0sec-cli 0.24.1 → 0.26.0

package/chunks/{chunk-PJU24AKR.js → chunk-R7VWEY45.js}

@@ -1,26 +1,16 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
-import {
-  bufferToString
-} from "./chunk-4ROZFLSR.js";
 import {
   scanExecutionTimeout
-} from "./chunk-BD7WULFS.js";
-
-// packages/core/dist/prepare.js
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync2, mkdirSync as mkdirSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join3, basename } from "node:path";
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { tmpdir as tmpdir2 } from "node:os";
+} from "./chunk-SSPP64FF.js";
 
 // packages/core/dist/package-ecosystems.js
-import { execFileSync, execSync } from "node:child_process";
-import { existsSync, mkdirSync as mkdirSync2, readFileSync, readdirSync, rmSync, statSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { execFileSync as execFileSync2, execSync } from "node:child_process";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync, readdirSync, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join3 } from "node:path";
 import { randomUUID } from "node:crypto";
-import { tmpdir } from "node:os";
+import { tmpdir as tmpdir2 } from "node:os";
 
 // packages/core/dist/historical-package-fallback.js
 import { mkdirSync, writeFileSync } from "node:fs";
@@ -93,6 +83,271 @@ function restoreHistoricalPackageFixture(packageName, tempDir, emit) {
   };
 }
 
+// packages/core/dist/shared-analysis.js
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, rmSync, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname as dirname2, isAbsolute, join as join2, relative, resolve, sep } from "node:path";
+var FOXGUARD_PINNED_TAG = "v0.14.0";
+var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini"]);
+function bufferToString(value) {
+  if (!value) {
+    return "";
+  }
+  return Buffer.isBuffer(value) ? value.toString("utf-8") : value;
+}
+function mapSemgrepSeverity(level) {
+  switch (level.toUpperCase()) {
+    case "ERROR":
+      return "high";
+    case "WARNING":
+      return "medium";
+    case "INFO":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function mapFoxguardSeverity(level) {
+  switch ((level ?? "").toLowerCase()) {
+    case "error":
+    case "critical":
+      return "critical";
+    case "warning":
+    case "high":
+      return "high";
+    case "note":
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function runSemgrepScan(targetPath, emit, opts) {
+  emit({
+    type: "stage:start",
+    stage: "source-analysis",
+    message: "Running semgrep security scan..."
+  });
+  if (opts?.paths?.length === 0) {
+    emit({ type: "stage:end", stage: "source-analysis", message: "Semgrep: no files selected" });
+    return [];
+  }
+  const args = [
+    "scan",
+    "--config",
+    "auto",
+    "--json",
+    ...opts?.noGitIgnore ? ["--no-git-ignore"] : [],
+    "--timeout",
+    "60",
+    "--max-target-bytes",
+    "1000000",
+    ...opts?.paths ?? [targetPath]
+  ];
+  let rawOutput;
+  try {
+    rawOutput = execFileSync("semgrep", args, {
+      timeout: scanExecutionTimeout(3e5),
+      stdio: "pipe",
+      encoding: "utf-8",
+      env: { ...process.env, SEMGREP_SEND_METRICS: "off" }
+    });
+  } catch (err) {
+    if (!err || typeof err !== "object" || !("status" in err) || err.status !== 1)
+      throw err;
+    rawOutput = bufferToString("stdout" in err ? err.stdout : void 0);
+  }
+  const raw = JSON.parse(rawOutput);
+  if (!raw || !Array.isArray(raw.results))
+    throw new Error("invalid Semgrep JSON report");
+  const results = raw.results;
+  const findings = results.map((r) => ({
+    ruleId: r.check_id,
+    message: r.extra?.message ?? "",
+    severity: mapSemgrepSeverity(r.extra?.severity ?? "WARNING"),
+    path: r.path,
+    startLine: r.start?.line ?? 0,
+    endLine: r.end?.line ?? 0,
+    snippet: r.extra?.lines ?? "",
+    metadata: r.extra?.metadata
+  }));
+  emit({
+    type: "stage:end",
+    stage: "source-analysis",
+    message: `Semgrep: ${findings.length} findings`
+  });
+  return findings;
+}
+function selectedStaticScanner() {
+  return process.env["ZERO_STATIC"] === "semgrep" ? "semgrep" : "foxguard";
+}
+function runFoxguardScan(targetPath, emit, opts) {
+  emit({
+    type: "stage:start",
+    stage: "source-analysis",
+    message: "Running foxguard security scan..."
+  });
+  if (opts?.paths?.length === 0) {
+    emit({ type: "stage:end", stage: "source-analysis", message: "Foxguard: no files selected" });
+    return [];
+  }
+  const foxguardTag = opts?.foxguardTag ?? FOXGUARD_PINNED_TAG;
+  const runner = opts?.runner ?? execFileSync;
+  const logger = opts?.logger ?? ((m) => console.warn(m));
+  const cwd = statSync(targetPath, { throwIfNoEntry: false })?.isFile() ? dirname2(resolve(targetPath)) : resolve(targetPath);
+  let useNpm = opts?.foxguardCommand !== void 0 || opts?.foxguardTag !== void 0;
+  const findings = [];
+  let selectionDir;
+  try {
+    let selectionFile;
+    if (opts?.paths && !opts.diffBase) {
+      const paths = opts.paths.map((path) => {
+        const selected = relative(cwd, resolve(cwd, path));
+        if (isAbsolute(selected) || selected === ".." || selected.startsWith(`..${sep}`) || /[\r\n\0]/.test(selected)) {
+          throw new Error(`selected Foxguard path is outside the scan root or cannot be represented: ${path}`);
+        }
+        return selected.split(sep).join("/");
+      });
+      selectionDir = mkdtempSync(join2(tmpdir(), "0-foxguard-"));
+      selectionFile = join2(selectionDir, "changed-files.txt");
+      writeFileSync2(selectionFile, `${paths.join("\n")}
+`, { mode: 384 });
+    }
+    const scanRoot = relative(cwd, resolve(targetPath)) || ".";
+    const invocations = [opts?.diffBase ? ["diff", opts.diffBase, scanRoot, "--format", "json"] : ["--format", "json", ...selectionFile ? ["--changed-files-from", selectionFile] : [], scanRoot]];
+    for (const args of invocations) {
+      let rawOutput;
+      const invoke = () => {
+        try {
+          return bufferToString(runner(useNpm ? opts?.foxguardCommand ?? "npx" : "foxguard", useNpm ? ["--yes", `foxguard@${foxguardTag}`, ...args] : args, {
+            cwd,
+            timeout: scanExecutionTimeout(3e5),
+            maxBuffer: 64 * 1024 * 1024,
+            stdio: "pipe",
+            encoding: "utf-8"
+          }));
+        } catch (err) {
+          if (err && typeof err === "object" && "status" in err && err.status === 1) {
+            return bufferToString("stdout" in err ? err.stdout : void 0);
+          }
+          throw err;
+        }
+      };
+      try {
+        rawOutput = invoke();
+      } catch (err) {
+        if (!useNpm && err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+          useNpm = true;
+          rawOutput = invoke();
+        } else {
+          throw err;
+        }
+      }
+      const report = parseFoxguardJson(rawOutput);
+      if (report === null)
+        throw new Error("invalid Foxguard JSON report");
+      if (report.filesScanned === 0) {
+        throw new Error("Foxguard scanned 0 files; static coverage is unavailable (files may be excluded or unsupported)");
+      }
+      for (const finding of translateFoxguardFindings(report.findings)) {
+        finding.path = resolve(cwd, finding.path);
+        findings.push(finding);
+      }
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    logger(`[0] foxguard scan failed (${message}). Npm pin: foxguard@${foxguardTag}. Set ZERO_STATIC=semgrep to use semgrep.`);
+    emit({ type: "error", stage: "source-analysis", message: `Foxguard scan failed: ${message}` });
+    throw err;
+  } finally {
+    if (selectionDir)
+      rmSync(selectionDir, { recursive: true, force: true });
+  }
+  emit({
+    type: "stage:end",
+    stage: "source-analysis",
+    message: `Foxguard: ${findings.length} findings`
+  });
+  return findings;
+}
+function runSelectedStaticScan(targetPath, emit, opts) {
+  return selectedStaticScanner() === "foxguard" ? runFoxguardScan(targetPath, emit, opts) : runSemgrepScan(targetPath, emit, opts);
+}
+function parseFoxguardJson(rawJson) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawJson);
+  } catch {
+    return null;
+  }
+  if (Array.isArray(parsed))
+    return { findings: parsed };
+  if (!parsed || typeof parsed !== "object" || !("findings" in parsed))
+    return null;
+  for (const field of ["schema_version", "finding_schema_version"]) {
+    if (field in parsed && !/^1\.\d+\.\d+$/.test(String(parsed[field]))) {
+      return null;
+    }
+  }
+  if (!Array.isArray(parsed.findings))
+    return null;
+  const target = "target" in parsed ? parsed.target : void 0;
+  const filesScanned = target && typeof target === "object" && "files_scanned" in target ? target.files_scanned : void 0;
+  if (filesScanned !== void 0 && (typeof filesScanned !== "number" || !Number.isSafeInteger(filesScanned) || filesScanned < 0))
+    return null;
+  return { findings: parsed.findings, ...typeof filesScanned === "number" ? { filesScanned } : {} };
+}
+function translateFoxguardFindings(rawFindings) {
+  const out = [];
+  for (const raw of rawFindings) {
+    if (!raw || typeof raw !== "object")
+      continue;
+    if (!raw.rule_id || !raw.file || typeof raw.line !== "number")
+      continue;
+    const startLine = raw.line;
+    const endLine = typeof raw.end_line === "number" ? raw.end_line : startLine;
+    const metadata = { scanner: "foxguard" };
+    if (raw.cwe)
+      metadata.cwe = raw.cwe;
+    if (typeof raw.confidence === "number")
+      metadata.confidence = raw.confidence;
+    if (typeof raw.taint_hops === "number")
+      metadata.taintHops = raw.taint_hops;
+    if (raw.source_line || raw.sink_line) {
+      metadata.dataflow = {
+        sourceLine: raw.source_line,
+        sourceDescription: raw.source_description,
+        sinkLine: raw.sink_line,
+        sinkDescription: raw.sink_description
+      };
+    }
+    if (raw.fix_suggestion)
+      metadata.fixSuggestion = raw.fix_suggestion;
+    if (raw.tags && raw.tags.length > 0)
+      metadata.tags = raw.tags;
+    if (raw.crypto_algorithm)
+      metadata.cryptoAlgorithm = raw.crypto_algorithm;
+    if (raw.cnsa2_deadline)
+      metadata.cnsa2Deadline = raw.cnsa2_deadline;
+    if (raw.dep_name)
+      metadata.depName = raw.dep_name;
+    out.push({
+      ruleId: raw.rule_id,
+      message: raw.description ?? "",
+      severity: mapFoxguardSeverity(raw.severity),
+      path: raw.file,
+      startLine,
+      endLine,
+      snippet: raw.snippet ?? "",
+      metadata
+    });
+  }
+  return out;
+}
+
 // packages/core/dist/package-ecosystems.js
 function stderrLooksLikeEresolve(stderr) {
   return /ERESOLVE/i.test(stderr);
@@ -270,7 +525,7 @@ function queryOsvAdvisoriesSync(ecosystem, packageName, version) {
     version
   });
   try {
-    const rawOutput = execFileSync("curl", [
+    const rawOutput = execFileSync2("curl", [
       "-fsSL",
       "--retry",
       "3",
@@ -308,7 +563,7 @@ function splitPackageSpec(rawPackageName, requestedVersion) {
   return { packageName, version };
 }
 function writeMinimalPackageJson(tempDir) {
-  execFileSync("npm", ["init", "-y", "--silent"], {
+  execFileSync2("npm", ["init", "-y", "--silent"], {
     cwd: tempDir,
     timeout: scanExecutionTimeout(15e3),
     stdio: "pipe"
@@ -325,18 +580,18 @@ function restoreNpmFixtureOrThrow(packageName, tempDir, msg, emit) {
       };
     }
   }
-  rmSync(tempDir, { recursive: true, force: true });
+  rmSync2(tempDir, { recursive: true, force: true });
   throw new Error(msg);
 }
 function installNpmPackage(packageName, requestedVersion, emit) {
-  const tempDir = join2(tmpdir(), `0-audit-${randomUUID().slice(0, 8)}`);
+  const tempDir = join3(tmpdir2(), `0-audit-${randomUUID().slice(0, 8)}`);
   mkdirSync2(tempDir, { recursive: true });
   const spec = requestedVersion ? `${packageName}@${requestedVersion}` : `${packageName}@latest`;
   emit({ type: "stage:start", stage: "discovery", message: `Installing ${spec}...` });
   try {
     writeMinimalPackageJson(tempDir);
     try {
-      execFileSync("npm", ["install", spec, "--ignore-scripts", "--no-audit", "--no-fund"], {
+      execFileSync2("npm", ["install", spec, "--ignore-scripts", "--no-audit", "--no-fund"], {
         cwd: tempDir,
         timeout: scanExecutionTimeout(12e4),
         stdio: "pipe"
@@ -351,7 +606,7 @@ function installNpmPackage(packageName, requestedVersion, emit) {
         stage: "discovery",
         message: `npm install ${spec} hit ERESOLVE peer conflict \u2014 retrying with --legacy-peer-deps`
       });
-      execFileSync("npm", ["install", "--legacy-peer-deps", spec, "--ignore-scripts", "--no-audit", "--no-fund"], {
+      execFileSync2("npm", ["install", "--legacy-peer-deps", spec, "--ignore-scripts", "--no-audit", "--no-fund"], {
         cwd: tempDir,
         timeout: scanExecutionTimeout(12e4),
         stdio: "pipe"
@@ -366,14 +621,14 @@ function installNpmPackage(packageName, requestedVersion, emit) {
     const msg = err instanceof Error ? err.message : String(err);
     return restoreNpmFixtureOrThrow(packageName, tempDir, `Failed to install ${spec}: ${msg}`, emit);
   }
-  const pkgJsonPath = join2(tempDir, "node_modules", packageName, "package.json");
+  const pkgJsonPath = join3(tempDir, "node_modules", packageName, "package.json");
   if (!existsSync(pkgJsonPath)) {
-    rmSync(tempDir, { recursive: true, force: true });
+    rmSync2(tempDir, { recursive: true, force: true });
     throw new Error(`Package ${packageName} not found after install. Check the package name.`);
   }
   const pkgJson = JSON.parse(readFileSync(pkgJsonPath, "utf8"));
   const installedVersion = pkgJson.version;
-  const packagePath = join2(tempDir, "node_modules", packageName);
+  const packagePath = join3(tempDir, "node_modules", packageName);
   emit({ type: "stage:end", stage: "discovery", message: `Installed ${packageName}@${installedVersion}` });
   return {
     ecosystem: "npm",
@@ -384,7 +639,7 @@ function installNpmPackage(packageName, requestedVersion, emit) {
   };
 }
 function extractSingleArchive(archivePath, outputDir) {
-  execFileSync("python3", ["-c", `
+  execFileSync2("python3", ["-c", `
 import pathlib, tarfile, zipfile, sys
 archive = pathlib.Path(sys.argv[1])
 out = pathlib.Path(sys.argv[2]).resolve()
@@ -411,7 +666,7 @@ else:
 `, archivePath, outputDir], { stdio: "pipe", timeout: scanExecutionTimeout(6e4) });
 }
 function pickPythonScopePath(extractRoot) {
-  const entries = readdirSync(extractRoot).map((name) => join2(extractRoot, name)).filter((abs) => existsSync(abs) && statSync(abs).isDirectory());
+  const entries = readdirSync(extractRoot).map((name) => join3(extractRoot, name)).filter((abs) => existsSync(abs) && statSync2(abs).isDirectory());
   return entries.length === 1 ? entries[0] : extractRoot;
 }
 function readPythonVersionFromMetadata(scopePath) {
@@ -426,16 +681,16 @@ function readPythonVersionFromMetadata(scopePath) {
       continue;
     }
     for (const entry of entries) {
-      const abs = join2(current, entry);
+      const abs = join3(current, entry);
       let st;
       try {
-        st = statSync(abs);
+        st = statSync2(abs);
       } catch {
         continue;
       }
       if (st.isDirectory()) {
         if (entry.endsWith(".dist-info")) {
-          candidates.push(join2(abs, "METADATA"));
+          candidates.push(join3(abs, "METADATA"));
         } else {
           stack.push(abs);
         }
@@ -502,7 +757,7 @@ with urllib.request.urlopen(request, timeout=120) as response, archive_path.open
 
 print(json.dumps({"archivePath": str(archive_path), "resolvedVersion": metadata.get("info", {}).get("version") or requested_version or "unknown"}))
 `;
-  const rawOutput = execFileSync("python3", ["-c", script, packageName, requestedVersion ?? "", downloadDir], {
+  const rawOutput = execFileSync2("python3", ["-c", script, packageName, requestedVersion ?? "", downloadDir], {
     encoding: "utf8",
     timeout: scanExecutionTimeout(18e4),
     stdio: ["ignore", "pipe", "pipe"]
@@ -510,9 +765,9 @@ print(json.dumps({"archivePath": str(archive_path), "resolvedVersion": metadata.
   return JSON.parse(rawOutput);
 }
 function installPypiPackage(packageName, requestedVersion, emit) {
-  const tempDir = join2(tmpdir(), `0-audit-${randomUUID().slice(0, 8)}`);
-  const downloadDir = join2(tempDir, "downloads");
-  const extractDir = join2(tempDir, "src");
+  const tempDir = join3(tmpdir2(), `0-audit-${randomUUID().slice(0, 8)}`);
+  const downloadDir = join3(tempDir, "downloads");
+  const extractDir = join3(tempDir, "src");
   mkdirSync2(downloadDir, { recursive: true });
   mkdirSync2(extractDir, { recursive: true });
   const spec = requestedVersion ? `${packageName}==${requestedVersion}` : packageName;
@@ -524,14 +779,14 @@ function installPypiPackage(packageName, requestedVersion, emit) {
     archivePath = downloaded.archivePath;
     installedVersion = downloaded.resolvedVersion;
   } catch (err) {
-    rmSync(tempDir, { recursive: true, force: true });
+    rmSync2(tempDir, { recursive: true, force: true });
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`Failed to download ${spec} from PyPI: ${msg}`);
   }
   extractSingleArchive(archivePath, extractDir);
   const scopePath = pickPythonScopePath(extractDir);
-  const pyprojectPath = join2(scopePath, "pyproject.toml");
-  const setupPyPath = join2(scopePath, "setup.py");
+  const pyprojectPath = join3(scopePath, "pyproject.toml");
+  const setupPyPath = join3(scopePath, "setup.py");
   if (!installedVersion && existsSync(pyprojectPath)) {
     const content = readFileSync(pyprojectPath, "utf8");
     const match = content.match(/^\s*version\s*=\s*["']([^"']+)["']/m);
@@ -549,7 +804,7 @@ function installPypiPackage(packageName, requestedVersion, emit) {
     installedVersion = readPythonVersionFromArchiveName(packageName, archivePath);
   }
   installedVersion = installedVersion ?? "unknown";
-  writeFileSync2(join2(tempDir, "requirements.txt"), `${packageName}==${installedVersion}
+  writeFileSync3(join3(tempDir, "requirements.txt"), `${packageName}==${installedVersion}
 `, "utf8");
   emit({ type: "stage:end", stage: "discovery", message: `Prepared ${packageName}==${installedVersion} from PyPI` });
   return {
@@ -563,7 +818,7 @@ function installPypiPackage(packageName, requestedVersion, emit) {
 function resolveCargoVersion(packageName, requestedVersion) {
   if (requestedVersion)
     return requestedVersion;
-  const raw = execFileSync("curl", buildCratesIoCurlArgs(`https://crates.io/api/v1/crates/${packageName}`), {
+  const raw = execFileSync2("curl", buildCratesIoCurlArgs(`https://crates.io/api/v1/crates/${packageName}`), {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"],
     timeout: scanExecutionTimeout(6e4)
@@ -572,39 +827,39 @@ function resolveCargoVersion(packageName, requestedVersion) {
   return parsed.crate?.max_stable_version ?? parsed.crate?.max_version ?? parsed.crate?.newest_version ?? "latest";
 }
 function installCargoPackage(packageName, requestedVersion, emit) {
-  const tempDir = join2(tmpdir(), `0-audit-${randomUUID().slice(0, 8)}`);
-  const downloadDir = join2(tempDir, "downloads");
-  const extractDir = join2(tempDir, "src");
+  const tempDir = join3(tmpdir2(), `0-audit-${randomUUID().slice(0, 8)}`);
+  const downloadDir = join3(tempDir, "downloads");
+  const extractDir = join3(tempDir, "src");
   mkdirSync2(downloadDir, { recursive: true });
   mkdirSync2(extractDir, { recursive: true });
   const version = resolveCargoVersion(packageName, requestedVersion);
   emit({ type: "stage:start", stage: "discovery", message: `Downloading crates.io crate ${packageName}@${version}...` });
   try {
-    execFileSync("curl", [
+    execFileSync2("curl", [
       ...buildCratesIoCurlArgs(`https://crates.io/api/v1/crates/${packageName}/${version}/download`),
       "-o",
-      join2(downloadDir, `${packageName}-${version}.crate`)
+      join3(downloadDir, `${packageName}-${version}.crate`)
     ], {
       cwd: tempDir,
       timeout: scanExecutionTimeout(12e4),
       stdio: "pipe"
     });
   } catch (err) {
-    rmSync(tempDir, { recursive: true, force: true });
+    rmSync2(tempDir, { recursive: true, force: true });
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`Failed to download ${packageName}@${version} from crates.io: ${msg}`);
   }
-  const archivePath = join2(downloadDir, `${packageName}-${version}.crate`);
+  const archivePath = join3(downloadDir, `${packageName}-${version}.crate`);
   extractSingleArchive(archivePath, extractDir);
   const scopePath = pickPythonScopePath(extractDir);
-  const cargoTomlPath = join2(scopePath, "Cargo.toml");
+  const cargoTomlPath = join3(scopePath, "Cargo.toml");
   let resolvedVersion = version;
   if (existsSync(cargoTomlPath)) {
     const content = readFileSync(cargoTomlPath, "utf8");
     const match = content.match(/^\s*version\s*=\s*["']([^"']+)["']/m);
     resolvedVersion = match?.[1] ?? version;
   }
-  writeFileSync2(join2(tempDir, "Cargo.toml"), `[package]
+  writeFileSync3(join3(tempDir, "Cargo.toml"), `[package]
 name = "0-cargo-audit"
 version = "0.1.0"
 edition = "2021"
@@ -612,10 +867,10 @@ edition = "2021"
 [dependencies]
 ${packageName} = "${resolvedVersion}"
 `, "utf8");
-  mkdirSync2(join2(tempDir, "src"), { recursive: true });
-  writeFileSync2(join2(tempDir, "src", "main.rs"), "fn main() {}\n", "utf8");
+  mkdirSync2(join3(tempDir, "src"), { recursive: true });
+  writeFileSync3(join3(tempDir, "src", "main.rs"), "fn main() {}\n", "utf8");
   try {
-    execFileSync("cargo", ["generate-lockfile"], {
+    execFileSync2("cargo", ["generate-lockfile"], {
       cwd: tempDir,
       timeout: scanExecutionTimeout(18e4),
       stdio: "pipe"
@@ -681,7 +936,7 @@ function resolveOciImageRef(rawImageRef, requestedVersion) {
 }
 function hasExecutable(command, args = ["--version"]) {
   try {
-    execFileSync(command, args, {
+    execFileSync2(command, args, {
       timeout: scanExecutionTimeout(1e4),
       stdio: "ignore"
     });
@@ -733,22 +988,22 @@ for layer in layers:
                 continue
             layer_tar.extract(member, rootfs)
 `;
-  execFileSync("python3", ["-c", script, archivePath, rootfsDir], {
+  execFileSync2("python3", ["-c", script, archivePath, rootfsDir], {
     timeout: scanExecutionTimeout(3e5),
     stdio: "pipe"
   });
 }
 function installOciImage(rawImageRef, requestedVersion, emit) {
-  const tempDir = join2(tmpdir(), `0-audit-${randomUUID().slice(0, 8)}`);
-  const rootfsDir = join2(tempDir, "rootfs");
-  const exportTar = join2(tempDir, "image.tar");
+  const tempDir = join3(tmpdir2(), `0-audit-${randomUUID().slice(0, 8)}`);
+  const rootfsDir = join3(tempDir, "rootfs");
+  const exportTar = join3(tempDir, "image.tar");
   mkdirSync2(rootfsDir, { recursive: true });
   const { imageRef, name, version } = resolveOciImageRef(rawImageRef, requestedVersion);
   emit({ type: "stage:start", stage: "discovery", message: `Pulling OCI image ${imageRef}...` });
   let containerId = "";
   try {
     if (hasExecutable("skopeo")) {
-      execFileSync("skopeo", [
+      execFileSync2("skopeo", [
         "copy",
         "--insecure-policy",
         `docker://${imageRef}`,
@@ -759,32 +1014,32 @@ function installOciImage(rawImageRef, requestedVersion, emit) {
       });
       extractDockerArchiveLayers(exportTar, rootfsDir);
     } else {
-      execFileSync("docker", ["pull", imageRef], {
+      execFileSync2("docker", ["pull", imageRef], {
         timeout: scanExecutionTimeout(3e5),
         stdio: "pipe"
       });
-      containerId = execFileSync("docker", ["create", imageRef], {
+      containerId = execFileSync2("docker", ["create", imageRef], {
         encoding: "utf8",
         timeout: scanExecutionTimeout(6e4),
         stdio: ["pipe", "pipe", "pipe"]
       }).trim();
-      execFileSync("docker", ["export", containerId, "-o", exportTar], {
+      execFileSync2("docker", ["export", containerId, "-o", exportTar], {
         timeout: scanExecutionTimeout(3e5),
         stdio: "pipe"
       });
-      execFileSync("tar", ["-xf", exportTar, "-C", rootfsDir], {
+      execFileSync2("tar", ["-xf", exportTar, "-C", rootfsDir], {
         timeout: scanExecutionTimeout(3e5),
         stdio: "pipe"
       });
     }
   } catch (err) {
-    rmSync(tempDir, { recursive: true, force: true });
+    rmSync2(tempDir, { recursive: true, force: true });
     const msg = err instanceof Error ? err.message : String(err);
     throw new Error(`Failed to prepare OCI image ${imageRef}: ${msg}`);
   } finally {
     if (containerId) {
       try {
-        execFileSync("docker", ["rm", "-f", containerId], {
+        execFileSync2("docker", ["rm", "-f", containerId], {
           timeout: 3e4,
           stdio: "pipe"
         });
@@ -850,7 +1105,7 @@ function walkInstalledNpmTree(projectDir, rootName, maxPackages = 5e3) {
   const out = [];
   const rootLower = rootName.toLowerCase();
   function readPackage(pkgDir) {
-    const pkgJsonPath = join2(pkgDir, "package.json");
+    const pkgJsonPath = join3(pkgDir, "package.json");
     if (!existsSync(pkgJsonPath))
       return null;
     try {
@@ -873,9 +1128,9 @@ function walkInstalledNpmTree(projectDir, rootName, maxPackages = 5e3) {
     for (const entry of entries) {
       if (entry === ".bin" || entry === ".cache" || entry === ".package-lock.json")
         continue;
-      const abs = join2(nodeModulesDir, entry);
+      const abs = join3(nodeModulesDir, entry);
       try {
-        if (!statSync(abs).isDirectory())
+        if (!statSync2(abs).isDirectory())
           continue;
       } catch {
         continue;
@@ -888,9 +1143,9 @@ function walkInstalledNpmTree(projectDir, rootName, maxPackages = 5e3) {
           continue;
         }
         for (const inner of scoped) {
-          const innerAbs = join2(abs, inner);
+          const innerAbs = join3(abs, inner);
           try {
-            if (statSync(innerAbs).isDirectory())
+            if (statSync2(innerAbs).isDirectory())
               dirs.push(innerAbs);
           } catch {
           }
@@ -914,12 +1169,12 @@ function walkInstalledNpmTree(projectDir, rootName, maxPackages = 5e3) {
       if (!(depth === 1 && meta.name.toLowerCase() === rootLower)) {
         out.push({ name: meta.name, version: meta.version, path: pkgDir, depth, dependencyPath });
       }
-      const nested = join2(pkgDir, "node_modules");
+      const nested = join3(pkgDir, "node_modules");
       if (existsSync(nested))
         walk(nested, depth + 1, dependencyPath);
     }
   }
-  walk(join2(projectDir, "node_modules"), 1, [rootName]);
+  walk(join3(projectDir, "node_modules"), 1, [rootName]);
   return out;
 }
 async function probePublicNpmRegistry(packageName, opts = {}) {
@@ -951,211 +1206,38 @@ async function probePublicNpmRegistry(packageName, opts = {}) {
 }
 
 // packages/core/dist/path-resolution.js
-import { statSync as statSync2 } from "node:fs";
+import { statSync as statSync3 } from "node:fs";
 import { homedir } from "node:os";
-import { isAbsolute, resolve } from "node:path";
+import { isAbsolute as isAbsolute2, resolve as resolve2 } from "node:path";
 function expandHomePath(input, homeDir = homedir()) {
   if (input === "~")
     return homeDir;
   if (input.startsWith("~/"))
-    return resolve(homeDir, input.slice(2));
+    return resolve2(homeDir, input.slice(2));
   return input;
 }
 function resolveLocalTargetPath(input, opts = {}) {
   const expanded = expandHomePath(input, opts.homeDir);
-  if (isAbsolute(expanded))
-    return resolve(expanded);
-  return resolve(opts.cwd ?? process.cwd(), expanded);
+  if (isAbsolute2(expanded))
+    return resolve2(expanded);
+  return resolve2(opts.cwd ?? process.cwd(), expanded);
 }
 function isExplicitLocalTargetPath(input) {
-  return input === "." || input === ".." || input === "~" || input.startsWith("./") || input.startsWith("../") || input.startsWith("~/") || isAbsolute(input);
+  return input === "." || input === ".." || input === "~" || input.startsWith("./") || input.startsWith("../") || input.startsWith("~/") || isAbsolute2(input);
 }
 function isExistingLocalTargetPath(input, opts = {}) {
   try {
-    return statSync2(resolveLocalTargetPath(input, opts)).isDirectory();
+    return statSync3(resolveLocalTargetPath(input, opts)).isDirectory();
   } catch {
     return false;
   }
 }
 
-// packages/core/dist/prepare.js
-function detectTargetType(target) {
-  if (target.startsWith("git@") || target.startsWith("git://") || target.endsWith(".git") || target.startsWith("https://github.com/")) {
-    return "source-code";
-  }
-  if (target.startsWith("http://") || target.startsWith("https://")) {
-    return "url";
-  }
-  if (isExplicitLocalTargetPath(target) || isExistingLocalTargetPath(target)) {
-    return "source-code";
-  }
-  if (/^(@[a-z0-9-]+\/)?[a-z0-9][a-z0-9._-]*(@.*)?$/.test(target)) {
-    return "npm-package";
-  }
-  return "source-code";
-}
-function installPackage(ecosystem, packageName, requestedVersion, emit) {
-  return installPackageForEcosystem(ecosystem, packageName, requestedVersion, emit);
-}
-function resolveRepo(repo, emit) {
-  const isUrl = repo.startsWith("https://") || repo.startsWith("http://") || repo.startsWith("git@") || repo.startsWith("git://");
-  if (!isUrl) {
-    const absPath = resolveLocalTargetPath(repo);
-    if (!existsSync2(absPath)) {
-      throw new Error(`Repository path not found: ${absPath}`);
-    }
-    return { repoPath: absPath, cloned: false };
-  }
-  const tempDir = join3(tmpdir2(), `0-review-${randomUUID2().slice(0, 8)}`);
-  mkdirSync3(tempDir, { recursive: true });
-  emit({
-    type: "stage:start",
-    stage: "discovery",
-    message: `Cloning ${repo}...`
-  });
-  try {
-    execFileSync2("git", ["clone", "--depth", "1", repo, `${tempDir}/repo`], {
-      timeout: 12e4,
-      stdio: "pipe"
-    });
-  } catch (err) {
-    rmSync2(tempDir, { recursive: true, force: true });
-    const msg = err instanceof Error ? err.message : String(err);
-    throw new Error(`Failed to clone ${repo}: ${msg}`);
-  }
-  const repoPath = join3(tempDir, "repo");
-  emit({
-    type: "stage:end",
-    stage: "discovery",
-    message: `Cloned ${basename(repo.replace(/\.git$/, ""))}`
-  });
-  return { repoPath, cloned: true, tempDir };
-}
-async function validateUrl(url) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 1e4);
-  try {
-    const res = await fetch(url, {
-      method: "HEAD",
-      signal: controller.signal,
-      redirect: "follow"
-    });
-    if (!res.ok) {
-      throw new Error(`URL returned HTTP ${res.status}: ${url}`);
-    }
-  } catch (err) {
-    if (err instanceof Error && err.name === "AbortError") {
-      throw new Error(`URL unreachable (timeout): ${url}`);
-    }
-    throw err;
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function prepare(target, type, opts, emit) {
-  switch (type) {
-    case "npm-package": {
-      let packageName = target;
-      let version = opts.packageVersion;
-      const atIdx = target.startsWith("@") ? target.indexOf("@", 1) : target.indexOf("@");
-      if (atIdx > 0) {
-        packageName = target.slice(0, atIdx);
-        version = version ?? target.slice(atIdx + 1);
-      }
-      const pkg = installPackage("npm", packageName, version, emit);
-      return {
-        targetType: type,
-        resolvedTarget: pkg.path,
-        packageInfo: pkg,
-        cleanup: () => {
-          try {
-            rmSync2(pkg.tempDir, { recursive: true, force: true });
-          } catch {
-          }
-        }
-      };
-    }
-    case "pypi-package": {
-      const pkg = installPackage("pypi", target, opts.packageVersion, emit);
-      return {
-        targetType: type,
-        resolvedTarget: pkg.path,
-        packageInfo: pkg,
-        cleanup: () => {
-          try {
-            rmSync2(pkg.tempDir, { recursive: true, force: true });
-          } catch {
-          }
-        }
-      };
-    }
-    case "cargo-package": {
-      const pkg = installPackage("cargo", target, opts.packageVersion, emit);
-      return {
-        targetType: type,
-        resolvedTarget: pkg.path,
-        packageInfo: pkg,
-        cleanup: () => {
-          try {
-            rmSync2(pkg.tempDir, { recursive: true, force: true });
-          } catch {
-          }
-        }
-      };
-    }
-    case "oci-image": {
-      const pkg = installPackage("oci", target, opts.packageVersion, emit);
-      return {
-        targetType: type,
-        resolvedTarget: pkg.path,
-        packageInfo: pkg,
-        cleanup: () => {
-          try {
-            rmSync2(pkg.tempDir, { recursive: true, force: true });
-          } catch {
-          }
-        }
-      };
-    }
-    case "source-code": {
-      const { repoPath, cloned, tempDir } = resolveRepo(target, emit);
-      return {
-        targetType: type,
-        resolvedTarget: repoPath,
-        repoPath,
-        cleanup: () => {
-          if (cloned && tempDir) {
-            try {
-              rmSync2(tempDir, { recursive: true, force: true });
-            } catch {
-            }
-          }
-        }
-      };
-    }
-    case "url":
-    case "web-app": {
-      await validateUrl(target);
-      emit({
-        type: "stage:end",
-        stage: "discovery",
-        message: `URL reachable: ${target}`
-      });
-      return {
-        targetType: type,
-        resolvedTarget: target,
-        cleanup: () => {
-        }
-      };
-    }
-    default: {
-      const _exhaustive = type;
-      throw new Error(`Unknown target type: ${_exhaustive}`);
-    }
-  }
-}
-
 export {
+  CLI_RUNTIME_TYPES,
+  selectedStaticScanner,
+  runFoxguardScan,
+  runSelectedStaticScan,
   normalizeSeverity,
   installPackageForEcosystem,
   runDependencyAuditForEcosystem,
@@ -1164,7 +1246,5 @@ export {
   expandHomePath,
   resolveLocalTargetPath,
   isExplicitLocalTargetPath,
-  isExistingLocalTargetPath,
-  detectTargetType,
-  prepare
+  isExistingLocalTargetPath
 };