0sec-cli 0.22.0 → 0.22.4

package/chunks/chunk-GQ3DGHWE.js

@@ -0,0 +1,1659 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  source_default
+} from "./chunk-HLFS6WV2.js";
+import {
+  SEVERITY_RANK,
+  VERSION,
+  createAuditReportDocument,
+  createReviewReportDocument,
+  createScanReportDocument,
+  severityRank
+} from "./chunk-6KFB6AYN.js";
+
+// packages/cli/src/utils.ts
+import { gzipSync } from "zlib";
+async function getRuntimeAvailability() {
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-27BNG6WD.js");
+  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
+  const hasApiKey = apiRuntimeDiagnostics.valid;
+  const availableRuntimes = [...await detectAvailableRuntimes()];
+  return {
+    hasApiKey,
+    availableRuntimes,
+    apiRuntime: {
+      configured: apiRuntimeDiagnostics.reason !== "missing_key",
+      valid: apiRuntimeDiagnostics.valid,
+      providerLabel: apiRuntimeDiagnostics.providerLabel,
+      error: apiRuntimeDiagnostics.fatalError
+    }
+  };
+}
+async function checkRuntimeAvailability(runtime) {
+  const availability = await getRuntimeAvailability();
+  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
+  if (hasApiKey) return;
+  console.log("");
+  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
+    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
+  }
+  if (runtime === "api") {
+    console.log(source_default.yellow(
+      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
+    ));
+  } else if (availableRuntimes.length > 0) {
+    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
+  } else {
+    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
+  }
+  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
+  console.log("");
+}
+function buildShareUrl(report) {
+  const json = JSON.stringify(report);
+  const compressed = gzipSync(Buffer.from(json, "utf-8"));
+  const b64 = compressed.toString("base64url");
+  return `https://0.security/r#${b64}`;
+}
+
+// packages/cli/src/formatters/terminal.ts
+var SEVERITY_STYLE = {
+  critical: {
+    badge: (s) => source_default.bgRed.white.bold(` ${s} `),
+    label: "Critical",
+    icon: "\u25CF"
+  },
+  high: {
+    badge: (s) => source_default.bgRedBright.white.bold(` ${s} `),
+    label: "High",
+    icon: "\u25CF"
+  },
+  medium: {
+    badge: (s) => source_default.bgYellow.black.bold(` ${s} `),
+    label: "Medium",
+    icon: "\u25CF"
+  },
+  low: {
+    badge: (s) => source_default.bgBlue.white(` ${s} `),
+    label: "Low",
+    icon: "\u25CB"
+  },
+  info: {
+    badge: (s) => source_default.bgGray.white(` ${s} `),
+    label: "Info",
+    icon: "\xB7"
+  }
+};
+var SEVERITY_COUNT_COLOR = {
+  critical: source_default.red.bold,
+  high: source_default.redBright.bold,
+  medium: source_default.yellow.bold,
+  low: source_default.blue,
+  info: source_default.gray
+};
+function formatTerminal(report) {
+  const W = 60;
+  const lines = [];
+  lines.push("");
+  if (report.warnings.length > 0) {
+    lines.push(`  ${source_default.yellow.bold("WARNINGS")}`);
+    lines.push("");
+    for (const warning of report.warnings) {
+      lines.push(
+        `  ${source_default.yellow.bold("!")} ${source_default.yellow(`[${warning.stage}] ${warning.message}`)}`
+      );
+    }
+    lines.push("");
+  }
+  if (report.findings.length === 0) {
+    lines.push("");
+    if (report.warnings.length > 0 || report.executionSuccessful === false) {
+      lines.push(
+        `  ${source_default.yellow.bold("!")} ${source_default.yellow("No vulnerabilities confirmed. Scan finished with warnings.")}`
+      );
+    } else if (report.reviewChecks?.some((check) => check.status !== "pass")) {
+      lines.push(`  ${source_default.yellow.bold("!")} ${source_default.yellow("No security vulnerabilities found. Advisory review checks need attention.")}`);
+    } else {
+      lines.push(`  ${source_default.green.bold("\u2713")} ${source_default.green("No vulnerabilities found.")}`);
+    }
+  } else {
+    lines.push(`  ${source_default.bold.white("FINDINGS")}`);
+    lines.push("");
+    const sorted = [...report.findings].sort(
+      (a, b) => severityRank(b.severity) - severityRank(a.severity)
+    );
+    for (const finding of sorted) {
+      lines.push(formatFinding(finding));
+    }
+  }
+  if (report.reviewChecks?.length) {
+    lines.push("", `  ${source_default.bold.white("REVIEW CHECKS (advisory)")}`, "");
+    for (const check of report.reviewChecks) {
+      const color = check.status === "pass" ? source_default.green : source_default.yellow;
+      lines.push(`  ${color(check.status.toUpperCase())} ${check.name} (${check.id})`);
+      lines.push(`    Reason: ${check.reason}`);
+      if (check.fix) lines.push(`    Suggested fix: ${check.fix}`);
+      lines.push("");
+    }
+  }
+  lines.push("");
+  lines.push(`  ${source_default.gray("\u2500".repeat(50))}`);
+  lines.push("");
+  const { summary } = report;
+  const sev = [
+    summary.critical > 0 ? source_default.red.bold(`${summary.critical} critical`) : source_default.gray(`${summary.critical} critical`),
+    summary.high > 0 ? source_default.hex("#f97316").bold(`${summary.high} high`) : source_default.gray(`${summary.high} high`),
+    summary.medium > 0 ? source_default.yellow.bold(`${summary.medium} medium`) : source_default.gray(`${summary.medium} medium`),
+    source_default.gray(`${summary.low} low`),
+    source_default.gray(`${summary.info} info`)
+  ].join(source_default.gray("  "));
+  lines.push(`  ${sev}`);
+  lines.push(`  ${source_default.white.bold(String(summary.totalFindings))} findings ${source_default.gray("in")} ${source_default.white(formatDuration(report.durationMs))}`);
+  lines.push(`  ${source_default.gray("Share:")} ${source_default.cyan(buildShareUrl(report))}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function formatFinding(finding) {
+  const style = SEVERITY_STYLE[finding.severity];
+  const lines = [];
+  lines.push(`  ${style.badge(style.label.toUpperCase().padEnd(8))} ${source_default.bold.white(finding.title)}`);
+  const meta = [];
+  meta.push(`${source_default.gray("Category:")} ${formatCategory(finding.category)}`);
+  if (finding.status === "confirmed") {
+    meta.push(source_default.green("\u2713 Confirmed"));
+  }
+  lines.push(`  ${" ".repeat(11)}${meta.join(source_default.gray("  \xB7  "))}`);
+  if (finding.description) {
+    const desc = finding.description.length > 100 ? finding.description.slice(0, 97) + "..." : finding.description;
+    lines.push(`  ${" ".repeat(11)}${source_default.gray(desc)}`);
+  }
+  if (finding.evidence.analysis) {
+    const ev = finding.evidence.analysis.length > 100 ? finding.evidence.analysis.slice(0, 97) + "..." : finding.evidence.analysis;
+    lines.push(`  ${" ".repeat(11)}${source_default.gray.italic("\u21B3 " + ev)}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function formatCategory(cat) {
+  return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+
+// packages/cli/src/formatters/json.ts
+function formatJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+
+// packages/cli/src/formatters/markdown.ts
+var EVIDENCE_BLOCK_LIMIT = 4e3;
+var POC_STEP_LIMIT = 20;
+function formatMarkdown(report) {
+  const lines = [];
+  lines.push("# 0 Scan Report");
+  lines.push("");
+  lines.push(`| Field | Value |`);
+  lines.push(`|-------|-------|`);
+  lines.push(`| Target | ${report.target} |`);
+  lines.push(`| Depth | ${report.scanDepth} |`);
+  lines.push(`| Started | ${report.startedAt} |`);
+  lines.push(`| Duration | ${(report.durationMs / 1e3).toFixed(1)}s |`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`- **Attacks:** ${report.summary.totalAttacks}`);
+  lines.push(`- **Findings:** ${report.summary.totalFindings}`);
+  if (report.summary.critical > 0)
+    lines.push(`- **Critical:** ${report.summary.critical}`);
+  if (report.summary.high > 0) lines.push(`- **High:** ${report.summary.high}`);
+  if (report.summary.medium > 0) lines.push(`- **Medium:** ${report.summary.medium}`);
+  if (report.summary.low > 0) lines.push(`- **Low:** ${report.summary.low}`);
+  lines.push("");
+  if (report.warnings.length > 0) {
+    lines.push("## Warnings");
+    lines.push("");
+    for (const warning of report.warnings) {
+      lines.push(`- **${warning.stage}:** ${warning.message}`);
+    }
+    lines.push("");
+  }
+  if (report.reviewChecks?.length) {
+    lines.push("## Review Checks (Advisory)", "");
+    const literal = (text) => text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/([\\`*_{}\[\]()#+.!|~-])/g, "\\$1");
+    for (const check of report.reviewChecks) {
+      lines.push(`### ${check.status.toUpperCase()}: ${literal(check.name)}`, "");
+      lines.push(`- **ID:** ${literal(check.id)}`);
+      lines.push(`- **Reason:** ${literal(check.reason)}`);
+      if (check.fix) lines.push(`- **Suggested fix:** ${literal(check.fix)}`);
+      lines.push("");
+    }
+  }
+  if (report.findings.length > 0) {
+    lines.push("## Findings");
+    lines.push("");
+    for (const finding of report.findings) {
+      lines.push(formatFinding2(finding));
+    }
+  } else {
+    lines.push(report.warnings.length > 0 ? "## No Confirmed Vulnerabilities" : "## No Vulnerabilities Found");
+    lines.push("");
+    lines.push(
+      report.warnings.length > 0 ? "The scanner did not confirm vulnerabilities, but target validation or probe execution produced warnings." : report.reviewChecks?.length ? "No security vulnerabilities were found in the inspected scope. Advisory review-check results are reported separately above." : "The target passed all tests."
+    );
+  }
+  return lines.join("\n");
+}
+function evidenceBlock(label, raw) {
+  const lines = [];
+  lines.push(`**${label}:**`);
+  if (!raw) {
+    lines.push("");
+    lines.push("_(not captured)_");
+    return lines;
+  }
+  const truncated = raw.length > EVIDENCE_BLOCK_LIMIT;
+  const body = truncated ? raw.slice(0, EVIDENCE_BLOCK_LIMIT) : raw;
+  lines.push("```");
+  lines.push(body);
+  lines.push("```");
+  if (truncated) {
+    lines.push(
+      `_Truncated for readability: ${raw.length - EVIDENCE_BLOCK_LIMIT} of ${raw.length} characters not shown. Use \`--format json\` or \`--format sarif\` for the complete evidence._`
+    );
+  }
+  return lines;
+}
+function remediationSection(remediation) {
+  const lines = [];
+  lines.push("**Remediation:**");
+  lines.push("");
+  lines.push(remediation.summary);
+  if (remediation.steps.length > 0) {
+    lines.push("");
+    for (const step of remediation.steps) lines.push(`1. ${step}`);
+  }
+  if (remediation.codeExample) {
+    const { before, after, language } = remediation.codeExample;
+    lines.push("");
+    lines.push("<details>");
+    lines.push("<summary>Suggested change</summary>");
+    lines.push("");
+    lines.push("Before:");
+    lines.push("");
+    lines.push("```" + language);
+    lines.push(before);
+    lines.push("```");
+    lines.push("");
+    lines.push("After:");
+    lines.push("");
+    lines.push("```" + language);
+    lines.push(after);
+    lines.push("```");
+    lines.push("</details>");
+  }
+  if (remediation.references.length > 0) {
+    lines.push("");
+    lines.push("References:");
+    for (const ref of remediation.references) lines.push(`- ${ref}`);
+  }
+  lines.push("");
+  return lines;
+}
+function reproductionSection(steps) {
+  const lines = [];
+  lines.push("**Reproduction steps:**");
+  lines.push("");
+  const shown = steps.slice(0, POC_STEP_LIMIT);
+  shown.forEach((step, i) => {
+    lines.push(`${i + 1}. **[${step.kind}]** ${step.summary}`);
+  });
+  if (steps.length > shown.length) {
+    lines.push("");
+    lines.push(
+      `_${steps.length - shown.length} further step(s) omitted; the full graph is in \`--format json\`._`
+    );
+  }
+  lines.push("");
+  return lines;
+}
+function formatFinding2(finding) {
+  const lines = [];
+  const badge = severityBadge(finding.severity);
+  lines.push(`### ${badge} ${finding.title}`);
+  lines.push("");
+  lines.push(`- **Category:** ${finding.category}`);
+  lines.push(`- **Status:** ${finding.status}`);
+  if (finding.cvssScore !== void 0 || finding.cvssVector) {
+    const score = finding.cvssScore !== void 0 ? `${finding.cvssScore}` : "n/a";
+    const vector = finding.cvssVector ? ` (\`${finding.cvssVector}\`)` : "";
+    lines.push(`- **CVSS:** ${score}${vector}`);
+  }
+  if (finding.confidence !== void 0) {
+    lines.push(`- **Confidence:** ${(finding.confidence * 100).toFixed(0)}%`);
+  }
+  if (finding.triageNote) {
+    lines.push(`- **Triage:** ${finding.triageNote}`);
+  }
+  lines.push(`- **Description:** ${finding.description}`);
+  lines.push("");
+  if (finding.evidence.analysis) {
+    lines.push(`**Evidence:** ${finding.evidence.analysis}`);
+    lines.push("");
+  }
+  if (finding.pocSteps && finding.pocSteps.length > 0) {
+    lines.push(...reproductionSection(finding.pocSteps));
+  }
+  if (finding.remediation) {
+    lines.push(...remediationSection(finding.remediation));
+  }
+  lines.push("<details>");
+  lines.push("<summary>Request / Response</summary>");
+  lines.push("");
+  lines.push(...evidenceBlock("Request", finding.evidence.request));
+  lines.push("");
+  lines.push(...evidenceBlock("Response", finding.evidence.response));
+  lines.push("</details>");
+  lines.push("");
+  return lines.join("\n");
+}
+function severityBadge(severity) {
+  const badges = {
+    critical: "[CRITICAL]",
+    high: "[HIGH]",
+    medium: "[MEDIUM]",
+    low: "[LOW]",
+    info: "[INFO]"
+  };
+  return badges[severity] ?? `[${severity.toUpperCase()}]`;
+}
+
+// packages/cli/src/formatters/html.ts
+function escapeHtml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var SEVERITY_COLORS = {
+  critical: { bg: "#991b1b", text: "#ffffff", accent: "#f87171" },
+  high: { bg: "#c2410c", text: "#ffffff", accent: "#fb923c" },
+  medium: { bg: "#a16207", text: "#000000", accent: "#facc15" },
+  low: { bg: "#1d4ed8", text: "#ffffff", accent: "#60a5fa" },
+  info: { bg: "#4b5563", text: "#ffffff", accent: "#9ca3af" }
+};
+var SEVERITY_ORDER = Object.keys(SEVERITY_RANK).sort(
+  (a, b) => SEVERITY_RANK[b] - SEVERITY_RANK[a]
+);
+function formatCategory2(cat) {
+  return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function formatDuration2(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+function riskLevel(summary) {
+  if (summary.critical > 0) return { label: "CRITICAL", color: "#ef4444" };
+  if (summary.high > 0) return { label: "HIGH", color: "#f97316" };
+  if (summary.medium > 0) return { label: "MEDIUM", color: "#eab308" };
+  if (summary.low > 0) return { label: "LOW", color: "#3b82f6" };
+  return { label: "CLEAN", color: "#22c55e" };
+}
+function renderFinding(finding, index) {
+  const sev = SEVERITY_COLORS[finding.severity];
+  const confidence = finding.confidence != null ? `${Math.round(finding.confidence * 100)}%` : null;
+  const cvss = finding.cvssScore != null ? finding.cvssScore.toFixed(1) : null;
+  const rank = finding.findingRank != null ? `Rank: ${finding.findingRank}` : null;
+  const dedupe = finding.semanticDedupe ? `Canonical: ${escapeHtml(finding.semanticDedupe.canonicalId.slice(0, 12))}\u2026` : null;
+  return `
+    <div class="finding-card">
+      <div class="finding-header">
+        <span class="severity-badge" style="background:${sev.bg};color:${sev.text}">${finding.severity.toUpperCase()}</span>
+        <span class="finding-title">${escapeHtml(finding.title)}</span>
+      </div>
+      <div class="finding-meta">
+        <span class="meta-tag">Category: ${formatCategory2(finding.category)}</span>
+        ${finding.status === "confirmed" ? '<span class="meta-tag confirmed">Confirmed</span>' : `<span class="meta-tag">${escapeHtml(finding.status)}</span>`}
+        ${confidence ? `<span class="meta-tag">Confidence: ${confidence}</span>` : ""}
+        ${cvss ? `<span class="meta-tag">CVSS: ${cvss}</span>` : ""}
+        ${rank ? `<span class="meta-tag">${rank}</span>` : ""}
+        ${dedupe ? `<span class="meta-tag">${dedupe}</span>` : ""}
+      </div>
+      <p class="finding-desc">${escapeHtml(finding.description)}</p>
+      ${finding.evidence.analysis ? `<div class="evidence-analysis"><strong>Analysis:</strong> ${escapeHtml(finding.evidence.analysis)}</div>` : ""}
+      <details class="evidence-details">
+        <summary>Request / Response</summary>
+        <div class="evidence-block">
+          <div class="evidence-label">Request</div>
+          <pre><code>${escapeHtml(finding.evidence.request.slice(0, 2e3))}</code></pre>
+        </div>
+        <div class="evidence-block">
+          <div class="evidence-label">Response</div>
+          <pre><code>${escapeHtml(finding.evidence.response.slice(0, 2e3))}</code></pre>
+        </div>
+      </details>
+    </div>`;
+}
+function renderSeverityBar(summary) {
+  const total = summary.critical + summary.high + summary.medium + summary.low + summary.info;
+  if (total === 0) return "";
+  const segments = SEVERITY_ORDER.filter((s) => summary[s] > 0).map((s) => {
+    const pct = summary[s] / total * 100;
+    return `<div class="bar-segment" style="width:${pct}%;background:${SEVERITY_COLORS[s].accent}" title="${summary[s]} ${s}"></div>`;
+  }).join("");
+  return `<div class="severity-bar">${segments}</div>`;
+}
+function formatHtml(report) {
+  const risk = riskLevel(report.summary);
+  const sorted = [...report.findings].sort(
+    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity)
+  );
+  const findingsHtml = sorted.length > 0 ? sorted.map((f, i) => renderFinding(f, i)).join("\n") : `<div class="no-findings">${report.warnings.length > 0 || report.executionSuccessful === false ? "No vulnerabilities confirmed. Scan finished with warnings." : report.reviewChecks?.length ? "No security vulnerabilities found. See advisory review-check results below." : "No vulnerabilities found. Target passed all tests."}</div>`;
+  const warningsHtml = report.warnings.length > 0 ? `<div class="section">
+        <h2 class="section-title warning-title">Warnings</h2>
+        ${report.warnings.map((w) => `<div class="warning-item"><span class="warning-stage">${escapeHtml(w.stage)}</span> ${escapeHtml(w.message)}</div>`).join("\n")}
+      </div>` : "";
+  const checksHtml = report.reviewChecks?.length ? `<div class="section"><h2 class="section-title">Review Checks (Advisory)</h2>
+       ${report.reviewChecks.map((check) => `<div class="warning-item">
+         <h3>${escapeHtml(check.status.toUpperCase())}: ${escapeHtml(check.name)}</h3>
+         <p><strong>ID:</strong> ${escapeHtml(check.id)}</p>
+         <p style="white-space:pre-wrap"><strong>Reason:</strong> ${escapeHtml(check.reason)}</p>
+         ${check.fix ? `<p style="white-space:pre-wrap"><strong>Suggested fix:</strong> ${escapeHtml(check.fix)}</p>` : ""}
+       </div>`).join("\n")}</div>` : "";
+  const sevCountsHtml = SEVERITY_ORDER.map((s) => {
+    const count = report.summary[s];
+    return `<div class="sev-count"><span class="sev-dot" style="background:${SEVERITY_COLORS[s].accent}"></span><span class="sev-label">${s}</span><span class="sev-num">${count}</span></div>`;
+  }).join("");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>0 Report \u2014 ${escapeHtml(report.target)}</title>
+<style>
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body {
+    background: #09090b;
+    color: #d4d4d8;
+    font-family: 'SF Mono', 'Cascadia Code', 'Fira Code', 'JetBrains Mono', 'Consolas', monospace;
+    font-size: 14px;
+    line-height: 1.6;
+    padding: 2rem;
+    max-width: 960px;
+    margin: 0 auto;
+  }
+  a { color: #f87171; text-decoration: none; }
+  a:hover { text-decoration: underline; }
+
+  /* Header */
+  .header {
+    border-bottom: 1px solid #27272a;
+    padding-bottom: 1.5rem;
+    margin-bottom: 2rem;
+  }
+  .header-top {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    flex-wrap: wrap;
+    gap: 1rem;
+  }
+  .brand {
+    color: #f87171;
+    font-size: 1.6rem;
+    font-weight: bold;
+    letter-spacing: 0.15em;
+  }
+  .brand-sub { color: #52525b; font-size: 0.8rem; }
+  .risk-badge {
+    font-size: 0.85rem;
+    font-weight: bold;
+    padding: 0.3rem 1rem;
+    border-radius: 4px;
+    letter-spacing: 0.1em;
+  }
+  .meta-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+    gap: 0.5rem;
+    margin-top: 1rem;
+    font-size: 0.85rem;
+    color: #71717a;
+  }
+  .meta-grid span { display: block; }
+  .meta-grid strong { color: #a1a1aa; }
+
+  /* Summary */
+  .summary-section {
+    display: grid;
+    grid-template-columns: 1fr 1fr;
+    gap: 1.5rem;
+    margin-bottom: 2rem;
+    padding-bottom: 1.5rem;
+    border-bottom: 1px solid #27272a;
+  }
+  @media (max-width: 600px) {
+    .summary-section { grid-template-columns: 1fr; }
+  }
+  .stat-box {
+    background: #18181b;
+    border: 1px solid #27272a;
+    border-radius: 6px;
+    padding: 1rem;
+  }
+  .stat-box h3 {
+    color: #71717a;
+    font-size: 0.75rem;
+    letter-spacing: 0.1em;
+    text-transform: uppercase;
+    margin-bottom: 0.5rem;
+  }
+  .stat-box .big-num {
+    font-size: 2rem;
+    font-weight: bold;
+    color: #fafafa;
+  }
+  .sev-counts {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.75rem;
+    margin-top: 0.5rem;
+  }
+  .sev-count {
+    display: flex;
+    align-items: center;
+    gap: 0.35rem;
+    font-size: 0.8rem;
+  }
+  .sev-dot {
+    width: 8px;
+    height: 8px;
+    border-radius: 50%;
+    display: inline-block;
+  }
+  .sev-label { color: #71717a; }
+  .sev-num { color: #d4d4d8; font-weight: bold; }
+
+  .severity-bar {
+    display: flex;
+    height: 6px;
+    border-radius: 3px;
+    overflow: hidden;
+    margin-top: 0.75rem;
+  }
+  .bar-segment { min-width: 4px; }
+
+  /* Findings */
+  .section { margin-bottom: 2rem; }
+  .section-title {
+    color: #f87171;
+    font-size: 0.9rem;
+    letter-spacing: 0.1em;
+    text-transform: uppercase;
+    margin-bottom: 1rem;
+  }
+  .warning-title { color: #facc15; }
+
+  .finding-card {
+    background: #18181b;
+    border: 1px solid #27272a;
+    border-radius: 6px;
+    padding: 1rem;
+    margin-bottom: 0.75rem;
+  }
+  .finding-header {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    margin-bottom: 0.5rem;
+  }
+  .severity-badge {
+    font-size: 0.7rem;
+    font-weight: bold;
+    padding: 0.15rem 0.5rem;
+    border-radius: 3px;
+    letter-spacing: 0.05em;
+    flex-shrink: 0;
+  }
+  .finding-title {
+    color: #fafafa;
+    font-weight: bold;
+    font-size: 0.95rem;
+  }
+  .finding-meta {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.5rem;
+    margin-bottom: 0.5rem;
+  }
+  .meta-tag {
+    font-size: 0.75rem;
+    color: #71717a;
+    background: #27272a;
+    padding: 0.1rem 0.5rem;
+    border-radius: 3px;
+  }
+  .meta-tag.confirmed { color: #4ade80; background: #052e16; }
+  .finding-desc {
+    color: #a1a1aa;
+    font-size: 0.85rem;
+    margin-bottom: 0.5rem;
+  }
+  .evidence-analysis {
+    color: #a1a1aa;
+    font-size: 0.85rem;
+    font-style: italic;
+    padding: 0.5rem;
+    background: #1c1c1e;
+    border-left: 3px solid #3f3f46;
+    border-radius: 2px;
+    margin-bottom: 0.5rem;
+  }
+  .evidence-details {
+    margin-top: 0.5rem;
+  }
+  .evidence-details summary {
+    cursor: pointer;
+    color: #71717a;
+    font-size: 0.8rem;
+    padding: 0.3rem 0;
+  }
+  .evidence-details summary:hover { color: #a1a1aa; }
+  .evidence-block {
+    margin-top: 0.5rem;
+  }
+  .evidence-label {
+    font-size: 0.75rem;
+    color: #71717a;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    margin-bottom: 0.25rem;
+  }
+  .evidence-details pre {
+    background: #0a0a0a;
+    border: 1px solid #27272a;
+    border-radius: 4px;
+    padding: 0.75rem;
+    overflow-x: auto;
+    font-size: 0.8rem;
+    line-height: 1.5;
+    color: #a1a1aa;
+    white-space: pre-wrap;
+    word-break: break-word;
+  }
+
+  .no-findings {
+    background: #052e16;
+    color: #4ade80;
+    padding: 1rem;
+    border-radius: 6px;
+    border: 1px solid #166534;
+    font-size: 0.9rem;
+  }
+
+  .warning-item {
+    padding: 0.4rem 0.5rem;
+    margin-bottom: 0.25rem;
+    background: #1c1307;
+    border-left: 3px solid #facc15;
+    border-radius: 2px;
+    font-size: 0.85rem;
+  }
+  .warning-stage {
+    color: #facc15;
+    font-weight: bold;
+    margin-right: 0.5rem;
+  }
+
+  /* Timeline */
+  .timeline {
+    font-size: 0.8rem;
+    color: #71717a;
+  }
+  .timeline-row {
+    display: flex;
+    gap: 0.5rem;
+    padding: 0.2rem 0;
+  }
+  .timeline-label { color: #52525b; min-width: 80px; }
+  .timeline-value { color: #a1a1aa; }
+
+  /* Footer */
+  .footer {
+    margin-top: 2rem;
+    padding-top: 1rem;
+    border-top: 1px solid #27272a;
+    color: #3f3f46;
+    font-size: 0.75rem;
+    text-align: center;
+  }
+</style>
+</head>
+<body>
+  <div class="header">
+    <div class="header-top">
+      <div>
+        <div class="brand">ZERO</div>
+        <div class="brand-sub">Security Scan Report</div>
+      </div>
+      <div class="risk-badge" style="background:${risk.color};color:#fff">${risk.label} RISK</div>
+    </div>
+    <div class="meta-grid">
+      <span><strong>Target:</strong> ${escapeHtml(report.target)}</span>
+      <span><strong>Depth:</strong> ${report.scanDepth}</span>
+      <span><strong>Duration:</strong> ${formatDuration2(report.durationMs)}</span>
+      <span><strong>Started:</strong> ${escapeHtml(report.startedAt)}</span>
+    </div>
+  </div>
+
+  <div class="summary-section">
+    <div class="stat-box">
+      <h3>Findings</h3>
+      <div class="big-num">${report.summary.totalFindings}</div>
+      <div class="sev-counts">
+        ${sevCountsHtml}
+      </div>
+      ${renderSeverityBar(report.summary)}
+    </div>
+    <div class="stat-box">
+      <h3>Attacks Tested</h3>
+      <div class="big-num">${report.summary.totalAttacks}</div>
+      <div class="timeline">
+        <div class="timeline-row"><span class="timeline-label">Started</span><span class="timeline-value">${escapeHtml(report.startedAt)}</span></div>
+        <div class="timeline-row"><span class="timeline-label">Completed</span><span class="timeline-value">${escapeHtml(report.completedAt)}</span></div>
+        <div class="timeline-row"><span class="timeline-label">Duration</span><span class="timeline-value">${formatDuration2(report.durationMs)}</span></div>
+      </div>
+    </div>
+  </div>
+
+  ${warningsHtml}
+
+  <div class="section">
+    <h2 class="section-title">Findings</h2>
+    ${findingsHtml}
+  </div>
+
+  ${checksHtml}
+
+  <div class="footer">
+    Generated by 0 &middot; ${escapeHtml((/* @__PURE__ */ new Date()).toISOString())}
+  </div>
+</body>
+</html>`;
+}
+
+// packages/cli/src/formatters/sarif.ts
+function severityToLevel(severity) {
+  switch (severity) {
+    case "critical":
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    case "low":
+    case "info":
+      return "note";
+  }
+}
+function stableFingerprint(finding, target) {
+  return [
+    finding.fingerprint,
+    finding.templateId,
+    finding.category,
+    finding.title,
+    target
+  ].filter(Boolean).join("|");
+}
+function actionSummary(step) {
+  switch (step.action.type) {
+    case "shell":
+      return { type: "shell", command: step.action.cmd, cwd: step.action.cwd };
+    case "http":
+      return {
+        type: "http",
+        method: step.action.method,
+        url: step.action.url,
+        headers: step.action.headers
+      };
+    case "docker":
+      return { type: "docker", image: step.action.image, args: step.action.args };
+    case "note":
+      return { type: "note" };
+  }
+}
+function pocStepsToCodeFlows(pocSteps, target) {
+  if (!pocSteps || pocSteps.length === 0) return void 0;
+  return [
+    {
+      threadFlows: [
+        {
+          locations: pocSteps.map((step) => ({
+            location: {
+              physicalLocation: {
+                artifactLocation: { uri: target }
+              },
+              message: { text: `${step.kind}: ${step.summary}` },
+              properties: {
+                stepId: step.id,
+                kind: step.kind,
+                action: actionSummary(step),
+                expect: step.expect
+              }
+            }
+          }))
+        }
+      ]
+    }
+  ];
+}
+function findingToResult(finding, target) {
+  const result = {
+    ruleId: finding.templateId,
+    level: severityToLevel(finding.severity),
+    message: { text: finding.description },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: target }
+        }
+      }
+    ],
+    partialFingerprints: {
+      primary: stableFingerprint(finding, target)
+    }
+  };
+  const codeFlows = pocStepsToCodeFlows(finding.pocSteps, target);
+  if (codeFlows) result.codeFlows = codeFlows;
+  result.properties = {
+    findingId: finding.id,
+    category: finding.category,
+    severity: finding.severity,
+    status: finding.status,
+    evidence: finding.evidence
+  };
+  if (finding.cvssScore !== void 0) result.properties["cvssScore"] = finding.cvssScore;
+  if (finding.cvssVector) result.properties["cvssVector"] = finding.cvssVector;
+  if (finding.confidence !== void 0) result.properties["confidence"] = finding.confidence;
+  if (finding.publishability) result.properties["publishability"] = finding.publishability;
+  if (finding.noveltyVerdict) result.properties["noveltyVerdict"] = finding.noveltyVerdict;
+  if (finding.dedupRefs) result.properties["dedupRefs"] = finding.dedupRefs;
+  if (finding.advisoryMatches) result.properties["advisoryMatches"] = finding.advisoryMatches;
+  if (finding.verification_result) result.properties["verificationResult"] = finding.verification_result;
+  if (finding.inlineValidation) result.properties["inlineValidation"] = finding.inlineValidation;
+  if (finding.supplyChain) result.properties["supplyChain"] = finding.supplyChain;
+  if (finding.kernelExploit) result.properties["kernelExploit"] = finding.kernelExploit;
+  if (finding.semanticDedupe) result.properties["semanticDedupe"] = finding.semanticDedupe;
+  if (finding.findingRank !== void 0) result.properties["findingRank"] = finding.findingRank;
+  return result;
+}
+function findingToRule(finding) {
+  return {
+    id: finding.templateId,
+    name: finding.title,
+    shortDescription: { text: finding.title },
+    defaultConfiguration: { level: severityToLevel(finding.severity) },
+    properties: {
+      category: finding.category,
+      severity: finding.severity
+    }
+  };
+}
+function formatSarif(report) {
+  const rulesMap = /* @__PURE__ */ new Map();
+  for (const finding of report.findings) {
+    if (!rulesMap.has(finding.templateId)) {
+      rulesMap.set(finding.templateId, findingToRule(finding));
+    }
+  }
+  for (const check of report.reviewChecks ?? []) {
+    rulesMap.set(`review-check/${check.id}`, {
+      id: `review-check/${check.id}`,
+      name: check.name,
+      shortDescription: { text: check.name },
+      defaultConfiguration: { level: "note" },
+      properties: { advisory: true }
+    });
+  }
+  const sarif = {
+    $schema: "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "0",
+            version: VERSION,
+            informationUri: "https://github.com/0sec-labs/0",
+            rules: Array.from(rulesMap.values())
+          }
+        },
+        results: [
+          ...report.findings.map((f) => findingToResult(f, report.target)),
+          ...(report.reviewChecks ?? []).map((check) => ({
+            ruleId: `review-check/${check.id}`,
+            kind: check.status === "pass" ? "pass" : check.status === "issue" ? "fail" : "open",
+            level: "note",
+            message: { text: `${check.name}: ${check.reason}${check.fix ? `
+Suggested fix: ${check.fix}` : ""}` },
+            properties: { advisory: true, reviewCheck: check }
+          }))
+        ],
+        invocations: [
+          {
+            executionSuccessful: report.executionSuccessful !== false,
+            startTimeUtc: report.startedAt,
+            endTimeUtc: report.completedAt
+          }
+        ]
+      }
+    ]
+  };
+  return JSON.stringify(sarif, null, 2);
+}
+
+// packages/cli/src/formatters/pdf.ts
+import { createRequire } from "node:module";
+import { createWriteStream } from "node:fs";
+var COLORS = {
+  primary: "#1a1a2e",
+  accent: "#e94560",
+  background: "#f8f9fa",
+  text: "#2d2d2d",
+  textLight: "#6c757d",
+  white: "#ffffff",
+  severity: {
+    critical: "#dc2626",
+    high: "#ea580c",
+    medium: "#ca8a04",
+    low: "#2563eb",
+    info: "#6b7280"
+  }
+};
+var PAGE_MARGIN = 50;
+var CONTENT_WIDTH = 612 - PAGE_MARGIN * 2;
+function severityLabel(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+function formatDate(iso) {
+  return new Date(iso).toLocaleDateString("en-US", {
+    year: "numeric",
+    month: "long",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit"
+  });
+}
+function formatDuration3(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  const seconds = Math.floor(ms / 1e3);
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  const remainingSec = seconds % 60;
+  return `${minutes}m ${remainingSec}s`;
+}
+function riskScore(summary) {
+  const score = summary.critical * 40 + summary.high * 20 + summary.medium * 10 + summary.low * 3 + summary.info * 0;
+  return Math.min(100, score);
+}
+function riskRating(score) {
+  if (score >= 80) return "Critical";
+  if (score >= 60) return "High";
+  if (score >= 30) return "Medium";
+  if (score >= 10) return "Low";
+  return "Informational";
+}
+function truncate(text, maxLen) {
+  if (text.length <= maxLen) return text;
+  return text.slice(0, maxLen - 3) + "...";
+}
+async function generatePdfReport(report, outputPath) {
+  const require_ = createRequire(import.meta.url);
+  const PDFDocument = require_("pdfkit");
+  return new Promise((resolve, reject) => {
+    const doc = new PDFDocument({
+      size: "LETTER",
+      margins: { top: PAGE_MARGIN, bottom: PAGE_MARGIN, left: PAGE_MARGIN, right: PAGE_MARGIN },
+      info: {
+        Title: `0 Pentest Report - ${report.target}`,
+        Author: "0",
+        Subject: "Automated Penetration Test Report",
+        CreationDate: /* @__PURE__ */ new Date()
+      },
+      bufferPages: true
+    });
+    const stream = createWriteStream(outputPath);
+    stream.on("error", reject);
+    stream.on("finish", resolve);
+    doc.pipe(stream);
+    renderCoverPage(doc, report);
+    renderExecutiveSummary(doc, report);
+    renderFindingsTable(doc, report);
+    renderFindingDetails(doc, report);
+    renderReviewChecks(doc, report);
+    renderMethodology(doc, report);
+    renderFooters(doc);
+    doc.end();
+  });
+}
+function renderCoverPage(doc, report) {
+  doc.rect(0, 0, 612, 792).fill(COLORS.primary);
+  doc.fontSize(48).font("Helvetica-Bold").fillColor(COLORS.accent).text("0", PAGE_MARGIN, 200, { align: "center" });
+  doc.fontSize(14).font("Helvetica").fillColor(COLORS.white).text("Automated Penetration Test Report", PAGE_MARGIN, 260, { align: "center" });
+  doc.moveTo(200, 300).lineTo(412, 300).strokeColor(COLORS.accent).lineWidth(2).stroke();
+  doc.fontSize(18).font("Helvetica-Bold").fillColor(COLORS.white).text(report.target, PAGE_MARGIN, 330, { align: "center" });
+  doc.fontSize(12).font("Helvetica").fillColor(COLORS.textLight).text(`Scan Depth: ${report.scanDepth}`, PAGE_MARGIN, 370, { align: "center" }).text(`Date: ${formatDate(report.startedAt)}`, PAGE_MARGIN, 390, { align: "center" }).text(`Duration: ${formatDuration3(report.durationMs)}`, PAGE_MARGIN, 410, { align: "center" });
+  const score = riskScore(report.summary);
+  const rating = riskRating(score);
+  doc.fontSize(14).font("Helvetica-Bold").fillColor(COLORS.accent).text(`Risk Score: ${score}/100 (${rating})`, PAGE_MARGIN, 460, { align: "center" });
+  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text("CONFIDENTIAL - For authorized recipients only", PAGE_MARGIN, 700, { align: "center" });
+}
+function renderExecutiveSummary(doc, report) {
+  doc.addPage();
+  sectionTitle(doc, "Executive Summary");
+  const score = riskScore(report.summary);
+  const rating = riskRating(score);
+  const { summary } = report;
+  doc.fontSize(11).font("Helvetica").fillColor(COLORS.text).text(
+    `An automated penetration test was conducted against ${report.target} on ${formatDate(report.startedAt)}. The scan ran for ${formatDuration3(report.durationMs)} at "${report.scanDepth}" depth.`,
+    PAGE_MARGIN,
+    doc.y + 10,
+    { width: CONTENT_WIDTH }
+  );
+  doc.moveDown(0.5);
+  doc.text(
+    `The overall risk score is ${score}/100 (${rating}). A total of ${summary.totalFindings} finding(s) were identified across ${summary.totalAttacks} attack(s).`,
+    { width: CONTENT_WIDTH }
+  );
+  doc.moveDown(1);
+  subSectionTitle(doc, "Findings by Severity");
+  const severities = ["critical", "high", "medium", "low", "info"];
+  const sevCounts = {
+    critical: summary.critical,
+    high: summary.high,
+    medium: summary.medium,
+    low: summary.low,
+    info: summary.info
+  };
+  for (const sev of severities) {
+    const count = sevCounts[sev];
+    if (count === 0) continue;
+    const barWidth = Math.max(4, count / Math.max(summary.totalFindings, 1) * (CONTENT_WIDTH - 140));
+    const y = doc.y;
+    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[sev]).text(severityLabel(sev), PAGE_MARGIN, y, { width: 70 });
+    doc.rect(PAGE_MARGIN + 80, y + 2, barWidth, 12).fill(COLORS.severity[sev]);
+    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(String(count), PAGE_MARGIN + 90 + barWidth, y, { width: 40 });
+    doc.y = y + 22;
+  }
+  if (report.warnings.length > 0) {
+    doc.moveDown(1);
+    subSectionTitle(doc, "Warnings");
+    for (const w of report.warnings) {
+      doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text(`[${w.stage}] ${w.message}`, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
+      doc.moveDown(0.3);
+    }
+  }
+}
+function renderFindingsTable(doc, report) {
+  if (report.findings.length === 0) return;
+  doc.addPage();
+  sectionTitle(doc, "Findings Overview");
+  const colWidths = { severity: 70, title: 220, category: 120, status: 80 };
+  const tableX = PAGE_MARGIN;
+  const headerY = doc.y + 5;
+  doc.rect(tableX, headerY, CONTENT_WIDTH, 20).fill(COLORS.primary);
+  doc.fontSize(9).font("Helvetica-Bold").fillColor(COLORS.white);
+  doc.text("Severity", tableX + 5, headerY + 5, { width: colWidths.severity });
+  doc.text("Title", tableX + colWidths.severity + 5, headerY + 5, { width: colWidths.title });
+  doc.text("Category", tableX + colWidths.severity + colWidths.title + 5, headerY + 5, { width: colWidths.category });
+  doc.text("Status", tableX + colWidths.severity + colWidths.title + colWidths.category + 5, headerY + 5, { width: colWidths.status });
+  doc.y = headerY + 22;
+  const sorted = [...report.findings].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity)
+  );
+  for (let i = 0; i < sorted.length; i++) {
+    const finding = sorted[i];
+    const rowY = doc.y;
+    if (rowY > 720) {
+      doc.addPage();
+      doc.y = PAGE_MARGIN;
+    }
+    if (i % 2 === 0) {
+      doc.rect(tableX, rowY, CONTENT_WIDTH, 18).fill(COLORS.background);
+    }
+    doc.fontSize(8).font("Helvetica");
+    doc.fillColor(COLORS.severity[finding.severity]).font("Helvetica-Bold").text(severityLabel(finding.severity), tableX + 5, rowY + 5, { width: colWidths.severity });
+    doc.fillColor(COLORS.text).font("Helvetica").text(truncate(finding.title, 45), tableX + colWidths.severity + 5, rowY + 5, { width: colWidths.title });
+    doc.text(finding.category, tableX + colWidths.severity + colWidths.title + 5, rowY + 5, { width: colWidths.category });
+    doc.text(finding.status, tableX + colWidths.severity + colWidths.title + colWidths.category + 5, rowY + 5, { width: colWidths.status });
+    doc.y = rowY + 20;
+  }
+}
+function renderFindingDetails(doc, report) {
+  if (report.findings.length === 0) return;
+  const sorted = [...report.findings].sort(
+    (a, b) => severityRank(b.severity) - severityRank(a.severity)
+  );
+  for (const finding of sorted) {
+    doc.addPage();
+    sectionTitle(doc, finding.title);
+    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.severity[finding.severity]).text(`${severityLabel(finding.severity)} Severity`, PAGE_MARGIN, doc.y, { continued: true }).fillColor(COLORS.textLight).font("Helvetica").text(`  |  ${finding.category}  |  ${finding.status}  |  ID: ${finding.id}`);
+    if (finding.cvssScore != null) {
+      doc.fontSize(9).fillColor(COLORS.text).text(`CVSS Score: ${finding.cvssScore}${finding.cvssVector ? ` (${finding.cvssVector})` : ""}`, PAGE_MARGIN, doc.y + 2);
+    }
+    doc.moveDown(1);
+    subSectionTitle(doc, "Description");
+    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(finding.description, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
+    if (finding.evidence.request) {
+      doc.moveDown(1);
+      subSectionTitle(doc, "Request");
+      codeBlock(doc, finding.evidence.request);
+    }
+    if (finding.evidence.response) {
+      doc.moveDown(0.5);
+      subSectionTitle(doc, "Response");
+      codeBlock(doc, finding.evidence.response);
+    }
+    if (finding.evidence.analysis) {
+      doc.moveDown(0.5);
+      subSectionTitle(doc, "Analysis & Remediation");
+      doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(finding.evidence.analysis, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH });
+    }
+  }
+}
+function renderReviewChecks(doc, report) {
+  if (!report.reviewChecks?.length) return;
+  doc.addPage();
+  sectionTitle(doc, "Review Checks (Advisory)");
+  for (const check of report.reviewChecks) {
+    if (doc.y > doc.page.height - PAGE_MARGIN - 80) doc.addPage();
+    subSectionTitle(doc, `${check.status.toUpperCase()}: ${check.name}`);
+    doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(`ID: ${check.id}`, PAGE_MARGIN, doc.y, { width: CONTENT_WIDTH }).text(`Reason: ${check.reason}`, { width: CONTENT_WIDTH });
+    if (check.fix) doc.text(`Suggested fix: ${check.fix}`, { width: CONTENT_WIDTH });
+    doc.moveDown(1);
+  }
+}
+function renderMethodology(doc, report) {
+  doc.addPage();
+  sectionTitle(doc, "Methodology");
+  doc.fontSize(10).font("Helvetica").fillColor(COLORS.text).text(
+    "This report was generated by 0, a fully autonomous agentic pentesting framework. The tool uses AI-driven attack generation and multi-agent consensus verification to identify security vulnerabilities.",
+    PAGE_MARGIN,
+    doc.y + 10,
+    { width: CONTENT_WIDTH }
+  );
+  doc.moveDown(1);
+  subSectionTitle(doc, "Scan Parameters");
+  const params = [
+    ["Target", report.target],
+    ["Scan Depth", report.scanDepth],
+    ["Started", formatDate(report.startedAt)],
+    ["Completed", formatDate(report.completedAt)],
+    ["Duration", formatDuration3(report.durationMs)],
+    ["Total Attacks", String(report.summary.totalAttacks)],
+    ["Total Findings", String(report.summary.totalFindings)]
+  ];
+  for (const [label, value] of params) {
+    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.text).text(`${label}: `, PAGE_MARGIN, doc.y, { continued: true }).font("Helvetica").text(value);
+    doc.moveDown(0.2);
+  }
+  doc.moveDown(1);
+  subSectionTitle(doc, "Severity Definitions");
+  const sevDefs = [
+    ["Critical", "Immediate exploitation possible with severe business impact. Requires urgent remediation."],
+    ["High", "Easily exploitable vulnerability with significant impact. Should be fixed in the next release cycle."],
+    ["Medium", "Exploitable with some prerequisites. Should be addressed in planned maintenance."],
+    ["Low", "Minor issue with limited impact. Fix as part of regular development."],
+    ["Info", "Informational finding or best-practice recommendation. No immediate risk."]
+  ];
+  for (const [sev, desc] of sevDefs) {
+    doc.fontSize(10).font("Helvetica-Bold").fillColor(COLORS.text).text(`${sev}: `, PAGE_MARGIN, doc.y, { continued: true }).font("Helvetica").fillColor(COLORS.textLight).text(desc, { width: CONTENT_WIDTH - 60 });
+    doc.moveDown(0.3);
+  }
+  doc.moveDown(1);
+  subSectionTitle(doc, "Disclaimer");
+  doc.fontSize(9).font("Helvetica").fillColor(COLORS.textLight).text(
+    "This automated scan provides a point-in-time assessment. It may not identify all vulnerabilities. Results should be validated by security professionals. The findings do not guarantee the absence of other security issues. This report is confidential and intended for authorized recipients only.",
+    PAGE_MARGIN,
+    doc.y,
+    { width: CONTENT_WIDTH }
+  );
+}
+function sectionTitle(doc, title) {
+  doc.fontSize(20).font("Helvetica-Bold").fillColor(COLORS.primary).text(title, PAGE_MARGIN, PAGE_MARGIN);
+  doc.moveTo(PAGE_MARGIN, doc.y + 4).lineTo(PAGE_MARGIN + CONTENT_WIDTH, doc.y + 4).strokeColor(COLORS.accent).lineWidth(1.5).stroke();
+  doc.y += 12;
+}
+function subSectionTitle(doc, title) {
+  doc.fontSize(12).font("Helvetica-Bold").fillColor(COLORS.primary).text(title, PAGE_MARGIN, doc.y);
+  doc.moveDown(0.3);
+}
+function codeBlock(doc, text) {
+  const maxChars = 2e3;
+  const displayText = truncate(text, maxChars);
+  doc.font("Courier").fontSize(8);
+  const textHeight = doc.heightOfString(displayText, {
+    width: CONTENT_WIDTH - 20
+  });
+  const blockHeight = Math.min(textHeight + 16, 300);
+  const y = doc.y;
+  if (y + blockHeight > 740) {
+    doc.addPage();
+  }
+  doc.rect(PAGE_MARGIN, doc.y, CONTENT_WIDTH, blockHeight).fill("#f1f3f5");
+  doc.fontSize(8).font("Courier").fillColor(COLORS.text).text(displayText, PAGE_MARGIN + 10, doc.y - blockHeight + 8, {
+    width: CONTENT_WIDTH - 20,
+    height: blockHeight - 16,
+    ellipsis: true
+  });
+  doc.y = doc.y + 4;
+}
+function renderFooters(doc) {
+  const pageCount = doc.bufferedPageRange().count;
+  for (let i = 0; i < pageCount; i++) {
+    doc.switchToPage(i);
+    if (i === 0) continue;
+    doc.fontSize(8).font("Helvetica").fillColor(COLORS.textLight).text(
+      `0 Pentest Report  |  Page ${i + 1} of ${pageCount}  |  CONFIDENTIAL`,
+      PAGE_MARGIN,
+      760,
+      { width: CONTENT_WIDTH, align: "center" }
+    );
+  }
+}
+
+// packages/cli/src/formatters/replay.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+var BOX_WIDTH = 55;
+function boxTop(label) {
+  const inner = ` ${label} `;
+  const remaining = BOX_WIDTH - inner.length - 1;
+  return source_default.dim("\u250C\u2500 ") + source_default.bold.white(label) + source_default.dim(" " + "\u2500".repeat(Math.max(0, remaining)) + "\u2510");
+}
+function boxRow(content) {
+  const visible = stripAnsi(content);
+  const pad = Math.max(0, BOX_WIDTH - visible.length - 2);
+  return source_default.dim("\u2502") + " " + content + " ".repeat(pad) + source_default.dim("\u2502");
+}
+function boxBottom(withArrow) {
+  if (withArrow) {
+    const half = Math.floor((BOX_WIDTH - 1) / 2);
+    const rest = BOX_WIDTH - half - 1;
+    return source_default.dim("\u2514" + "\u2500".repeat(half) + "\u2534" + "\u2500".repeat(rest) + "\u2518");
+  }
+  return source_default.dim("\u2514" + "\u2500".repeat(BOX_WIDTH) + "\u2518");
+}
+function connector() {
+  const half = Math.floor((BOX_WIDTH + 1) / 2);
+  return " ".repeat(half) + source_default.dim("\u25BC");
+}
+function outcomeLabel(outcome) {
+  switch (outcome) {
+    case "vulnerable":
+      return source_default.red.bold("VULNERABLE");
+    case "leaked":
+      return source_default.red.bold("LEAKED");
+    case "bypassed":
+      return source_default.red.bold("BYPASSED");
+    case "safe":
+      return source_default.green("SAFE");
+    case "error":
+      return source_default.yellow("ERROR");
+    default:
+      return source_default.gray(outcome.toUpperCase());
+  }
+}
+function buildReplayLines(data) {
+  const lines = [];
+  const FAST = 50;
+  const MED = 75;
+  const SLOW = 100;
+  const PAUSE = 200;
+  lines.push({ text: boxTop("DISCOVER"), delay: PAUSE });
+  if (data.targetInfo) {
+    const t = data.targetInfo;
+    const truncUrl = t.url.length > 30 ? t.url.slice(0, 27) + "..." : t.url;
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncUrl}`) + source_default.dim(" \u2192 ") + source_default.white(`200`) + source_default.gray(` (${t.type} endpoint detected)`)
+      ),
+      delay: MED
+    });
+    if (t.systemPrompt) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`System prompt extracted`) + source_default.gray(` (${t.systemPrompt.length} chars)`)
+        ),
+        delay: MED
+      });
+    }
+    if (t.detectedFeatures && t.detectedFeatures.length > 0) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`${t.detectedFeatures.length} features detected: `) + source_default.gray(t.detectedFeatures.slice(0, 3).join(", "))
+        ),
+        delay: MED
+      });
+    }
+    if (t.endpoints && t.endpoints.length > 0) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`${t.endpoints.length} endpoints found`)
+        ),
+        delay: MED
+      });
+    }
+  } else {
+    const truncTarget = data.target.length > 30 ? data.target.slice(0, 27) + "..." : data.target;
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncTarget}`) + source_default.dim(" \u2192 ") + source_default.white("200") + source_default.gray(" (LLM API detected)")
+      ),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("ATTACK"), delay: PAUSE });
+  const vulnerableFindings = data.findings.filter(
+    (f) => f.status !== "false-positive"
+  );
+  if (vulnerableFindings.length > 0) {
+    for (const finding of vulnerableFindings.slice(0, 8)) {
+      const truncTitle = finding.title.length > 30 ? finding.title.slice(0, 27) + "..." : finding.title;
+      let outcome = "VULNERABLE";
+      const cat = finding.category;
+      if (cat === "system-prompt-extraction") outcome = "LEAKED";
+      if (cat === "jailbreak") outcome = "BYPASSED";
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(truncTitle) + source_default.dim(" \u2192 ") + "  " + outcomeLabel(outcome.toLowerCase())
+        ),
+        delay: MED
+      });
+    }
+    if (vulnerableFindings.length > 8) {
+      lines.push({
+        text: boxRow(
+          source_default.gray(
+            `  ... and ${vulnerableFindings.length - 8} more attacks`
+          )
+        ),
+        delay: FAST
+      });
+    }
+  } else {
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`${data.summary.totalAttacks} probes executed`) + source_default.dim(" \u2192 ") + source_default.green("ALL SAFE")
+      ),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("VERIFY"), delay: PAUSE });
+  const confirmed = data.findings.filter(
+    (f) => f.status === "confirmed" || f.status === "verified" || f.status === "scored" || f.status === "reported"
+  );
+  const falsePositives = data.findings.filter(
+    (f) => f.status === "false-positive"
+  );
+  if (confirmed.length > 0 || data.findings.length > 0) {
+    const reproduced = confirmed.length > 0 ? confirmed.length : data.findings.length;
+    lines.push({
+      text: boxRow(
+        source_default.green("\u2713") + " " + source_default.white(`Reproduced ${reproduced}/${reproduced} findings`)
+      ),
+      delay: MED
+    });
+  }
+  if (falsePositives.length > 0) {
+    lines.push({
+      text: boxRow(
+        source_default.red("\u2717") + " " + source_default.white(`Eliminated ${falsePositives.length} false positives`)
+      ),
+      delay: MED
+    });
+  }
+  if (confirmed.length === 0 && falsePositives.length === 0 && data.findings.length === 0) {
+    lines.push({
+      text: boxRow(source_default.green("\u2713") + " " + source_default.white("No findings to verify")),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("REPORT"), delay: PAUSE });
+  const totalFindings = data.summary.totalFindings;
+  if (totalFindings > 0) {
+    const parts = [];
+    if (data.summary.critical > 0) parts.push(source_default.red.bold(`${data.summary.critical} CRITICAL`));
+    if (data.summary.high > 0) parts.push(source_default.redBright(`${data.summary.high} HIGH`));
+    if (data.summary.medium > 0) parts.push(source_default.yellow(`${data.summary.medium} MEDIUM`));
+    if (data.summary.low > 0) parts.push(source_default.blue(`${data.summary.low} LOW`));
+    if (data.summary.info > 0) parts.push(source_default.gray(`${data.summary.info} INFO`));
+    lines.push({
+      text: boxRow(
+        source_default.white(`${totalFindings} verified findings: `) + parts.join(source_default.dim(", "))
+      ),
+      delay: MED
+    });
+  } else {
+    lines.push({
+      text: boxRow(source_default.green.bold("0 findings") + source_default.white(" - target appears secure")),
+      delay: MED
+    });
+  }
+  const duration = data.durationMs < 1e3 ? `${data.durationMs}ms` : `${(data.durationMs / 1e3).toFixed(1)}s`;
+  lines.push({
+    text: boxRow(
+      source_default.white(`Completed in ${duration}`) + source_default.dim(" \u2192 ") + source_default.gray("./0-report.json")
+    ),
+    delay: MED
+  });
+  lines.push({ text: boxBottom(false), delay: FAST });
+  return lines;
+}
+async function renderReplay(data) {
+  const lines = buildReplayLines(data);
+  process.stdout.write("\n");
+  process.stdout.write(
+    source_default.red.bold("  \u25C6 0") + source_default.gray(" attack replay") + "\n"
+  );
+  process.stdout.write(
+    source_default.dim("  " + "\u2500".repeat(BOX_WIDTH + 1)) + "\n"
+  );
+  process.stdout.write("\n");
+  await sleep(200);
+  for (const line of lines) {
+    await sleep(line.delay);
+    process.stdout.write("  " + line.text + "\n");
+  }
+  process.stdout.write("\n");
+}
+
+// packages/cli/src/formatters/timeline.ts
+var TIMELINE_FORMATS = ["json", "csv", "markdown"];
+function isTimelineFormat(value) {
+  return TIMELINE_FORMATS.includes(value);
+}
+function formatTimeline(record, format) {
+  switch (format) {
+    case "json":
+      return formatTimelineJson(record);
+    case "csv":
+      return formatTimelineCsv(record);
+    case "markdown":
+      return formatTimelineMarkdown(record);
+  }
+}
+function formatTimelineJson(record) {
+  return JSON.stringify(record, null, 2);
+}
+var CSV_COLUMNS = [
+  "timestamp",
+  "stage",
+  "eventType",
+  "agentRole",
+  "findingId",
+  "action",
+  "attackTechniqueIds",
+  "attackTactics",
+  // Appended, never interleaved with the ATT&CK columns — an importer that
+  // only knows the ATT&CK pair keeps working, and the two taxonomies stay
+  // visibly distinct in a spreadsheet.
+  "atlasTechniqueIds",
+  "atlasTactics"
+];
+function formatTimelineCsv(record) {
+  const lines = [CSV_COLUMNS.join(",")];
+  for (const entry of record.entries) {
+    lines.push(
+      [
+        entry.timestamp,
+        entry.stage,
+        entry.eventType,
+        entry.agentRole ?? "",
+        entry.findingId ?? "",
+        entry.action,
+        entry.techniques.map((t) => t.id).join(" "),
+        uniq(entry.techniques.map((t) => t.tactic)).join(" "),
+        entry.atlasTechniques.map((t) => t.id).join(" "),
+        uniq(entry.atlasTechniques.map((t) => t.tactic)).join(" ")
+      ].map(csvCell).join(",")
+    );
+  }
+  return lines.join("\n") + "\n";
+}
+function csvCell(value) {
+  if (!/[",\r\n]/.test(value)) return value;
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function formatTimelineMarkdown(record) {
+  const out = [];
+  out.push(`# Forensic timeline \u2014 scan \`${record.scanId}\``);
+  out.push("");
+  if (record.target) out.push(`- **Target:** ${record.target}`);
+  out.push(`- **Generated:** ${record.generatedAt}`);
+  out.push(`- **Events:** ${record.eventCount} of ${record.totalEventCount} recorded`);
+  if (record.filters.since) out.push(`- **Since:** ${record.filters.since}`);
+  if (record.filters.until) out.push(`- **Until:** ${record.filters.until}`);
+  if (record.filters.attackOnly) {
+    out.push(`- **Filter:** technique-mapped events only (pipeline lifecycle events omitted)`);
+  }
+  out.push("");
+  out.push("All timestamps are UTC (ISO-8601).");
+  out.push("");
+  out.push(
+    "ATT&CK (Enterprise) and ATLAS (AI systems) are separate matrices; a row may carry either, both, or neither."
+  );
+  out.push("");
+  if (record.entries.length === 0) {
+    out.push("_No pipeline events recorded for this scan in the selected window._");
+    out.push("");
+    return out.join("\n");
+  }
+  out.push("| # | Timestamp (UTC) | Stage | Event | Agent | Finding | Action | ATT&CK | ATLAS |");
+  out.push("| --- | --- | --- | --- | --- | --- | --- | --- | --- |");
+  record.entries.forEach((entry, i) => {
+    out.push(
+      "| " + [
+        String(i + 1),
+        entry.timestamp,
+        mdCell(entry.stage),
+        mdCell(entry.eventType),
+        mdCell(entry.agentRole ?? "\u2014"),
+        mdCell(entry.findingId ?? "\u2014"),
+        mdCell(entry.action),
+        mdTechniques(entry.techniques),
+        mdTechniques(entry.atlasTechniques)
+      ].join(" | ") + " |"
+    );
+  });
+  out.push("");
+  return out.join("\n");
+}
+function mdTechniques(techniques) {
+  return techniques.length > 0 ? techniques.map(mdTechnique).join(", ") : "\u2014";
+}
+function mdTechnique(technique) {
+  const label = mdCell(`${technique.id} ${technique.name}`);
+  return technique.url ? `[${label}](${technique.url})` : label;
+}
+function mdCell(value) {
+  return value.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
+}
+function uniq(values) {
+  return [...new Set(values.filter((v) => v.length > 0))];
+}
+
+// packages/cli/src/formatters/index.ts
+function formatPresentationDocument(document, format) {
+  if (format === "json" && document.documentType !== "scan-report") {
+    return JSON.stringify(document.report, null, 2);
+  }
+  const report = document.documentType === "scan-report" ? document.report : document.documentType === "audit-report" ? {
+    target: `${document.report.package}@${document.report.version}`,
+    scanDepth: "deep",
+    startedAt: document.report.startedAt,
+    completedAt: document.report.completedAt,
+    durationMs: document.report.durationMs,
+    summary: document.report.summary,
+    findings: document.report.findings,
+    warnings: []
+  } : {
+    target: document.report.repo,
+    scanDepth: "deep",
+    startedAt: document.report.startedAt,
+    completedAt: document.report.completedAt,
+    durationMs: document.report.durationMs,
+    summary: document.report.summary,
+    findings: document.report.findings,
+    warnings: document.report.warnings?.map((warning) => ({ stage: "report", message: `[${warning.stage}] ${warning.message}` })) ?? [],
+    executionSuccessful: document.report.researchFailed ? false : void 0,
+    reviewChecks: document.report.reviewChecks
+  };
+  switch (format) {
+    case "terminal":
+      return formatTerminal(report);
+    case "json":
+      return formatJson(report);
+    case "markdown":
+      return formatMarkdown(report);
+    case "html":
+      return formatHtml(report);
+    case "sarif":
+      return formatSarif(report);
+    case "pdf":
+      return "[PDF output requires generatePdfReport()]";
+  }
+}
+function formatReport(report, format) {
+  return formatPresentationDocument(createScanReportDocument(report), format);
+}
+function formatAuditReport(report, format) {
+  return formatPresentationDocument(createAuditReportDocument(report), format);
+}
+function formatReviewReport(report, format) {
+  return formatPresentationDocument(createReviewReportDocument(report), format);
+}
+
+export {
+  renderReplay,
+  getRuntimeAvailability,
+  checkRuntimeAvailability,
+  buildShareUrl,
+  formatSarif,
+  generatePdfReport,
+  TIMELINE_FORMATS,
+  isTimelineFormat,
+  formatTimeline,
+  formatReport,
+  formatAuditReport,
+  formatReviewReport
+};