0sec-cli 0.24.0 → 0.24.1

package/chunks/{commands-I5L3VD2A.js → commands-FRPOFIO4.js}

@@ -3,25 +3,25 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   registerOrchestrateCommand
-} from "./chunk-TTDFBFNZ.js";
+} from "./chunk-SZDD77KX.js";
 import {
   registerDbCommand
-} from "./chunk-J6G73WYF.js";
+} from "./chunk-RURJYCWY.js";
 import {
   discoverSshHosts,
   hashTeamPassword,
   registerDashboardCommand,
   registerWorkbenchCommand
-} from "./chunk-GHEBZKUS.js";
+} from "./chunk-F2P25DJY.js";
 import {
   registerVerifyCommand
-} from "./chunk-G2EJ3R5I.js";
-import "./chunk-UHUW45S3.js";
-import "./chunk-ZPFBQ3SD.js";
+} from "./chunk-GZA7RGK7.js";
+import "./chunk-RVJVM5L4.js";
+import "./chunk-CJRZSWII.js";
 import {
   registerLensSynthCommand
-} from "./chunk-JSTLXPJS.js";
-import "./chunk-O7Q2G2KW.js";
+} from "./chunk-VU7V2SDW.js";
+import "./chunk-W624J7NF.js";
 import {
   buildFindingChatPrompt,
   buildFindingConsoleCommand,
@@ -29,30 +29,30 @@ import {
   loadFindingFocus,
   resolveFindingChatIntent,
   runUnified
-} from "./chunk-AV5BF4V7.js";
+} from "./chunk-2XGBEH53.js";
 import {
   TIMELINE_FORMATS,
   formatTimeline,
   getRuntimeAvailability,
   isTimelineFormat,
   renderReplay
-} from "./chunk-3XLEDCFX.js";
-import "./chunk-3XLFB46W.js";
+} from "./chunk-I43YYHDU.js";
+import "./chunk-JWSOUKFF.js";
 import {
   executeManagedOperation
-} from "./chunk-TOFIGQ63.js";
+} from "./chunk-R2XBH476.js";
 import {
   registerDeepReviewCommand
-} from "./chunk-5POT5OYF.js";
-import "./chunk-W6IYTSZH.js";
+} from "./chunk-GV5WXDHY.js";
+import "./chunk-2NBZZFRG.js";
 import {
   deployWorker,
   stopWorker,
   validateWorkerOptions
-} from "./chunk-TZRHWP7R.js";
+} from "./chunk-Q7JKIKKF.js";
 import {
   performAutoUpdate
-} from "./chunk-SGILXLR3.js";
+} from "./chunk-7UHAXEOV.js";
 import {
   Command,
   InvalidArgumentError,
@@ -62,12 +62,12 @@ import {
   consolePresentationOutput,
   processPresentationOutput,
   writePresentationLine
-} from "./chunk-GNR3APR6.js";
-import "./chunk-FEOPHBMY.js";
+} from "./chunk-OOMBOLAF.js";
+import "./chunk-56UTQKXO.js";
 import {
   configureSettingsStore,
   updateSetting
-} from "./chunk-62PGWN7Y.js";
+} from "./chunk-LMP2T4G2.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -94,7 +94,7 @@ import {
   settingsFilePath,
   validateTheme,
   writeInstalledTheme
-} from "./chunk-QEA2VHBD.js";
+} from "./chunk-X2IPO5JO.js";
 import {
   CraftMemoryStore,
   DEFAULT_MAX_TOOL_ITERATIONS,
@@ -179,19 +179,19 @@ import {
   updateProjectReviewChecks,
   withVariantFeatureFlags,
   writeAgentActionEvidenceBundle
-} from "./chunk-V5I5GAQH.js";
+} from "./chunk-ZM6ANQZJ.js";
 import {
   formatSarif
-} from "./chunk-5FHFG5P2.js";
+} from "./chunk-H5QURBBK.js";
 import {
   adaptAndVerify
-} from "./chunk-4YRXIVPZ.js";
+} from "./chunk-5NFIY2SJ.js";
 import {
   RateLimiter,
   enumerateJsChunkUrls,
   parseRateLimitFlag
-} from "./chunk-TOAAYJVN.js";
-import "./chunk-4TUR47H5.js";
+} from "./chunk-BOBIAHKA.js";
+import "./chunk-ILRMLA6J.js";
 import {
   createLiveHttpSender
 } from "./chunk-GVD6SJGH.js";
@@ -203,7 +203,7 @@ import {
 import {
   getEvalCategories,
   runEval
-} from "./chunk-V4BD7GSP.js";
+} from "./chunk-S2GITRD5.js";
 import "./chunk-IIBNQTOK.js";
 import {
   runNpmDynamicDiscovery
@@ -216,15 +216,15 @@ import {
   DETECTOR_REGISTRY,
   resolveDetectors
 } from "./chunk-DQTNI3KY.js";
-import "./chunk-FKGFHLLS.js";
-import "./chunk-RPTO5FY2.js";
+import "./chunk-3WUPCZGF.js";
+import "./chunk-UJE4WOQS.js";
 import {
   prepare
-} from "./chunk-E42XEJTK.js";
-import "./chunk-HRBOZBMC.js";
+} from "./chunk-PJU24AKR.js";
+import "./chunk-6XMFCVJS.js";
 import "./chunk-AZ7L3HFD.js";
-import "./chunk-H76JYUPE.js";
-import "./chunk-CSPF47S3.js";
+import "./chunk-TVS6WVSK.js";
+import "./chunk-YSQWZ67M.js";
 import {
   ToolExecutor,
   aggregateScorecard,
@@ -252,8 +252,8 @@ import {
   targetRequiresScope,
   validateAwsCredentials,
   workflowPolicyRuntime
-} from "./chunk-A3EKBUEM.js";
-import "./chunk-YORL5S5V.js";
+} from "./chunk-5WAHHZBF.js";
+import "./chunk-3LPBJMHB.js";
 import "./chunk-K2PWUPUI.js";
 import {
   buildIntelDossier,
@@ -261,29 +261,29 @@ import {
   searchAdvisories,
   searchSimilar,
   searchTargetHistory
-} from "./chunk-CIMN2AO6.js";
+} from "./chunk-X2ZMSRTP.js";
 import "./chunk-YERUDEXT.js";
 import "./chunk-UEX7PFSE.js";
-import "./chunk-YJU7QACE.js";
+import "./chunk-4ROZFLSR.js";
 import {
   budgetNativeRuntime
-} from "./chunk-YYOQADBB.js";
-import "./chunk-DNV3ZMPX.js";
+} from "./chunk-BD7WULFS.js";
+import "./chunk-XA2IBHPB.js";
 import {
   runSourceFix
-} from "./chunk-A6AZZ6XX.js";
+} from "./chunk-5ETI27Q3.js";
 import {
   appendImprovementLedgerEntry,
   evaluateImprovementPromotion,
   loadEvolutionConfigFile,
   verifyImprovementLedger
-} from "./chunk-Y7KV7WV6.js";
+} from "./chunk-YKWARO3T.js";
 import {
   runHttpConformanceCheck
 } from "./chunk-SQCBHFWN.js";
 import {
   createRuntime
-} from "./chunk-EXTN4SQV.js";
+} from "./chunk-K74DRDC5.js";
 import "./chunk-O6KPVYOI.js";
 import {
   buildAdGraph,
@@ -303,7 +303,7 @@ import {
   resolveOsecDbPath,
   resolveOsecRunStorage,
   writeOsecRunReport
-} from "./chunk-RCHAFSWS.js";
+} from "./chunk-BMDG6T7D.js";
 import {
   DISCLOSURE_STATUSES,
   IncompleteEvidenceError,
@@ -322,39 +322,39 @@ import {
   renderReproducibilityManifest,
   renderVendorNotificationMarkdown,
   transition
-} from "./chunk-554D4AYM.js";
+} from "./chunk-GTED3FSZ.js";
 import {
   executePocSteps
 } from "./chunk-IXT64DV5.js";
 import {
   findCveArtifacts,
   normaliseCveId
-} from "./chunk-RD4FKFWR.js";
+} from "./chunk-SU4IHQQI.js";
 import "./chunk-NJLKFC66.js";
-import "./chunk-O3ADFN2A.js";
+import "./chunk-NBV4I237.js";
 import {
   LlmApiRuntime,
   features
-} from "./chunk-EYBMTELO.js";
+} from "./chunk-IJ6UPW3H.js";
 import {
   isAdmittedSmolvmWorkbench
-} from "./chunk-BIJPMYFA.js";
+} from "./chunk-PVJUPIQG.js";
 import {
   eventBus
-} from "./chunk-52AWIBCT.js";
+} from "./chunk-5PFRE522.js";
 import "./chunk-RS4MAN3Q.js";
 import {
   EmptyPocError,
   detectVersionRange,
   renderAdvisoryMarkdown,
   verifyAgainstRef
-} from "./chunk-IK27KMVV.js";
+} from "./chunk-CGBDEST2.js";
 import {
   ScopePolicy,
   getScopeEnforcementState,
   isScopeEnforcementEnabled,
   loadScope
-} from "./chunk-RBOMXUYL.js";
+} from "./chunk-QNRYOJEB.js";
 import "./chunk-5IBCBQEH.js";
 import {
   AgentActionScenarioSchema,
@@ -372,7 +372,7 @@ import {
   parseAgentActionEvidenceManifest,
   pocStepArraySchema,
   reportSummarySchema
-} from "./chunk-RZR2XXAK.js";
+} from "./chunk-GXXX7AGH.js";
 import {
   external_exports
 } from "./chunk-VIT5ALXF.js";
@@ -530,7 +530,7 @@ function registerScanCommand(program) {
   ).option("--base <branch>", "Base branch for `--emit pr` (default: main)").option("--dry-run", "With `--emit pr`: print git/gh commands instead of running them", false).option("--emit-out-dir <path>", "Directory for `--emit pr` rollup files (default: system temp)").option("--resume <run-id>", "Resume a previous run from its on-disk journal").addOption(new Option("--branch-from <entry-index>", "Branch the journal at an entry index before resuming (with --resume)").hideHelp()).option("--verbose", "Show detailed output", false).addOption(new Option("--replay", "Replay the last scan's results").default(false).hideHelp()).action(async (opts) => {
     if (opts.replay) {
       try {
-        const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+        const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
         const db = new osecDB2(opts.dbPath);
         const scans = db.listScans(1);
         if (scans.length === 0) {
@@ -682,7 +682,7 @@ function registerScanCommand(program) {
         process.exit(2);
       }
       try {
-        const { loadScope: loadScope2 } = await import("./dist-AJU25UXA.js");
+        const { loadScope: loadScope2 } = await import("./dist-TQMHMSBZ.js");
         const policy = loadScope2(scopeFile);
         const verdict = scopeEnforcement.enabled ? policy.match(String(opts.target)) : void 0;
         if (verdict && !verdict.allowed) {
@@ -709,7 +709,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveAttribution: resolveAttribution2,
         extractAttributionFromScopeJson: extractAttributionFromScopeJson2
-      } = await import("./dist-AJU25UXA.js");
+      } = await import("./dist-TQMHMSBZ.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveAttribution2({
         scopeFileBlock: policy ? extractAttributionFromScopeJson2(policy.raw) : void 0,
@@ -727,7 +727,7 @@ function registerScanCommand(program) {
         loadScope: loadScope2,
         resolveEngagementProfile: resolveEngagementProfile2,
         extractEngagementFromScopeJson: extractEngagementFromScopeJson2
-      } = await import("./dist-AJU25UXA.js");
+      } = await import("./dist-TQMHMSBZ.js");
       const policy = scopeFile ? loadScope2(scopeFile) : void 0;
       resolveEngagementProfile2({
         scopeFileBlock: policy ? extractEngagementFromScopeJson2(policy.raw) : void 0,
@@ -756,7 +756,7 @@ function registerScanCommand(program) {
     const rateLimit = opts.rateLimit;
     if (rateLimit !== void 0 && rateLimit !== "") {
       try {
-        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-AJU25UXA.js");
+        const { parseRateLimitFlag: parseRateLimitFlag2 } = await import("./dist-TQMHMSBZ.js");
         parseRateLimitFlag2(rateLimit);
       } catch (err) {
         console.error(source_default.red(err instanceof Error ? err.message : String(err)));
@@ -927,7 +927,7 @@ function registerResumeCommand(program) {
 
 // packages/cli/src/commands/replay.ts
 async function replayScan(opts) {
-  const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+  const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
   const db = new osecDB2(opts.dbPath);
   const requestedScan = opts.scan;
   let scanRecord;
@@ -994,9 +994,9 @@ async function replayScan(opts) {
 function registerReplayCommand(program) {
   program.command("replay").description("Replay the last scan's attack chain as an animated terminal sequence").option("--db-path <path>", "Path to SQLite database").option("--scan <scanId>", "Replay a specific scan by ID (default: last scan)").action(async (opts) => {
     try {
-      const { isBunRuntime, canUseOpenTui } = await import("./runtime-HFFRUOPL.js");
+      const { isBunRuntime, canUseOpenTui } = await import("./runtime-AUBLQUOH.js");
       if (isBunRuntime() && canUseOpenTui()) {
-        const { showOpenTuiReplay } = await import("./run-5T4Z3Q2D.js");
+        const { showOpenTuiReplay } = await import("./run-MU3MFL2Z.js");
         await showOpenTuiReplay({ dbPath: opts.dbPath, scanId: opts.scan });
         return;
       }
@@ -1015,9 +1015,9 @@ import { existsSync as existsSync2 } from "node:fs";
 function registerHistoryCommand(program) {
   program.command("history").description("Show past scan history from run-local SQLite databases").option("--db-path <path>", "Path to one SQLite database").option("--limit <n>", "Number of scans to show", "10").action(async (opts) => {
     const limit2 = Number.parseInt(opts.limit ?? "10", 10);
-    const { isBunRuntime, canUseOpenTui } = await import("./runtime-HFFRUOPL.js");
+    const { isBunRuntime, canUseOpenTui } = await import("./runtime-AUBLQUOH.js");
     if (opts.dbPath && isBunRuntime() && canUseOpenTui()) {
-      const { showOpenTuiHistory } = await import("./run-5T4Z3Q2D.js");
+      const { showOpenTuiHistory } = await import("./run-MU3MFL2Z.js");
       await showOpenTuiHistory({ dbPath: opts.dbPath, limit: limit2 });
       return;
     }
@@ -1225,9 +1225,9 @@ function registerFindingsCommand(program) {
     const resolved = resolveFindingsOptions(opts, command);
     const limit2 = Number.parseInt(resolved.limit ?? "50", 10);
     const selectedDbPath = resolveDbPath(resolved);
-    const { isBunRuntime, canUseOpenTui } = await import("./runtime-HFFRUOPL.js");
+    const { isBunRuntime, canUseOpenTui } = await import("./runtime-AUBLQUOH.js");
     if (selectedDbPath && isBunRuntime() && canUseOpenTui()) {
-      const { showOpenTuiFindings } = await import("./run-5T4Z3Q2D.js");
+      const { showOpenTuiFindings } = await import("./run-MU3MFL2Z.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1248,9 +1248,9 @@ function registerFindingsCommand(program) {
     const resolved = resolveFindingsOptions(opts, command);
     const limit2 = Number.parseInt(resolved.limit ?? "50", 10);
     const selectedDbPath = resolveDbPath(resolved);
-    const { isBunRuntime, canUseOpenTui } = await import("./runtime-HFFRUOPL.js");
+    const { isBunRuntime, canUseOpenTui } = await import("./runtime-AUBLQUOH.js");
     if (selectedDbPath && isBunRuntime() && canUseOpenTui()) {
-      const { showOpenTuiFindings } = await import("./run-5T4Z3Q2D.js");
+      const { showOpenTuiFindings } = await import("./run-MU3MFL2Z.js");
       await showOpenTuiFindings({
         dbPath: selectedDbPath,
         scan: resolved.scan,
@@ -1308,7 +1308,7 @@ function registerFindingsCommand(program) {
         console.log(`  ${source_default.dim(finding.evidenceAnalysis)}`);
       }
       {
-        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-AJU25UXA.js");
+        const { summarizeTriageProvenance, formatTriageProvenance } = await import("./dist-TQMHMSBZ.js");
         const provenance = summarizeTriageProvenance({
           ...finding,
           layerVerdicts: parseLayerVerdicts(finding.layerVerdicts)
@@ -1428,7 +1428,7 @@ import { existsSync as existsSync3 } from "node:fs";
 var VALID_BUILD_SYSTEMS = /* @__PURE__ */ new Set(["autotools", "cmake", "meson", "auto"]);
 var VALID_SANITIZERS = /* @__PURE__ */ new Set(["asan", "ubsan", "msan"]);
 async function runHarnessTier2(args2) {
-  const { buildTier2Harness, extractCorpus } = await import("./dist-AJU25UXA.js");
+  const { buildTier2Harness, extractCorpus } = await import("./dist-TQMHMSBZ.js");
   const repoAbs = resolve2(args2.repo);
   if (!existsSync3(repoAbs)) {
     throw new Error(`Tier-2: repo path '${repoAbs}' does not exist.`);
@@ -1524,7 +1524,7 @@ async function runHarnessTier3(args2) {
     buildTier2Harness,
     extractCorpus,
     runTier3Validation
-  } = await import("./dist-AJU25UXA.js");
+  } = await import("./dist-TQMHMSBZ.js");
   const repoAbs = resolve3(args2.repo);
   if (!existsSync4(repoAbs)) {
     throw new Error(`Tier-3: repo path '${repoAbs}' does not exist.`);
@@ -1744,7 +1744,7 @@ function registerReviewCommand(program) {
     let seedFindings;
     const seedPath = opts.seedFindings;
     if (seedPath) {
-      const { readSeedFindings } = await import("./dist-AJU25UXA.js");
+      const { readSeedFindings } = await import("./dist-TQMHMSBZ.js");
       seedFindings = readSeedFindings(seedPath);
       console.log(
         source_default.cyan(
@@ -1760,7 +1760,7 @@ function registerReviewCommand(program) {
       );
     }
     if (fixCommit) {
-      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-AJU25UXA.js");
+      const { huntAppFixVariants, appFixVariantsToSeedFindings } = await import("./dist-TQMHMSBZ.js");
       const result = huntAppFixVariants({
         repoPath: repo,
         fixCommit
@@ -2073,9 +2073,9 @@ function registerAuditCommand(program) {
 // packages/cli/src/commands/doctor.ts
 function registerDoctorCommand(program) {
   program.command("doctor").description("Check local runtime prerequisites and suggest the next command").action(async () => {
-    const { isBunRuntime, canUseOpenTui, getRuntimeMetadata } = await import("./runtime-HFFRUOPL.js");
+    const { isBunRuntime, canUseOpenTui, getRuntimeMetadata } = await import("./runtime-AUBLQUOH.js");
     if (isBunRuntime() && canUseOpenTui()) {
-      const { showOpenTuiDoctor } = await import("./run-5T4Z3Q2D.js");
+      const { showOpenTuiDoctor } = await import("./run-MU3MFL2Z.js");
       await showOpenTuiDoctor();
       return;
     }
@@ -2372,7 +2372,7 @@ function clampRateLimitToPosture(cfg, posture) {
 }
 var workflowInputsSchema = SecurityWorkflowBindingsSchema;
 async function registerWorkflowTools(server, selected, opts) {
-  const runtime = opts.backend || opts.engineUrl ? await (await import("./remote-workflow-runtime-XNNGI2PG.js")).createRemoteWorkflowRuntime({ backendId: opts.backend, configPath: opts.backendsConfig, sessionId: opts.session, engineUrl: opts.engineUrl, engineTokenEnv: opts.engineTokenEnv }) : await (await import("./workflow-runtime-V26HIJO3.js")).createCliWorkflowRuntime({
+  const runtime = opts.backend || opts.engineUrl ? await (await import("./remote-workflow-runtime-DB52SINR.js")).createRemoteWorkflowRuntime({ backendId: opts.backend, configPath: opts.backendsConfig, sessionId: opts.session, engineUrl: opts.engineUrl, engineTokenEnv: opts.engineTokenEnv }) : await (await import("./workflow-runtime-AR627I26.js")).createCliWorkflowRuntime({
     ownerId: `mcp:${randomUUID()}`,
     workspace: opts.workspace,
     target: opts.target,
@@ -2670,11 +2670,11 @@ function rowToFinding(row) {
   };
 }
 async function openStore(dbPath) {
-  const { MemoryStore } = await import("./dist-AJU25UXA.js");
+  const { MemoryStore } = await import("./dist-TQMHMSBZ.js");
   return new MemoryStore(dbPath);
 }
 async function loadFinding2(dbPath, findingId) {
-  const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+  const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
   const db = new osecDB2(dbPath);
   try {
     const rows = db.listFindings({ limit: 5e3 });
@@ -2749,7 +2749,7 @@ async function runMemoryRemove(id, dbPath) {
 async function runMarkFp(findingId, opts) {
   const row = await loadFinding2(opts.dbPath, findingId);
   const finding = rowToFinding(row);
-  const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+  const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
   const db = new osecDB2(opts.dbPath);
   try {
     db.updateFindingTriage(row.id, "suppressed", opts.reason);
@@ -6464,7 +6464,7 @@ function registerIngestCommand(program) {
         reviewKernelCrashSubsystems,
         verifyStandaloneKernelReproducer,
         verifyKernelCrash
-      } = await import("./dist-AJU25UXA.js");
+      } = await import("./dist-TQMHMSBZ.js");
       let kernelBuild;
       if (opts.kernelTree) {
         kernelBuild = prepareKernelVmArtifacts({
@@ -6887,7 +6887,7 @@ function registerKernelCommand(program) {
         checkAlreadyFixed,
         rankKernelHypothesesWithJev,
         verifyStaticKernelFinding
-      } = await import("./dist-AJU25UXA.js");
+      } = await import("./dist-TQMHMSBZ.js");
       const noveltyExcluded = opts.upstreamTree ? findings.flatMap((finding) => {
         const path = finding.reviewAnnotation?.path ?? finding.evidence.request.match(/([^\s:]+\.[ch]):\d+/)?.[1];
         if (!path) return [];
@@ -6934,7 +6934,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev commit prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { rankKernelCommitsWithJev } = await import("./dist-AJU25UXA.js");
+      const { rankKernelCommitsWithJev } = await import("./dist-TQMHMSBZ.js");
       const result = await rankKernelCommitsWithJev({
         tree: opts.tree,
         evaluator: createJevEvaluator(config),
@@ -6958,7 +6958,7 @@ function registerKernelCommand(program) {
     try {
       const config = jevConfigFromEnvironment("kernel", process.env);
       if (!config) throw new Error("Jev source prepass requires ZERO_JEV_FEATURES=kernel and a configured provider");
-      const { runKernelSourceJevPrepass } = await import("./dist-AJU25UXA.js");
+      const { runKernelSourceJevPrepass } = await import("./dist-TQMHMSBZ.js");
       const result = await runKernelSourceJevPrepass({
         tree: opts.tree,
         subtree: opts.subtree,
@@ -6992,7 +6992,7 @@ function registerKernelCommand(program) {
       if (crashes.length === 0) throw new Error("Crash input must be a CrashRecord[] or an object with a crashes array");
       const records = crashes.filter((c) => !!c && typeof c === "object" && "id" in c && "summary" in c && typeof c.id === "string" && typeof c.summary === "string");
       if (records.length !== crashes.length) throw new Error("Every crash record requires string id and summary fields");
-      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-AJU25UXA.js");
+      const { rankCrashesWithJev, crashSummaryFromTriage } = await import("./dist-TQMHMSBZ.js");
       const result = await rankCrashesWithJev(
         records,
         createJevEvaluator(config)
@@ -7020,7 +7020,7 @@ function registerKernelCommand(program) {
       const details = parsePositiveInt(opts.details, "--details", 100);
       const detailDelayMs = parsePositiveInt(opts.detailDelay, "--detail-delay", 5e3);
       const subsystems = opts.subsystems.split(",").map((value) => value.trim()).filter(Boolean);
-      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-AJU25UXA.js");
+      const { defaultSyzbotFetcher, mineSyzbotQueue, toHuntCandidates } = await import("./dist-TQMHMSBZ.js");
       const result = await mineSyzbotQueue({
         fetch: defaultSyzbotFetcher,
         fetchDetail: defaultSyzbotFetcher,
@@ -7078,7 +7078,7 @@ function registerKernelCommand(program) {
           `Invalid output format '${opts.output}'. Valid: ${VALID_OUTPUT_FORMATS2.join(", ")}`
         );
       }
-      const { runKernelVariantHunt } = await import("./dist-AJU25UXA.js");
+      const { runKernelVariantHunt } = await import("./dist-TQMHMSBZ.js");
       const report = await runKernelVariantHunt({
         tree: opts.tree,
         advisory: opts.advisory,
@@ -7181,7 +7181,7 @@ function resolveOutputDir(opts, scanId) {
   return join9(homedir2(), "0", "disclosures", `scan-${scanId.slice(0, 8)}`);
 }
 async function disclose(findingId, opts) {
-  const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+  const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
   const db = new osecDB2(opts.dbPath);
   try {
     let routeDroppedFinding2 = function(args2) {
@@ -7633,7 +7633,7 @@ async function runExploit(opts) {
     classifyPrimitiveFromDmesg,
     describeKernelPrimitive,
     runWeaponization
-  } = await import("./dist-AJU25UXA.js");
+  } = await import("./dist-TQMHMSBZ.js");
   const rawFinding = readJson(opts.findingPath, "finding");
   let finding;
   try {
@@ -7696,7 +7696,7 @@ async function runExploit(opts) {
 }
 async function exploitAction(opts) {
   if (opts.agent) {
-    const { agentFromExploitOpts } = await import("./exploit-agent-A4RTIJ4J.js");
+    const { agentFromExploitOpts } = await import("./exploit-agent-Y2P4GFIY.js");
     process.exitCode = await agentFromExploitOpts({
       ...opts.task ? { task: opts.task } : {},
       ...opts.flagPath ? { flagPath: opts.flagPath } : {},
@@ -7711,7 +7711,7 @@ async function exploitAction(opts) {
     return;
   }
   if (opts.autoclimb) {
-    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-ABMMBC3M.js");
+    const { autoclimbFromExploitOpts } = await import("./exploit-autoclimb-YRZ3TMS2.js");
     process.exitCode = await autoclimbFromExploitOpts({
       ...opts.bugSpec ? { bugSpec: opts.bugSpec } : {},
       ...opts.bootScript ? { bootScript: opts.bootScript } : {},
@@ -7725,7 +7725,7 @@ async function exploitAction(opts) {
     throw new Error("missing required flag: --finding <path>");
   }
   if (opts.climb) {
-    const { runClimb } = await import("./exploit-climb-BQ2SVU63.js");
+    const { runClimb } = await import("./exploit-climb-4LEY4SDW.js");
     let loopBoots = 8;
     if (opts.loopBoots !== void 0) {
       loopBoots = parseInt(opts.loopBoots, 10);
@@ -7898,7 +7898,7 @@ async function runHunt(opts) {
     makeLloreJudge,
     makeHuntProveStage,
     prepare: prepare2
-  } = await import("./dist-AJU25UXA.js");
+  } = await import("./dist-TQMHMSBZ.js");
   const log = opts.log ?? (() => {
   });
   const runtime = opts.runtime ?? "api";
@@ -8246,7 +8246,7 @@ function parseWitnessMode(raw) {
 }
 async function recencyAction(opts) {
   if (!opts.tree) throw new Error("missing required flag: --tree <kernel source tree>");
-  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-AJU25UXA.js");
+  const { runRecencyHunt, renderRecencyReportMarkdown } = await import("./dist-TQMHMSBZ.js");
   const tree = resolve14(opts.tree);
   const runtime = opts.runtime ?? "api";
   const modelDir = opts.modelDir ? resolve14(opts.modelDir) : join10(tree, ".recency-models");
@@ -8362,7 +8362,7 @@ function resolveArtifactDir(value, sourceRoot) {
   return canonicalArtifactDir;
 }
 async function runMemSafety(opts) {
-  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-AJU25UXA.js");
+  const { prepare: prepare2, runMemSafetyScan } = await import("./dist-TQMHMSBZ.js");
   const log = opts.log ?? (() => {
   });
   const prepared = await prepare2(
@@ -8569,7 +8569,7 @@ function parseWitnessMode2(raw) {
   return m;
 }
 async function runAssumptionHuntCli(sourceRoot, opts) {
-  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-AJU25UXA.js");
+  const { runAssumptionHunt, makeSkepticVerifier } = await import("./dist-TQMHMSBZ.js");
   const log = (m) => process.stderr.write(m + "\n");
   const runtime = opts.runtime ?? "api";
   const root = resolve16(sourceRoot);
@@ -10022,7 +10022,7 @@ function registerConsoleCommand(program) {
     let resumedModel;
     let resumedTarget;
     if (opts.continue || opts.resume !== void 0) {
-      const { listSessions, loadSession } = await import("./session-store-K7I4GLNH.js");
+      const { listSessions, loadSession } = await import("./session-store-MKAAP3WL.js");
       const idArg = typeof opts.resume === "string" ? opts.resume.trim() : "";
       if (idArg || opts.continue) {
         let stored = idArg ? loadSession(idArg) : null;
@@ -11139,7 +11139,7 @@ function registerXnuFuzzCommand(program) {
 import { readFileSync as readFileSync17 } from "node:fs";
 import { resolve as resolve20 } from "node:path";
 async function managedResearch(adapter, target, options, engine) {
-  const { executeManagedOperation: executeManagedOperation2 } = await import("./managed-operation-SQFMBWHG.js");
+  const { executeManagedOperation: executeManagedOperation2 } = await import("./managed-operation-6R2QPPW5.js");
   const started = Date.now();
   return executeManagedOperation2({
     type: "research",
@@ -11191,7 +11191,7 @@ function print(value) {
 function registerResearchCommand(program) {
   const research = program.command("research").description("Run target-specific research engines");
   research.command("pipeline").description("Run the existing web/AI/source/package pipeline through the shared evidence plane").requiredOption("--target <target>", "URL, local path, repository, package, or image").option("--target-type <type>", "url, web-app, source-code, npm-package, pypi-package, cargo-package, or oci-image").option("--profile <profile>", "Source review profile").option("--depth <depth>", "quick, default, or deep", "default").option("--runtime <runtime>", "auto, api, claude, codex, gemini, or ollama", "auto").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-AJU25UXA.js");
+    const { UnifiedPipelineResearchAdapter, runResearch } = await import("./dist-TQMHMSBZ.js");
     const allowedTypes = /* @__PURE__ */ new Set(["url", "web-app", "source-code", "npm-package", "pypi-package", "cargo-package", "oci-image"]);
     if (opts.targetType && !allowedTypes.has(opts.targetType)) throw new Error(`unsupported --target-type ${opts.targetType}`);
     print(await managedResearch(
@@ -11215,7 +11215,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("counterexample").description("Search a C/C++ source target for sanitizer-confirmed counterexample inputs; optional mitigation replay").requiredOption("--source <dir>", "C/C++ source tree root").requiredOption("--fn <name>", "Suspect function name").requiredOption("--header <path>", "Header declaring the suspect function").requiredOption("--declaration <decl>", "C declaration of the suspect function").option("--input-shape <shape>", "bytesAndLen, bytesPtr, or bytesAndLenOut", "bytesAndLen").option("--build-system <system>", "auto, autotools, cmake, or meson", "auto").option("--timeout <sec>", "Fuzz wall-clock budget in seconds").option("--mitigation-source <files...>", "Reference-mitigation source file(s) for replay").option("--mitigation-include <dirs...>", "Extra include directories for the mitigation build").option("--witness <files...>", "Finding-proposed witness input file(s) to replay through the sanitizer build").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { UserspaceCounterexampleResearchAdapter, runResearch } = await import("./dist-AJU25UXA.js");
+    const { UserspaceCounterexampleResearchAdapter, runResearch } = await import("./dist-TQMHMSBZ.js");
     const SHAPES = { bytesAndLen: true, bytesPtr: true, bytesAndLenOut: true };
     if (!SHAPES[opts.inputShape]) throw new Error(`unsupported --input-shape ${opts.inputShape}`);
     const SYSTEMS = { auto: true, autotools: true, cmake: true, meson: true };
@@ -11245,7 +11245,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("mobile").description("Run passive mobile intake; indicators remain hypotheses and only scoped adapters may hand off targets").requiredOption("--target <path>", "Extracted APK/IPA directory or metadata file").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-AJU25UXA.js");
+    const { MobileStaticResearchAdapter, runResearch } = await import("./dist-TQMHMSBZ.js");
     const targetPath = resolve20(opts.target);
     print(await managedResearch(
       new MobileStaticResearchAdapter(),
@@ -11255,7 +11255,7 @@ function registerResearchCommand(program) {
     ));
   });
   research.command("linux-matrix").description("Import externally executed vulnerable-vs-patched boot logs; 0 validates and hashes them but does not execute boots").requiredOption("--matrix <path>", "Versioned external boot-matrix manifest JSON").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-AJU25UXA.js");
+    const { LinuxBootMatrixImportAdapter, runResearch } = await import("./dist-TQMHMSBZ.js");
     const matrix = resolve20(opts.matrix);
     const finding = JSON.parse(readFileSync17(resolve20(opts.finding), "utf8"));
     const result = await managedResearch(
@@ -11268,7 +11268,7 @@ function registerResearchCommand(program) {
     print(result);
   });
   research.command("linux").description("Run a supplied Linux kernel reproducer through the shared N-boot evidence gate").requiredOption("--kernel-tree <path>", "Linux source tree").requiredOption("--reproducer <path>", "C reproducer or syzkaller .syz program").requiredOption("--finding <path>", "Existing Finding JSON to bind the proof to").requiredOption("--expected-signature <literal>", "Literal crash signature that every counted boot must contain").option("--boots <n>", "Fresh boots", "3").option("--min-hits <n>", "Required reproducing boots", "2").option("--artifact-root <path>", "Research artifact root", ".0-research").action(async (opts) => {
-    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-AJU25UXA.js");
+    const { LinuxKernelResearchAdapter, runResearch } = await import("./dist-TQMHMSBZ.js");
     const kernelTree = resolve20(opts.kernelTree);
     const reproducer = resolve20(opts.reproducer);
     const finding = JSON.parse(readFileSync17(resolve20(opts.finding), "utf8"));
@@ -11430,7 +11430,7 @@ function registerTimelineCommand(program) {
       process.exitCode = 2;
       return;
     }
-    const { osecDB: osecDB2 } = await import("./dist-3SWWY5FZ.js");
+    const { osecDB: osecDB2 } = await import("./dist-RKLQIXDT.js");
     const db = new osecDB2(opts.dbPath);
     let scan2;
     let rows;
@@ -12006,7 +12006,7 @@ var MAX_SOURCE_BYTES = 4 * 1024 * 1024;
 var cachedCore;
 async function defaultCorePort() {
   if (cachedCore) return cachedCore;
-  const mod = await import("./dist-AJU25UXA.js");
+  const mod = await import("./dist-TQMHMSBZ.js");
   cachedCore = {
     validatePluginManifest: mod.validatePluginManifest,
     reservedToolNames: Object.values(mod.TOOL_DEFINITIONS).map((tool) => tool.name),
@@ -12345,7 +12345,7 @@ function registerHackstoreCommand(program) {
 var cachedCore2;
 async function defaultCorePort2() {
   if (cachedCore2) return cachedCore2;
-  const mod = await import("./dist-AJU25UXA.js");
+  const mod = await import("./dist-TQMHMSBZ.js");
   cachedCore2 = mod;
   return mod;
 }
@@ -12896,7 +12896,7 @@ var EXIT_USER_ERROR5 = 1;
 var cachedCore3;
 async function defaultThemeCorePort() {
   if (cachedCore3) return cachedCore3;
-  const mod = await import("./dist-AJU25UXA.js");
+  const mod = await import("./dist-TQMHMSBZ.js");
   cachedCore3 = mod;
   return mod;
 }
@@ -13446,8 +13446,8 @@ import { realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve26 } from "node:path";
 import { homedir as homedir3 } from "node:os";
 async function defaultService() {
-  const { LearningService, HuntMemoryStore } = await import("./dist-AJU25UXA.js");
-  const { SecurityWorkflowStore: SecurityWorkflowStore2, learningProjectId } = await import("./dist-3SWWY5FZ.js");
+  const { LearningService, HuntMemoryStore } = await import("./dist-TQMHMSBZ.js");
+  const { SecurityWorkflowStore: SecurityWorkflowStore2, learningProjectId } = await import("./dist-RKLQIXDT.js");
   const workflows = new SecurityWorkflowStore2();
   const store = workflows.learningStore();
   const service = new LearningService(store, { workflows });
@@ -13731,9 +13731,9 @@ function registerReviewChecksCommand(program) {
 import { open } from "node:fs/promises";
 import { constants as constants4 } from "node:fs";
 var defaults = {
-  createRemoteRuntime: async (options) => (await import("./remote-workflow-runtime-XNNGI2PG.js")).createRemoteWorkflowRuntime(options),
+  createRemoteRuntime: async (options) => (await import("./remote-workflow-runtime-DB52SINR.js")).createRemoteWorkflowRuntime(options),
   createRuntime: async (options) => {
-    const { createCliWorkflowRuntime } = await import("./workflow-runtime-V26HIJO3.js");
+    const { createCliWorkflowRuntime } = await import("./workflow-runtime-AR627I26.js");
     return await createCliWorkflowRuntime(options);
   },
   out: (text2) => process.stdout.write(`${text2}