0sec-cli 0.25.0 → 0.26.0

package/chunks/{chunk-HDJSHLRM.js → chunk-SSPP64FF.js}

@@ -3,14 +3,14 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   eventBus
-} from "./chunk-MY44EZKD.js";
+} from "./chunk-ULRLUXSS.js";
 import {
   compareFindingsByBusinessPriority,
   estimateCost,
   modelProvider,
   splitCost,
   validateScanPlan
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/agent/cost-ledger.js
 var recordedResults = /* @__PURE__ */ new WeakMap();

package/chunks/{chunk-WK6VUCKK.js → chunk-STPHTPSD.js}

@@ -4,7 +4,7 @@ const require = __0CreateRequire(import.meta.url);
 import {
   RateLimiter,
   parseRateLimitFlag
-} from "./chunk-OFPF26WL.js";
+} from "./chunk-6SNOKNCS.js";
 
 // packages/core/dist/stages/web.js
 import { randomUUID } from "node:crypto";

package/chunks/{chunk-SEWZ76MN.js → chunk-UGCTPKJG.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   resolveOsecDbPath
-} from "./chunk-YXTV2FRE.js";
+} from "./chunk-72PU46MS.js";
 import {
   BACKEND_PROTOCOL_VERSION,
   BackendDescriptorSchema,
@@ -12,7 +12,7 @@ import {
   backendCapabilitiesForApiPath,
   homeStateDir,
   parseBackendHandshake
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -46,6 +46,9 @@ function resolveWorkerRepoRoot(moduleUrl = import.meta.url) {
     directory = parent;
   }
 }
+function resolveWorkerDemoRoot(repoRoot, bundleRoot) {
+  return existsSync(join(bundleRoot, "dist/worker-assets/demo-target")) ? join(bundleRoot, "dist/worker-assets") : join(repoRoot, "assets/worker-demo");
+}
 function validateWorkerOptions(options) {
   if (options.enginePort !== void 0 && (!Number.isInteger(options.enginePort) || options.enginePort < 1 || options.enginePort > 65535)) throw new Error("enginePort must be 1-65535");
   if (options.ssh && (!SSH_HOST_PATTERN.test(options.ssh) || options.ssh.startsWith("-"))) {
@@ -116,7 +119,7 @@ async function deployWorker(options, runner = createRunner(options)) {
       }
     }
     execFileSync("tar", ["-czf", join(staging, "bundle.tar.gz"), "-C", bundleRoot, "dist"], { stdio: "inherit", env: { ...process.env, COPYFILE_DISABLE: "1" } });
-    const demoRoot = existsSync(join(bundleRoot, "dist/worker-assets/demo-target")) ? join(bundleRoot, "dist/worker-assets") : join(repoRoot, "research/counterexample-decoder");
+    const demoRoot = resolveWorkerDemoRoot(repoRoot, bundleRoot);
     if (!options.targetGit) execFileSync("tar", ["-czf", join(staging, "demo-target.tar.gz"), "-C", demoRoot, "demo-target"], { stdio: "inherit", env: { ...process.env, COPYFILE_DISABLE: "1" } });
     shell(`for entry in /proc/[0-9]*/cwd; do
     test "$(readlink "$entry" 2>/dev/null)" = "${REMOTE_DIR}" || continue
@@ -425,6 +428,9 @@ var BackendConnectionRegistry = class {
   #descriptors = /* @__PURE__ */ new Map();
   #pins = /* @__PURE__ */ new Map();
   #handshakes = /* @__PURE__ */ new Map();
+  // Bind the safe classification to the exact returned view, so concurrent
+  // reprobes cannot replace another caller's failure. No cause crosses the API.
+  #disconnectedStatuses = /* @__PURE__ */ new WeakMap();
   #pending = /* @__PURE__ */ new Map();
   #env;
   #fetch;
@@ -529,7 +535,7 @@ var BackendConnectionRegistry = class {
     delete descriptor.error;
     try {
       const response = await this.#send(row, "/api/backend/handshake", {});
-      if (!response.ok) throw new BackendConnectionError("Backend handshake was rejected.", response.status === 401 || response.status === 403 ? 403 : 502);
+      if (!response.ok) throw new BackendConnectionError("Backend handshake was rejected.", response.status);
       const raw = BackendHandshakeSchema.parse(await response.json());
       descriptor.protocolVersion = raw.protocolVersion;
       if (raw.protocolVersion !== BACKEND_PROTOCOL_VERSION) {
@@ -549,7 +555,9 @@ var BackendConnectionRegistry = class {
       if (descriptor.status !== "incompatible") descriptor.status = "disconnected";
       descriptor.error = error instanceof BackendConnectionError ? error.message : "Backend connection failed.";
       this.#handshakes.delete(id);
-      return { backend: structuredClone(descriptor), error: descriptor.error };
+      const backend = structuredClone(descriptor);
+      this.#disconnectedStatuses.set(backend, error instanceof BackendConnectionError ? error.statusCode : 502);
+      return { backend, error: descriptor.error };
     }
   }
   async request(id, path, options = {}) {
@@ -559,7 +567,7 @@ var BackendConnectionRegistry = class {
     const canonical = apiPath(path);
     const cached = this.#handshakes.get(id);
     const view = cached && Date.now() - cached.at < 5e3 ? { backend: this.#descriptors.get(id) } : await this.handshake(id);
-    if (view.backend.status !== "connected") throw new BackendConnectionError(view.backend.error ?? "Backend is disconnected.", view.backend.status === "incompatible" ? 409 : 503);
+    if (view.backend.status !== "connected") throw new BackendConnectionError(view.backend.error ?? "Backend is disconnected.", this.#disconnectedStatuses.get(view.backend) ?? (view.backend.status === "incompatible" ? 409 : 503));
     for (const required of capabilities(canonical)) if (!view.backend.capabilities.includes(required)) throw new BackendConnectionError(`Backend does not support ${required}.`, 409);
     try {
       return await this.#send(row, canonical, options);

package/chunks/{chunk-MY44EZKD.js → chunk-ULRLUXSS.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   createPresentationEvent
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 
 // packages/core/dist/events/bus.js
 function presentationEventSink(sink, options = {}) {

package/chunks/{chunk-BWUW6ZQR.js → chunk-UQS7XCBV.js}

@@ -5,10 +5,10 @@ import {
   formatAuditReport,
   formatReport,
   formatReviewReport
-} from "./chunk-C6ZMPXN2.js";
+} from "./chunk-FBZBJYZS.js";
 import {
   executeManagedOperation
-} from "./chunk-JCRQV4FE.js";
+} from "./chunk-MOEVVXML.js";
 import {
   deleteSession,
   isValidSessionId,
@@ -18,7 +18,7 @@ import {
   sessionsDir,
   setSessionArchived,
   storedSessionMetadata
-} from "./chunk-ZWAWZU6C.js";
+} from "./chunk-YJGPPPUB.js";
 import {
   applyWebConsoleRuntimeSelection,
   createWebConsoleRuntime,
@@ -28,21 +28,21 @@ import {
   reloadWebConsoleRuntimeConnection,
   sanitizeComposerText,
   savedWebRuntimeSelection
-} from "./chunk-EQBC2ZWL.js";
+} from "./chunk-ZPVSDB63.js";
 import {
   checkRuntimeAvailability
-} from "./chunk-ITHDAIRY.js";
+} from "./chunk-MNK373HF.js";
 import {
   consoleExecutionProfile,
   createIsolatedConsoleSession,
   loadServicePluginConnections
-} from "./chunk-7TIWL6E5.js";
+} from "./chunk-KCABBZHN.js";
 import {
   resolveEngagement
-} from "./chunk-NO543ZBU.js";
+} from "./chunk-A7G6S5RA.js";
 import {
   getSettings
-} from "./chunk-RBTJYREN.js";
+} from "./chunk-OILVEROI.js";
 import {
   source_default
 } from "./chunk-HLFS6WV2.js";
@@ -71,10 +71,10 @@ import {
   runReproductionBundle,
   runResearch,
   toToolContextJevRuntime
-} from "./chunk-EEP6GBUO.js";
+} from "./chunk-3MWQNNJU.js";
 import {
   generatePdfReport
-} from "./chunk-AL32F74R.js";
+} from "./chunk-YP2DHYNI.js";
 import {
   DockerRunner,
   HuntMemoryStore,
@@ -90,13 +90,13 @@ import {
   sendOperatorMessage,
   withWorkflowAuditExecutionPolicy,
   workflowPolicyRuntime
-} from "./chunk-HFUOUT2B.js";
+} from "./chunk-SIR7XW2S.js";
 import {
   oracleForCategory
 } from "./chunk-PAE7ZAV6.js";
 import {
   budgetNativeRuntime
-} from "./chunk-HDJSHLRM.js";
+} from "./chunk-SSPP64FF.js";
 import {
   applySourceFixCandidate,
   loadSourceFixProjectInputs,
@@ -106,7 +106,7 @@ import {
   runSourceFix,
   saveSourceFixProjectInputs,
   verifySourceFixCandidate
-} from "./chunk-ITEMDJAB.js";
+} from "./chunk-AFJ2UMPR.js";
 import {
   LearningStoreError,
   SecurityWorkflowStore,
@@ -115,32 +115,33 @@ import {
   listOsecRunDatabasePaths,
   osecDB,
   resolveOsecDbPath
-} from "./chunk-YXTV2FRE.js";
+} from "./chunk-72PU46MS.js";
 import {
   evidenceKindForFinding,
   executePocSteps
 } from "./chunk-XPDJE537.js";
 import {
-  LlmApiRuntime
-} from "./chunk-EIONVEFN.js";
+  LlmApiRuntime,
+  features
+} from "./chunk-HS2NQ7K6.js";
 import {
   WORKBENCH_BROKER_WORKSPACE,
   isAdmittedSmolvmWorkbench,
   runWorkbenchBrokerProgram
-} from "./chunk-3T5R7P4T.js";
+} from "./chunk-XOVYV7TT.js";
 import {
   eventBus
-} from "./chunk-MY44EZKD.js";
+} from "./chunk-ULRLUXSS.js";
 import {
   redactSensitiveHeaders
-} from "./chunk-RFK5F45W.js";
+} from "./chunk-VJBEB2K6.js";
 import {
   ScopePolicy,
   getScopeEnforcementState,
   loadScope,
   normalizeScopeHostname,
   withScopeEnforcement
-} from "./chunk-27SXCYWH.js";
+} from "./chunk-RZZ6VPRY.js";
 import {
   sanitizedEnv
 } from "./chunk-5IBCBQEH.js";
@@ -166,7 +167,7 @@ import {
   resolvePersistedScanResume,
   severityRank,
   validateScanPlan
-} from "./chunk-S3B6HFSM.js";
+} from "./chunk-GYEYTNHK.js";
 import {
   external_exports
 } from "./chunk-5XOYTAOK.js";
@@ -226,7 +227,7 @@ async function loadCoreModule() {
   if (!coreModulePromise) {
     const srcUrl = new URL("../../../core/src/index.ts", import.meta.url);
     const srcExists = process.versions.bun && existsSync(fileURLToPath(srcUrl));
-    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-6RNAVFAY.js");
+    coreModulePromise = srcExists ? import(srcUrl.href) : import("./dist-ONIRKDH6.js");
   }
   return coreModulePromise;
 }
@@ -317,12 +318,13 @@ function printCrossValidatedLeads(summary) {
   }
 }
 function attachedAssessmentTarget(opts) {
-  const accepted = /* @__PURE__ */ new Set(["target", "targetType", "depth", "format", "runtime", "timeout", "verbose", "plan", "signal", "suppressOutput", "suppressUi", "dbPath", "reportPath", "onEvent", "onReport", "onOutcome", "sessionUiFactory", "costCeilingUsd", "embedded", "mode", "reviewStrategy"]);
+  const accepted = /* @__PURE__ */ new Set(["target", "targetType", "depth", "format", "runtime", "timeout", "verbose", "plan", "signal", "suppressOutput", "suppressUi", "dbPath", "reportPath", "onEvent", "onReport", "onOutcome", "sessionUiFactory", "costCeilingUsd", "embedded", "mode", "reviewStrategy", "reviewProfile"]);
   const inactiveFalse = /* @__PURE__ */ new Set(["changedOnly", "race", "egats", "allowScanners", "seedOnly", "npmDynamicDiscovery", "emitPrDryRun"]);
   const unsupported = Object.entries(opts).filter(([key, value]) => value !== void 0 && !accepted.has(key) && (value !== false || !inactiveFalse.has(key))).map(([key]) => key);
   if (opts.runtime !== "api" && opts.runtime !== "auto") unsupported.push("runtime");
   if (opts.mode !== void 0 && opts.mode !== "web") unsupported.push("mode");
   if (opts.reviewStrategy !== void 0 && opts.reviewStrategy !== "lenses") unsupported.push("reviewStrategy");
+  if (opts.reviewProfile !== void 0 && opts.reviewProfile !== "default") unsupported.push("reviewProfile");
   if (unsupported.length) throw new Error(`The running engine cannot represent these assessment overrides: ${[...new Set(unsupported)].join(", ")}. Configure or select an engine that supports them; no separate assessment was started.`);
   const prefix = { "npm-package": "npm:", "pypi-package": "pypi:", "cargo-package": "cargo:", "oci-image": "oci:", "source-code": "source:" }[opts.targetType ?? ""];
   if (prefix === "source:" || opts.target.startsWith("source:")) {
@@ -392,7 +394,7 @@ async function runUnified(opts) {
   if (opts.plan) validateScanPlan(opts.plan);
   const { target, format, runtime, timeout } = opts;
   const depth = opts.plan?.depth ?? opts.depth;
-  const attachedEngine = !opts.embedded && !opts.resumeScanId ? await (await import("./local-engine-WP3I7K7G.js")).connectLocalEngine({ dbPath: opts.dbPath, workspace: process.cwd(), model: opts.model, scopePath: opts.scopeFile }) : null;
+  const attachedEngine = !opts.embedded && !opts.resumeScanId ? await (await import("./local-engine-ZRTZVSSX.js")).connectLocalEngine({ dbPath: opts.dbPath, workspace: process.cwd(), model: opts.model, scopePath: opts.scopeFile }) : null;
   if (attachedEngine) {
     try {
       opts.signal?.throwIfAborted();
@@ -416,7 +418,7 @@ async function runUnified(opts) {
       if (opts.embedded) throw new Error("--branch-from requires --resume <run-id>");
       process.exit(2);
     }
-    const { branchJournal } = await import("./dist-6RNAVFAY.js");
+    const { branchJournal } = await import("./dist-ONIRKDH6.js");
     const result = branchJournal({
       runId: effectiveResumeScanId,
       fromEntry: opts.branchFromEntry
@@ -475,7 +477,7 @@ async function runUnified(opts) {
     if (opts.sessionUiFactory) {
       inkUI = await opts.sessionUiFactory({ target, depth, mode: mode2 });
     } else {
-      const { renderScanStream } = await import("./scan-stream-6VOJTHTR.js");
+      const { renderScanStream } = await import("./scan-stream-HJVTWZ44.js");
       inkUI = renderScanStream({ version: VERSION, target, depth, mode: mode2 });
     }
     eventHandler = (event) => {
@@ -502,7 +504,7 @@ async function runUnified(opts) {
       reviewStrategy: _reviewStrategy,
       ...assessmentOptions
     } = opts;
-    const retainedStore = opts.embedded || attachedEngine ? void 0 : new (await import("./dist-OLGNKDB2.js")).SecurityWorkflowStore(opts.dbPath);
+    const retainedStore = opts.embedded || attachedEngine ? void 0 : new (await import("./dist-QLMPTFT7.js")).SecurityWorkflowStore(opts.dbPath);
     const scanIds = [];
     const dbPaths = [];
     let assessment;
@@ -998,7 +1000,7 @@ async function readConversationCatalog(options = {}) {
   const files = await Promise.all(candidates.slice(0, MAX_FILES).map(async (entry) => {
     try {
       const info = await stat(join3(dir, entry.name));
-      return { name: entry.name, size: info.size, modified: info.mtimeMs };
+      return { name: entry.name, modified: info.mtimeMs };
     } catch {
       return null;
     }
@@ -1006,27 +1008,23 @@ async function readConversationCatalog(options = {}) {
   const ordered = files.filter((file) => file !== null).sort((a, b) => b.modified - a.modified || a.name.localeCompare(b.name));
   let bytes = 0;
   for (const file of ordered) {
-    if (file.size > MAX_FILE_BYTES || bytes + file.size > MAX_READ_BYTES) {
-      truncated = true;
-      continue;
-    }
-    bytes += file.size;
     let handle;
     try {
       handle = await open(join3(dir, file.name), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
       const info = await handle.stat();
-      if (!info.isFile() || info.size > file.size) {
+      if (!info.isFile() || info.size > MAX_FILE_BYTES || bytes + info.size > MAX_READ_BYTES) {
         truncated = true;
         continue;
       }
-      const buffer = Buffer.alloc(file.size + 1);
+      bytes += info.size;
+      const buffer = Buffer.alloc(info.size + 1);
       let bytesRead = 0;
       while (bytesRead < buffer.length) {
         const chunk = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
         if (!chunk.bytesRead) break;
         bytesRead += chunk.bytesRead;
       }
-      if (bytesRead > file.size) {
+      if (bytesRead > info.size) {
         truncated = true;
         continue;
       }
@@ -1172,7 +1170,7 @@ function assertSessionContract(session) {
   if (!session || typeof session !== "object" || !session.ready || typeof session.ready.then !== "function") {
     throw new Error("Built engine does not implement asynchronous session readiness");
   }
-  for (const method of ["send", "cleanup", "exportCheckpoint", "prepareHandoff", "setAutonomyMode", "configureEngagement", "configureWorkspace", "clearConversation", "stopPersistentAgent", "stopPersistentAgents"]) {
+  for (const method of ["send", "cleanup", "exportCheckpoint", "prepareHandoff", "configureEngagement", "configureWorkspace", "clearConversation", "stopPersistentAgent", "stopPersistentAgents"]) {
     if (typeof session[method] !== "function") throw new Error(`Built engine omitted ${method}`);
   }
 }
@@ -1400,10 +1398,6 @@ function withDevEngineUpdates(initial, config, closeStore) {
     get(_target, key) {
       if (key === "send") return send;
       if (key === "cleanup") return cleanup;
-      if (key === "setAutonomyMode") return (mode2) => {
-        current.setAutonomyMode(mode2);
-        handoffCandidate?.setAutonomyMode(mode2);
-      };
       if (key === "configureWorkspace") return (path) => {
         current.configureWorkspace(path);
       };
@@ -1433,10 +1427,10 @@ var CONSOLE_JEV_FEATURES = /* @__PURE__ */ new Set([
   "foxguard"
 ]);
 function consoleJevRuntimeFromEnvironment() {
-  const features = [...new Set(
+  const features2 = [...new Set(
     (process.env["ZERO_JEV_FEATURES"] ?? "").split(",").map((feature) => feature.trim()).filter((feature) => CONSOLE_JEV_FEATURES.has(feature))
   )];
-  return toToolContextJevRuntime(createConsoleJevRuntime({ provider: "direct", features }));
+  return toToolContextJevRuntime(createConsoleJevRuntime({ provider: "direct", features: features2 }));
 }
 function createLocalConsoleSession(config, dbPath, options = {}) {
   config = { ...config, codebaseLearning: config.codebaseLearning ?? true };
@@ -1802,8 +1796,9 @@ function scopePolicy(value) {
 }
 function configuration(value) {
   const raw = object(value, "Configuration");
-  allowedKeys(raw, ["title", "target", "autonomyMode", "scope", "runtime", "workspacePath", "modelSource"]);
+  allowedKeys(raw, ["title", "target", "autonomyMode", "scope", "runtime", "workspacePath", "modelSource", "webSearchEnabled"]);
   const result = {};
+  if (raw.webSearchEnabled !== void 0) result.webSearchEnabled = external_exports.boolean().parse(raw.webSearchEnabled);
   if (raw.modelSource !== void 0) result.modelSource = external_exports.object({ kind: external_exports.literal("local"), grantId: external_exports.string().uuid() }).strict().parse(raw.modelSource);
   if (raw.workspacePath !== void 0) result.workspacePath = text(raw.workspacePath, "Workspace folder", MAX_TARGET_LENGTH);
   if (raw.title !== void 0) result.title = text(raw.title, "Title", 200);
@@ -1996,7 +1991,7 @@ var ConsoleGateway = class {
   }
   #createRecord(value) {
     const raw = object(value, "Session");
-    allowedKeys(raw, ["target", "role", "autonomyMode", "title", "scope", "runtime", "findingId", "findingIntent", "modelSource", "workflowId", "skillId"]);
+    allowedKeys(raw, ["target", "role", "autonomyMode", "title", "scope", "runtime", "findingId", "findingIntent", "modelSource", "workflowId", "skillId", "webSearchEnabled"]);
     const id = this.#createId();
     if (!isValidSessionId(id) || this.#sessions.has(id)) throw new ConsoleGatewayError("Generated session ID is invalid or already in use.", 500);
     const now = this.#now().toISOString();
@@ -2046,6 +2041,7 @@ var ConsoleGateway = class {
       createdAt: now,
       updatedAt: now,
       target: raw.target === void 0 ? "" : text(raw.target, "Target", MAX_TARGET_LENGTH, true),
+      webSearchEnabled: raw.webSearchEnabled === void 0 ? features.webSearch : external_exports.boolean().parse(raw.webSearchEnabled),
       role: raw.role === void 0 ? "audit" : role(raw.role),
       autonomyMode: raw.autonomyMode === void 0 ? DEFAULT_AUTONOMY_MODE : mode(raw.autonomyMode),
       title: raw.title === void 0 ? "New chat" : text(raw.title, "Title", 200),
@@ -2275,6 +2271,11 @@ var ConsoleGateway = class {
   async configure(id, value) {
     const managed = this.#requireOpen(id);
     const input = configuration(value);
+    if (input.webSearchEnabled !== void 0) {
+      this.#assertIdle(managed);
+      if ([...managed.workers.values()].some((worker) => Object.hasOwn(ACTIVE_WORKERS, worker.status))) throw new ConsoleGatewayError("Finish active agents before changing web search.", 409);
+      if (managed.session && !managed.session.setWebSearchEnabled) throw new ConsoleGatewayError("This engine does not support changing web search. Start a new chat with the setting selected.", 409);
+    }
     if (input.modelSource) {
       this.#assertIdle(managed);
       if (!this.#options.remoteProviderRelays) throw new ConsoleGatewayError("This host does not support a local model relay.", 409);
@@ -2347,7 +2348,7 @@ var ConsoleGateway = class {
       const hadRuntime = managed.runtime !== null;
       await this.#ensureSession(managed);
       if (hadRuntime && managed.runtime) {
-        managed.info = managed.modelRelayId ? { ...describeWebConsoleRuntime(managed.runtime), modelSource: "local" } : await reloadWebConsoleRuntimeConnection(managed.runtime);
+        managed.info = managed.modelRelayId ? { ...describeWebConsoleRuntime(managed.runtime), modelSource: "local" } : await reloadWebConsoleRuntimeConnection(managed.runtime, { allowChatGptPlan: this.#options.allowChatGptPlan !== false });
         managed.session?.reconfigureRuntime({ contextWindowTokens: managed.info.contextWindowTokens });
       }
       if (managed.status !== "closed") managed.status = "ready";
@@ -2432,7 +2433,7 @@ var ConsoleGateway = class {
   async resume(id, value = {}) {
     const stored = this.#stored(id);
     const raw = object(value, "Resume configuration");
-    allowedKeys(raw, ["title", "role", "runtime", "autonomyMode", "target", "scope"]);
+    allowedKeys(raw, ["title", "role", "runtime", "autonomyMode", "target", "scope", "webSearchEnabled"]);
     if (raw.title !== void 0) text(raw.title, "Title", 200);
     if (raw.target !== void 0) text(raw.target, "Target", MAX_TARGET_LENGTH, true);
     if (raw.role !== void 0) role(raw.role);
@@ -2453,6 +2454,7 @@ var ConsoleGateway = class {
     const defaults2 = {
       autonomyMode: "standard",
       target: configuration2?.target ?? stored.target ?? "",
+      ...configuration2?.webSearchEnabled !== void 0 ? { webSearchEnabled: configuration2.webSearchEnabled } : {},
       ...configuration2?.workflowId ? { workflowId: configuration2.workflowId } : {},
       ...configuration2?.skillId ? { skillId: configuration2.skillId } : {},
       ...configuration2 ? { role: configuration2.role, runtime: configuration2.runtime } : stored.model ? { runtime: { model: stored.model } } : {}
@@ -2462,6 +2464,7 @@ var ConsoleGateway = class {
     managed.initialMessages = initialMessages;
     managed.workspacePath = stored.cwd;
     managed.savedId = id;
+    managed.resumePending = true;
     managed.title = raw.title === void 0 ? stored.summary ?? stored.preview ?? "Resumed chat" : managed.title;
     if (configuration2?.modelSource === "local") {
       managed.requiresModelRelay = true;
@@ -2760,10 +2763,10 @@ var ConsoleGateway = class {
         const skillDiscoveryOptions = this.#options.skillDiscoveryOptions ? () => this.#options.skillDiscoveryOptions(managed.workspacePath ?? this.#projectPath ?? process.cwd()) : void 0;
         if (managed.modelRelayId && consoleExecutionProfile(this.#options.homeDir) === "smolvm") throw new ConsoleGatewayError("Local model relays currently require the operator-selected host execution profile on this host.", 409);
         if (this.#options.createSession) {
-          session = await this.#options.createSession({ scanId: managed.id, target: managed.target, role: managed.role, autonomyMode: managed.autonomyMode, scope: managed.scope, skillDiscoveryOptions, skillAuthoring, skillEditor, workspaceRoot: managed.workspacePath ?? this.#projectPath, initialMessages: managed.initialMessages, codebaseLearning: true, ...this.#sourceLearningStore ? { learningStore: this.#sourceLearningStore } : {}, ...this.#workflowLifecycle ? { workflowLifecycle: this.#workflowCallbacks(managed) } : {}, ...callbacks });
+          session = await this.#options.createSession({ scanId: managed.id, target: managed.target, role: managed.role, autonomyMode: managed.autonomyMode, webSearchEnabled: managed.webSearchEnabled, scope: managed.scope, skillDiscoveryOptions, skillAuthoring, skillEditor, workspaceRoot: managed.workspacePath ?? this.#projectPath, initialMessages: managed.initialMessages, codebaseLearning: true, ...this.#sourceLearningStore ? { learningStore: this.#sourceLearningStore } : {}, ...this.#workflowLifecycle ? { workflowLifecycle: this.#workflowCallbacks(managed) } : {}, ...callbacks });
         } else if (consoleExecutionProfile(this.#options.homeDir) === "smolvm") {
           if (!managed.runtime) {
-            const created = await createWebConsoleRuntime(managed.selection);
+            const created = await createWebConsoleRuntime(managed.selection, { allowChatGptPlan: this.#options.allowChatGptPlan !== false });
             managed.runtime = created.runtime;
             managed.info = created.info;
           }
@@ -2775,6 +2778,7 @@ var ConsoleGateway = class {
             target: managed.target,
             role: managed.role,
             autonomyMode: managed.autonomyMode,
+            webSearchEnabled: managed.webSearchEnabled,
             scope: managed.scope,
             initialMessages: managed.initialMessages,
             skillDiscoveryOptions,
@@ -2801,7 +2805,7 @@ var ConsoleGateway = class {
         } else {
           managed.execution = { backend: "local", status: "ready", workspacePath: this.#projectPath };
           if (!managed.runtime) {
-            const created = await createWebConsoleRuntime(managed.selection);
+            const created = await createWebConsoleRuntime(managed.selection, { allowChatGptPlan: this.#options.allowChatGptPlan !== false });
             managed.runtime = created.runtime;
             managed.info = created.info;
           }
@@ -2820,6 +2824,7 @@ var ConsoleGateway = class {
               target: managed.target,
               role: managed.role,
               autonomyMode: managed.autonomyMode,
+              webSearchEnabled: managed.webSearchEnabled,
               scope: managed.scope,
               initialMessages: managed.initialMessages,
               codebaseLearning: true,
@@ -2855,6 +2860,7 @@ var ConsoleGateway = class {
           throw new ConsoleGatewayError("Console session is closed.", 410);
         }
         managed.session = session;
+        managed.resumePending = false;
         if (managed.status === "failed") managed.status = "ready";
         managed.initialMessages = [];
         return session;
@@ -3004,14 +3010,17 @@ var ConsoleGateway = class {
           onUsage: (usage) => {
             managed.usage.inputTokens += usage.inputTokens;
             managed.usage.outputTokens += usage.outputTokens;
-            const model = managed.runtime?.resolvedModel() ?? managed.info?.model;
-            if (model && Object.hasOwn(MODEL_PRICING, model)) {
-              if (managed.usage.inputTokens === usage.inputTokens && managed.usage.outputTokens === usage.outputTokens) managed.usage.costUnavailable = false;
+            const model = usage.kind === "worker" ? usage.model : usage.model ?? managed.runtime?.resolvedModel() ?? managed.info?.model;
+            if (!usage.usageUnavailable && model && Object.hasOwn(MODEL_PRICING, model)) {
+              if (managed.usage.costUsd === void 0 && managed.usage.inputTokens === usage.inputTokens && managed.usage.outputTokens === usage.outputTokens) managed.usage.costUnavailable = false;
               managed.usage.costUsd = (managed.usage.costUsd ?? 0) + estimateCost(usage, model);
               managed.usage.costKind = "estimated";
-            } else managed.usage.costUnavailable = true;
+            } else {
+              managed.usage.costUnavailable = true;
+              managed.usage.costUsd ??= 0;
+            }
             if (usage.kind === "planner") managed.contextInputTokens = usage.inputTokens;
-            this.#emit(managed, { type: "usage", usage: { ...usage, turnTokenBudget: Number.isFinite(usage.turnTokenBudget) ? usage.turnTokenBudget : null } });
+            this.#emit(managed, { type: "usage", usage: { ...usage, turnTokenBudget: Number.isFinite(usage.turnTokenBudget) ? usage.turnTokenBudget : null, maxToolIterations: Number.isFinite(usage.maxToolIterations) ? usage.maxToolIterations : null } });
           },
           onNotice: (text3) => this.#emit(managed, { type: "notice", text: text3 }),
           onCompaction: (event) => {
@@ -3247,7 +3256,7 @@ var ConsoleGateway = class {
     }
   }
   #outcome(outcome) {
-    return { assistantText: outcome.assistantText, stopReason: outcome.stopReason, budget: { ...outcome.budget, tokenBudget: Number.isFinite(outcome.budget.tokenBudget) ? outcome.budget.tokenBudget : null }, usage: { ...outcome.usage }, ...outcome.error ? { error: outcome.error } : {}, ...outcome.contextInputTokens !== void 0 ? { contextInputTokens: outcome.contextInputTokens } : {}, ...outcome.outputCap ? { outputCap: { ...outcome.outputCap, checkpoint: json(outcome.outputCap.checkpoint) } } : {} };
+    return { assistantText: outcome.assistantText, stopReason: outcome.stopReason, budget: { ...outcome.budget, maxToolIterations: Number.isFinite(outcome.budget.maxToolIterations) ? outcome.budget.maxToolIterations : null, tokenBudget: Number.isFinite(outcome.budget.tokenBudget) ? outcome.budget.tokenBudget : null }, usage: { ...outcome.usage }, ...outcome.error ? { error: outcome.error } : {}, ...outcome.contextInputTokens !== void 0 ? { contextInputTokens: outcome.contextInputTokens } : {}, ...outcome.outputCap ? { outputCap: { ...outcome.outputCap, checkpoint: json(outcome.outputCap.checkpoint) } } : {} };
   }
   #cancelTurn(managed) {
     for (const request of managed.workflowRequests.values()) if (request.turnOwner === managed.turnOwner && request.status === "queued") {
@@ -3307,7 +3316,7 @@ var ConsoleGateway = class {
             managed.runtime.reconfigure({ model: input.runtime.model, provider: input.runtime.providerId, agentModels: input.runtime.agentModels, singleModel: input.runtime.singleModel, autoRoute: input.runtime.autoRoute });
             if (input.runtime.reasoningEffort) managed.runtime.setReasoningEffort(input.runtime.reasoningEffort);
             return { ...describeWebConsoleRuntime(managed.runtime), modelSource: "local" };
-          })() : await applyWebConsoleRuntimeSelection(managed.runtime, input.runtime);
+          })() : await applyWebConsoleRuntimeSelection(managed.runtime, input.runtime, { allowChatGptPlan: this.#options.allowChatGptPlan !== false });
           managed.info = info;
           managed.session?.reconfigureRuntime({ contextWindowTokens: info.contextWindowTokens });
           managed.selection = { ...managed.selection, ...input.runtime };
@@ -3315,6 +3324,10 @@ var ConsoleGateway = class {
       }
       if (input.target !== void 0) managed.target = input.target;
       if (input.scope !== void 0) managed.scope = input.scope === null ? void 0 : ScopePolicy.fromJson(input.scope);
+      if (input.webSearchEnabled !== void 0) {
+        await managed.session?.setWebSearchEnabled?.(input.webSearchEnabled);
+        managed.webSearchEnabled = input.webSearchEnabled;
+      }
       if (input.autonomyMode) {
         managed.autonomyMode = input.autonomyMode;
         managed.session?.setAutonomyMode(input.autonomyMode);
@@ -3440,6 +3453,7 @@ var ConsoleGateway = class {
     return stored;
   }
   #save(managed) {
+    if (managed.resumePending) return true;
     const messages = managed.session?.messages ?? managed.initialMessages;
     const id = managed.savedId ?? managed.id;
     const consoleState = {
@@ -3447,6 +3461,7 @@ var ConsoleGateway = class {
         ...managed.requiresModelRelay ? { modelSource: "local" } : {},
         target: managed.session?.target ?? managed.target,
         role: managed.role,
+        webSearchEnabled: managed.session?.webSearchEnabled ?? managed.webSearchEnabled,
         ...managed.workflowId ? { workflowId: managed.workflowId } : {},
         ...managed.skillId ? { skillId: managed.skillId } : {},
         runtime: savedWebRuntimeSelection(managed.selection, managed.info)
@@ -3478,7 +3493,7 @@ var ConsoleGateway = class {
     return { id, name: call.name, arguments: json(call.arguments) };
   }
   #summary(managed) {
-    return { id: managed.id, ...managed.workflowId ? { workflowId: managed.workflowId } : {}, ...managed.skillId ? { skillId: managed.skillId } : {}, ...managed.savedId ? { savedId: managed.savedId } : {}, target: managed.session?.target ?? managed.target, role: managed.role, autonomyMode: managed.session?.autonomyMode ?? managed.autonomyMode, scopeConfigured: Boolean(managed.session?.scope ?? managed.scope), localScopeConfigured: Boolean(managed.session?.localScopePath), status: managed.status, createdAt: managed.createdAt, updatedAt: managed.updatedAt, title: managed.title, messageCount: (managed.session?.messages ?? managed.initialMessages).length + managed.queued.length, execution: structuredClone(managed.execution), ...managed.info ? { runtime: structuredClone(managed.info) } : {}, ...managed.pendingConfiguration ? { pendingConfiguration: structuredClone(managed.pendingConfiguration) } : {} };
+    return { id: managed.id, ...managed.workflowId ? { workflowId: managed.workflowId } : {}, ...managed.skillId ? { skillId: managed.skillId } : {}, ...managed.savedId ? { savedId: managed.savedId } : {}, target: managed.session?.target ?? managed.target, role: managed.role, autonomyMode: managed.session?.autonomyMode ?? managed.autonomyMode, webSearchEnabled: managed.session?.webSearchEnabled ?? managed.webSearchEnabled, scopeConfigured: Boolean(managed.session?.scope ?? managed.scope), localScopeConfigured: Boolean(managed.session?.localScopePath), status: managed.status, createdAt: managed.createdAt, updatedAt: managed.updatedAt, title: managed.title, messageCount: (managed.session?.messages ?? managed.initialMessages).length + managed.queued.length, execution: structuredClone(managed.execution), ...managed.info ? { runtime: structuredClone(managed.info) } : {}, ...managed.pendingConfiguration ? { pendingConfiguration: structuredClone(managed.pendingConfiguration) } : {} };
   }
   #emitSession(managed) {
     this.#emit(managed, { type: "session", session: this.#summary(managed) });
@@ -3856,7 +3871,7 @@ function parseDurationMs(raw) {
   }
 }
 async function runKernelFindingVerify(opts) {
-  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-6RNAVFAY.js");
+  const { verifyStaticKernelFinding, applyVerificationToFinding } = await import("./dist-ONIRKDH6.js");
   const rawFinding = readJson(opts.findingPath, "finding");
   let finding;
   try {
@@ -4677,7 +4692,7 @@ function createResearchWorkflowExecutors(options) {
       const target = await scopedPath(options.workspace, context.target);
       const selected = options.model ?? options.runtime.resolvedModel?.();
       if (input.models?.some((model) => model !== selected)) throw new Error("Workflow deep review models must match its bound model connection.");
-      const { runDeepReview } = await import("./deep-review-Q6BJKEV4.js");
+      const { runDeepReview } = await import("./deep-review-5AL6QYTK.js");
       const result = await runDeepReview({
         ...input,
         target,