0sec-cli 0.22.4 → 0.23.0

package/chunks/{chunk-4ZYYX5GY.js → chunk-A5QO7N3S.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createPresentationEvent
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/events/bus.js
 function presentationEventSink(sink, options = {}) {

package/chunks/{chunk-CF3MNS3O.js → chunk-AAA4PRWK.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-2WWAPKAW.js";
+} from "./chunk-NI6QYQSK.js";
 import {
   isScopeEnforcementEnabled
-} from "./chunk-C6JPA32H.js";
+} from "./chunk-ITES7BCY.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";

package/chunks/{chunk-QVIRWJ45.js → chunk-BF5FIK7H.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-2WWAPKAW.js";
+} from "./chunk-NI6QYQSK.js";
 import {
   MESSAGE_CACHE_BREAKPOINTS,
   planMessageBreakpoints,
@@ -13,7 +13,7 @@ import {
 } from "./chunk-RS4MAN3Q.js";
 import {
   VERSION
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/agent/feature-presets.js
 var FP_MOAT_FLAGS = [
@@ -2710,7 +2710,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     const state = this.codexAuthState;
     if (this.provider !== "chatgpt-codex" || !state)
       throw new Error("No active Codex subscription");
-    const { loadCodexModelCatalog } = await import("./codex-models-Z43V3427.js");
+    const { loadCodexModelCatalog } = await import("./codex-models-Y457ND6Q.js");
     return loadCodexModelCatalog({ signal, resolveCredentials: () => refreshChatGptCodexAuthState(state) });
   }
   /** Host-only inference grant bound to this captured account, including after

package/chunks/{chunk-YAZARMJY.js → chunk-CP6HANBE.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-4ZYYX5GY.js";
+} from "./chunk-A5QO7N3S.js";
 import {
   estimateCost,
   modelProvider,
   splitCost,
   validateScanPlan
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 
 // packages/core/dist/agent/cost-ledger.js
 var recordedResults = /* @__PURE__ */ new WeakMap();

package/chunks/{chunk-H6Q2QAIY.js → chunk-EH2WTNY7.js}

@@ -19,7 +19,7 @@ import {
   searchPublicReports,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-SCWWLABR.js";
+} from "./chunk-JEYIWMGL.js";
 import {
   buildPlaybookInjection,
   classifyPromptLayerImpact,
@@ -27,14 +27,14 @@ import {
   parseSanitizerLog,
   renderSanitizerVerdict,
   verifyOracleByCategory
-} from "./chunk-2OQOQ2FZ.js";
+} from "./chunk-Y4HJRUFE.js";
 import {
   appendCredentialShared,
   createJournalWriter,
   loadJournal,
   rehydrateContext,
   renderSeedMessages
-} from "./chunk-YED25PA4.js";
+} from "./chunk-3E54JYS4.js";
 import {
   applyPatchOps,
   canonicalEvolutionJson,
@@ -48,7 +48,7 @@ import {
   readEvolutionArtifact,
   resolveEvolutionDirectoryPath,
   resolveScopedPath
-} from "./chunk-CF3MNS3O.js";
+} from "./chunk-AAA4PRWK.js";
 import {
   acquireHostToken,
   aggregateVerdict,
@@ -61,15 +61,15 @@ import {
 } from "./chunk-IXT64DV5.js";
 import {
   runFoxguardScan
-} from "./chunk-CPCHLL6A.js";
+} from "./chunk-65H3MRBF.js";
 import {
   addRuntimeUsage
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-CP6HANBE.js";
 import {
   LlmApiRuntime,
   diag,
   features
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-BF5FIK7H.js";
 import {
   DEFAULT_WORKBENCH_BROKER_LIMITS,
   WORKBENCH_BROKER_WORKSPACE,
@@ -106,13 +106,13 @@ import {
   summarizeScannerResult,
   superviseChild,
   withRunContribution
-} from "./chunk-2WWAPKAW.js";
+} from "./chunk-NI6QYQSK.js";
 import {
   redactSensitiveHeaders
 } from "./chunk-UELXHK2Y.js";
 import {
   eventBus
-} from "./chunk-4ZYYX5GY.js";
+} from "./chunk-A5QO7N3S.js";
 import {
   FrameReader,
   MAX_RESULT_CHARS,
@@ -127,7 +127,7 @@ import {
   sanitizeUntrustedToolResult,
   validatePluginManifest,
   withScopeEnforcement
-} from "./chunk-C6JPA32H.js";
+} from "./chunk-ITES7BCY.js";
 import {
   allowlistedChildEnv,
   sanitizedEnv
@@ -144,7 +144,7 @@ import {
   homeStateDir,
   jevConfigFromEnvironment,
   resolveIdentities
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-LTEE2JWK.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -13336,7 +13336,7 @@ async function executeEntraPosture(ctx, args) {
   const { runIdentityAssessment } = await import("./identity-62SVRW4H.js");
   let scope;
   if (typeof args.scope === "string" && args.scope.trim()) {
-    const { ScopePolicy: ScopePolicy2 } = await import("./scope-E5QZUOOH.js");
+    const { ScopePolicy: ScopePolicy2 } = await import("./scope-Q5PIX2IS.js");
     try {
       scope = ScopePolicy2.fromJsonFile(scopedPath(ctx, args.scope.trim()));
     } catch (error) {
@@ -13382,7 +13382,7 @@ async function executeEntraPosture(ctx, args) {
   };
 }
 async function executeAssembleAdvisory(_ctx, args) {
-  const { osecDB } = await import("./dist-7RUOKPRJ.js");
+  const { osecDB } = await import("./dist-7Q5A6TQM.js");
   const { renderAdvisoryMarkdown, assembleEvidencePack, decideFilingState, renderVendorNotificationMarkdown, EmptyPocError, UnreproducedFindingError } = await import("./disclose-LDNKAVRH.js");
   const dbPath = typeof args.db_path === "string" && args.db_path.trim() ? args.db_path.trim() : void 0;
   const scanId = typeof args.scan_id === "string" && args.scan_id.trim() ? args.scan_id.trim() : void 0;
@@ -13489,7 +13489,7 @@ function rowToAdvisoryFinding(row) {
   return finding;
 }
 async function executeCveLookup(_ctx, args) {
-  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-Z4UUIOH3.js");
+  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-NYKUF2M5.js");
   const rawCve = String(args.cve ?? args.cve_id ?? "").trim();
   if (!rawCve)
     return errResult("`cve` is required, e.g. CVE-2024-1086");
@@ -15011,8 +15011,8 @@ function refuseOutOfScope(ctx, url) {
   return null;
 }
 async function loadPersistedFinding(findingId, dbPathArg) {
-  const { osecDB, resolveOsecDbPath, listOsecRunDatabasePaths } = await import("./dist-7RUOKPRJ.js");
-  const { findingSchema, formatZodError } = await import("./dist-NG2HT5XU.js");
+  const { osecDB, resolveOsecDbPath, listOsecRunDatabasePaths } = await import("./dist-7Q5A6TQM.js");
+  const { findingSchema, formatZodError } = await import("./dist-RLPNLRZD.js");
   const { resolve: resolve14 } = await import("node:path");
   const { existsSync: existsSync9 } = await import("node:fs");
   const requestedId = findingId.trim();
@@ -15136,9 +15136,9 @@ async function executeVariantHunt(ctx, args) {
   if (!target)
     return errResult2("`source` is required (a source tree path or git URL)");
   const { resolve: resolve14, join: join18 } = await import("node:path");
-  const { prepare } = await import("./prepare-72GWTRVI.js");
-  const { generateVariantCandidates } = await import("./variant-candidates-SZKDCOLK.js");
-  const { runHuntScan, makeSkepticVerifier } = await import("./hunt-scan-ELTKGKC4.js");
+  const { prepare } = await import("./prepare-YVNENPNL.js");
+  const { generateVariantCandidates } = await import("./variant-candidates-TX5V6XOT.js");
+  const { runHuntScan, makeSkepticVerifier } = await import("./hunt-scan-MIRMABY4.js");
   let resolvedTarget;
   try {
     resolvedTarget = scopedPath2(ctx, target);
@@ -15202,10 +15202,10 @@ async function executeAssumptionHunt(ctx, args) {
   const { resolve: resolve14, join: join18, sep: sep7, relative: relative5, basename: basename3 } = await import("node:path");
   const { mkdtemp: mkdtemp4, rm: rm4 } = await import("node:fs/promises");
   const { tmpdir: tmpdir5 } = await import("node:os");
-  const { prepare } = await import("./prepare-72GWTRVI.js");
+  const { prepare } = await import("./prepare-YVNENPNL.js");
   const { collectScopeFiles } = await import("./source-files-REHOM44I.js");
-  const { runAssumptionHunt } = await import("./assumption-mining-2UAKQB6V.js");
-  const { makeSkepticVerifier } = await import("./hunt-scan-ELTKGKC4.js");
+  const { runAssumptionHunt } = await import("./assumption-mining-ZX3YVWEH.js");
+  const { makeSkepticVerifier } = await import("./hunt-scan-MIRMABY4.js");
   let resolvedTarget;
   try {
     resolvedTarget = scopedPath2(ctx, target);
@@ -15284,8 +15284,8 @@ async function executeGenerateFix(ctx, args) {
   if (!repoArg)
     return errResult2("`repo` is required (the repo root the patch applies to) \u2014 no scoped source path is set to default to.");
   const { resolve: resolve14 } = await import("node:path");
-  const { runSourceFix } = await import("./fix-NSNPU33B.js");
-  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-FCKOUB7V.js");
+  const { runSourceFix } = await import("./fix-JGBW7XUN.js");
+  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-HWL6HG7A.js");
   const loaded = await loadPersistedFinding(findingId, typeof args.db_path === "string" ? args.db_path : void 0);
   if ("error" in loaded)
     return errResult2(loaded.error);
@@ -15386,7 +15386,7 @@ async function executeProtocolConformance(ctx, args) {
     return errResult2(denial);
   const { runHttpConformanceCheck } = await import("./http-conformance-U5F6GKYG.js");
   const { createLiveHttpSender } = await import("./http-sender-I5XFFY35.js");
-  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-FCKOUB7V.js");
+  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-HWL6HG7A.js");
   const llm = new LlmApiRuntime2({ type: "api", timeout: 6e4 });
   const send = createLiveHttpSender();
   const protocol = {
@@ -15441,7 +15441,7 @@ async function executeSpecDrift(ctx, args) {
   if (!specArg.trim())
     return errResult2("`spec` is required (spec text, or a path to a spec document).");
   const { resolve: resolve14, basename: basename3 } = await import("node:path");
-  const { prepare } = await import("./prepare-72GWTRVI.js");
+  const { prepare } = await import("./prepare-YVNENPNL.js");
   const { runSpecdriftScan, runSpecdriftPlan } = await import("./specdrift-AFS54WEJ.js");
   let specText = specArg;
   let specName = typeof args.spec_name === "string" && args.spec_name.trim() ? args.spec_name.trim() : "spec";
@@ -15525,7 +15525,7 @@ async function executeSafetyEval(ctx, args) {
   const denial = refuseOutOfScope(ctx, target);
   if (denial)
     return errResult2(denial);
-  const { runEval } = await import("./eval-runner-6Q3H52SP.js");
+  const { runEval } = await import("./eval-runner-RZKDOQ2G.js");
   const categories = Array.isArray(args.categories) ? args.categories.map((c) => String(c)).filter(Boolean) : void 0;
   const timeout = typeof args.timeout_ms === "number" && args.timeout_ms > 0 ? args.timeout_ms : void 0;
   let scorecard;
@@ -15569,8 +15569,8 @@ async function executeMemsafetyFuzz(ctx, args) {
     return errResult2("`source` is required (a native source tree).");
   const { resolve: resolve14, join: join18, sep: sep7 } = await import("node:path");
   const { existsSync: existsSync9 } = await import("node:fs");
-  const { prepare } = await import("./prepare-72GWTRVI.js");
-  const { runMemSafetyScan } = await import("./memsafety-scan-FCPAXIZE.js");
+  const { prepare } = await import("./prepare-YVNENPNL.js");
+  const { runMemSafetyScan } = await import("./memsafety-scan-RPS446CD.js");
   let resolvedTarget;
   try {
     resolvedTarget = scopedPath2(ctx, target);
@@ -15704,14 +15704,14 @@ async function executeWeaponizeKernel(ctx, args) {
   if (!hasEngagementScope(ctx)) {
     return errResult2("weaponize_kernel requires an active engagement scope. It is not available for a no-scope session.");
   }
-  const { runWeaponization, kernelVmArtifactsReady } = await import("./harness-KXQOVIDQ.js");
+  const { runWeaponization, kernelVmArtifactsReady } = await import("./harness-CBOLMUHB.js");
   if (!kernelVmArtifactsReady()) {
     return errResult2("weaponize_kernel is denied: kernel-VM artifacts are not present. It only ever runs inside a DISPOSABLE kernel VM \u2014 set ZERO_KERNEL_QEMU_KERNEL and ZERO_KERNEL_QEMU_DISK to existing image paths. Refusing to run without the VM.");
   }
   const dmesg = typeof args.dmesg === "string" ? args.dmesg : "";
   if (!dmesg.trim())
     return errResult2("`dmesg` is required (the kernel crash log / KASAN splat to weaponize).");
-  const { classifyPrimitiveFromDmesg } = await import("./kernel-primitive-MT7YZSIG.js");
+  const { classifyPrimitiveFromDmesg } = await import("./kernel-primitive-NAPDMJC7.js");
   const crashType = typeof args.crash_type === "string" && args.crash_type.trim() ? args.crash_type.trim() : void 0;
   const primitive = classifyPrimitiveFromDmesg(dmesg, crashType);
   const reproducer = typeof args.reproducer === "string" && args.reproducer.trim() ? args.reproducer : void 0;
@@ -15746,12 +15746,12 @@ async function executeCveAdapt(ctx, args) {
   if (!hasEngagementScope(ctx)) {
     return errResult2("cve_adapt requires an active engagement scope. It is not available for a no-scope session.");
   }
-  const { kernelVmArtifactsReady } = await import("./harness-KXQOVIDQ.js");
+  const { kernelVmArtifactsReady } = await import("./harness-CBOLMUHB.js");
   if (!kernelVmArtifactsReady()) {
     return errResult2("cve_adapt is denied: its default verification boots a kernel VM and kernel-VM artifacts are not present. Set ZERO_KERNEL_QEMU_KERNEL and ZERO_KERNEL_QEMU_DISK to existing image paths. Refusing to run without the VM.");
   }
-  const { adaptAndVerify } = await import("./adapt-loop-3CCOWE43.js");
-  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-Z4UUIOH3.js");
+  const { adaptAndVerify } = await import("./adapt-loop-V3JFWOKC.js");
+  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-NYKUF2M5.js");
   const rawCve = String(args.cve ?? "").trim();
   if (!rawCve)
     return errResult2("`cve` is required, e.g. CVE-2024-1086.");
@@ -23564,7 +23564,7 @@ var ToolExecutor = class _ToolExecutor {
    * inside `runNativeAgentLoop`), so this is effectively free.
    */
   async loadSubagentDeps() {
-    const { runNativeAgentLoop: runNativeAgentLoop2 } = await import("./native-loop-OFJDRHPI.js");
+    const { runNativeAgentLoop: runNativeAgentLoop2 } = await import("./native-loop-CGOJMNHV.js");
     return { runNativeAgentLoop: runNativeAgentLoop2 };
   }
   subagentTools(messaging) {

package/chunks/{chunk-ELI3BVIK.js → chunk-EJH2TNVH.js}

@@ -5,13 +5,13 @@ import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-H4DH7COV.js";
+} from "./chunk-P7KDN5PK.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-RCRTSKQN.js";
+} from "./chunk-F344NYUN.js";
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-BF5FIK7H.js";
 import {
   __commonJS,
   __require,