 +5692,11 @@ function rowToFinding(row) {
   };
 }
 async function openStore(dbPath) {
-  const { MemoryStore } = await import("./dist-3FNZIBB4.js");
+  const { MemoryStore } = await import("./dist-L3XJWWZ6.js");
   return new MemoryStore(dbPath);
 }
 async function loadFinding2(dbPath, findingId) {
-  const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+  const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
   const db = new osecDB2(dbPath);
   try {
     const rows = db.listFindings({ limit: 5e3 });
@@ -5771,7 +5771,7 @@ async function runMemoryRemove(id, dbPath) {
 async function runMarkFp(findingId, opts) {
   const row = await loadFinding2(opts.dbPath, findingId);
   const finding = rowToFinding(row);
-  const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+  const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
   const db = new osecDB2(opts.dbPath);
   try {
     db.updateFindingTriage(row.id, "suppressed", opts.reason);
@@ -9486,7 +9486,7 @@ function registerIngestCommand(program) {
         reviewKernelCrashSubsystems,
         verifyStandaloneKernelReproducer,
         verifyKernelCrash
-      } = await import("./dist-3FNZIBB4.js");
+      } = await import("./dist-L3XJWWZ6.js");
       let kernelBuild;
       if (opts.kernelTree) {
         kernelBuild = prepareKernelVmArtifacts({
@@ -9909,7 +9909,7 @@ function registerKernelCommand(program) {
         checkAlreadyFixed,
         rankKernelHypothesesWithJev,
         verifyStaticKernelFinding
-      } = await import("./dist-3FNZIBB4.js");
+      } = await import("./dist-L3XJWWZ6.js");
       const noveltyExcluded = opts.upstreamTree ? findings.flatMap((finding) => {
         const path = finding.reviewAnnotation?.path ?? finding.evidence.request.match(/([^\s:]+\.[ch]):\d+/)?.[1];
         if (!path) return [];
@@ -9956,7 +9956,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev commit prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { rankKernelCommitsWithJev } = await import("./dist-3FNZIBB4.js");
+      const { rankKernelCommitsWithJev } = await import("./dist-L3XJWWZ6.js");
       const result = await rankKernelCommitsWithJev({
         tree: opts.tree,
         evaluator: createJevEvaluator(config),
@@ -9980,7 +9980,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev source prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { runKernelSourceJevPrepass } = await import("./dist-3FNZIBB4.js");
+      const { runKernelSourceJevPrepass } = await import("./dist-L3XJWWZ6.js");
       const result = await runKernelSourceJevPrepass({
         tree: opts.tree,
         subtree: opts.subtree,
@@ -10014,7 +10014,7 @@ function registerKernelCommand(program) {
       if (crashes.length === 0) throw new Error("Crash input must be a CrashRecord[] or an object with a crashes array");
       const records = crashes.filter((c) => !!c && typeof c === "object" && "id" in c && "summary" in c && typeof c.id === "string" && typeof c.summary === "string");
       if (records.length !== crashes.length) throw new Error("Every crash record requires string id and summary fields");
-      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-3FNZIBB4.js");
+      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-L3XJWWZ6.js");
       const result = await rankCrashesWithJev(
         records,
         createJevEvaluator(config)
@@ -10042,7 +10042,7 @@ function registerKernelCommand(program) {
       const details = parsePositiveInt(opts.details, "--details", 100);
       const detailDelayMs = parsePositiveInt(opts.detailDelay, "--detail-delay", 5e3);
       const subsystems = opts.subsystems.split(",").map((value) => value.trim()).filter(Boolean);
-      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-3FNZIBB4.js");
+      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-L3XJWWZ6.js");
       const result = await mineSyzbotQueue({
         fetch: defaultSyzbotFetcher,
         fetchDetail: defaultSyzbotFetcher,
@@ -10100,7 +10100,7 @@ function registerKernelCommand(program) {
           `Invalid output format '${opts.output}'. Valid: ${VALID_OUTPUT_FORMATS2.join(", ")}`
         );
       }
-      const { runKernelVariantHunt } = await import("./dist-3FNZIBB4.js");
+      const { runKernelVariantHunt } = await import("./dist-L3XJWWZ6.js");
       const report = await runKernelVariantHunt({
         tree: opts.tree,
         advisory: opts.advisory,
@@ -10203,7 +10203,7 @@ function resolveOutputDir(opts, scanId) {
   return join10(homedir2(), "0", "disclosures", `scan-${scanId.slice(0, 8)}`);
 }
 async function disclose(findingId, opts) {
-  const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+  const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
   const db = new osecDB2(opts.dbPath);
   try {
     let routeDroppedFinding2 = function(args2) {
@@ -10965,7 +10965,7 @@ function parseDurationMs(raw) {
   }
 }
 async function runKernelFindingVerify(opts) {
-  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-3FNZIBB4.js");
+  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-L3XJWWZ6.js");
   const rawFinding = readJson2(opts.findingPath, "finding");
   let finding;
   try {
@@ -11520,7 +11520,7 @@ async function runExploit(opts) {
     classifyPrimitiveFromDmesg,
     describeKernelPrimitive,
     runWeaponization
-  } = await import("./dist-3FNZIBB4.js");
+  } = await import("./dist-L3XJWWZ6.js");
   const rawFinding = readJson3(opts.findingPath, "finding");
   let finding;
   try {
@@ -11583,7 +11583,7 @@ async function runExploit(opts) {
 }
 async function exploitAction(opts) {
   if (opts.agent) {
-    const { agentFromExploitOpts } = await import("./exploit-agent-N4A5ELBK.js");
+    const { agentFromExploitOpts } = await import("./exploit-agent-KW4EB7BE.js");
     process.exitCode = await agentFromExploitOpts({
       ...opts.task ? { task: opts.task } : {},
       ...opts.flagPath ? { flagPath: opts.flagPath } : {},
@@ -11598,7 +11598,7 @@ async function exploitAction(opts) {
     return;
   }
   if (opts.autoclimb) {
-    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-N7P6KIF5.js");
+    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-CXJ2ERRO.js");
     process.exitCode = await autoclimbFromExploitOpts({
       ...opts.bugSpec ? { bugSpec: opts.bugSpec } : {},
       ...opts.bootScript ? { bootScript: opts.bootScript } : {},
@@ -11612,7 +11612,7 @@ async function exploitAction(opts) {
     throw new Error("missing required flag: --finding <path>");
   }
   if (opts.climb) {
-    const { runClimb } = await import("./exploit-climb-WNEJUB5W.js");
+    const { runClimb } = await import("./exploit-climb-TJWLY4XC.js");
     let loopBoots = 8;
     if (opts.loopBoots !== void 0) {
       loopBoots = parseInt(opts.loopBoots, 10);
@@ -11785,7 +11785,7 @@ async function runHunt(opts) {
     makeLloreJudge,
     makeHuntProveStage,
     prepare: prepare2
-  } = await import("./dist-3FNZIBB4.js");
+  } = await import("./dist-L3XJWWZ6.js");
   const log = opts.log ?? (() => {
   });
   const runtime = opts.runtime ?? "api";
@@ -12133,7 +12133,7 @@ function parseWitnessMode(raw) {
 }
 async function recencyAction(opts) {
   if (!opts.tree) throw new Error("missing required flag: --tree <kernel source tree>");
-  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-3FNZIBB4.js");
+  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-L3XJWWZ6.js");
   const tree = resolve16(opts.tree);
   const runtime = opts.runtime ?? "api";
   const modelDir = opts.modelDir ? resolve16(opts.modelDir) : join12(tree, ".recency-models");
@@ -12473,7 +12473,7 @@ async function runDeepReview(opts) {
     cairoVerifyLenses,
     moveFinderLenses,
     moveVerifyLenses
-  } = await import("./dist-3FNZIBB4.js");
+  } = await import("./dist-L3XJWWZ6.js");
   const costLedger = new ScanCostLedger();
   const scanStartedAt = Date.now();
   const log = opts.log ?? (() => {
@@ -12519,7 +12519,7 @@ async function runDeepReview(opts) {
     let lanes = null;
     let allocateAcrossLanes;
     if (opts.useThreatModel) {
-      const threatModule = await import("./dist-3FNZIBB4.js");
+      const threatModule = await import("./dist-L3XJWWZ6.js");
       allocateAcrossLanes = threatModule.allocateCandidatesAcrossLanes;
       const rtType = runtime !== "auto" ? runtime : "api";
       const plannerRuntime = threatModule.createRuntime({
@@ -12903,7 +12903,7 @@ function resolveArtifactDir(value, sourceRoot) {
   return canonicalArtifactDir;
 }
 async function runMemSafety(opts) {
-  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-3FNZIBB4.js");
+  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-L3XJWWZ6.js");
   const log = opts.log ?? (() => {
   });
   const prepared = await prepare2(
@@ -13110,7 +13110,7 @@ function parseWitnessMode2(raw) {
   return m;
 }
 async function runAssumptionHuntCli(sourceRoot, opts) {
-  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-3FNZIBB4.js");
+  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-L3XJWWZ6.js");
   const log = (m) => process.stderr.write(m + "\n");
   const runtime = opts.runtime ?? "api";
   const root = resolve19(sourceRoot);
@@ -14561,7 +14561,7 @@ function registerConsoleCommand(program) {
     let resumedTarget;
     let openResumePicker = false;
     if (opts.continue || opts.resume !== void 0) {
-      const { listSessions, loadSession } = await import("./session-store-27L3ZU73.js");
+      const { listSessions, loadSession } = await import("./session-store-XIDFGG7K.js");
       const idArg = typeof opts.resume === "string" ? opts.resume.trim() : "";
       if (idArg || opts.continue) {
         let stored = idArg ? loadSession(idArg) : null;
@@ -14642,7 +14642,7 @@ turn failed: ${err instanceof Error ? err.message : String(err)}`));
       console.log(source_default.dim(`MCP: connected ${mcpHost.serverIds().length} server(s) \u2014 ${mcpHost.registeredTools().length} tool(s)`));
     }
     if (useOpenTui) {
-      const { showOpenTuiConsole, showOpenTuiResume } = await import("./run-U3XU4CTC.js");
+      const { showOpenTuiConsole, showOpenTuiResume } = await import("./run-GAFKBCTN.js");
       const baseOptions = {
         target: focusedTarget,
         scope,
@@ -14886,8 +14886,8 @@ function printHelp() {
   }
   console.log(source_default.dim("  Modes: Standard runs automatically in scope and can request a narrow session-only extension; Co-pilot adds approval for every non-read-only tool; YOLO runs only inside an explicit configured scope and never requests extensions."));
   console.log(source_default.dim("  The Node fallback cannot approve scope extensions or Co-pilot actions; use the Bun TUI for those approvals."));
-  console.log(source_default.dim("  anything else is sent to the engine as an operator message.\n"));
-  console.log(source_default.dim("  Navigation commands (/chat, /scope, /sessions, \u2026) require the Bun TUI. Switch agents in the inline chat worklist."));
+  console.log(source_default.dim("  Non-slash input is sent to the engine as an operator message; unknown slash commands stay local.\n"));
+  console.log(source_default.dim("  Other commands require the Bun TUI. Switch agents in the inline chat worklist."));
   console.log(source_default.dim("  Run the bare `0` command for the full interactive experience.\n"));
 }
 function findCategory(name) {
@@ -15908,7 +15908,7 @@ function print(value) {
 function registerResearchCommand(program) {
   const research = program.command("research").description("Run target-specific engines through the shared evidence research plane");
   research.command("pipeline").description("Run the existing web/AI/source/package pipeline through the shared evidence plane").requiredOption("--target <target>", "URL, local path, repository, package, or image").option("--target-type <type>", "url, web-app, source-code, npm-package, pypi-package, cargo-package, or oci-image").option("--profile <profile>", "Source review profile").option("--depth <depth>", "quick, default, or deep", "default").option("--runtime <runtime>", "auto, api, claude, codex, gemini, or ollama", "auto").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-3FNZIBB4.js");
+    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-L3XJWWZ6.js");
     const allowedTypes = /* @__PURE__ */ new Set(["url", "web-app", "source-code", "npm-package", "pypi-package", "cargo-package", "oci-image"]);
     if (opts.targetType && !allowedTypes.has(opts.targetType)) throw new Error(`unsupported --target-type ${opts.targetType}`);
     print(await runResearch(
@@ -15931,7 +15931,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("mobile").description("Run passive mobile intake; indicators remain hypotheses and only scoped adapters may hand off targets").requiredOption("--target <path>", "Extracted APK/IPA directory or metadata file").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-3FNZIBB4.js");
+    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-L3XJWWZ6.js");
     const targetPath = resolve23(opts.target);
     print(await runResearch(
       new MobileStaticResearchAdapter(),
@@ -15940,7 +15940,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("linux-matrix").description("Import externally executed vulnerable-vs-patched boot logs; 0 validates and hashes them but does not execute boots").requiredOption("--matrix <path>", "Versioned external boot-matrix manifest JSON").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-3FNZIBB4.js");
+    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-L3XJWWZ6.js");
     const matrix = resolve23(opts.matrix);
     const finding = JSON.parse(readFileSync20(resolve23(opts.finding), "utf8"));
     const result = await runResearch(
@@ -15952,7 +15952,7 @@ function registerResearchCommand(program) {
     print(result);
   });
   research.command("linux").description("Run a supplied Linux kernel reproducer through the shared N-boot evidence gate").requiredOption("--kernel-tree <path>", "Linux source tree").requiredOption("--reproducer <path>", "C reproducer or syzkaller .syz program").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").requiredOption("--expected-signature <literal>", "Literal crash signature that every counted boot must contain").option("--boots <n>", "Fresh boots", "3").option("--min-hits <n>", "Required reproducing boots", "2").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-3FNZIBB4.js");
+    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-L3XJWWZ6.js");
     const kernelTree = resolve23(opts.kernelTree);
     const reproducer = resolve23(opts.reproducer);
     const finding = JSON.parse(readFileSync20(resolve23(opts.finding), "utf8"));
@@ -16081,7 +16081,7 @@ function registerTimelineCommand(program) {
       process.exitCode = 2;
       return;
     }
-    const { osecDB: osecDB2 } = await import("./dist-5YHYNLI3.js");
+    const { osecDB: osecDB2 } = await import("./dist-FSS7MBDF.js");
     const db = new osecDB2(opts.dbPath);
     let scan2;
     let rows;
@@ -16657,7 +16657,7 @@ var MAX_SOURCE_BYTES = 4 * 1024 * 1024;
 var cachedCore;
 async function defaultCorePort() {
   if (cachedCore) return cachedCore;
-  const mod = await import("./dist-3FNZIBB4.js");
+  const mod = await import("./dist-L3XJWWZ6.js");
   cachedCore = {
     validatePluginManifest: mod.validatePluginManifest,
     reservedToolNames: Object.values(mod.TOOL_DEFINITIONS).map((tool) => tool.name),
@@ -16996,7 +16996,7 @@ function registerHackstoreCommand(program) {
 var cachedCore2;
 async function defaultCorePort2() {
   if (cachedCore2) return cachedCore2;
-  const mod = await import("./dist-3FNZIBB4.js");
+  const mod = await import("./dist-L3XJWWZ6.js");
   cachedCore2 = mod;
   return mod;
 }
@@ -17547,7 +17547,7 @@ var EXIT_USER_ERROR5 = 1;
 var cachedCore3;
 async function defaultThemeCorePort() {
   if (cachedCore3) return cachedCore3;
-  const mod = await import("./dist-3FNZIBB4.js");
+  const mod = await import("./dist-L3XJWWZ6.js");
   cachedCore3 = mod;
   return mod;
 }

package/chunks/{db-5AP3JB4W.js → db-5IWEJUYV.js}

@@ -4,10 +4,10 @@ const require = __0CreateRequire(import.meta.url);
 import {
   registerDbCommand,
   seedVerificationWorkbench
-} from "./chunk-LCRTAQN2.js";
+} from "./chunk-IVQV574Y.js";
 import "./chunk-HLFS6WV2.js";
-import "./chunk-VNRY6AWF.js";
-import "./chunk-76KSBWOQ.js";
+import "./chunk-VWITLWXB.js";
+import "./chunk-KAU6NLGP.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {

package/chunks/{dist-DD4H6HMQ.js → dist-BS4CY4RG.js}

@@ -81,7 +81,7 @@ import {
   transitionRuleSchema,
   transitionTargetSchema,
   workflowDefinitionSchema
-} from "./chunk-76KSBWOQ.js";
+} from "./chunk-KAU6NLGP.js";
 import "./chunk-VIT5ALXF.js";
 import "./chunk-VCSFCHAJ.js";
 export {