0sec-cli 0.24.0 → 0.24.1

package/chunks/{chunk-A3EKBUEM.js → chunk-5WAHHZBF.js}

@@ -7,7 +7,7 @@ import {
   loadJournal,
   rehydrateContext,
   renderSeedMessages
-} from "./chunk-YORL5S5V.js";
+} from "./chunk-3LPBJMHB.js";
 import {
   runWpFingerprint,
   summarizeWpFingerprint
@@ -26,7 +26,7 @@ import {
   searchPublicReports,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-CIMN2AO6.js";
+} from "./chunk-X2ZMSRTP.js";
 import {
   buildPlaybookInjection,
   classifyPromptLayerImpact,
@@ -38,10 +38,10 @@ import {
 } from "./chunk-YERUDEXT.js";
 import {
   runFoxguardScan
-} from "./chunk-YJU7QACE.js";
+} from "./chunk-4ROZFLSR.js";
 import {
   addRuntimeUsage
-} from "./chunk-YYOQADBB.js";
+} from "./chunk-BD7WULFS.js";
 import {
   applyPatchOps,
   canonicalEvolutionJson,
@@ -55,12 +55,12 @@ import {
   readEvolutionArtifact,
   resolveEvolutionDirectoryPath,
   resolveScopedPath
-} from "./chunk-Y7KV7WV6.js";
+} from "./chunk-YKWARO3T.js";
 import {
   LearningStore,
   learningProjectId,
   workflowRestorePolicy
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-BMDG6T7D.js";
 import {
   acquireHostToken,
   aggregateVerdict,
@@ -75,7 +75,7 @@ import {
   LlmApiRuntime,
   diag,
   features
-} from "./chunk-EYBMTELO.js";
+} from "./chunk-IJ6UPW3H.js";
 import {
   DEFAULT_WORKBENCH_BROKER_LIMITS,
   WORKBENCH_BROKER_WORKSPACE,
@@ -112,13 +112,13 @@ import {
   summarizeScannerResult,
   superviseChild,
   withRunContribution
-} from "./chunk-BIJPMYFA.js";
+} from "./chunk-PVJUPIQG.js";
 import {
   eventBus
-} from "./chunk-52AWIBCT.js";
+} from "./chunk-5PFRE522.js";
 import {
   redactSensitiveHeaders
-} from "./chunk-IK27KMVV.js";
+} from "./chunk-CGBDEST2.js";
 import {
   FrameReader,
   MAX_RESULT_CHARS,
@@ -131,7 +131,7 @@ import {
   normalizeScopeHostname,
   validatePluginManifest,
   withScopeEnforcement
-} from "./chunk-RBOMXUYL.js";
+} from "./chunk-QNRYOJEB.js";
 import {
   allowlistedChildEnv,
   sanitizedEnv
@@ -151,7 +151,7 @@ import {
   pocStepActionSchema,
   pocStepExpectSchema,
   resolveIdentities
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -13535,7 +13535,7 @@ async function executeEntraPosture(ctx, args) {
   const { runIdentityAssessment } = await import("./identity-62SVRW4H.js");
   let scope;
   if (typeof args.scope === "string" && args.scope.trim()) {
-    const { ScopePolicy: ScopePolicy2 } = await import("./scope-M7L3CD6X.js");
+    const { ScopePolicy: ScopePolicy2 } = await import("./scope-HSTG63TQ.js");
     try {
       scope = ScopePolicy2.fromJsonFile(scopedPath(ctx, args.scope.trim()));
     } catch (error) {
@@ -13581,8 +13581,8 @@ async function executeEntraPosture(ctx, args) {
   };
 }
 async function executeAssembleAdvisory(_ctx, args) {
-  const { osecDB } = await import("./dist-3SWWY5FZ.js");
-  const { renderAdvisoryMarkdown, assembleEvidencePack, decideFilingState, renderVendorNotificationMarkdown, EmptyPocError, UnreproducedFindingError } = await import("./disclose-PFBWESVJ.js");
+  const { osecDB } = await import("./dist-RKLQIXDT.js");
+  const { renderAdvisoryMarkdown, assembleEvidencePack, decideFilingState, renderVendorNotificationMarkdown, EmptyPocError, UnreproducedFindingError } = await import("./disclose-OU6Z6GVT.js");
   const dbPath = typeof args.db_path === "string" && args.db_path.trim() ? args.db_path.trim() : void 0;
   const scanId = typeof args.scan_id === "string" && args.scan_id.trim() ? args.scan_id.trim() : void 0;
   const findingId = typeof args.finding_id === "string" && args.finding_id.trim() ? args.finding_id.trim() : void 0;
@@ -13688,7 +13688,7 @@ function rowToAdvisoryFinding(row) {
   return finding;
 }
 async function executeCveLookup(_ctx, args) {
-  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-AJZ3LOQY.js");
+  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-BV67RAP5.js");
   const rawCve = String(args.cve ?? args.cve_id ?? "").trim();
   if (!rawCve)
     return errResult("`cve` is required, e.g. CVE-2024-1086");
@@ -15224,8 +15224,8 @@ function refuseOutOfScope(ctx, url) {
   return null;
 }
 async function loadPersistedFinding(findingId, dbPathArg) {
-  const { osecDB, resolveOsecDbPath, listOsecRunDatabasePaths } = await import("./dist-3SWWY5FZ.js");
-  const { findingSchema, formatZodError } = await import("./dist-VK2M4HNW.js");
+  const { osecDB, resolveOsecDbPath, listOsecRunDatabasePaths } = await import("./dist-RKLQIXDT.js");
+  const { findingSchema, formatZodError } = await import("./dist-7KSYDDSG.js");
   const { resolve: resolve16 } = await import("node:path");
   const { existsSync: existsSync10 } = await import("node:fs");
   const requestedId = findingId.trim();
@@ -15349,9 +15349,9 @@ async function executeVariantHunt(ctx, args) {
   if (!target)
     return errResult2("`source` is required (a source tree path or git URL)");
   const { resolve: resolve16, join: join20 } = await import("node:path");
-  const { prepare } = await import("./prepare-SODWQN6O.js");
-  const { generateVariantCandidates } = await import("./variant-candidates-2KSP5EHH.js");
-  const { runHuntScan, makeSkepticVerifier } = await import("./hunt-scan-DXV5H6YN.js");
+  const { prepare } = await import("./prepare-C3KGMBXT.js");
+  const { generateVariantCandidates } = await import("./variant-candidates-LG767HWH.js");
+  const { runHuntScan, makeSkepticVerifier } = await import("./hunt-scan-W246VWJC.js");
   let resolvedTarget;
   try {
     resolvedTarget = scopedPath2(ctx, target);
@@ -15415,10 +15415,10 @@ async function executeAssumptionHunt(ctx, args) {
   const { resolve: resolve16, join: join20, sep: sep9, relative: relative6, basename: basename4 } = await import("node:path");
   const { mkdtemp: mkdtemp4, rm: rm4 } = await import("node:fs/promises");
   const { tmpdir: tmpdir5 } = await import("node:os");
-  const { prepare } = await import("./prepare-SODWQN6O.js");
+  const { prepare } = await import("./prepare-C3KGMBXT.js");
   const { collectScopeFiles } = await import("./source-files-REHOM44I.js");
-  const { runAssumptionHunt } = await import("./assumption-mining-EATDC4BB.js");
-  const { makeSkepticVerifier } = await import("./hunt-scan-DXV5H6YN.js");
+  const { runAssumptionHunt } = await import("./assumption-mining-RPVR77A3.js");
+  const { makeSkepticVerifier } = await import("./hunt-scan-W246VWJC.js");
   let resolvedTarget;
   try {
     resolvedTarget = scopedPath2(ctx, target);
@@ -15497,8 +15497,8 @@ async function executeGenerateFix(ctx, args) {
   if (!repoArg)
     return errResult2("`repo` is required (the repo root the patch applies to) \u2014 no scoped source path is set to default to.");
   const { resolve: resolve16 } = await import("node:path");
-  const { runSourceFix } = await import("./fix-4YCLHFDT.js");
-  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-MB4GEFBY.js");
+  const { runSourceFix } = await import("./fix-RQSIG75B.js");
+  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-U66JNSAY.js");
   const loaded = await loadPersistedFinding(findingId, typeof args.db_path === "string" ? args.db_path : void 0);
   if ("error" in loaded)
     return errResult2(loaded.error);
@@ -15599,7 +15599,7 @@ async function executeProtocolConformance(ctx, args) {
     return errResult2(denial);
   const { runHttpConformanceCheck } = await import("./http-conformance-U5F6GKYG.js");
   const { createLiveHttpSender } = await import("./http-sender-I5XFFY35.js");
-  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-MB4GEFBY.js");
+  const { LlmApiRuntime: LlmApiRuntime2 } = await import("./runtime-U66JNSAY.js");
   const llm = new LlmApiRuntime2({ type: "api", timeout: 6e4 });
   const send = createLiveHttpSender();
   const protocol = {
@@ -15654,7 +15654,7 @@ async function executeSpecDrift(ctx, args) {
   if (!specArg.trim())
     return errResult2("`spec` is required (spec text, or a path to a spec document).");
   const { resolve: resolve16, basename: basename4 } = await import("node:path");
-  const { prepare } = await import("./prepare-SODWQN6O.js");
+  const { prepare } = await import("./prepare-C3KGMBXT.js");
   const { runSpecdriftScan, runSpecdriftPlan } = await import("./specdrift-AFS54WEJ.js");
   let specText = specArg;
   let specName = typeof args.spec_name === "string" && args.spec_name.trim() ? args.spec_name.trim() : "spec";
@@ -15738,7 +15738,7 @@ async function executeSafetyEval(ctx, args) {
   const denial = refuseOutOfScope(ctx, target);
   if (denial)
     return errResult2(denial);
-  const { runEval } = await import("./eval-runner-XVRX3R2Y.js");
+  const { runEval } = await import("./eval-runner-A2DIGVP7.js");
   const categories = Array.isArray(args.categories) ? args.categories.map((c) => String(c)).filter(Boolean) : void 0;
   const timeout = typeof args.timeout_ms === "number" && args.timeout_ms > 0 ? args.timeout_ms : void 0;
   let scorecard;
@@ -15782,7 +15782,7 @@ async function executeMemsafetyFuzz(ctx, args) {
     return errResult2("`source` is required (a native source tree).");
   const { resolve: resolve16, join: join20, sep: sep9 } = await import("node:path");
   const { existsSync: existsSync10 } = await import("node:fs");
-  const { prepare } = await import("./prepare-SODWQN6O.js");
+  const { prepare } = await import("./prepare-C3KGMBXT.js");
   const { runMemSafetyScan } = await import("./memsafety-scan-L2Z7E7TE.js");
   let resolvedTarget;
   try {
@@ -15917,14 +15917,14 @@ async function executeWeaponizeKernel(ctx, args) {
   if (!hasEngagementScope(ctx)) {
     return errResult2("weaponize_kernel requires an active engagement scope. It is not available for a no-scope session.");
   }
-  const { runWeaponization, kernelVmArtifactsReady } = await import("./harness-DHWULEIZ.js");
+  const { runWeaponization, kernelVmArtifactsReady } = await import("./harness-3NVC3DDY.js");
   if (!kernelVmArtifactsReady()) {
     return errResult2("weaponize_kernel is denied: kernel-VM artifacts are not present. It only ever runs inside a DISPOSABLE kernel VM \u2014 set ZERO_KERNEL_QEMU_KERNEL and ZERO_KERNEL_QEMU_DISK to existing image paths. Refusing to run without the VM.");
   }
   const dmesg = typeof args.dmesg === "string" ? args.dmesg : "";
   if (!dmesg.trim())
     return errResult2("`dmesg` is required (the kernel crash log / KASAN splat to weaponize).");
-  const { classifyPrimitiveFromDmesg } = await import("./kernel-primitive-SF4NALVR.js");
+  const { classifyPrimitiveFromDmesg } = await import("./kernel-primitive-T47V3RD3.js");
   const crashType = typeof args.crash_type === "string" && args.crash_type.trim() ? args.crash_type.trim() : void 0;
   const primitive = classifyPrimitiveFromDmesg(dmesg, crashType);
   const reproducer = typeof args.reproducer === "string" && args.reproducer.trim() ? args.reproducer : void 0;
@@ -15959,12 +15959,12 @@ async function executeCveAdapt(ctx, args) {
   if (!hasEngagementScope(ctx)) {
     return errResult2("cve_adapt requires an active engagement scope. It is not available for a no-scope session.");
   }
-  const { kernelVmArtifactsReady } = await import("./harness-DHWULEIZ.js");
+  const { kernelVmArtifactsReady } = await import("./harness-3NVC3DDY.js");
   if (!kernelVmArtifactsReady()) {
     return errResult2("cve_adapt is denied: its default verification boots a kernel VM and kernel-VM artifacts are not present. Set ZERO_KERNEL_QEMU_KERNEL and ZERO_KERNEL_QEMU_DISK to existing image paths. Refusing to run without the VM.");
   }
-  const { adaptAndVerify } = await import("./adapt-loop-TEJPXWFG.js");
-  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-AJZ3LOQY.js");
+  const { adaptAndVerify } = await import("./adapt-loop-L77BWMNE.js");
+  const { findCveArtifacts, normaliseCveId } = await import("./artifact-scraper-BV67RAP5.js");
   const rawCve = String(args.cve ?? "").trim();
   if (!rawCve)
     return errResult2("`cve` is required, e.g. CVE-2024-1086.");
@@ -23805,7 +23805,7 @@ var ToolExecutor = class _ToolExecutor {
    * inside `runNativeAgentLoop`), so this is effectively free.
    */
   async loadSubagentDeps() {
-    const { runNativeAgentLoop: runNativeAgentLoop2 } = await import("./native-loop-ZNAELJGB.js");
+    const { runNativeAgentLoop: runNativeAgentLoop2 } = await import("./native-loop-26X2CHBV.js");
     return { runNativeAgentLoop: runNativeAgentLoop2 };
   }
   subagentTools(messaging) {

package/chunks/{chunk-HRBOZBMC.js → chunk-6XMFCVJS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-EYBMTELO.js";
+} from "./chunk-IJ6UPW3H.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-SGILXLR3.js → chunk-7UHAXEOV.js}

@@ -3,13 +3,13 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   spinnerGlyph
-} from "./chunk-GNR3APR6.js";
+} from "./chunk-OOMBOLAF.js";
 import {
   loadLayeredSettings
-} from "./chunk-QEA2VHBD.js";
+} from "./chunk-X2IPO5JO.js";
 import {
   homeStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 
 // packages/cli/src/utils/update-check.ts
 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";

package/chunks/{chunk-YYOQADBB.js → chunk-BD7WULFS.js}

@@ -3,14 +3,14 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-52AWIBCT.js";
+} from "./chunk-5PFRE522.js";
 import {
   compareFindingsByBusinessPriority,
   estimateCost,
   modelProvider,
   splitCost,
   validateScanPlan
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 
 // packages/core/dist/agent/cost-ledger.js
 var recordedResults = /* @__PURE__ */ new WeakMap();

package/chunks/{chunk-RCHAFSWS.js → chunk-BMDG6T7D.js}

@@ -8,7 +8,7 @@ import {
   homeStateDir,
   parseSecurityWorkflowInput,
   runStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   __export
 } from "./chunk-VCSFCHAJ.js";

package/chunks/{chunk-TOAAYJVN.js → chunk-BOBIAHKA.js}

@@ -3,10 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-CIMN2AO6.js";
+} from "./chunk-X2ZMSRTP.js";
 import {
   scanExecutionSignal
-} from "./chunk-YYOQADBB.js";
+} from "./chunk-BD7WULFS.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {

package/chunks/{chunk-ESM447R6.js → chunk-BPU6M42R.js}

@@ -5,7 +5,7 @@ import {
   connectionConfigEnvPatch,
   credentialEnvPatch,
   loadCredentials
-} from "./chunk-62PGWN7Y.js";
+} from "./chunk-LMP2T4G2.js";
 
 // packages/cli/src/herdr-state.ts
 var sink = null;

package/chunks/{chunk-IK27KMVV.js → chunk-CGBDEST2.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   getFindingPriority
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 
 // packages/core/dist/disclose/cwe.js
 var CWE_MAP = {

package/chunks/{chunk-ZPFBQ3SD.js → chunk-CJRZSWII.js}

@@ -4,7 +4,7 @@ const require = __0CreateRequire(import.meta.url);
 import {
   BackendIdSchema,
   requireBackendCapability
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -47,7 +47,7 @@ async function createRemoteWorkflowRuntime(options, suppliedRegistry) {
   if (options.engineUrl && (options.backendId || options.configPath)) throw new Error("--engine-url cannot be combined with a registered backend.");
   if (Boolean(options.engineUrl) !== Boolean(options.engineTokenEnv)) throw new Error("Direct engine attachment requires both --engine-url and --engine-token-env.");
   const backendId = BackendIdSchema.parse(options.backendId ?? (options.engineUrl ? "attached-engine" : void 0));
-  const registry = suppliedRegistry ?? new (await import("./backend-connections-QE4NASAK.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
+  const registry = suppliedRegistry ?? new (await import("./backend-connections-ACIXNYZN.js")).BackendConnectionRegistry(options.engineUrl ? { connections: [{ id: backendId, name: "Attached engine", url: options.engineUrl, bearerTokenEnv: options.engineTokenEnv }] } : { configPath: options.configPath });
   try {
     const connection = await registry.handshake(backendId);
     if (connection.backend.transport !== "http") throw new Error("Select a registered remote HTTP backend; local execution cannot use this transport.");

package/chunks/{chunk-GHEBZKUS.js → chunk-F2P25DJY.js}

@@ -7,21 +7,21 @@ import {
   WebOperatorServices,
   WebWorkflowService,
   WorkflowEngineService
-} from "./chunk-G2EJ3R5I.js";
+} from "./chunk-GZA7RGK7.js";
 import {
   assertLocalEngineAvailable,
   registerLocalEngine
-} from "./chunk-UHUW45S3.js";
+} from "./chunk-RVJVM5L4.js";
 import {
   findingFromRow as findingFromRow2
-} from "./chunk-O7Q2G2KW.js";
+} from "./chunk-W624J7NF.js";
 import {
   buildFindingConsoleCommand,
   createLocalConsoleSession,
   createSessionPluginHostManager,
   findingFromRow,
   loadFindingFocus
-} from "./chunk-AV5BF4V7.js";
+} from "./chunk-2XGBEH53.js";
 import {
   BackendConnectionRegistry,
   backendBearerFromEnv,
@@ -29,13 +29,13 @@ import {
   handleBackendConnectionRequest,
   loadManagedWorker,
   validateWorkerOptions
-} from "./chunk-TZRHWP7R.js";
+} from "./chunk-Q7JKIKKF.js";
 import {
   Option
 } from "./chunk-WUPN3D37.js";
 import {
   presentationEventBus
-} from "./chunk-FEOPHBMY.js";
+} from "./chunk-56UTQKXO.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -61,13 +61,13 @@ import {
   validateWorkbenchSourceLesson,
   workbenchConfigPath,
   workbenchNetworkEnabled
-} from "./chunk-QEA2VHBD.js";
+} from "./chunk-X2IPO5JO.js";
 import {
   connectServicePlugins,
   createConsoleRuntime,
   exportReport,
   isReportExportFormat
-} from "./chunk-V5I5GAQH.js";
+} from "./chunk-ZM6ANQZJ.js";
 import {
   HuntMemoryStore,
   TOOL_DEFINITIONS,
@@ -75,7 +75,7 @@ import {
   loadSkillRegistry,
   readToolCallNames,
   validateAgentSkillContent
-} from "./chunk-A3EKBUEM.js";
+} from "./chunk-5WAHHZBF.js";
 import {
   SecurityWorkflowStore,
   WorkflowTriggerStore,
@@ -83,21 +83,21 @@ import {
   nextWorkflowTriggerFire,
   osecDB,
   resolveOsecDbPath
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-BMDG6T7D.js";
 import {
   LlmApiRuntime
-} from "./chunk-EYBMTELO.js";
+} from "./chunk-IJ6UPW3H.js";
 import {
   DEFAULT_WORKBENCH_BROKER_LIMITS,
   approveSmolvmWorkbenchImage,
   getSmolvmWorkbenchStatus,
   isAdmittedSmolvmWorkbench,
   resolveSmolvmRuntime
-} from "./chunk-BIJPMYFA.js";
+} from "./chunk-PVJUPIQG.js";
 import {
   ScopePolicy,
   withScopeEnforcement
-} from "./chunk-RBOMXUYL.js";
+} from "./chunk-QNRYOJEB.js";
 import {
   BackendDescriptorSchema,
   BackendRequestIdSchema,
@@ -106,7 +106,7 @@ import {
   VERSION,
   createPresentationEvent,
   homeStateDir
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -4355,11 +4355,7 @@ function resolveDashboardAssetDir(explicitAssetDir) {
   const candidates = [
     ...explicitAssetDir ? [resolve4(explicitAssetDir)] : [],
     join7(moduleDir, "dashboard"),
-    join7(moduleDir, "..", "dashboard"),
-    // A source checkout must serve the freshly built workspace dashboard,
-    // not an unrelated stale root bundle left by an earlier packaging run.
-    join7(process.cwd(), "packages", "dashboard", "dist"),
-    join7(process.cwd(), "dist", "dashboard")
+    join7(moduleDir, "..", "dashboard")
   ];
   for (const candidate of candidates) {
     if (existsSync2(join7(candidate, "index.html"))) {
@@ -4368,6 +4364,14 @@ function resolveDashboardAssetDir(explicitAssetDir) {
   }
   const embedded = materializeEmbeddedDashboardAssets(DASHBOARD_ASSETS);
   if (embedded) return embedded;
+  for (const candidate of [
+    join7(process.cwd(), "packages", "dashboard", "dist"),
+    join7(process.cwd(), "dist", "dashboard")
+  ]) {
+    if (existsSync2(join7(candidate, "index.html"))) {
+      return { path: candidate };
+    }
+  }
   throw new Error("Dashboard assets not found. Run `pnpm build` to generate the dashboard app.");
 }
 function resolveAssetPath(assetDir, pathname) {
@@ -4568,7 +4572,7 @@ data: ${JSON.stringify(event)}
 `);
 }
 async function handleApiRequest(req, res, pathname, dbPath, controlToken, engineBearer) {
-  const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+  const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
   if (isPresentationEventsStreamPath(pathname)) {
     if (req.method !== "GET") {
       json(res, 405, { error: "Method not allowed" });
@@ -4622,7 +4626,7 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken, engine
       return true;
     }
     if (controlPath.action === "recover-stale-workers") {
-      const { recoverStaleWorkers } = await import("./orchestrate-YHFJXGID.js");
+      const { recoverStaleWorkers } = await import("./orchestrate-OBS37FWQ.js");
       const body = await readJson(req);
       const recovered = recoverStaleWorkers(
         dbPath,
@@ -4669,8 +4673,8 @@ async function handleApiRequest(req, res, pathname, dbPath, controlToken, engine
       return true;
     }
     if (controlPath.action === "reset-database") {
-      const { resetOsecDatabase } = await import("./dist-3SWWY5FZ.js");
-      const { seedVerificationWorkbench } = await import("./db-P5EIKMLP.js");
+      const { resetOsecDatabase } = await import("./dist-RKLQIXDT.js");
+      const { seedVerificationWorkbench } = await import("./db-BXJNWUYJ.js");
       const body = await readJson(req);
       const seed = typeof body.seed === "string" ? body.seed.trim().toLowerCase() : "verification";
       if (!["verification", "empty"].includes(seed)) {

package/chunks/{chunk-554D4AYM.js → chunk-GTED3FSZ.js}

@@ -9,10 +9,10 @@ import {
 import {
   extractFileRefs,
   redactSensitiveHeaders
-} from "./chunk-IK27KMVV.js";
+} from "./chunk-CGBDEST2.js";
 import {
   getFindingPriority
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   __toESM
 } from "./chunk-VCSFCHAJ.js";

package/chunks/{chunk-5POT5OYF.js → chunk-GV5WXDHY.js}

@@ -5,20 +5,20 @@ import {
   captureObservation,
   createEvolvedFinder,
   loadAppsecFinderLenses
-} from "./chunk-V5I5GAQH.js";
+} from "./chunk-ZM6ANQZJ.js";
 import {
   ScanCostLedger
-} from "./chunk-YYOQADBB.js";
+} from "./chunk-BD7WULFS.js";
 import {
   loadEvolutionConfigFile
-} from "./chunk-Y7KV7WV6.js";
+} from "./chunk-YKWARO3T.js";
 import {
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-BMDG6T7D.js";
 import {
   eventBus
-} from "./chunk-52AWIBCT.js";
+} from "./chunk-5PFRE522.js";
 
 // packages/cli/src/commands/deep-review.ts
 import { readFileSync, realpathSync, statSync } from "node:fs";
@@ -283,7 +283,7 @@ async function runDeepReview(opts) {
     cairoVerifyLenses,
     moveFinderLenses,
     moveVerifyLenses
-  } = await import("./dist-AJU25UXA.js");
+  } = await import("./dist-TQMHMSBZ.js");
   opts.signal?.throwIfAborted();
   const costLedger = opts.costLedger ?? new ScanCostLedger();
   const scanStartedAt = Date.now();
@@ -330,7 +330,7 @@ async function runDeepReview(opts) {
     let lanes = null;
     let allocateAcrossLanes;
     if (opts.useThreatModel) {
-      const threatModule = await import("./dist-AJU25UXA.js");
+      const threatModule = await import("./dist-TQMHMSBZ.js");
       allocateAcrossLanes = threatModule.allocateCandidatesAcrossLanes;
       const rtType = runtime !== "auto" ? runtime : "api";
       const plannerRuntime = opts.nativeRuntime ? {
@@ -654,7 +654,7 @@ async function deepReviewAction(target, opts) {
     costCeilingUsd = parsed;
   }
   const { writeFileSync } = await import("node:fs");
-  const { executeManagedOperation } = await import("./managed-operation-SQFMBWHG.js");
+  const { executeManagedOperation } = await import("./managed-operation-6R2QPPW5.js");
   const timeoutMs = parsePositive("--timeout", opts.timeout, 6e5);
   const outcome = await executeManagedOperation({
     type: "deep-review",

package/chunks/{chunk-RZR2XXAK.js → chunk-GXXX7AGH.js}

@@ -67,7 +67,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, join } from "node:path";
 function loadVersion() {
   if (true) {
-    return "0.24.0";
+    return "0.24.1";
   }
   try {
     const here = dirname(fileURLToPath(import.meta.url));