0sec-cli 0.23.0 → 0.24.1

package/chunks/chunk-I43YYHDU.js

@@ -0,0 +1,566 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+import {
+  source_default
+} from "./chunk-HLFS6WV2.js";
+import {
+  formatHtml,
+  formatMarkdown,
+  formatSarif
+} from "./chunk-H5QURBBK.js";
+import {
+  compareFindingsByBusinessPriority,
+  createAuditReportDocument,
+  createReviewReportDocument,
+  createScanReportDocument,
+  getFindingPriority
+} from "./chunk-GXXX7AGH.js";
+
+// packages/cli/src/utils.ts
+import { gzipSync } from "zlib";
+async function getRuntimeAvailability() {
+  const { detectAvailableRuntimes, LlmApiRuntime } = await import("./dist-TQMHMSBZ.js");
+  const apiRuntimeDiagnostics = new LlmApiRuntime({ type: "api", timeout: 5e3 }).getConfigurationDiagnostics();
+  const hasApiKey = apiRuntimeDiagnostics.valid;
+  const availableRuntimes = [...await detectAvailableRuntimes()];
+  return {
+    hasApiKey,
+    availableRuntimes,
+    apiRuntime: {
+      configured: apiRuntimeDiagnostics.reason !== "missing_key",
+      valid: apiRuntimeDiagnostics.valid,
+      providerLabel: apiRuntimeDiagnostics.providerLabel,
+      error: apiRuntimeDiagnostics.fatalError
+    }
+  };
+}
+async function checkRuntimeAvailability(runtime) {
+  const availability = await getRuntimeAvailability();
+  const { hasApiKey, availableRuntimes, apiRuntime } = availability;
+  if (hasApiKey) return;
+  console.log("");
+  if ((runtime === "api" || runtime === "auto") && apiRuntime.configured && apiRuntime.error) {
+    console.log(source_default.red(`  ${apiRuntime.providerLabel} config error: ${apiRuntime.error.split("\n")[0]}`));
+  }
+  if (runtime === "api") {
+    console.log(source_default.yellow(
+      apiRuntime.configured ? "  Warning: `--runtime api` needs a valid provider configuration. AI analysis will fail until this is fixed." : "  Warning: `--runtime api` needs provider credentials. AI analysis may be skipped."
+    ));
+  } else if (availableRuntimes.length > 0) {
+    console.log(source_default.cyan(`  Using local runtime(s): ${availableRuntimes.join(", ")}`));
+  } else {
+    console.log(source_default.yellow("  Warning: No API key or local agent runtime detected. AI analysis will be skipped."));
+  }
+  console.log(source_default.gray("  Provider credentials: ZERO_CHATGPT_ACCESS_TOKEN | ZERO_CHATGPT_OAUTH_REFRESH_TOKEN, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, AZURE_OPENAI_API_KEY, OPENAI_API_KEY"));
+  console.log("");
+}
+function buildShareUrl(report) {
+  const json = JSON.stringify(report);
+  const compressed = gzipSync(Buffer.from(json, "utf-8"));
+  const b64 = compressed.toString("base64url");
+  return `https://0.security/r#${b64}`;
+}
+
+// packages/cli/src/formatters/terminal.ts
+var SEVERITY_COUNT_COLOR = {
+  critical: source_default.red.bold,
+  high: source_default.redBright.bold,
+  medium: source_default.yellow.bold,
+  low: source_default.blue,
+  info: source_default.gray
+};
+function formatTerminal(report) {
+  const W = 60;
+  const lines = [];
+  lines.push("");
+  if (report.warnings.length > 0) {
+    lines.push(`  ${source_default.yellow.bold("WARNINGS")}`);
+    lines.push("");
+    for (const warning of report.warnings) {
+      lines.push(
+        `  ${source_default.yellow.bold("!")} ${source_default.yellow(`[${warning.stage}] ${warning.message}`)}`
+      );
+    }
+    lines.push("");
+  }
+  if (report.findings.length === 0) {
+    lines.push("");
+    if (report.warnings.length > 0 || report.executionSuccessful === false) {
+      lines.push(
+        `  ${source_default.yellow.bold("!")} ${source_default.yellow("No vulnerabilities confirmed. Scan finished with warnings.")}`
+      );
+    } else if (report.reviewChecks?.some((check) => check.status !== "pass")) {
+      lines.push(`  ${source_default.yellow.bold("!")} ${source_default.yellow("No security vulnerabilities found. Advisory review checks need attention.")}`);
+    } else {
+      lines.push(`  ${source_default.green.bold("\u2713")} ${source_default.green("No vulnerabilities found.")}`);
+    }
+  } else {
+    lines.push(`  ${source_default.bold.white("FINDINGS")}`);
+    lines.push("");
+    const sorted = [...report.findings].sort(compareFindingsByBusinessPriority);
+    for (const finding of sorted) {
+      lines.push(formatFinding(finding));
+    }
+  }
+  if (report.reviewChecks?.length) {
+    lines.push("", `  ${source_default.bold.white("REVIEW CHECKS (advisory)")}`, "");
+    for (const check of report.reviewChecks) {
+      const color = check.status === "pass" ? source_default.green : source_default.yellow;
+      lines.push(`  ${color(check.status.toUpperCase())} ${check.name} (${check.id})`);
+      lines.push(`    Reason: ${check.reason}`);
+      if (check.fix) lines.push(`    Suggested fix: ${check.fix}`);
+      lines.push("");
+    }
+  }
+  lines.push("");
+  lines.push(`  ${source_default.gray("\u2500".repeat(50))}`);
+  lines.push("");
+  const { summary } = report;
+  const sev = [
+    summary.critical > 0 ? source_default.red.bold(`${summary.critical} critical`) : source_default.gray(`${summary.critical} critical`),
+    summary.high > 0 ? source_default.hex("#f97316").bold(`${summary.high} high`) : source_default.gray(`${summary.high} high`),
+    summary.medium > 0 ? source_default.yellow.bold(`${summary.medium} medium`) : source_default.gray(`${summary.medium} medium`),
+    source_default.gray(`${summary.low} low`),
+    source_default.gray(`${summary.info} info`)
+  ].join(source_default.gray("  "));
+  for (const label of ["Urgent", "High", "Moderate", "Low", "Not assessed"]) {
+    const count = report.findings.filter((finding) => getFindingPriority(finding).label === label).length;
+    if (count) lines.push(`  Business priority ${label}: ${count}`);
+  }
+  lines.push(`  ${source_default.gray("Technical severity:")} ${sev}`);
+  lines.push(`  ${source_default.white.bold(String(summary.totalFindings))} findings ${source_default.gray("in")} ${source_default.white(formatDuration(report.durationMs))}`);
+  lines.push(`  ${source_default.gray("Share:")} ${source_default.cyan(buildShareUrl(report))}`);
+  lines.push("");
+  return lines.join("\n");
+}
+function formatFinding(finding) {
+  const priority = getFindingPriority(finding);
+  const lines = [];
+  lines.push(`  ${source_default.bold(`Business priority: ${priority.label}`)} ${source_default.bold.white(finding.title)}`);
+  lines.push(`    ${source_default.gray("Business impact rationale:")} ${priority.rationale}`);
+  lines.push(`    ${source_default.gray("Technical severity:")} ${finding.severity}${finding.cvssScore !== void 0 ? `  CVSS: ${finding.cvssScore}` : ""}${finding.cvssVector ? `  CVSS vector: ${finding.cvssVector}` : ""}`);
+  const meta = [];
+  meta.push(`${source_default.gray("Category:")} ${formatCategory(finding.category)}`);
+  if (finding.status === "confirmed") {
+    meta.push(source_default.green("\u2713 Confirmed"));
+  }
+  lines.push(`  ${" ".repeat(11)}${meta.join(source_default.gray("  \xB7  "))}`);
+  if (finding.description) {
+    const desc = finding.description.length > 100 ? finding.description.slice(0, 97) + "..." : finding.description;
+    lines.push(`  ${" ".repeat(11)}${source_default.gray(desc)}`);
+  }
+  if (finding.evidence.analysis) {
+    const ev = finding.evidence.analysis.length > 100 ? finding.evidence.analysis.slice(0, 97) + "..." : finding.evidence.analysis;
+    lines.push(`  ${" ".repeat(11)}${source_default.gray.italic("\u21B3 " + ev)}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function formatCategory(cat) {
+  return cat.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
+}
+function formatDuration(ms) {
+  if (ms < 1e3) return `${ms}ms`;
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+
+// packages/cli/src/formatters/json.ts
+function formatJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+
+// packages/cli/src/formatters/replay.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+var BOX_WIDTH = 55;
+function boxTop(label) {
+  const inner = ` ${label} `;
+  const remaining = BOX_WIDTH - inner.length - 1;
+  return source_default.dim("\u250C\u2500 ") + source_default.bold.white(label) + source_default.dim(" " + "\u2500".repeat(Math.max(0, remaining)) + "\u2510");
+}
+function boxRow(content) {
+  const visible = stripAnsi(content);
+  const pad = Math.max(0, BOX_WIDTH - visible.length - 2);
+  return source_default.dim("\u2502") + " " + content + " ".repeat(pad) + source_default.dim("\u2502");
+}
+function boxBottom(withArrow) {
+  if (withArrow) {
+    const half = Math.floor((BOX_WIDTH - 1) / 2);
+    const rest = BOX_WIDTH - half - 1;
+    return source_default.dim("\u2514" + "\u2500".repeat(half) + "\u2534" + "\u2500".repeat(rest) + "\u2518");
+  }
+  return source_default.dim("\u2514" + "\u2500".repeat(BOX_WIDTH) + "\u2518");
+}
+function connector() {
+  const half = Math.floor((BOX_WIDTH + 1) / 2);
+  return " ".repeat(half) + source_default.dim("\u25BC");
+}
+function outcomeLabel(outcome) {
+  switch (outcome) {
+    case "vulnerable":
+      return source_default.red.bold("VULNERABLE");
+    case "leaked":
+      return source_default.red.bold("LEAKED");
+    case "bypassed":
+      return source_default.red.bold("BYPASSED");
+    case "safe":
+      return source_default.green("SAFE");
+    case "error":
+      return source_default.yellow("ERROR");
+    default:
+      return source_default.gray(outcome.toUpperCase());
+  }
+}
+function buildReplayLines(data) {
+  const lines = [];
+  const FAST = 50;
+  const MED = 75;
+  const SLOW = 100;
+  const PAUSE = 200;
+  lines.push({ text: boxTop("DISCOVER"), delay: PAUSE });
+  if (data.targetInfo) {
+    const t = data.targetInfo;
+    const truncUrl = t.url.length > 30 ? t.url.slice(0, 27) + "..." : t.url;
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncUrl}`) + source_default.dim(" \u2192 ") + source_default.white(`200`) + source_default.gray(` (${t.type} endpoint detected)`)
+      ),
+      delay: MED
+    });
+    if (t.systemPrompt) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`System prompt extracted`) + source_default.gray(` (${t.systemPrompt.length} chars)`)
+        ),
+        delay: MED
+      });
+    }
+    if (t.detectedFeatures && t.detectedFeatures.length > 0) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`${t.detectedFeatures.length} features detected: `) + source_default.gray(t.detectedFeatures.slice(0, 3).join(", "))
+        ),
+        delay: MED
+      });
+    }
+    if (t.endpoints && t.endpoints.length > 0) {
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(`${t.endpoints.length} endpoints found`)
+        ),
+        delay: MED
+      });
+    }
+  } else {
+    const truncTarget = data.target.length > 30 ? data.target.slice(0, 27) + "..." : data.target;
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`GET ${truncTarget}`) + source_default.dim(" \u2192 ") + source_default.white("200") + source_default.gray(" (LLM API detected)")
+      ),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("ATTACK"), delay: PAUSE });
+  const vulnerableFindings = data.findings.filter(
+    (f) => f.status !== "false-positive"
+  );
+  if (vulnerableFindings.length > 0) {
+    for (const finding of vulnerableFindings.slice(0, 8)) {
+      const truncTitle = finding.title.length > 30 ? finding.title.slice(0, 27) + "..." : finding.title;
+      let outcome = "VULNERABLE";
+      const cat = finding.category;
+      if (cat === "system-prompt-extraction") outcome = "LEAKED";
+      if (cat === "jailbreak") outcome = "BYPASSED";
+      lines.push({
+        text: boxRow(
+          source_default.dim("\u25B8") + " " + source_default.white(truncTitle) + source_default.dim(" \u2192 ") + "  " + outcomeLabel(outcome.toLowerCase())
+        ),
+        delay: MED
+      });
+    }
+    if (vulnerableFindings.length > 8) {
+      lines.push({
+        text: boxRow(
+          source_default.gray(
+            `  ... and ${vulnerableFindings.length - 8} more attacks`
+          )
+        ),
+        delay: FAST
+      });
+    }
+  } else {
+    lines.push({
+      text: boxRow(
+        source_default.dim("\u25B8") + " " + source_default.white(`${data.summary.totalAttacks} probes executed`) + source_default.dim(" \u2192 ") + source_default.green("ALL SAFE")
+      ),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("VERIFY"), delay: PAUSE });
+  const confirmed = data.findings.filter(
+    (f) => f.status === "confirmed" || f.status === "verified" || f.status === "scored" || f.status === "reported"
+  );
+  const falsePositives = data.findings.filter(
+    (f) => f.status === "false-positive"
+  );
+  if (confirmed.length > 0 || data.findings.length > 0) {
+    const reproduced = confirmed.length > 0 ? confirmed.length : data.findings.length;
+    lines.push({
+      text: boxRow(
+        source_default.green("\u2713") + " " + source_default.white(`Reproduced ${reproduced}/${reproduced} findings`)
+      ),
+      delay: MED
+    });
+  }
+  if (falsePositives.length > 0) {
+    lines.push({
+      text: boxRow(
+        source_default.red("\u2717") + " " + source_default.white(`Eliminated ${falsePositives.length} false positives`)
+      ),
+      delay: MED
+    });
+  }
+  if (confirmed.length === 0 && falsePositives.length === 0 && data.findings.length === 0) {
+    lines.push({
+      text: boxRow(source_default.green("\u2713") + " " + source_default.white("No findings to verify")),
+      delay: MED
+    });
+  }
+  lines.push({ text: boxBottom(true), delay: FAST });
+  lines.push({ text: connector(), delay: PAUSE });
+  lines.push({ text: boxTop("REPORT"), delay: PAUSE });
+  const totalFindings = data.summary.totalFindings;
+  if (totalFindings > 0) {
+    const parts = [];
+    if (data.summary.critical > 0) parts.push(source_default.red.bold(`${data.summary.critical} CRITICAL`));
+    if (data.summary.high > 0) parts.push(source_default.redBright(`${data.summary.high} HIGH`));
+    if (data.summary.medium > 0) parts.push(source_default.yellow(`${data.summary.medium} MEDIUM`));
+    if (data.summary.low > 0) parts.push(source_default.blue(`${data.summary.low} LOW`));
+    if (data.summary.info > 0) parts.push(source_default.gray(`${data.summary.info} INFO`));
+    lines.push({
+      text: boxRow(
+        source_default.white(`${totalFindings} verified findings: `) + parts.join(source_default.dim(", "))
+      ),
+      delay: MED
+    });
+  } else {
+    lines.push({
+      text: boxRow(source_default.green.bold("0 findings") + source_default.white(" - target appears secure")),
+      delay: MED
+    });
+  }
+  const duration = data.durationMs < 1e3 ? `${data.durationMs}ms` : `${(data.durationMs / 1e3).toFixed(1)}s`;
+  lines.push({
+    text: boxRow(
+      source_default.white(`Completed in ${duration}`) + source_default.dim(" \u2192 ") + source_default.gray("./0-report.json")
+    ),
+    delay: MED
+  });
+  lines.push({ text: boxBottom(false), delay: FAST });
+  return lines;
+}
+async function renderReplay(data) {
+  const lines = buildReplayLines(data);
+  process.stdout.write("\n");
+  process.stdout.write(
+    source_default.red.bold("  \u25C6 0") + source_default.gray(" attack replay") + "\n"
+  );
+  process.stdout.write(
+    source_default.dim("  " + "\u2500".repeat(BOX_WIDTH + 1)) + "\n"
+  );
+  process.stdout.write("\n");
+  await sleep(200);
+  for (const line of lines) {
+    await sleep(line.delay);
+    process.stdout.write("  " + line.text + "\n");
+  }
+  process.stdout.write("\n");
+}
+
+// packages/cli/src/formatters/timeline.ts
+var TIMELINE_FORMATS = ["json", "csv", "markdown"];
+function isTimelineFormat(value) {
+  return TIMELINE_FORMATS.includes(value);
+}
+function formatTimeline(record, format) {
+  switch (format) {
+    case "json":
+      return formatTimelineJson(record);
+    case "csv":
+      return formatTimelineCsv(record);
+    case "markdown":
+      return formatTimelineMarkdown(record);
+  }
+}
+function formatTimelineJson(record) {
+  return JSON.stringify(record, null, 2);
+}
+var CSV_COLUMNS = [
+  "timestamp",
+  "stage",
+  "eventType",
+  "agentRole",
+  "findingId",
+  "action",
+  "attackTechniqueIds",
+  "attackTactics",
+  // Appended, never interleaved with the ATT&CK columns — an importer that
+  // only knows the ATT&CK pair keeps working, and the two taxonomies stay
+  // visibly distinct in a spreadsheet.
+  "atlasTechniqueIds",
+  "atlasTactics"
+];
+function formatTimelineCsv(record) {
+  const lines = [CSV_COLUMNS.join(",")];
+  for (const entry of record.entries) {
+    lines.push(
+      [
+        entry.timestamp,
+        entry.stage,
+        entry.eventType,
+        entry.agentRole ?? "",
+        entry.findingId ?? "",
+        entry.action,
+        entry.techniques.map((t) => t.id).join(" "),
+        uniq(entry.techniques.map((t) => t.tactic)).join(" "),
+        entry.atlasTechniques.map((t) => t.id).join(" "),
+        uniq(entry.atlasTechniques.map((t) => t.tactic)).join(" ")
+      ].map(csvCell).join(",")
+    );
+  }
+  return lines.join("\n") + "\n";
+}
+function csvCell(value) {
+  if (!/[",\r\n]/.test(value)) return value;
+  return `"${value.replace(/"/g, '""')}"`;
+}
+function formatTimelineMarkdown(record) {
+  const out = [];
+  out.push(`# Forensic timeline \u2014 scan \`${record.scanId}\``);
+  out.push("");
+  if (record.target) out.push(`- **Target:** ${record.target}`);
+  out.push(`- **Generated:** ${record.generatedAt}`);
+  out.push(`- **Events:** ${record.eventCount} of ${record.totalEventCount} recorded`);
+  if (record.filters.since) out.push(`- **Since:** ${record.filters.since}`);
+  if (record.filters.until) out.push(`- **Until:** ${record.filters.until}`);
+  if (record.filters.attackOnly) {
+    out.push(`- **Filter:** technique-mapped events only (pipeline lifecycle events omitted)`);
+  }
+  out.push("");
+  out.push("All timestamps are UTC (ISO-8601).");
+  out.push("");
+  out.push(
+    "ATT&CK (Enterprise) and ATLAS (AI systems) are separate matrices; a row may carry either, both, or neither."
+  );
+  out.push("");
+  if (record.entries.length === 0) {
+    out.push("_No pipeline events recorded for this scan in the selected window._");
+    out.push("");
+    return out.join("\n");
+  }
+  out.push("| # | Timestamp (UTC) | Stage | Event | Agent | Finding | Action | ATT&CK | ATLAS |");
+  out.push("| --- | --- | --- | --- | --- | --- | --- | --- | --- |");
+  record.entries.forEach((entry, i) => {
+    out.push(
+      "| " + [
+        String(i + 1),
+        entry.timestamp,
+        mdCell(entry.stage),
+        mdCell(entry.eventType),
+        mdCell(entry.agentRole ?? "\u2014"),
+        mdCell(entry.findingId ?? "\u2014"),
+        mdCell(entry.action),
+        mdTechniques(entry.techniques),
+        mdTechniques(entry.atlasTechniques)
+      ].join(" | ") + " |"
+    );
+  });
+  out.push("");
+  return out.join("\n");
+}
+function mdTechniques(techniques) {
+  return techniques.length > 0 ? techniques.map(mdTechnique).join(", ") : "\u2014";
+}
+function mdTechnique(technique) {
+  const label = mdCell(`${technique.id} ${technique.name}`);
+  return technique.url ? `[${label}](${technique.url})` : label;
+}
+function mdCell(value) {
+  return value.replace(/\s+/g, " ").replace(/\|/g, "\\|").trim();
+}
+function uniq(values) {
+  return [...new Set(values.filter((v) => v.length > 0))];
+}
+
+// packages/cli/src/formatters/index.ts
+function formatPresentationDocument(document, format) {
+  if (format === "json" && document.documentType !== "scan-report") {
+    return JSON.stringify(document.report, null, 2);
+  }
+  const report = document.documentType === "scan-report" ? document.report : document.documentType === "audit-report" ? {
+    target: `${document.report.package}@${document.report.version}`,
+    scanDepth: "deep",
+    startedAt: document.report.startedAt,
+    completedAt: document.report.completedAt,
+    durationMs: document.report.durationMs,
+    summary: document.report.summary,
+    findings: document.report.findings,
+    warnings: []
+  } : {
+    target: document.report.repo,
+    scanDepth: "deep",
+    startedAt: document.report.startedAt,
+    completedAt: document.report.completedAt,
+    durationMs: document.report.durationMs,
+    summary: document.report.summary,
+    findings: document.report.findings,
+    warnings: document.report.warnings?.map((warning) => ({ stage: "report", message: `[${warning.stage}] ${warning.message}` })) ?? [],
+    executionSuccessful: document.report.researchFailed ? false : void 0,
+    reviewChecks: document.report.reviewChecks
+  };
+  switch (format) {
+    case "terminal":
+      return formatTerminal(report);
+    case "json":
+      return formatJson(report);
+    case "markdown":
+      return formatMarkdown(report);
+    case "html":
+      return formatHtml(report);
+    case "sarif":
+      return formatSarif(report);
+    case "pdf":
+      return "[PDF output requires generatePdfReport()]";
+  }
+}
+function formatReport(report, format) {
+  return formatPresentationDocument(createScanReportDocument(report), format);
+}
+function formatAuditReport(report, format) {
+  return formatPresentationDocument(createAuditReportDocument(report), format);
+}
+function formatReviewReport(report, format) {
+  return formatPresentationDocument(createReviewReportDocument(report), format);
+}
+
+export {
+  renderReplay,
+  getRuntimeAvailability,
+  checkRuntimeAvailability,
+  buildShareUrl,
+  TIMELINE_FORMATS,
+  isTimelineFormat,
+  formatTimeline,
+  formatReport,
+  formatAuditReport,
+  formatReviewReport
+};

package/chunks/{chunk-62ENS6XO.js → chunk-IIBNQTOK.js}

@@ -5,7 +5,7 @@ import {
   buildPlaybookInjection,
   parseSanitizerLog,
   verifyOracleByCategory
-} from "./chunk-Y4HJRUFE.js";
+} from "./chunk-YERUDEXT.js";
 import {
   allowlistedChildEnv
 } from "./chunk-5IBCBQEH.js";
@@ -558,6 +558,7 @@ async function runCLoop(opts, ctx) {
   ctx.log(`[userspace-fuzz] compiling Tier-2 harness: ${compile_command}`);
   const compileRes = await runChild("sh", ["-c", compile_command], sourceRoot, ctx.timeoutMs);
   if (compileRes.signalled || /error:|fatal error:/i.test(compileRes.output)) {
+    ctx.toolingMissing.push("tier2-harness-compile");
     ctx.log(`[userspace-fuzz] Tier-2 harness failed to compile:
 ${compileRes.output.slice(-2e3)}`);
     return finish(crashes, iterations, sourceRoot, ctx, "tier2");
@@ -1317,7 +1318,7 @@ async function adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTu
       oracle: oracleKind
     };
   }
-  if (isOracleInfraError(oracleResult.reason)) {
+  if (oracleResult.inconclusive || isOracleInfraError(oracleResult.reason)) {
     return {
       hasPov: false,
       povArtifact: submitted.artifact || null,