0sec-cli 0.22.4 → 0.24.0

package/chunks/{chunk-2WWAPKAW.js → chunk-BIJPMYFA.js}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  redactAuthHeaders
-} from "./chunk-UELXHK2Y.js";
 import {
   eventBus
-} from "./chunk-4ZYYX5GY.js";
+} from "./chunk-52AWIBCT.js";
+import {
+  redactAuthHeaders
+} from "./chunk-IK27KMVV.js";
 import {
   ScopePolicy
-} from "./chunk-C6JPA32H.js";
+} from "./chunk-RBOMXUYL.js";
 import {
   allowlistedChildEnv,
   sanitizedEnv
@@ -18,7 +18,7 @@ import {
   VERSION,
   cloudStateDir,
   homeStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";

package/chunks/{chunk-SCWWLABR.js → chunk-CIMN2AO6.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/scope/waf-detect.js
 function readHeader(headers, name) {

package/chunks/{chunk-H4DH7COV.js → chunk-CSPF47S3.js}

@@ -17,40 +17,40 @@ import {
   registerSignalCleanup,
   runNativeAgentLoop,
   toolCallPreview
-} from "./chunk-H6Q2QAIY.js";
+} from "./chunk-A3EKBUEM.js";
 import {
   WafDetector
-} from "./chunk-SCWWLABR.js";
+} from "./chunk-CIMN2AO6.js";
 import {
   RECIPE_LIBRARY
 } from "./chunk-UEX7PFSE.js";
+import {
+  CLI_RUNTIME_TYPES
+} from "./chunk-YJU7QACE.js";
+import {
+  addRuntimeUsage,
+  scanGoalPrompt
+} from "./chunk-YYOQADBB.js";
 import {
   createRuntime,
   detectAvailableRuntimes,
   pickRuntimeForStage
-} from "./chunk-WBRGXCU2.js";
+} from "./chunk-EXTN4SQV.js";
 import {
   osecDB
-} from "./chunk-L2CCO4KE.js";
-import {
-  CLI_RUNTIME_TYPES
-} from "./chunk-CPCHLL6A.js";
-import {
-  addRuntimeUsage,
-  scanGoalPrompt
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-RCHAFSWS.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-EYBMTELO.js";
 import {
   analyticsPipeline,
   reportUnsupportedContributionMode
-} from "./chunk-2WWAPKAW.js";
+} from "./chunk-BIJPMYFA.js";
 import {
   estimateCost,
   modelProvider
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -5087,7 +5087,7 @@ function cleanupHuntDb(path2) {
   }
 }
 async function runSourceHunt(config, hint, purpose, emit = () => {
-}) {
+}, nativeRuntime) {
   const dbPath = freshHuntDb();
   const db = new osecDB(dbPath);
   try {
@@ -5100,7 +5100,7 @@ async function runSourceHunt(config, hint, purpose, emit = () => {
       scopePath: sourceRoot,
       target: config.target,
       scanId,
-      config,
+      config: { ...config, ...nativeRuntime ? { nativeRuntime } : {} },
       db,
       emit,
       cliPrompt: prompt,
@@ -5316,6 +5316,8 @@ LENS FOCUS \u2014 concentrate this refute pass specifically on: ${opts.focus}`;
     const baseConfig = {
       ...opts.costCeilingUsd !== void 0 ? { costCeilingUsd: opts.costCeilingUsd } : {},
       ...opts.costLedger ? { costLedger: opts.costLedger } : {},
+      ...opts.signal ? { signal: opts.signal } : {},
+      ...opts.plan ? { plan: opts.plan } : {},
       target: resolve(opts.sourceRoot, candidate.path),
       depth: "quick",
       format: "json",
@@ -5326,7 +5328,7 @@ LENS FOCUS \u2014 concentrate this refute pass specifically on: ${opts.focus}`;
     };
     const refutePass = async (model) => {
       const config = { ...baseConfig, ...model ? { model } : {} };
-      const report = await runSourceHunt(config, hint, "verify");
+      const report = await runSourceHunt(config, hint, "verify", void 0, opts.nativeRuntime);
       return report.findings.length > 0;
     };
     let choice = refuter;
@@ -5404,6 +5406,9 @@ function makeMultiLensVerifier(lenses, opts) {
   const makePass = opts.makePass ?? ((lens) => makeSkepticVerifier({
     sourceRoot: opts.sourceRoot,
     runtime: opts.runtime,
+    ...opts.signal ? { signal: opts.signal } : {},
+    ...opts.nativeRuntime ? { nativeRuntime: opts.nativeRuntime } : {},
+    ...opts.plan ? { plan: opts.plan } : {},
     ...opts.model ? { model: opts.model } : {},
     ...opts.negatives ? { negatives: opts.negatives } : {},
     ...opts.costCeilingUsd !== void 0 ? { costCeilingUsd: opts.costCeilingUsd } : {},
@@ -5474,6 +5479,7 @@ function siteGroupKey(candidatePath, model, lensId) {
   return lensId ? `${base} ${lensId}` : base;
 }
 async function runHuntScan(opts) {
+  opts.signal?.throwIfAborted();
   const log = opts.log ?? (() => {
   });
   const models = opts.models && opts.models.length > 0 ? opts.models : [void 0];
@@ -5515,6 +5521,7 @@ async function runHuntScan(opts) {
   const aimd = huntAimdEnabled() ? new AimdState(concurrency) : null;
   const effectiveConcurrency = costCeilingEnabled ? 1 : aimd ?? concurrency;
   const reports = await pool(runs, effectiveConcurrency, async (run) => {
+    opts.signal?.throwIfAborted();
     const version = run.lens.versionDigest ? { lensVersionDigest: run.lens.versionDigest } : {};
     if (costCeilingReached()) {
       return {
@@ -5538,7 +5545,7 @@ async function runHuntScan(opts) {
           model: run.model,
           attempt: run.attempt,
           challengeHint: huntHint(opts.brief, run.candidate, run.lens.challengeHint),
-          ...finderAbort ? { signal: finderAbort.signal } : {}
+          ...opts.signal || finderAbort ? { signal: opts.signal && finderAbort ? AbortSignal.any([opts.signal, finderAbort.signal]) : opts.signal ?? finderAbort?.signal } : {}
         });
         lateRef.current = scanPromise2;
         return await scanPromise2;
@@ -5553,7 +5560,9 @@ async function runHuntScan(opts) {
         repoPath: opts.sourceRoot,
         ...run.model ? { model: run.model } : {},
         ...costCeilingUsd !== void 0 ? { costCeilingUsd } : {},
-        ...costLedger ? { costLedger } : {}
+        ...costLedger ? { costLedger } : {},
+        ...opts.signal ? { signal: opts.signal } : {},
+        ...opts.plan ? { plan: opts.plan } : {}
       };
       const scanPromise = runSourceHunt(config, huntHint(opts.brief, run.candidate, run.lens.challengeHint), "research", (event) => {
         if (event.type !== "finding")
@@ -5561,11 +5570,12 @@ async function runHuntScan(opts) {
         const partial = partialFindingFromEvent(event.data);
         if (partial)
           partials.push(partial);
-      });
+      }, opts.nativeRuntime);
       lateRef.current = scanPromise;
       return await scanPromise;
     };
     const outcome = await runFinderResilient(attemptOnce, { timeoutMs: finderTimeoutMs, maxRetries: finderMaxRetries });
+    opts.signal?.throwIfAborted();
     if (outcome.status === "timed-out")
       finderAbort?.abort();
     let findings;

package/chunks/{chunk-RCRTSKQN.js → chunk-DNV3ZMPX.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   homeStateDir
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/triage/kernel-vm-runner.js
 import { execFileSync, spawn } from "node:child_process";

package/chunks/{chunk-GVY3S5E5.js → chunk-E42XEJTK.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   bufferToString
-} from "./chunk-CPCHLL6A.js";
+} from "./chunk-YJU7QACE.js";
 import {
   scanExecutionTimeout
-} from "./chunk-YAZARMJY.js";
+} from "./chunk-YYOQADBB.js";
 
 // packages/core/dist/prepare.js
 import { execFileSync as execFileSync2 } from "node:child_process";

package/chunks/{chunk-VDOWARMJ.js → chunk-ESM447R6.js}

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  connectionConfigEnvPatch,
+  credentialEnvPatch,
+  loadCredentials
+} from "./chunk-62PGWN7Y.js";
 
 // packages/cli/src/herdr-state.ts
 var sink = null;
@@ -49,6 +54,14 @@ function reportHerdrSessionClose() {
   });
 }
 
+// packages/cli/src/connection-env.ts
+function savedConnectionEnvPatch(env, homeDir) {
+  return {
+    ...connectionConfigEnvPatch(env, homeDir),
+    ...credentialEnvPatch(loadCredentials(homeDir), env)
+  };
+}
+
 export {
   setHerdrSink,
   reportOperatorGate,
@@ -59,5 +72,6 @@ export {
   reportHerdrActivity,
   reportHerdrCompaction,
   reportHerdrSession,
-  reportHerdrSessionClose
+  reportHerdrSessionClose,
+  savedConnectionEnvPatch
 };

package/chunks/{chunk-WBRGXCU2.js → chunk-EXTN4SQV.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-O6KPVYOI.js";
 import {
   LlmApiRuntime
-} from "./chunk-QVIRWJ45.js";
+} from "./chunk-EYBMTELO.js";
 import {
   readCacheUsage
 } from "./chunk-RS4MAN3Q.js";

package/chunks/{chunk-QVIRWJ45.js → chunk-EYBMTELO.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-2WWAPKAW.js";
+} from "./chunk-BIJPMYFA.js";
 import {
   MESSAGE_CACHE_BREAKPOINTS,
   planMessageBreakpoints,
@@ -13,7 +13,7 @@ import {
 } from "./chunk-RS4MAN3Q.js";
 import {
   VERSION
-} from "./chunk-6KFB6AYN.js";
+} from "./chunk-RZR2XXAK.js";
 
 // packages/core/dist/agent/feature-presets.js
 var FP_MOAT_FLAGS = [
@@ -556,17 +556,11 @@ var features = {
     return env("ZERO_FEATURE_PER_ITEM_ORCHESTRATION", true);
   },
   /**
-   * JIT skill loading (`packages/core/src/agent/skills/`).
-   * When enabled, the agent gains `list_skills` and `load_skill` tools
-   * that let it browse a registry of focused methodology guides and load
-   * them into working context mid-scan. Skills replace the monolithic
-   * playbook injection with targeted, on-demand knowledge (#410, #457).
-   *
-   * Default OFF unless an assigned cloud methodology manifest opts this run in.
-   * An explicit feature flag still takes precedence over that default.
-   * Implemented as a getter so the CLI `--features` flag — which sets
-   * the env var inside the command action, AFTER this module has been
-   * imported — is still honored at tool-dispatch time.
+   * Additional skill-discovery hints in security task prompts.
+   * The list_skills and load_skill tools are always available; this legacy
+   * flag controls extra prompting, rather than access to skill folders.
+   * Default OFF unless an assigned cloud methodology manifest opts the run in.
+   * Explicit feature settings take precedence over that default.
    */
   get jitSkills() {
     return env("ZERO_FEATURE_JIT_SKILLS", Boolean(process.env["ZERO_AUDIT_SKILLS_MANIFEST"]?.trim()));
@@ -1486,6 +1480,26 @@ var DEEPSEEK_DEFAULT_MODEL = "deepseek-flash";
 var QWEN_TOKEN_PLAN_DEEPSEEK_MODEL = "deepseek-v4-flash-0731";
 var XAI_DEFAULT_BASE_URL = "https://api.x.ai/v1";
 var XAI_DEFAULT_MODEL = "grok-4.6";
+var CLINE_DEFAULT_BASE_URL = "https://api.cline.bot/api/v1";
+var CLINE_DEFAULT_MODEL = "anthropic/claude-sonnet-4-6";
+function clineModelId(model) {
+  return model.replace(/^cline\//i, "");
+}
+function clineChatResponse(value) {
+  const record = (input) => input !== null && typeof input === "object" && !Array.isArray(input);
+  if (!record(value))
+    throw new Error("Cline returned an invalid chat response.");
+  let response = value;
+  if (Object.hasOwn(value, "success")) {
+    if (value.success !== true || !record(value.data))
+      throw new Error("Cline returned an unsuccessful or invalid chat response.");
+    response = value.data;
+  }
+  if (!Array.isArray(response.choices) || response.choices.length === 0 || !record(response.choices[0]) || !record(response.choices[0].message)) {
+    throw new Error("Cline returned an invalid chat response.");
+  }
+  return response;
+}
 var OPENCODE_DEFAULT_BASE_URL = "https://opencode.ai/zen/v1";
 var OPENCODE_DEFAULT_MODEL = "muse-spark-1.3-contributor-free";
 function openAICompatibleWireApi(env2, variable, fallback = "chat_completions") {
@@ -1560,6 +1574,7 @@ function parseLlmFallbackChain(env2 = process.env) {
     qwen: true,
     xai: true,
     opencode: true,
+    cline: true,
     copilot: true,
     google: true
   };
@@ -1604,10 +1619,11 @@ function resolveFailoverProvider(provider, model, env2 = process.env, apiKey) {
       const key = apiKey ?? env2.AZURE_OPENAI_API_KEY;
       if (!key)
         return void 0;
-      const url = env2.AZURE_OPENAI_BASE_URL ?? env2.OPENAI_BASE_URL;
+      const azureConfig = parseCodexAzureConfig(env2);
+      const url = env2.AZURE_OPENAI_BASE_URL ?? env2.OPENAI_BASE_URL ?? azureConfig.baseUrl;
       if (!url)
         return void 0;
-      return { apiKey: key, baseUrl: url, wireApi: openAICompatibleWireApi(env2, "AZURE_OPENAI_WIRE_API") };
+      return { apiKey: key, baseUrl: url, wireApi: openAICompatibleWireApi(env2, "AZURE_OPENAI_WIRE_API", azureConfig.wireApi) };
     }
     case "openai": {
       const key = apiKey ?? env2.OPENAI_API_KEY;
@@ -1650,6 +1666,12 @@ function resolveFailoverProvider(provider, model, env2 = process.env, apiKey) {
         return void 0;
       return { apiKey: key, baseUrl: env2.XAI_BASE_URL ?? XAI_DEFAULT_BASE_URL, wireApi: openAICompatibleWireApi(env2, "XAI_WIRE_API") };
     }
+    case "cline": {
+      const key = apiKey ?? env2.CLINE_API_KEY;
+      if (!key?.trim())
+        return void 0;
+      return { apiKey: key, baseUrl: env2.CLINE_BASE_URL ?? CLINE_DEFAULT_BASE_URL, wireApi: "chat_completions" };
+    }
     case "opencode": {
       const key = apiKey ?? env2.OPENCODE_API_KEY;
       if (!key)
@@ -2137,6 +2159,8 @@ function providerForModel(model, env2) {
   if (m === QWEN_TOKEN_PLAN_DEEPSEEK_MODEL) {
     return env2.QWEN_API_KEY ? "qwen" : void 0;
   }
+  if (m.startsWith("cline/") || m.startsWith("cline-pass/"))
+    return env2.CLINE_API_KEY?.trim() ? "cline" : void 0;
   if (m.startsWith("openrouter/"))
     return env2.OPENROUTER_API_KEY ? "openrouter" : void 0;
   if (m.startsWith("glm-") || m.startsWith("z-ai/") || m.includes("glm")) {
@@ -2187,6 +2211,7 @@ var DEFAULT_PROVIDER_MODELS = {
   kimi: KIMI_DEFAULT_MODEL,
   qwen: QWEN_DEFAULT_MODEL,
   xai: XAI_DEFAULT_MODEL,
+  cline: CLINE_DEFAULT_MODEL,
   opencode: OPENCODE_DEFAULT_MODEL,
   copilot: COPILOT_DEFAULT_MODEL,
   google: GEMINI_DEFAULT_MODEL
@@ -2211,6 +2236,17 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
   const primaryModel = env2["ZERO_MODEL"]?.trim();
   const selectedProviderApplies = configProvider !== void 0 || !preferredModel || !primaryModel || preferredModel === primaryModel;
   const pinnedProviderRaw = forcedProviderRaw ?? (selectedProviderApplies ? selectedProviderRaw : void 0);
+  if (preferredModel && /^(?:cline\/|cline-pass\/)/i.test(preferredModel)) {
+    if (pinnedProviderRaw && pinnedProviderRaw !== "cline") {
+      throw new Error("Cline model IDs require the Cline provider; choose the Cline connection.");
+    }
+    if (configApiKey && !pinnedProviderRaw) {
+      throw new Error("Cline model IDs with RuntimeConfig.apiKey require an explicit Cline provider.");
+    }
+    if (!configApiKey && !env2.CLINE_API_KEY?.trim()) {
+      throw new Error("Cline model requires CLINE_API_KEY credentials. Connect Cline in Connections.");
+    }
+  }
   if (pinnedProviderRaw) {
     const source = pinnedProviderRaw === forcedProviderRaw ? "ZERO_FORCE_PROVIDER" : configProvider !== void 0 ? "RuntimeConfig.provider" : "ZERO_SELECTED_PROVIDER";
     if (!Object.hasOwn(DEFAULT_PROVIDER_MODELS, pinnedProviderRaw)) {
@@ -2318,6 +2354,14 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
         defaultModel: XAI_DEFAULT_MODEL,
         wireApi: openAICompatibleWireApi(env2, "XAI_WIRE_API")
       };
+    case "cline":
+      return {
+        provider: "cline",
+        apiKey: env2.CLINE_API_KEY,
+        baseUrl: env2.CLINE_BASE_URL ?? CLINE_DEFAULT_BASE_URL,
+        defaultModel: CLINE_DEFAULT_MODEL,
+        wireApi: "chat_completions"
+      };
     case "opencode":
       return {
         provider: "opencode",
@@ -2487,6 +2531,15 @@ function detectProvider(configApiKey, preferredModel, env2, configProvider) {
       wireApi: opencodeWireApiForModel(preferredModel)
     };
   }
+  if (env2.CLINE_API_KEY?.trim()) {
+    return {
+      provider: "cline",
+      apiKey: env2.CLINE_API_KEY,
+      baseUrl: env2.CLINE_BASE_URL ?? CLINE_DEFAULT_BASE_URL,
+      defaultModel: CLINE_DEFAULT_MODEL,
+      wireApi: "chat_completions"
+    };
+  }
   const copilotToken = env2["ZERO_COPILOT_GITHUB_TOKEN"];
   if (copilotToken) {
     return {
@@ -2646,6 +2699,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
     if (this.provider === "copilot") {
       this.model = copilotModelId(this.model);
     }
+    if (this.provider === "cline")
+      this.model = clineModelId(this.model);
     this.applyModelWireApi();
     if (this.apiKey && !this.env["ZERO_SKIP_PROVIDER_BANNER"]) {
       void logProviderStartup(this.provider, this.providerLabel, this.baseUrl, this.model, this.wireApi, this.apiKey).catch(() => {
@@ -2710,9 +2765,21 @@ var LlmApiRuntime = class _LlmApiRuntime {
     const state = this.codexAuthState;
     if (this.provider !== "chatgpt-codex" || !state)
       throw new Error("No active Codex subscription");
-    const { loadCodexModelCatalog } = await import("./codex-models-Z43V3427.js");
+    const { loadCodexModelCatalog } = await import("./codex-models-FQPCWRPC.js");
     return loadCodexModelCatalog({ signal, resolveCredentials: () => refreshChatGptCodexAuthState(state) });
   }
+  /** Discover endpoint inventory; Cline explicitly marks its public catalog provenance. */
+  async availableModelCatalog(signal) {
+    if (this.provider === "chatgpt-codex")
+      return this.codexModelCatalog(signal);
+    const { discoverProviderModels } = await import("./provider-model-discovery-QGUGL3XW.js");
+    return discoverProviderModels({
+      provider: this.provider,
+      baseUrl: this.baseUrl,
+      headers: this.provider === "google" ? {} : await this.ensureFreshHeaders(),
+      signal
+    });
+  }
   /** Host-only inference grant bound to this captured account, including after
    * later logins or runtime reconfiguration. Never serialize the closure or
    * its result into guest admission, workspace files or environment. */
@@ -2755,7 +2822,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
       this.config = { ...this.config, autoRoute: sel.autoRoute };
     }
     if (sel.model !== void 0) {
-      const model = this.provider === "opencode" ? opencodeModelId(sel.model) : this.provider === "copilot" ? copilotModelId(sel.model) : sel.model;
+      const model = this.provider === "opencode" ? opencodeModelId(sel.model) : this.provider === "copilot" ? copilotModelId(sel.model) : this.provider === "cline" ? clineModelId(sel.model) : sel.model;
       if (model !== this.model) {
         this.model = model;
         this.config = { ...this.config, model };
@@ -2770,6 +2837,18 @@ var LlmApiRuntime = class _LlmApiRuntime {
       }
     }
   }
+  /** Explicit idle-boundary reconnect; ordinary model picks retain captured credentials. */
+  refreshConnection(env2) {
+    const effort = this.reasoningEffort;
+    this.applyConfiguration({
+      ...this.config,
+      apiKey: void 0,
+      provider: this.provider,
+      model: this.model,
+      env: Object.fromEntries(Object.entries(env2).filter((entry) => entry[1] !== void 0))
+    });
+    this.reasoningEffort = effort;
+  }
   /** Modern OpenAI tool calls use Responses, shared by roots and forks. */
   applyModelWireApi() {
     const normalizedModel = this.model.toLowerCase();
@@ -2839,7 +2918,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     if (typeof selectedModel !== "string" || !selectedModel.trim()) {
       throw new Error("Subagent model must be a non-empty model ID");
     }
-    const stripProviderPrefix = (id) => this.provider === "opencode" ? opencodeModelId(id) : this.provider === "copilot" ? copilotModelId(id) : id;
+    const stripProviderPrefix = (id) => this.provider === "opencode" ? opencodeModelId(id) : this.provider === "copilot" ? copilotModelId(id) : this.provider === "cline" ? clineModelId(id) : id;
     const model = stripProviderPrefix(selectedModel);
     const approvedByAllowlist = model === this.model || Object.values(this.config.agentModels ?? {}).some((id) => id !== AUTO_MODEL_SENTINEL && stripProviderPrefix(id) === model);
     const approved = approvedByAllowlist || autoInEffect && this.isModelAccessible(selectedModel);
@@ -2867,7 +2946,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
    * inert default — it is intentionally unused for these two providers.
    */
   get isOpenAICompat() {
-    return this.provider === "openrouter" || this.provider === "openai" || this.provider === "azure" || this.provider === "deepseek" || this.provider === "qwen" || this.provider === "xai" || this.provider === "copilot" || this.provider === "opencode" && (this.wireApi === "chat_completions" || this.wireApi === "responses") || // chatgpt-codex always speaks Responses API; treat it as
+    return this.provider === "openrouter" || this.provider === "openai" || this.provider === "azure" || this.provider === "deepseek" || this.provider === "qwen" || this.provider === "xai" || this.provider === "copilot" || this.provider === "cline" || this.provider === "opencode" && (this.wireApi === "chat_completions" || this.wireApi === "responses") || // chatgpt-codex always speaks Responses API; treat it as
     // OpenAI-compat for body-shape branching purposes (the Responses
     // wire-API code paths below already key on `wireApi === "responses"`
     // and produce a body codex's backend accepts as-is).
@@ -2973,7 +3052,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
       } else {
         headers["Authorization"] = `Bearer ${this.apiKey}`;
       }
-      if (this.provider === "openrouter") {
+      if (this.provider === "openrouter" || this.provider === "cline") {
         headers["HTTP-Referer"] = "https://0.security";
         headers["X-Title"] = "0 Security Scanner";
       }
@@ -3200,6 +3279,8 @@ var LlmApiRuntime = class _LlmApiRuntime {
         return "xAI (Grok)";
       case "opencode":
         return "OpenCode Zen";
+      case "cline":
+        return "Cline";
       case "copilot":
         return "GitHub Copilot";
       case "google":
@@ -3207,7 +3288,7 @@ var LlmApiRuntime = class _LlmApiRuntime {
     }
   }
   noKeyError() {
-    return "No provider credential found. Set one of:\n  env ZERO_CHATGPT_OAUTH_REFRESH_TOKEN=... 0 <command> (ChatGPT Codex subscription auth)\n  export OPENROUTER_API_KEY=sk-or-...   (OpenRouter \u2014 many models, one key)\n  export DEEPSEEK_API_KEY=...           (DeepSeek \u2014 direct Flash 0731 inference)\n  export ANTHROPIC_API_KEY=sk-ant-...    (Anthropic \u2014 direct Claude access)\n  export AZURE_OPENAI_API_KEY=...        (Azure OpenAI \u2014 reuse your Codex Azure provider)\n  export OPENAI_API_KEY=sk-...           (OpenAI \u2014 direct GPT access)\n  export Z_AI_API_KEY=...                (Z.ai GLM \u2014 flat-rate Coding Plan, Anthropic-compatible)\n  export KIMI_API_KEY=...                (Moonshot Kimi K3 \u2014 flat-rate coding, Anthropic-compatible)\n  export QWEN_API_KEY=...                (Alibaba Qwen \u2014 Token Plan sub, OpenAI-compatible)\n  export XAI_API_KEY=...                 (xAI Grok \u2014 OpenAI-compatible)\n  export OPENCODE_API_KEY=...            (OpenCode Zen \u2014 multi-wire gateway)\n  export ZERO_COPILOT_GITHUB_TOKEN=...   (GitHub Copilot \u2014 device-code OAuth token)";
+    return "No provider credential found. Set one of:\n  env ZERO_CHATGPT_OAUTH_REFRESH_TOKEN=... 0 <command> (ChatGPT Codex subscription auth)\n  export OPENROUTER_API_KEY=sk-or-...   (OpenRouter \u2014 many models, one key)\n  export DEEPSEEK_API_KEY=...           (DeepSeek \u2014 direct Flash 0731 inference)\n  export ANTHROPIC_API_KEY=sk-ant-...    (Anthropic \u2014 direct Claude access)\n  export AZURE_OPENAI_API_KEY=...        (Azure OpenAI \u2014 reuse your Codex Azure provider)\n  export OPENAI_API_KEY=sk-...           (OpenAI \u2014 direct GPT access)\n  export Z_AI_API_KEY=...                (Z.ai GLM \u2014 flat-rate Coding Plan, Anthropic-compatible)\n  export KIMI_API_KEY=...                (Moonshot Kimi K3 \u2014 flat-rate coding, Anthropic-compatible)\n  export QWEN_API_KEY=...                (Alibaba Qwen \u2014 Token Plan sub, OpenAI-compatible)\n  export XAI_API_KEY=...                 (xAI Grok \u2014 OpenAI-compatible)\n  export CLINE_API_KEY=...               (Cline \u2014 API key; cline-pass/* needs ClinePass)\n  export OPENCODE_API_KEY=...            (OpenCode Zen \u2014 multi-wire gateway)\n  export ZERO_COPILOT_GITHUB_TOKEN=...   (GitHub Copilot \u2014 device-code OAuth token)";
   }
   getConfigurationDiagnostics() {
     if (!this.apiKey && this.provider !== "chatgpt-codex") {
@@ -3296,7 +3377,7 @@ Missing: ${missing.join("; ")}
         continue;
       }
       this.provider = entry.provider;
-      this.model = entry.provider === "opencode" ? opencodeModelId(entry.model) : entry.provider === "copilot" ? copilotModelId(entry.model) : entry.model;
+      this.model = entry.provider === "opencode" ? opencodeModelId(entry.model) : entry.provider === "copilot" ? copilotModelId(entry.model) : entry.provider === "cline" ? clineModelId(entry.model) : entry.model;
       this.apiKey = cfg.apiKey;
       this.baseUrl = cfg.baseUrl;
       this.wireApi = cfg.wireApi;
@@ -3499,6 +3580,7 @@ Missing: ${missing.join("; ")}
           messages.push({ role: "user", content: prompt });
           res = await this.postWithRetry(() => JSON.stringify({
             model: this.model,
+            ...this.provider === "cline" ? { stream: false } : {},
             [this.maxTokensParamKey]: NATIVE_COMPLETION_TOKEN_LIMIT,
             messages,
             // See executeNative: explicit reasoning_effort passthrough only.
@@ -3565,7 +3647,7 @@ Missing: ${missing.join("; ")}
         };
       }
       const parsedBody = JSON.parse(body);
-      const json = this.isGeminiCodeAssist ? parsedBody.response ?? parsedBody : parsedBody;
+      const json = this.provider === "cline" ? clineChatResponse(parsedBody) : this.isGeminiCodeAssist ? parsedBody.response ?? parsedBody : parsedBody;
       let text;
       if (this.isOpenAICompat && this.wireApi === "chat_completions") {
         const msg = json.choices?.[0]?.message;
@@ -3716,6 +3798,8 @@ Missing: ${missing.join("; ")}
           }
           const body = {
             model: this.model,
+            // Cline defaults to SSE; this path consumes a complete JSON response.
+            ...this.provider === "cline" ? { stream: false } : {},
             [this.maxTokensParamKey]: NATIVE_COMPLETION_TOKEN_LIMIT,
             messages: chatMessages
           };
@@ -3965,7 +4049,7 @@ Missing: ${missing.join("; ")}
         };
       }
       const parsedResponse = JSON.parse(responseText);
-      const json = this.isGeminiCodeAssist ? parsedResponse.response ?? parsedResponse : parsedResponse;
+      const json = this.provider === "cline" ? clineChatResponse(parsedResponse) : this.isGeminiCodeAssist ? parsedResponse.response ?? parsedResponse : parsedResponse;
       appendNativeTrace({
         kind: "native-response",
         provider: this.providerLabel,

package/chunks/chunk-FEOPHBMY.js

@@ -0,0 +1,56 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  createPresentationEvent
+} from "./chunk-RZR2XXAK.js";
+
+// packages/cli/src/presentation/event-bus.ts
+var PresentationEventBus = class {
+  listeners = [];
+  subscribe(listener) {
+    this.listeners.push(listener);
+    return () => {
+      const index = this.listeners.indexOf(listener);
+      if (index >= 0) this.listeners.splice(index, 1);
+    };
+  }
+  emit(event) {
+    for (const listener of [...this.listeners]) {
+      try {
+        listener.emit(event);
+      } catch {
+      }
+    }
+  }
+  get size() {
+    return this.listeners.length;
+  }
+};
+var presentationEventBus = new PresentationEventBus();
+function createPresentationEmitter(options = {}) {
+  const source = options.source ?? "cli";
+  const now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+  const bus = options.bus ?? presentationEventBus;
+  let sequence = 0;
+  return {
+    emit(eventType, payload, correlation = {}) {
+      const event = createPresentationEvent({
+        source,
+        sequence: ++sequence,
+        at: now(),
+        eventType,
+        payload,
+        ...correlation.scanId ? { scanId: correlation.scanId } : {},
+        ...correlation.sessionId ? { sessionId: correlation.sessionId } : {}
+      });
+      bus.emit(event);
+      return event;
+    }
+  };
+}
+
+export {
+  presentationEventBus,
+  createPresentationEmitter
+};

package/chunks/{chunk-IHPTOTLL.js → chunk-FKGFHLLS.js}

@@ -10,7 +10,7 @@ import {
 } from "./chunk-UEX7PFSE.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-RCRTSKQN.js";
+} from "./chunk-DNV3ZMPX.js";
 
 // packages/core/dist/kernel/exploit/harness.js
 import { existsSync } from "node:fs";