Extract content of <tag>...</tag>. DOTALL so multiline ASAN traces work. Not a real XML parser — tags are markers in prose, not well-formed XML.

Wrap ``text`` in ANSI color ``name`` if ``stream`` is a TTY. dim — low-signal progress lines (tool calls) red — a crash landed bold — v

Neutralize anything that could close an <untrusted_data> block early.

Group crashes under results_root by signature. Returns {(crash_type, top_frame): [(result_json_path, status, reason), ...]} where reason is t

Return the most-recent assistant message text containing <tag>. Agents emit structured tags, then often a short final "Done!" message.

Grade a candidate patch against a verified crash. Spins a fresh container, applies the diff, walks the ladder. Short-circuits on the first fa

crash_type + READ/WRITE operation parsed from sanitizer output. Display-only: feeds found_bugs.jsonl excerpts and dedup summary. Not a decisi

Top-N frames from the crash stack that have project source info. Walks frames in order; collects those with a file:line source location (skip

First project-source frame from the crash stack (convenience wrapper).

Mock for docker_ops.exec_sh that returns a fixed sequence of (rc,out,err).

Closing tags that do not carry the nonce id attribute.

Per-prompt random delimiter id for <untrusted_data> blocks.

Run a Claude Code agent session via headless CLI inside ``container``. Invokes ``docker exec <container> claude -p --output-format stream-json``

3 crashes on signature A, 1 on B, plus a no-crash and a rejected-on-A.

Resolve auth for the in-container `claude -p` process. Returns the env dict set on the agent container at ``docker run`` time, or None if no auth

Full system prompt: fixed pipeline preamble + engagement block. --engagement-context overrides only the engagement block; the preamble's sand

Extract plain text from a content-block list. stream-json content is list[{"type":"text","text":...} | {"type":"tool_use",...} | ...]. We onl

Return a prior run's result if it reached a terminal status. agent_failed / build_failed / error are NOT terminal — resume retries them. Tran

SUMMARY line + first N stack frames, for dedup context. ~500 bytes per excerpt — enough for a find- or judge-agent to compare signatures sema

Extract the file path from a top_frame string like `func /path/file.h:1234`.

Return prior report.json if it landed with status report_submitted AND its signature matches. agent_failed / no_report are retried. A signature

Pick the best result.json from a dedup group for the report agent. Prefer passed-grade > rejected, then highest grade score, then smallest PoC

manifest_entries: [{"bug_id", "run_idx", "asan_excerpt", "report_text" or None}, ...]

Generate and verify a patch for a crash. Returns (diff_bytes, verdict, agent_result). diff_bytes is None if the agent never emitted a readabl

run_idx values that already passed through _stream_dispatch — the idempotence key for --resume --stream replay (one judge_log line per run, in

Manifest entries with existing report text attached if it's landed.

Distinct agent-image tag per *full* target tag, so a committed ``<name>:patched-<uuid>`` snapshot doesn't collide with ``<name>:v1``.

Return the engagement-context block. Falls back to DEFAULT if path is None or the file is missing/empty.

Wrap attacker-influenced text in nonce-delimited isolation tags.

Accept either a name (looked up under ./targets/) or a direct path.

Return an error string if --runs is incompatible with the on-disk layout of a --resume dir. out_dirs is [root] when runs==1 vs [root/run_NNN] when

Seed the jsonl with config known_bugs so a mid-run `cat` is a complete view, not just peer discoveries. System-prompt attention fades at high

Judge → maybe-report. Serialized on ctx["lock"] so two simultaneous arrivals don't both claim NEW for the same root cause. Report dispatch hap

Clip large tool_result content (ASAN traces) for transcript persistence. Mutates a copy. Only touches user messages with tool_result blocks.

Run one find attempt against a target. Returns (crash_or_none, agent_result, timings). crash is None if no PoC was emitted or the claimed pat

Explore the target's source and propose a focus-area partition. Returns (focus_areas, agent_result). focus_areas is empty if the agent failed

Produce an exploitability report for a verified crash. Returns (verdict, report_text, agent_result, elapsed). verdict is None if the agent em

JSON-serializable transcript for persistence.

Return `git log <commit>..HEAD -- <crash_file>` from a cached shallow clone. Returns a status-prefixed string: either the truncated git log outpu