@pensar/apex 0.0.93 → 0.0.96-canary.2ce26987

package/build/index.js

@@ -31880,12 +31880,6 @@ var init_openrouter = __esm(() => {
 var PENSAR_MODELS;
 var init_pensar = __esm(() => {
   PENSAR_MODELS = [
-    {
-      id: "pensar:anthropic.claude-opus-4-6-v1",
-      name: "Claude Opus 4.6 (Pensar)",
-      provider: "pensar",
-      contextLength: 200000
-    },
     {
       id: "pensar:anthropic.claude-sonnet-4-5-20250929-v1:0",
       name: "Claude Sonnet 4.5 (Pensar)",
@@ -31977,7 +31971,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@pensar/apex",
-    version: "0.0.93",
+    version: "0.0.96-canary.2ce26987",
     description: "AI-powered penetration testing CLI tool with terminal UI",
     module: "src/tui/index.tsx",
     main: "build/index.js",
@@ -31997,7 +31991,7 @@ var init_package = __esm(() => {
       "LICENSE"
     ],
     scripts: {
-      build: "bun build src/tui/index.tsx --outdir build --target node --format esm --external sharp",
+      build: "bun build src/tui/index.tsx --outdir build --target node --format esm --external sharp && bun build src/cli/auth.ts --outdir build --target node --format esm",
       "generate:ascii": "bun run scripts/generate-ascii-art.ts",
       "generate:models": "bun run scripts/generate-models.ts",
       "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
@@ -37045,6 +37039,22 @@ var init_toolset = __esm(() => {
       detail: "Retrieve the full content of a saved memory by its id. Use List Memories first to discover available memory ids.",
       category: "utility",
       defaultEnabled: true
+    },
+    {
+      id: "web_search",
+      name: "Web Search",
+      description: "Search the web",
+      detail: "Search the web for real-time information about CVEs, security advisories, exploit techniques, and vulnerability details. Requires a Pensar account.",
+      category: "reconnaissance",
+      defaultEnabled: true
+    },
+    {
+      id: "get_page",
+      name: "Get Page",
+      description: "Fetch page content",
+      detail: "Fetch and extract readable content from a web page. Use after web_search to read full details from found URLs. Requires a Pensar account.",
+      category: "reconnaissance",
+      defaultEnabled: true
     }
   ];
   TOOLSETS = [
@@ -87793,6 +87803,26 @@ async function* parseSSE(stream) {
   }
 }
 
+// src/core/auth/signing.ts
+import { createHmac, createHash, randomUUID } from "crypto";
+function signGatewayRequest(signingKey, modelId, body) {
+  const timestamp = String(Math.floor(Date.now() / 1000));
+  const nonce = randomUUID();
+  const bodyHash = createHash("sha256").update(body).digest("hex");
+  const payload = `${timestamp}
+${nonce}
+${modelId}
+${bodyHash}`;
+  const signature = createHmac("sha256", signingKey).update(payload).digest("base64");
+  return { signature, timestamp, nonce };
+}
+var init_signing = () => {};
+
+// src/core/ai/providers/pensarSigning.ts
+var init_pensarSigning = __esm(() => {
+  init_signing();
+});
+
 // src/core/ai/providers/pensar.ts
 function log(...args) {
   if (DEBUG)
@@ -87911,7 +87941,17 @@ function createPensarModel(bedrockModelId, config2) {
       logInfo(`doStream → ${bedrockModelId} (${url2})`);
       log(`  messages: ${body.messages?.length ?? 0}, tools: ${body.tools?.length ?? 0}`);
       const startTime = Date.now();
+      const serializedBody = JSON.stringify({
+        modelId: bedrockModelId,
+        body
+      });
       const headers = await buildHeaders();
+      if (config2.signingKey) {
+        const sig = signGatewayRequest(config2.signingKey, bedrockModelId, serializedBody);
+        headers["X-Pensar-Signature"] = sig.signature;
+        headers["X-Pensar-Timestamp"] = sig.timestamp;
+        headers["X-Pensar-Nonce"] = sig.nonce;
+      }
       log(`  headers: ${Object.keys(headers).join(", ")}`);
       let response;
       try {
@@ -87919,10 +87959,7 @@ function createPensarModel(bedrockModelId, config2) {
           method: "POST",
           headers,
           signal: options.abortSignal,
-          body: JSON.stringify({
-            modelId: bedrockModelId,
-            body
-          })
+          body: serializedBody
         });
       } catch (err) {
         logError(`  SSE fetch failed (${Date.now() - startTime}ms):`, err);
@@ -88124,17 +88161,11 @@ function mapStopReason(reason) {
 }
 var DEBUG;
 var init_pensar2 = __esm(() => {
+  init_pensarSigning();
   DEBUG = process.env.PENSAR_DEBUG === "1" || process.env.PENSAR_DEBUG === "true";
 });
 
 // src/core/api/constants.ts
-var exports_constants = {};
-__export(exports_constants, {
-  getPensarConsoleUrl: () => getPensarConsoleUrl,
-  getPensarApiUrl: () => getPensarApiUrl,
-  PENSAR_CONSOLE_BASE_URL: () => PENSAR_CONSOLE_BASE_URL,
-  PENSAR_API_BASE_URL: () => PENSAR_API_BASE_URL
-});
 function getPensarApiUrl() {
   return PENSAR_API_BASE_URL;
 }
@@ -88154,7 +88185,7 @@ var init_config2 = __esm(() => {
   };
 });
 
-// src/core/api/tokenRefresh.ts
+// src/core/auth/token.ts
 function decodeJwtPayload(token) {
   try {
     const parts = token.split(".");
@@ -88173,6 +88204,21 @@ function isTokenExpired(token, bufferSeconds = 60) {
   const nowSeconds = Math.floor(Date.now() / 1000);
   return payload.exp - nowSeconds < bufferSeconds;
 }
+async function fetchWorkOSClientId() {
+  if (cachedClientId)
+    return cachedClientId;
+  try {
+    const apiUrl = getPensarApiUrl();
+    const response = await fetch(`${apiUrl}/api/cli/config`);
+    if (!response.ok)
+      return null;
+    const data = await response.json();
+    cachedClientId = data.workosClientId;
+    return cachedClientId;
+  } catch {
+    return null;
+  }
+}
 async function refreshAccessToken(clientId, refreshToken) {
   try {
     const response = await fetch("https://api.workos.com/user_management/authenticate", {
@@ -88219,27 +88265,203 @@ async function ensureValidToken(cfg) {
   }
   return null;
 }
-async function fetchWorkOSClientId() {
-  if (cachedClientId)
-    return cachedClientId;
+var cachedClientId = null;
+var init_token = __esm(() => {
+  init_config2();
+});
+
+// src/core/auth/device-flow.ts
+function sleep2(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+async function startDeviceFlow(apiUrl) {
+  const url2 = apiUrl ?? getPensarApiUrl();
   try {
-    const { getPensarApiUrl: getPensarApiUrl2 } = await Promise.resolve().then(() => exports_constants);
-    const apiUrl = getPensarApiUrl2();
-    const response = await fetch(`${apiUrl}/api/cli/config`);
-    if (!response.ok)
-      return null;
-    const data = await response.json();
-    cachedClientId = data.workosClientId;
-    return cachedClientId;
-  } catch {
-    return null;
+    const configResponse = await fetch(`${url2}/api/cli/config`);
+    if (configResponse.ok) {
+      const cliConfig = await configResponse.json();
+      const response2 = await fetch("https://api.workos.com/user_management/authorize/device", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ client_id: cliConfig.workosClientId })
+      });
+      if (response2.ok) {
+        const deviceInfo2 = await response2.json();
+        return {
+          mode: "workos",
+          clientId: cliConfig.workosClientId,
+          deviceInfo: deviceInfo2
+        };
+      }
+    }
+  } catch {}
+  const response = await fetch(`${url2}/auth/device/code`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error("Failed to start device authorization");
+  }
+  const deviceInfo = await response.json();
+  return { mode: "legacy", deviceInfo };
+}
+async function pollWorkOSToken(params) {
+  const { clientId, deviceCode, interval, expiresIn, signal } = params;
+  const deadline = Date.now() + expiresIn * 1000;
+  while (Date.now() < deadline) {
+    if (signal?.aborted)
+      throw new Error("Authorization cancelled");
+    await sleep2(interval * 1000);
+    if (signal?.aborted)
+      throw new Error("Authorization cancelled");
+    try {
+      const response = await fetch("https://api.workos.com/user_management/authenticate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          client_id: clientId,
+          grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+          device_code: deviceCode
+        })
+      });
+      if (response.status === 400) {
+        continue;
+      }
+      if (!response.ok) {
+        throw new Error("Authentication failed");
+      }
+      const data = await response.json();
+      return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token
+      };
+    } catch (err) {
+      if (err instanceof Error && (err.message === "Authentication failed" || err.message === "Authorization cancelled")) {
+        throw err;
+      }
+    }
   }
+  throw new Error("Authorization timed out. Please try again.");
 }
-var cachedClientId = null;
-var init_tokenRefresh = __esm(() => {
+async function pollLegacyToken(params) {
+  const { apiUrl, deviceCode, interval, expiresIn, signal } = params;
+  const deadline = Date.now() + expiresIn * 1000;
+  while (Date.now() < deadline) {
+    if (signal?.aborted)
+      throw new Error("Authorization cancelled");
+    await sleep2(interval * 1000);
+    if (signal?.aborted)
+      throw new Error("Authorization cancelled");
+    try {
+      const response = await fetch(`${apiUrl}/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deviceCode })
+      });
+      if (!response.ok)
+        continue;
+      const data = await response.json();
+      if (data.status === "complete" && data.apiKey) {
+        return data;
+      }
+      if (data.status === "expired") {
+        throw new Error("Authorization expired. Please try again.");
+      }
+      if (data.status === "not_found") {
+        throw new Error("Invalid authorization session. Please try again.");
+      }
+    } catch (err) {
+      if (signal?.aborted) {
+        throw new Error("Authorization cancelled", { cause: err });
+      }
+      if (err instanceof Error && err.message.includes("Please try again")) {
+        throw err;
+      }
+    }
+  }
+  throw new Error("Authorization timed out. Please try again.");
+}
+var init_device_flow = () => {};
+
+// src/core/auth/workspaces.ts
+function sleep3(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+async function fetchWorkspaces(apiUrl, accessToken) {
+  const response = await fetch(`${apiUrl}/api/cli/workspaces`, {
+    headers: { Authorization: `Bearer ${accessToken}` }
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to fetch workspaces (${response.status})`);
+  }
+  const data = await response.json();
+  return data.workspaces;
+}
+async function pollForWorkspaceCreation(apiUrl, accessToken, signal) {
+  const POLL_INTERVAL = 3000;
+  const TIMEOUT = 5 * 60 * 1000;
+  const deadline = Date.now() + TIMEOUT;
+  while (Date.now() < deadline) {
+    if (signal?.aborted)
+      throw new Error("Cancelled");
+    await sleep3(POLL_INTERVAL);
+    if (signal?.aborted)
+      throw new Error("Cancelled");
+    try {
+      const response = await fetch(`${apiUrl}/api/cli/workspaces`, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      if (!response.ok)
+        continue;
+      const data = await response.json();
+      if (data.workspaces.length > 0) {
+        return data.workspaces;
+      }
+    } catch {}
+  }
+  throw new Error("Workspace creation timed out. Please try again.");
+}
+async function selectWorkspace(apiUrl, accessToken, workspaceId) {
+  const response = await fetch(`${apiUrl}/api/cli/select-workspace`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: JSON.stringify({ workspaceId })
+  });
+  if (!response.ok) {
+    throw new Error("Failed to select workspace");
+  }
+  return await response.json();
+}
+
+// src/core/auth/connection.ts
+function isConnected(cfg) {
+  return !!(cfg.accessToken || cfg.pensarAPIKey);
+}
+async function disconnect() {
+  await config2.update({
+    pensarAPIKey: null,
+    accessToken: null,
+    refreshToken: null,
+    workspaceId: null,
+    workspaceSlug: null,
+    gatewaySigningKey: null
+  });
+}
+var init_connection = __esm(() => {
   init_config2();
 });
 
+// src/core/auth/index.ts
+var init_auth = __esm(() => {
+  init_signing();
+  init_token();
+  init_device_flow();
+  init_connection();
+});
+
 // src/core/ai/utils.ts
 function buildAuthConfig(cfg) {
   return {
@@ -88252,6 +88474,7 @@ function buildAuthConfig(cfg) {
     accessToken: cfg.accessToken ?? undefined,
     refreshToken: cfg.refreshToken ?? undefined,
     workspaceId: cfg.workspaceId ?? undefined,
+    gatewaySigningKey: cfg.gatewaySigningKey ?? undefined,
     bedrock: cfg.bedrockAPIKey ? { apiKey: cfg.bedrockAPIKey } : undefined,
     local: cfg.localModelUrl ? { baseURL: cfg.localModelUrl } : undefined
   };
@@ -88332,7 +88555,8 @@ function getProviderModel(model, authConfig) {
       const modelConfig = {
         apiKey: pensarApiKey || authConfig?.accessToken || "",
         baseUrl: pensarApiUrl,
-        workspaceId: authConfig?.workspaceId
+        workspaceId: authConfig?.workspaceId,
+        signingKey: authConfig?.gatewaySigningKey
       };
       if (hasWorkOSAuth) {
         modelConfig.getToken = async () => {
@@ -88523,7 +88747,7 @@ var init_utils = __esm(() => {
   init_dist13();
   init_models();
   init_pensar2();
-  init_tokenRefresh();
+  init_auth();
   init_config2();
   init_dist5();
 });
@@ -108198,7 +108422,7 @@ var init_cvssScorer = __esm(() => {
 
 // src/core/agents/offSecAgent/tools/documentFinding.ts
 import { join as join11 } from "path";
-import { writeFileSync as writeFileSync7, appendFileSync as appendFileSync2 } from "fs";
+import { writeFileSync as writeFileSync7, appendFileSync as appendFileSync2, readFileSync as readFileSync7 } from "fs";
 function documentVulnerability(ctx4) {
   const { session } = ctx4;
   return tool({
@@ -108271,12 +108495,21 @@ FINDING STRUCTURE:
             };
           }
         }
+        let pocOutput = null;
+        if (input.pocPath) {
+          try {
+            const pocBasename = input.pocPath.replace(/^pocs\//, "");
+            const outputPath = join11(session.pocsPath, `${pocBasename}.output.json`);
+            pocOutput = JSON.parse(readFileSync7(outputPath, "utf-8"));
+          } catch {}
+        }
         const findingWithMeta = {
           ...finding,
           timestamp,
           sessionId: session.id,
           target: session.targets[0],
           ...evidenceFilePath && { evidenceFile: evidenceFilePath },
+          ...pocOutput && { pocOutput },
           cwes: cvssResult.cwes,
           cvss: {
             score: cvssResult.score,
@@ -108515,6 +108748,8 @@ async function executeLocalPoc(ctx4, poc, currentAttempts) {
       try {
         unlinkSync(pocPath);
       } catch {}
+    } else {
+      writePocOutputSidecar(pocsPath, filename, stdout, stderr, exitCode, poc.description);
     }
     return {
       success: exitCode === 0,
@@ -108563,6 +108798,8 @@ async function executeSandboxPoc(ctx4, poc, currentAttempts) {
       try {
         unlinkSync(localPocPath);
       } catch {}
+    } else {
+      writePocOutputSidecar(localPocsPath, filename, result.stdout || "", result.stderr || "", result.exitCode, poc.description);
     }
     return {
       success: executionSuccess,
@@ -108584,6 +108821,19 @@ POC file has been deleted.`,
     };
   }
 }
+function writePocOutputSidecar(pocsPath, filename, stdout, stderr, exitCode, description) {
+  try {
+    const outputPath = join12(pocsPath, `${filename}.output.json`);
+    writeFileSync8(outputPath, JSON.stringify({
+      stdout,
+      stderr,
+      exitCode,
+      executedAt: new Date().toISOString(),
+      pocFile: filename,
+      description
+    }, null, 2));
+  } catch {}
+}
 function preparePoc(poc, currentAttempts) {
   const extension = poc.pocType === "bash" ? ".sh" : poc.pocType === "python" ? ".py" : ".js";
   const sanitizedName = sanitizeFilename(poc.pocName);
@@ -109758,7 +110008,7 @@ If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "to
 `;
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
-import { existsSync as existsSync18, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync8 } from "fs";
 import { join as join16 } from "path";
 function loadAuthResult(authDataPath) {
   if (!existsSync18(authDataPath)) {
@@ -109773,7 +110023,7 @@ function loadAuthResult(authDataPath) {
     };
   }
   try {
-    const raw = JSON.parse(readFileSync7(authDataPath, "utf-8"));
+    const raw = JSON.parse(readFileSync8(authDataPath, "utf-8"));
     return {
       success: raw.authenticated ?? false,
       summary: raw.summary ?? "Authentication process completed.",
@@ -109894,7 +110144,9 @@ var init_agent = __esm(() => {
           "email_list_inboxes",
           "email_list_messages",
           "email_search_messages",
-          "email_get_message"
+          "email_get_message",
+          "web_search",
+          "get_page"
         ],
         stopWhen: hasToolCall("complete_authentication"),
         resolveResult: () => {
@@ -111386,7 +111638,7 @@ var init_runAttackSurface = __esm(() => {
 });
 
 // src/core/findings/registry.ts
-import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
 import { join as join20 } from "path";
 function extractVulnClass(title) {
   const t2 = title.trim();
@@ -111466,7 +111718,7 @@ class FindingsRegistry {
     const files = readdirSync3(findingsPath).filter((f) => f.endsWith(".json"));
     for (const file2 of files) {
       try {
-        const raw = readFileSync8(join20(findingsPath, file2), "utf-8");
+        const raw = readFileSync9(join20(findingsPath, file2), "utf-8");
         const finding = JSON.parse(raw);
         if (finding && typeof finding.title === "string" && typeof finding.endpoint === "string") {
           registry2.indexFinding(finding);
@@ -111791,7 +112043,9 @@ var init_agent3 = __esm(() => {
         "list_files",
         "grep",
         "execute_command",
-        "document_asset"
+        "document_asset",
+        "web_search",
+        "get_page"
       ];
       if (responseSchema2) {
         activeTools.push("response");
@@ -157509,7 +157763,7 @@ var require_gaxios = __commonJS((exports) => {
   var retry_js_1 = require_retry();
   var stream_1 = __require("stream");
   var interceptor_js_1 = require_interceptor();
-  var randomUUID = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
+  var randomUUID2 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
   var HTTP_STATUS_NO_CONTENT = 204;
 
   class Gaxios {
@@ -157720,7 +157974,7 @@ var require_gaxios = __commonJS((exports) => {
       }
       const shouldDirectlyPassData = typeof opts.data === "string" || opts.data instanceof ArrayBuffer || opts.data instanceof Blob || globalThis.File && opts.data instanceof File || opts.data instanceof FormData || opts.data instanceof stream_1.Readable || opts.data instanceof ReadableStream || opts.data instanceof String || opts.data instanceof URLSearchParams || ArrayBuffer.isView(opts.data) || ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
       if (opts.multipart?.length) {
-        const boundary = await randomUUID();
+        const boundary = await randomUUID2();
         preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
         opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
       } else if (shouldDirectlyPassData) {
@@ -168699,7 +168953,7 @@ var require_apirequest = __commonJS((exports) => {
   var h22 = require_http2();
   var util_1 = require_util7();
   var pkg = require_package4();
-  var randomUUID = () => globalThis.crypto?.randomUUID() || __require("crypto").randomUUID();
+  var randomUUID2 = () => globalThis.crypto?.randomUUID() || __require("crypto").randomUUID();
   function isReadableStream(obj) {
     return obj !== null && typeof obj === "object" && typeof obj.pipe === "function" && obj.readable !== false && typeof obj._read === "function" && typeof obj._readableState === "object";
   }
@@ -168772,7 +169026,7 @@ var require_apirequest = __commonJS((exports) => {
       authClient = undefined;
     }
     function multipartUpload(multipart) {
-      const boundary = randomUUID();
+      const boundary = randomUUID2();
       const finale = `--${boundary}--`;
       const rStream = new stream.PassThrough({
         flush(callback) {
@@ -168811,7 +169065,7 @@ content-type: ${part["content-type"]}\r
       options.data = rStream;
     }
     function browserMultipartUpload(multipart) {
-      const boundary = randomUUID();
+      const boundary = randomUUID2();
       const finale = `--${boundary}--`;
       headers["content-type"] = `multipart/related; boundary=${boundary}`;
       let content = "";
@@ -176322,7 +176576,7 @@ var require_quick_format_unescaped = __commonJS((exports, module2) => {
 // node_modules/atomic-sleep/index.js
 var require_atomic_sleep = __commonJS((exports, module2) => {
   if (typeof SharedArrayBuffer !== "undefined" && typeof Atomics !== "undefined") {
-    let sleep2 = function(ms) {
+    let sleep4 = function(ms) {
       const valid = ms > 0 && ms < Infinity;
       if (valid === false) {
         if (typeof ms !== "number" && typeof ms !== "bigint") {
@@ -176333,9 +176587,9 @@ var require_atomic_sleep = __commonJS((exports, module2) => {
       Atomics.wait(nil, 0, 0, Number(ms));
     };
     const nil = new Int32Array(new SharedArrayBuffer(4));
-    module2.exports = sleep2;
+    module2.exports = sleep4;
   } else {
-    let sleep2 = function(ms) {
+    let sleep4 = function(ms) {
       const valid = ms > 0 && ms < Infinity;
       if (valid === false) {
         if (typeof ms !== "number" && typeof ms !== "bigint") {
@@ -176346,7 +176600,7 @@ var require_atomic_sleep = __commonJS((exports, module2) => {
       const target = Date.now() + Number(ms);
       while (target > Date.now()) {}
     };
-    module2.exports = sleep2;
+    module2.exports = sleep4;
   }
 });
 
@@ -176356,7 +176610,7 @@ var require_sonic_boom = __commonJS((exports, module2) => {
   var EventEmitter11 = __require("events");
   var inherits = __require("util").inherits;
   var path6 = __require("path");
-  var sleep2 = require_atomic_sleep();
+  var sleep4 = require_atomic_sleep();
   var assert2 = __require("assert");
   var BUSY_WRITE_TIMEOUT = 100;
   var kEmptyBuffer = Buffer.allocUnsafe(0);
@@ -176504,7 +176758,7 @@ var require_sonic_boom = __commonJS((exports, module2) => {
         if ((err.code === "EAGAIN" || err.code === "EBUSY") && this.retryEAGAIN(err, this._writingBuf.length, this._len - this._writingBuf.length)) {
           if (this.sync) {
             try {
-              sleep2(BUSY_WRITE_TIMEOUT);
+              sleep4(BUSY_WRITE_TIMEOUT);
               this.release(undefined, 0);
             } catch (err2) {
               this.release(err2);
@@ -176818,7 +177072,7 @@ var require_sonic_boom = __commonJS((exports, module2) => {
         if (shouldRetry && !this.retryEAGAIN(err, buf.length, this._len - buf.length)) {
           throw err;
         }
-        sleep2(BUSY_WRITE_TIMEOUT);
+        sleep4(BUSY_WRITE_TIMEOUT);
       }
     }
     try {
@@ -176854,7 +177108,7 @@ var require_sonic_boom = __commonJS((exports, module2) => {
         if (shouldRetry && !this.retryEAGAIN(err, buf.length, this._len - buf.length)) {
           throw err;
         }
-        sleep2(BUSY_WRITE_TIMEOUT);
+        sleep4(BUSY_WRITE_TIMEOUT);
       }
     }
   }
@@ -177575,7 +177829,7 @@ var require_transport = __commonJS((exports, module2) => {
   var getCallers = require_caller();
   var { join: join22, isAbsolute: isAbsolute6, sep } = __require("node:path");
   var { fileURLToPath: fileURLToPath2 } = __require("node:url");
-  var sleep2 = require_atomic_sleep();
+  var sleep4 = require_atomic_sleep();
   var onExit = require_on_exit_leak_free();
   var ThreadStream = require_thread_stream();
   function setupOnExit(stream) {
@@ -177698,7 +177952,7 @@ var require_transport = __commonJS((exports, module2) => {
         return;
       }
       stream.flushSync();
-      sleep2(100);
+      sleep4(100);
       stream.end();
     }
     return stream;
@@ -187450,7 +187704,7 @@ var require_tools2 = __commonJS((exports, module2) => {
   var libmime = require_libmime();
   var { resolveCharset } = require_charsets2();
   var { compiler } = require_imap_handler();
-  var { createHash } = __require("crypto");
+  var { createHash: createHash2 } = __require("crypto");
   var { JPDecoder } = require_jp_decoder();
   var iconv = require_lib10();
   var FLAG_COLORS = ["red", "orange", "yellow", "green", "blue", "purple", "grey"];
@@ -187757,7 +188011,7 @@ var require_tools2 = __commonJS((exports, module2) => {
             path6 = iconv.encode(path6, "utf-7-imap").toString();
           } catch {}
         }
-        map3.id = map3.emailId || createHash("md5").update([path6, mailbox.uidValidity?.toString() || "", map3.uid.toString()].join(":")).digest("hex");
+        map3.id = map3.emailId || createHash2("md5").update([path6, mailbox.uidValidity?.toString() || "", map3.uid.toString()].join(":")).digest("hex");
       }
       if (map3.flags) {
         let flagColor = tools.getFlagColor(map3.flags);
@@ -193506,6 +193760,235 @@ var init_email = __esm(() => {
   ];
 });
 
+// src/core/agents/offSecAgent/tools/webSearch.ts
+function webSearch2(_ctx) {
+  return tool({
+    description: `Search the web for real-time information about any topic. Returns summarized information from search results.
+
+USAGE GUIDANCE:
+- Use this tool to look up CVEs, security advisories, and vulnerability details
+- Search for exploit techniques, payloads, and bypass methods
+- Research target technologies, frameworks, and their known vulnerabilities
+- Find documentation for tools, APIs, and security testing techniques
+- Look up default credentials, common misconfigurations, and hardening guides
+
+IMPORTANT: This tool requires a Pensar account. If you're not signed in, you'll receive an error message with instructions to sign in.
+
+COMMON SEARCH PATTERNS:
+- "CVE-2024-XXXX exploit" — Find details about specific CVEs
+- "Apache Struts RCE vulnerability" — Research known vulnerabilities in specific software
+- "SSRF bypass techniques" — Find security testing techniques
+- "Spring Boot actuator default credentials" — Look up default credentials
+- "JWT token security vulnerabilities" — Research vulnerability classes`,
+    inputSchema: webSearchInputSchema2,
+    execute: async ({ query }) => {
+      try {
+        const cfg = await config2.get();
+        const tokenResult = await ensureValidToken({
+          accessToken: cfg.accessToken,
+          refreshToken: cfg.refreshToken,
+          pensarAPIKey: cfg.pensarAPIKey
+        });
+        if (!tokenResult) {
+          return {
+            success: false,
+            results: [],
+            error: "Web search requires a Pensar account. Please sign in to your Pensar account to use this feature. You can sign in via the TUI settings or by running 'pensar auth login'."
+          };
+        }
+        if (!cfg.workspaceId) {
+          return {
+            success: false,
+            results: [],
+            error: "Web search requires a workspace. Please sign in to your Pensar account."
+          };
+        }
+        if (!cfg.gatewaySigningKey) {
+          return {
+            success: false,
+            results: [],
+            error: "Web search requires authentication. Please sign in again to your Pensar account."
+          };
+        }
+        const apiUrl = getPensarApiUrl();
+        const body = JSON.stringify({ query });
+        const { signature, timestamp, nonce } = signGatewayRequest(cfg.gatewaySigningKey, "web_search", body);
+        const response = await fetch(`${apiUrl}/agents/web_search`, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${tokenResult.token}`,
+            "X-Workspace-Id": cfg.workspaceId,
+            "X-Pensar-Timestamp": timestamp,
+            "X-Pensar-Nonce": nonce,
+            "X-Pensar-Signature": signature
+          },
+          body
+        });
+        if (!response.ok) {
+          if (response.status === 401) {
+            return {
+              success: false,
+              results: [],
+              error: "Authentication failed. Please sign in again to your Pensar account."
+            };
+          }
+          if (response.status === 429) {
+            return {
+              success: false,
+              results: [],
+              error: "Rate limit exceeded. Please wait a moment before searching again."
+            };
+          }
+          const errorText = await response.text().catch(() => "Unknown error");
+          return {
+            success: false,
+            results: [],
+            error: `Web search failed: ${response.status} ${response.statusText}. ${errorText}`
+          };
+        }
+        const data = await response.json();
+        if (data.error) {
+          return {
+            success: false,
+            results: [],
+            error: data.error
+          };
+        }
+        return {
+          success: true,
+          results: data.results || []
+        };
+      } catch (error40) {
+        const errorMsg = error40 instanceof Error ? error40.message : String(error40);
+        return {
+          success: false,
+          results: [],
+          error: `Web search failed: ${errorMsg}`
+        };
+      }
+    }
+  });
+}
+var webSearchInputSchema2;
+var init_webSearch = __esm(() => {
+  init_dist5();
+  init_zod();
+  init_config2();
+  init_auth();
+  webSearchInputSchema2 = exports_external.object({
+    query: exports_external.string().describe("The search query to look up. Be specific and include relevant keywords for better results."),
+    toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing (e.g., 'Searching for CVE-2024-1234 details')")
+  });
+});
+
+// src/core/agents/offSecAgent/tools/getPage.ts
+function extractTitle(html) {
+  const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
+  return titleMatch?.[1]?.trim();
+}
+function extractTextContent2(html) {
+  let text2 = html;
+  text2 = text2.replace(/<script[^>]*>[\s\S]*?<\/script>/gi, "");
+  text2 = text2.replace(/<style[^>]*>[\s\S]*?<\/style>/gi, "");
+  text2 = text2.replace(/<noscript[^>]*>[\s\S]*?<\/noscript>/gi, "");
+  text2 = text2.replace(/<!--[\s\S]*?-->/g, "");
+  text2 = text2.replace(/<[^>]+>/g, " ");
+  text2 = text2.replace(/&nbsp;/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&apos;/g, "'");
+  text2 = text2.replace(/\s+/g, " ").trim();
+  const lines = text2.split(/[.\n]/).map((line) => line.trim()).filter((line) => line.length > 0);
+  return lines.join(`
+`);
+}
+function getPage(ctx4) {
+  return tool({
+    description: `Fetch and extract readable content from a web page. Returns the page title and main text content.
+
+USAGE GUIDANCE:
+- Use this tool to read full content from URLs found via web_search
+- Fetch CVE details, security advisories, and vulnerability write-ups
+- Read documentation, API references, and technical guides
+- Extract exploit code, payloads, and proof-of-concept details from security blogs
+
+BEST PRACTICES:
+- First use web_search to find relevant URLs, then use get_page to read the full content
+- Prefer authoritative sources (NVD, vendor advisories, security researcher blogs)
+- For large pages, focus on the most relevant sections
+- If content is truncated, the important information is usually near the beginning`,
+    inputSchema: getPageInputSchema,
+    execute: async ({ url: url2 }) => {
+      try {
+        const controller = new AbortController;
+        const timeoutId = setTimeout(() => controller.abort(), REQUEST_TIMEOUT);
+        const combinedSignal = ctx4.abortSignal ? AbortSignal.any([ctx4.abortSignal, controller.signal]) : controller.signal;
+        const response = await fetch(url2, {
+          method: "GET",
+          headers: {
+            "User-Agent": "Mozilla/5.0 (compatible; PensarBot/1.0; +https://pensar.dev)",
+            Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+            "Accept-Language": "en-US,en;q=0.5"
+          },
+          signal: combinedSignal,
+          redirect: "follow"
+        });
+        clearTimeout(timeoutId);
+        if (!response.ok) {
+          return {
+            success: false,
+            url: url2,
+            error: `Failed to fetch page: ${response.status} ${response.statusText}`
+          };
+        }
+        const contentType = response.headers.get("content-type") || "";
+        if (!contentType.includes("text/html") && !contentType.includes("text/plain") && !contentType.includes("application/xhtml")) {
+          return {
+            success: false,
+            url: url2,
+            error: `Unsupported content type: ${contentType}. This tool only supports HTML and text pages.`
+          };
+        }
+        const html = await response.text();
+        const title = extractTitle(html);
+        let content = extractTextContent2(html);
+        if (content.length > MAX_CONTENT_LENGTH) {
+          content = content.substring(0, MAX_CONTENT_LENGTH) + `
+
+... (content truncated — page exceeded maximum length)`;
+        }
+        return {
+          success: true,
+          url: url2,
+          title,
+          content
+        };
+      } catch (error40) {
+        if (error40 instanceof Error && error40.name === "AbortError") {
+          return {
+            success: false,
+            url: url2,
+            error: ctx4.abortSignal?.aborted ? "Request aborted by user" : `Request timeout after ${REQUEST_TIMEOUT / 1000}s`
+          };
+        }
+        const errorMsg = error40 instanceof Error ? error40.message : String(error40);
+        return {
+          success: false,
+          url: url2,
+          error: `Failed to fetch page: ${errorMsg}`
+        };
+      }
+    }
+  });
+}
+var MAX_CONTENT_LENGTH = 50000, REQUEST_TIMEOUT = 30000, getPageInputSchema;
+var init_getPage = __esm(() => {
+  init_dist5();
+  init_zod();
+  getPageInputSchema = exports_external.object({
+    url: exports_external.string().url().describe("The URL of the page to fetch and extract content from."),
+    toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing (e.g., 'Fetching CVE details from NVD')")
+  });
+});
+
 // src/core/agents/offSecAgent/tools/index.ts
 function createAllTools(ctx4) {
   return {
@@ -193541,7 +194024,9 @@ function createAllTools(ctx4) {
     email_list_inboxes: emailListInboxes(ctx4),
     email_list_messages: emailListMessages(ctx4),
     email_search_messages: emailSearchMessages(ctx4),
-    email_get_message: emailGetMessage(ctx4)
+    email_get_message: emailGetMessage(ctx4),
+    web_search: webSearch2(ctx4),
+    get_page: getPage(ctx4)
   };
 }
 var ALL_TOOL_NAMES;
@@ -193576,6 +194061,8 @@ var init_tools = __esm(() => {
   init_listMemories();
   init_getMemory();
   init_email();
+  init_webSearch();
+  init_getPage();
   init_browserTools();
   init_executeCommand();
   init_httpRequest();
@@ -193609,6 +194096,8 @@ var init_tools = __esm(() => {
   init_listMessages();
   init_searchMessages();
   init_getMessage();
+  init_webSearch();
+  init_getPage();
   init_email();
   ALL_TOOL_NAMES = [
     "browser_navigate",
@@ -193645,7 +194134,9 @@ var init_tools = __esm(() => {
     "email_get_message",
     "email_search_messages",
     "email_get_attachments",
-    "email_mark_read"
+    "email_mark_read",
+    "web_search",
+    "get_page"
   ];
 });
 
@@ -194617,7 +195108,9 @@ var init_blackboxAgent = __esm(() => {
           "email_list_inboxes",
           "email_list_messages",
           "email_search_messages",
-          "email_get_message"
+          "email_get_message",
+          "web_search",
+          "get_page"
         ],
         stopWhen: [
           hasToolCall("create_attack_surface_report"),
@@ -194641,7 +195134,7 @@ var init_blackboxAgent = __esm(() => {
 });
 
 // src/core/agents/specialized/pentest/agent.ts
-import { existsSync as existsSync23, readdirSync as readdirSync4, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync23, readdirSync as readdirSync4, readFileSync as readFileSync10 } from "fs";
 import { join as join24 } from "path";
 function buildSystemPrompt(session) {
   return session.config?.exfilMode ? PENTEST_SYSTEM_PROMPT_EXFIL : PENTEST_SYSTEM_PROMPT_BASE;
@@ -194656,7 +195149,7 @@ function buildPrompt4(target, objectives, session, findingsRegistry) {
   const authDataPath = join24(sessionRootPath, "auth", "auth-data.json");
   if (existsSync23(authDataPath)) {
     try {
-      const raw = readFileSync9(authDataPath, "utf-8");
+      const raw = readFileSync10(authDataPath, "utf-8");
       const authData = JSON.parse(raw);
       if (authData.authenticated) {
         const parts = [
@@ -194697,7 +195190,7 @@ ${existing}`;
   const markerPath = join24(sessionRootPath, "scratchpad", ".knowledge-populated");
   if (existsSync23(markerPath)) {
     try {
-      const count = parseInt(readFileSync9(markerPath, "utf-8").trim(), 10) || 0;
+      const count = parseInt(readFileSync10(markerPath, "utf-8").trim(), 10) || 0;
       if (count > 0) {
         knowledgeBaseSection = `
 
@@ -194710,7 +195203,7 @@ There are ${count} project knowledge entries in the memory system from previous
     const knowledgePath = join24(sessionRootPath, "scratchpad", "knowledge-base.md");
     if (existsSync23(knowledgePath)) {
       try {
-        const knowledgeContent = readFileSync9(knowledgePath, "utf-8").trim();
+        const knowledgeContent = readFileSync10(knowledgePath, "utf-8").trim();
         if (knowledgeContent) {
           knowledgeBaseSection = `
 
@@ -194730,21 +195223,25 @@ ${outcomeGuidance}
 Your target is a flag with the format FLAG{...}. Locate and extract it.
 
 ## Instructions
-1. State the objectives and outline your testing plan — describe which techniques and payloads you will use for each objective before executing any tools
-2. Verify the target endpoint is reachable and understand its baseline behavior
-3. For each objective, research and craft targeted payloads appropriate to the technology
-4. Test systematically — vary payloads, encoding, and bypass techniques
-5. Create POC scripts to reliably demonstrate any confirmed vulnerabilities
-6. When a vulnerability provides internal access, pivot through it to discover reachable services and extract sensitive data
-7. Document every confirmed vulnerability (using document_vulnerability) with evidence and remediation steps
-8. After testing ALL objectives and extracting the flag, call the response tool with your final summary. Do NOT call response until you have completed all testing and extraction.` : `## Instructions
-1. State the objectives and outline your testing plan — describe which techniques and payloads you will use for each objective before executing any tools
-2. Verify the target endpoint is reachable and understand its baseline behavior
-3. For each objective, research and craft targeted payloads appropriate to the technology
-4. Test systematically — vary payloads, encoding, and bypass techniques
-5. Create POC scripts to reliably demonstrate any confirmed vulnerabilities
-6. Document every confirmed vulnerability (using document_vulnerability) with evidence and remediation steps — only if you have a working PoC
-7. After testing ALL objectives, call the response tool with your final summary
+1. Call list_memories to review any prior knowledge relevant to this target or engagement
+2. State the objectives and outline your testing plan — describe which techniques and payloads you will use for each objective before executing any tools
+3. Verify the target endpoint is reachable and understand its baseline behavior
+4. For each objective, research and craft targeted payloads appropriate to the technology
+5. Test systematically — vary payloads, encoding, and bypass techniques
+6. Create POC scripts to reliably demonstrate any confirmed vulnerabilities
+7. When a vulnerability provides internal access, pivot through it to discover reachable services and extract sensitive data
+8. Document every confirmed vulnerability (using document_vulnerability) with evidence and remediation steps
+9. Use add_memory to save reusable learnings from this engagement (effective techniques, target behaviors, technology details)
+10. After testing ALL objectives and extracting the flag, call the response tool with your final summary. Do NOT call response until you have completed all testing and extraction.` : `## Instructions
+1. Call list_memories to review any prior knowledge relevant to this target or engagement
+2. State the objectives and outline your testing plan — describe which techniques and payloads you will use for each objective before executing any tools
+3. Verify the target endpoint is reachable and understand its baseline behavior
+4. For each objective, research and craft targeted payloads appropriate to the technology
+5. Test systematically — vary payloads, encoding, and bypass techniques
+6. Create POC scripts to reliably demonstrate any confirmed vulnerabilities
+7. Document every confirmed vulnerability (using document_vulnerability) with evidence and remediation steps — only if you have a working PoC
+8. Use add_memory to save reusable learnings from this engagement (effective techniques, target behaviors, technology details, false positive patterns)
+9. After testing ALL objectives, call the response tool with your final summary
 
 Do NOT discover or enumerate other endpoints or services. Focus exclusively on the target and objectives above.`;
   return `# Testing Assignment
@@ -194766,7 +195263,7 @@ function loadFindings(findingsPath) {
   }
   return readdirSync4(findingsPath).filter((f3) => f3.endsWith(".json")).map((f3) => {
     try {
-      const content = readFileSync9(join24(findingsPath, f3), "utf-8");
+      const content = readFileSync10(join24(findingsPath, f3), "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -194785,22 +195282,26 @@ CRITICAL — Source Code Prohibition:
 - Your testing must rely exclusively on external interaction: sending requests, observing responses, and analyzing observable behavior.
 
 Your methodology:
-1. PLAN — Begin by stating the objectives you have been given and outlining your testing plan. For each objective, describe which attack techniques, payloads, and tools you intend to use. Output this plan as text before making any tool calls.
-2. VERIFY — Confirm the target endpoint exists and is reachable. Understand its basic behavior (response format, parameters, auth requirements).
-3. PREPARE — Research applicable payloads and attack techniques for the given objectives. Craft payloads tailored to the target's technology and behavior.
-4. TEST — Execute targeted attacks methodically, one payload/technique at a time. Observe responses carefully for indicators of vulnerability.
-5. EXPLOIT — When a vulnerability is confirmed, create a proof-of-concept script that reliably demonstrates it.
-6. DOCUMENT — Document every confirmed finding with evidence, impact assessment, and remediation steps.
-7. FINISH — After testing ALL objectives, call the response tool to submit your final summary. You may document multiple findings before finishing.
+1. ORIENT — Start by calling list_memories to review any existing knowledge from previous engagements (target-specific notes, successful techniques, false positive patterns, technology context). Use relevant findings to inform your testing plan.
+2. PLAN — State the objectives you have been given and outline your testing plan. For each objective, describe which attack techniques, payloads, and tools you intend to use. Output this plan as text before making any tool calls.
+3. VERIFY — Confirm the target endpoint exists and is reachable. Understand its basic behavior (response format, parameters, auth requirements).
+4. PREPARE — Research applicable payloads and attack techniques for the given objectives. Craft payloads tailored to the target's technology and behavior.
+5. TEST — Execute targeted attacks methodically, one payload/technique at a time. Observe responses carefully for indicators of vulnerability.
+6. EXPLOIT — When a vulnerability is confirmed, create a proof-of-concept script that reliably demonstrates it.
+7. DOCUMENT — Document every confirmed finding with evidence, impact assessment, and remediation steps.
+8. LEARN — Before finishing, use add_memory to persist reusable learnings from this engagement (e.g. target-specific behaviors, successful payload patterns, technology fingerprints, false positive patterns, credential formats). This knowledge helps future engagements be more efficient.
+9. FINISH — After testing ALL objectives and saving learnings, call the response tool to submit your final summary. You may document multiple findings before finishing.
 
 Guidelines:
-- Always start by stating your objectives and plan before executing any tools
+- Always call list_memories first to check for relevant knowledge before planning your approach
+- State your objectives and plan before executing any attack tools
 - Stay focused on the provided objectives — do not scan for other services or enumerate additional endpoints
 - Be methodical and thorough — test one payload at a time and observe the response
 - Use execute_command for crafting/running exploit scripts and http_request for targeted web tests
 - Always create POC scripts to confirm vulnerabilities before documenting
 - Document every confirmed vulnerability with document_vulnerability — you can document multiple vulnerabilities in a single run
 - Include clear remediation steps in every finding
+- Before finishing, use add_memory to save reusable learnings (target behaviors, effective techniques, technology details, false positive patterns)
 - When you have finished testing ALL objectives, call the response tool with a summary of your results. Do NOT call response until you have completed all testing.
 
 Rate Limiting:
@@ -194832,24 +195333,28 @@ Authentication:
 You are given a specific target and specific objectives. Your job is to deeply test the provided target, and when vulnerabilities are confirmed, pivot through them to discover and extract sensitive data.
 
 Your methodology:
-1. PLAN — Begin by stating the objectives you have been given and outlining your testing plan. For each objective, describe which attack techniques, payloads, and tools you intend to use. Output this plan as text before making any tool calls.
-2. VERIFY — Confirm the target endpoint exists and is reachable. Understand its basic behavior (response format, parameters, auth requirements).
-3. PREPARE — Research applicable payloads and attack techniques for the given objectives. Craft payloads tailored to the target's technology and behavior.
-4. TEST — Execute targeted attacks methodically, one payload/technique at a time. Observe responses carefully for indicators of vulnerability.
-5. EXPLOIT — When a vulnerability is confirmed, create a proof-of-concept script that reliably demonstrates it.
-6. PIVOT — When a vulnerability grants access to internal resources (e.g. SSRF, RCE, LFI), use it to discover and map what's accessible. Reason about what internal services, APIs, and data stores may exist behind the vulnerability — consider common internal hostnames, ports, and paths (e.g. internal DNS names in Docker/Kubernetes environments, common service ports, admin endpoints). Actively explore through the vulnerability to find reachable services.
-7. EXTRACT — The primary goal is to locate and extract a flag, secret, or sensitive data. Don't stop at proving the vulnerability exists — demonstrate full impact by retrieving the target data through the confirmed attack vector.
-8. DOCUMENT — Document every confirmed finding with evidence, impact assessment, and remediation steps. You can document multiple findings before finishing.
-9. FINISH — After testing ALL objectives and completing extraction, call the response tool to submit your final summary. Do NOT call response until you have completed all testing and extraction.
+1. ORIENT — Start by calling list_memories to review any existing knowledge from previous engagements (target-specific notes, successful techniques, false positive patterns, technology context). Use relevant findings to inform your testing plan.
+2. PLAN — State the objectives you have been given and outline your testing plan. For each objective, describe which attack techniques, payloads, and tools you intend to use. Output this plan as text before making any tool calls.
+3. VERIFY — Confirm the target endpoint exists and is reachable. Understand its basic behavior (response format, parameters, auth requirements).
+4. PREPARE — Research applicable payloads and attack techniques for the given objectives. Craft payloads tailored to the target's technology and behavior.
+5. TEST — Execute targeted attacks methodically, one payload/technique at a time. Observe responses carefully for indicators of vulnerability.
+6. EXPLOIT — When a vulnerability is confirmed, create a proof-of-concept script that reliably demonstrates it.
+7. PIVOT — When a vulnerability grants access to internal resources (e.g. SSRF, RCE, LFI), use it to discover and map what's accessible. Reason about what internal services, APIs, and data stores may exist behind the vulnerability — consider common internal hostnames, ports, and paths (e.g. internal DNS names in Docker/Kubernetes environments, common service ports, admin endpoints). Actively explore through the vulnerability to find reachable services.
+8. EXTRACT — The primary goal is to locate and extract a flag, secret, or sensitive data. Don't stop at proving the vulnerability exists — demonstrate full impact by retrieving the target data through the confirmed attack vector.
+9. DOCUMENT — Document every confirmed finding with evidence, impact assessment, and remediation steps. You can document multiple findings before finishing.
+10. LEARN — Before finishing, use add_memory to persist reusable learnings from this engagement (e.g. target-specific behaviors, successful payload patterns, technology fingerprints, false positive patterns, credential formats). This knowledge helps future engagements be more efficient.
+11. FINISH — After testing ALL objectives, completing extraction, and saving learnings, call the response tool to submit your final summary. Do NOT call response until you have completed all testing and extraction.
 
 Guidelines:
-- Always start by stating your objectives and plan before executing any tools
+- Always call list_memories first to check for relevant knowledge before planning your approach
+- State your objectives and plan before executing any attack tools
 - When you confirm a vulnerability that provides internal access, think through what lies behind it and actively explore through the vulnerability to maximize impact
 - Be methodical and thorough — test one payload at a time and observe the response
 - Use execute_command for crafting/running exploit scripts and http_request for targeted web tests
 - Always create POC scripts to confirm vulnerabilities before documenting
 - Document every confirmed vulnerability with document_vulnerability — you can document multiple vulnerabilities in a single run
 - Include clear remediation steps in every finding
+- Before finishing, use add_memory to save reusable learnings (target behaviors, effective techniques, technology details, false positive patterns)
 - When you have finished testing ALL objectives and extracting data, call the response tool with a summary of your results. Do NOT call response until you have completed all testing and extraction.
 
 Authentication:
@@ -194908,7 +195413,10 @@ var init_agent4 = __esm(() => {
           "email_search_messages",
           "email_get_message",
           "list_memories",
-          "get_memory"
+          "get_memory",
+          "add_memory",
+          "web_search",
+          "get_page"
         ],
         responseSchema: PentestResponseSchema,
         resolveResult: () => {
@@ -194925,7 +195433,7 @@ var init_agent4 = __esm(() => {
 });
 
 // src/core/session/execution-metrics.ts
-import { existsSync as existsSync24, readFileSync as readFileSync10, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync11, writeFileSync as writeFileSync16 } from "fs";
 import { join as join25 } from "path";
 function toNonNegativeInteger(value) {
   const n = Number(value);
@@ -194953,7 +195461,7 @@ function readExecutionMetrics(sessionRootPath) {
   if (!existsSync24(path6))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync10(path6, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(path6, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
@@ -194968,7 +195476,7 @@ function writeSessionJsonTokenTotals(sessionRootPath, tokenUsage) {
   if (!existsSync24(path6))
     return;
   try {
-    const parsed = JSON.parse(readFileSync10(path6, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(path6, "utf-8"));
     parsed.tokensIn = tokenUsage.inputTokens;
     parsed.tokensOut = tokenUsage.outputTokens;
     writeFileSync16(path6, JSON.stringify(parsed, null, 2));
@@ -195581,7 +196089,7 @@ __export(exports_pentest, {
   runPentestSwarm: () => runPentestSwarm,
   DEFAULT_CONCURRENCY: () => DEFAULT_CONCURRENCY4
 });
-import { existsSync as existsSync25, readdirSync as readdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync17 } from "fs";
+import { existsSync as existsSync25, readdirSync as readdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync17 } from "fs";
 import { join as join26 } from "path";
 function addUsageTotals(totals, usage) {
   if (!usage)
@@ -195878,7 +196386,7 @@ function loadFindings2(findingsPath) {
   }
   return readdirSync5(findingsPath).filter((f3) => f3.endsWith(".json")).map((f3) => {
     try {
-      const content = readFileSync11(join26(findingsPath, f3), "utf-8");
+      const content = readFileSync12(join26(findingsPath, f3), "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -272501,7 +273009,7 @@ var useTerminalDimensions = () => {
 };
 
 // src/tui/index.tsx
-var import_react87 = __toESM(require_react(), 1);
+var import_react88 = __toESM(require_react(), 1);
 
 // src/tui/components/footer.tsx
 import os6 from "os";
@@ -276900,6 +277408,7 @@ function WebWizard({
   const [headerNameInput, setHeaderNameInput] = import_react42.useState("");
   const [headerValueInput, setHeaderValueInput] = import_react42.useState("");
   const [error40, setError] = import_react42.useState(null);
+  const [targetError, setTargetError] = import_react42.useState(null);
   async function createSessionAndNavigate() {
     if (!state.target.trim())
       return;
@@ -276968,20 +277477,36 @@ function WebWizard({
       return;
     if (currentStep === "target") {
       const maxTargetField = state.sourceCodeAccess ? 2 : 1;
-      if (key.name === "tab") {
+      if (key.name === "tab" && !key.shift) {
         key.preventDefault();
-        if (key.shift) {
-          setTargetFocusedField((prev) => Math.max(0, prev - 1));
+        if (state.target.trim()) {
+          setTargetError(null);
+          setCurrentStep("configure");
         } else {
-          if (targetFocusedField === maxTargetField && state.target.trim()) {
-            setCurrentStep("configure");
-          } else {
-            setTargetFocusedField((prev) => Math.min(maxTargetField, prev + 1));
-          }
+          setTargetError("Target URL is required");
+        }
+        return;
+      }
+      if (key.name === "tab" && key.shift) {
+        key.preventDefault();
+        setTargetFocusedField((prev) => Math.max(0, prev - 1));
+        return;
+      }
+      if (key.name === "down") {
+        key.preventDefault();
+        if (targetFocusedField < maxTargetField) {
+          setTargetFocusedField((prev) => prev + 1);
+        }
+        return;
+      }
+      if (key.name === "up") {
+        key.preventDefault();
+        if (targetFocusedField > 0) {
+          setTargetFocusedField((prev) => prev - 1);
         }
         return;
       }
-      if (targetFocusedField === 1 && (key.name === "up" || key.name === "down")) {
+      if (key.sequence === " " && targetFocusedField === 1) {
         key.preventDefault();
         setState((prev) => ({
           ...prev,
@@ -277248,9 +277773,24 @@ function WebWizard({
             description: "e.g., https://example.com",
             placeholder: "https://example.com",
             value: state.target,
-            onInput: (v2) => setState((prev) => ({ ...prev, target: v2 })),
+            onInput: (v2) => {
+              setTargetError(null);
+              setState((prev) => ({ ...prev, target: v2 }));
+            },
+            onSubmit: () => {
+              if (state.target.trim()) {
+                setTargetError(null);
+                setCurrentStep("configure");
+              } else {
+                setTargetError("Target URL is required");
+              }
+            },
             focused: targetFocusedField === 0
           }, undefined, false, undefined, this),
+          targetError && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.error,
+            children: targetError
+          }, undefined, false, undefined, this),
           /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
             flexDirection: "column",
             gap: 1,
@@ -277269,7 +277809,7 @@ function WebWizard({
                   }, undefined, false, undefined, this),
                   targetFocusedField === 1 && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
                     fg: colors2.textMuted,
-                    children: "(↑/↓ to toggle)"
+                    children: "(Space to toggle)"
                   }, undefined, false, undefined, this)
                 ]
               }, undefined, true, undefined, this),
@@ -277855,11 +278395,12 @@ function WebWizard({
 }
 
 // src/tui/components/commands/provider-manager.tsx
-var import_react48 = __toESM(require_react(), 1);
+var import_react50 = __toESM(require_react(), 1);
 init_config2();
 // src/tui/components/commands/provider-selection.tsx
 var import_react45 = __toESM(require_react(), 1);
 function ProviderSelection({
+  providers,
   onProviderSelected,
   onClose
 }) {
@@ -277867,6 +278408,7 @@ function ProviderSelection({
   const route = useRoute();
   const _config = useConfig();
   const [highlightedIndex, setHighlightedIndex] = import_react45.useState(0);
+  const providerList = providers ?? AVAILABLE_PROVIDERS;
   const configuredProviders = getConfiguredProviders(_config.data);
   useKeyboard((key) => {
     if (key.name === "escape") {
@@ -277874,15 +278416,15 @@ function ProviderSelection({
       return;
     }
     if (key.name === "up") {
-      setHighlightedIndex((prev) => prev > 0 ? prev - 1 : AVAILABLE_PROVIDERS.length - 1);
+      setHighlightedIndex((prev) => prev > 0 ? prev - 1 : providerList.length - 1);
       return;
     }
     if (key.name === "down") {
-      setHighlightedIndex((prev) => prev < AVAILABLE_PROVIDERS.length - 1 ? prev + 1 : 0);
+      setHighlightedIndex((prev) => prev < providerList.length - 1 ? prev + 1 : 0);
       return;
     }
     if (key.name === "return") {
-      const selected = AVAILABLE_PROVIDERS[highlightedIndex];
+      const selected = providerList[highlightedIndex];
       if (selected) {
         onProviderSelected(selected.id);
       }
@@ -277952,7 +278494,7 @@ function ProviderSelection({
               marginBottom: 1,
               children: "Popular providers"
             }, undefined, false, undefined, this),
-            AVAILABLE_PROVIDERS.map((provider, index) => {
+            providerList.map((provider, index) => {
               const isHighlighted = index === highlightedIndex;
               const configured = configuredProviders.find((p) => p.id === provider.id)?.configured;
               return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
@@ -278139,12 +278681,649 @@ function APIKeyInput({
   }, undefined, false, undefined, this);
 }
 
+// src/tui/components/commands/auth-flow.tsx
+var import_react48 = __toESM(require_react(), 1);
+init_config2();
+init_auth();
+function AuthFlow({ onClose }) {
+  const { colors: colors2 } = useTheme();
+  const appConfig = useConfig();
+  const alreadyConnected = isConnected(appConfig.data);
+  const [step, setStep] = import_react48.useState(alreadyConnected ? "success" : "start");
+  const [error40, setError] = import_react48.useState(null);
+  const [flowInfo, setFlowInfo] = import_react48.useState(null);
+  const [workspaces, setWorkspaces] = import_react48.useState([]);
+  const [selectedWorkspace, setSelectedWorkspace] = import_react48.useState(null);
+  const [selectedIndex, setSelectedIndex] = import_react48.useState(0);
+  const [billingUrl, setBillingUrl] = import_react48.useState(null);
+  const [balance, setBalance] = import_react48.useState(null);
+  const abortRef = import_react48.useRef(null);
+  const connectedWorkspace = appConfig.data.workspaceSlug ? {
+    name: appConfig.data.workspaceSlug,
+    slug: appConfig.data.workspaceSlug
+  } : null;
+  const goHome = () => {
+    onClose();
+  };
+  const cleanup = () => {
+    abortRef.current?.abort();
+    abortRef.current = null;
+  };
+  import_react48.useEffect(() => {
+    return cleanup;
+  }, []);
+  const openUrl = (url2) => {
+    try {
+      const platform = process.platform;
+      if (platform === "darwin") {
+        Bun.spawn(["open", url2]);
+      } else if (platform === "win32") {
+        Bun.spawn(["cmd", "/c", "start", url2]);
+      } else {
+        Bun.spawn(["xdg-open", url2]);
+      }
+    } catch {}
+  };
+  const startFlow = async () => {
+    setStep("requesting");
+    setError(null);
+    cleanup();
+    const ac = new AbortController;
+    abortRef.current = ac;
+    const apiUrl = getPensarApiUrl();
+    try {
+      const info = await startDeviceFlow(apiUrl);
+      if (ac.signal.aborted)
+        return;
+      setFlowInfo(info);
+      if (info.mode === "workos") {
+        openUrl(info.deviceInfo.verification_uri_complete);
+      } else {
+        openUrl(info.deviceInfo.verificationUriComplete);
+      }
+      setStep("polling");
+      if (info.mode === "workos") {
+        handleWorkOSPoll(apiUrl, info, ac);
+      } else {
+        handleLegacyPoll(apiUrl, info, ac);
+      }
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Failed to start authorization");
+      setStep("error");
+    }
+  };
+  const handleWorkOSPoll = async (apiUrl, info, ac) => {
+    try {
+      const tokens = await pollWorkOSToken({
+        clientId: info.clientId,
+        deviceCode: info.deviceInfo.device_code,
+        interval: info.deviceInfo.interval,
+        expiresIn: info.deviceInfo.expires_in,
+        signal: ac.signal
+      });
+      if (ac.signal.aborted)
+        return;
+      await config2.update({
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken
+      });
+      await appConfig.reload();
+      await handleFetchWorkspaces(apiUrl, tokens.accessToken, ac);
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Authentication failed");
+      setStep("error");
+    }
+  };
+  const handleLegacyPoll = async (apiUrl, info, ac) => {
+    try {
+      const data = await pollLegacyToken({
+        apiUrl,
+        deviceCode: info.deviceInfo.deviceCode,
+        interval: info.deviceInfo.interval,
+        expiresIn: info.deviceInfo.expiresIn,
+        signal: ac.signal
+      });
+      if (ac.signal.aborted)
+        return;
+      await config2.update({
+        pensarAPIKey: data.apiKey,
+        gatewaySigningKey: data.signingKey ?? null
+      });
+      if (data.workspace) {
+        await config2.update({
+          workspaceId: data.workspace.id,
+          workspaceSlug: data.workspace.slug
+        });
+      }
+      appConfig.reload();
+      setSelectedWorkspace(data.workspace ? {
+        ...data.workspace,
+        balance: data.credits?.balance ?? 0,
+        hasPaymentMethod: true
+      } : null);
+      setBalance(data.credits?.balance ?? null);
+      setStep("success");
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Authentication failed");
+      setStep("error");
+    }
+  };
+  const handleFetchWorkspaces = async (apiUrl, accessToken, ac) => {
+    try {
+      const ws = await fetchWorkspaces(apiUrl, accessToken);
+      if (ac.signal.aborted)
+        return;
+      if (ws.length === 0) {
+        const consoleUrl = getPensarConsoleUrl();
+        openUrl(`${consoleUrl}/credits`);
+        setStep("creating-workspace");
+        handleWorkspaceCreationPoll(apiUrl, accessToken, ac);
+        return;
+      }
+      if (ws.length === 1) {
+        await handleSelectWorkspace(apiUrl, accessToken, ws[0], ac);
+        return;
+      }
+      setWorkspaces(ws);
+      setSelectedIndex(0);
+      setStep("select-workspace");
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Failed to fetch workspaces");
+      setStep("error");
+    }
+  };
+  const handleWorkspaceCreationPoll = async (apiUrl, accessToken, ac) => {
+    try {
+      const ws = await pollForWorkspaceCreation(apiUrl, accessToken, ac.signal);
+      if (ac.signal.aborted)
+        return;
+      if (ws.length === 1) {
+        await handleSelectWorkspace(apiUrl, accessToken, ws[0], ac);
+      } else {
+        setWorkspaces(ws);
+        setSelectedIndex(0);
+        setStep("select-workspace");
+      }
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Workspace creation timed out");
+      setStep("error");
+    }
+  };
+  const handleSelectWorkspace = async (apiUrl, accessToken, workspace, ac) => {
+    setSelectedWorkspace(workspace);
+    setStep("checking-billing");
+    try {
+      const data = await selectWorkspace(apiUrl, accessToken, workspace.id);
+      if (ac.signal.aborted)
+        return;
+      await config2.update({
+        workspaceId: workspace.id,
+        workspaceSlug: workspace.slug,
+        gatewaySigningKey: data.signingKey ?? null
+      });
+      appConfig.reload();
+      setBalance(data.billing.balance);
+      if (!data.confirmed && data.billingUrl) {
+        setBillingUrl(data.billingUrl);
+      }
+      setStep("success");
+    } catch (err) {
+      if (ac.signal.aborted)
+        return;
+      setError(err instanceof Error ? err.message : "Failed to select workspace");
+      setStep("error");
+    }
+  };
+  const handleDisconnect = async () => {
+    await disconnect();
+    appConfig.reload();
+    setFlowInfo(null);
+    setSelectedWorkspace(null);
+    setBalance(null);
+    setBillingUrl(null);
+    setStep("start");
+  };
+  const hasLowBalance = balance !== null && balance < 1;
+  const effectiveBillingUrl = billingUrl || (selectedWorkspace?.slug ? `${getPensarConsoleUrl()}/${selectedWorkspace.slug}/settings/billing` : connectedWorkspace?.slug ? `${getPensarConsoleUrl()}/${connectedWorkspace.slug}/settings/billing` : `${getPensarConsoleUrl()}/credits`);
+  const openBillingPage = () => {
+    openUrl(effectiveBillingUrl);
+    goHome();
+  };
+  const userCode = flowInfo?.mode === "workos" ? flowInfo.deviceInfo.user_code : flowInfo?.mode === "legacy" ? flowInfo.deviceInfo.userCode : null;
+  const verificationUrl = flowInfo?.mode === "workos" ? flowInfo.deviceInfo.verification_uri_complete : flowInfo?.mode === "legacy" ? flowInfo.deviceInfo.verificationUriComplete : null;
+  useKeyboard((key) => {
+    key.preventDefault();
+    if (key.name === "escape") {
+      cleanup();
+      goHome();
+      return;
+    }
+    if (step === "start") {
+      if (key.name === "return") {
+        startFlow();
+      }
+    }
+    if (step === "select-workspace") {
+      if (key.name === "up" && selectedIndex > 0) {
+        setSelectedIndex((i) => i - 1);
+      }
+      if (key.name === "down" && selectedIndex < workspaces.length - 1) {
+        setSelectedIndex((i) => i + 1);
+      }
+      if (key.name === "return" && workspaces[selectedIndex]) {
+        const currentConfig = appConfig.data;
+        const apiUrl = getPensarApiUrl();
+        const accessToken = currentConfig.accessToken;
+        const ac = abortRef.current ?? new AbortController;
+        handleSelectWorkspace(apiUrl, accessToken, workspaces[selectedIndex], ac);
+      }
+    }
+    if (step === "error") {
+      if (key.name === "return") {
+        startFlow();
+      }
+    }
+    if (step === "success") {
+      if (key.name === "return") {
+        if (hasLowBalance || billingUrl) {
+          openBillingPage();
+        } else {
+          goHome();
+        }
+      }
+      if (key.raw === "d" || key.raw === "D") {
+        handleDisconnect();
+      }
+    }
+  });
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(Dialog, {
+    size: "large",
+    onClose: goHome,
+    children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      alignItems: "flex-start",
+      padding: 1,
+      children: [
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginBottom: 1,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.primary,
+            children: "Pensar Console — Managed Inference"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginBottom: 1,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.textMuted,
+            children: [
+              "Connect to Pensar Console for usage-based AI inference.",
+              `
+`,
+              "No API keys needed — just a Pensar account with credits."
+            ]
+          }, undefined, true, undefined, this)
+        }, undefined, false, undefined, this),
+        step === "start" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.text,
+                children: [
+                  "Press ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ENTER]"
+                  }, undefined, false, undefined, this),
+                  " to authorize via your browser."
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ENTER]"
+                  }, undefined, false, undefined, this),
+                  " Connect ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Cancel"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        step === "requesting" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.warning,
+            children: "Starting authorization..."
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        step === "polling" && flowInfo && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.warning,
+                children: "Waiting for browser authorization..."
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.text,
+                children: [
+                  "Your code: ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: userCode
+                  }, undefined, false, undefined, this)
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  "If the browser didn't open, visit:",
+                  `
+`,
+                  verificationUrl
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Cancel"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        step === "select-workspace" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.text,
+                children: "Select a workspace:"
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              flexDirection: "column",
+              marginTop: 1,
+              children: workspaces.map((ws, i) => /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+                children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: i === selectedIndex ? colors2.primary : colors2.textMuted,
+                  children: [
+                    i === selectedIndex ? "▸ " : "  ",
+                    ws.name,
+                    " ",
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                      fg: colors2.textMuted,
+                      children: [
+                        "(",
+                        ws.slug,
+                        ") — $",
+                        ws.balance.toFixed(2)
+                      ]
+                    }, undefined, true, undefined, this)
+                  ]
+                }, undefined, true, undefined, this)
+              }, ws.id, false, undefined, this))
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[↑/↓]"
+                  }, undefined, false, undefined, this),
+                  " Navigate ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ENTER]"
+                  }, undefined, false, undefined, this),
+                  " Select ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Cancel"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        step === "creating-workspace" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.warning,
+                children: "No workspaces found. Opening browser to create one..."
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.text,
+                children: "Create a workspace and add credits in your browser."
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: "Waiting for workspace creation..."
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  "If the browser didn't open, visit:",
+                  `
+`,
+                  getPensarConsoleUrl(),
+                  "/credits"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Cancel"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        step === "checking-billing" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.warning,
+            children: [
+              "Checking billing for ",
+              selectedWorkspace?.name,
+              "..."
+            ]
+          }, undefined, true, undefined, this)
+        }, undefined, false, undefined, this),
+        step === "success" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.success,
+                children: "Connected to Pensar Console"
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            (selectedWorkspace || connectedWorkspace) && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              flexDirection: "column",
+              children: [
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: colors2.text,
+                  children: [
+                    "Workspace:",
+                    " ",
+                    selectedWorkspace?.name || connectedWorkspace?.name
+                  ]
+                }, undefined, true, undefined, this),
+                balance !== null && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: colors2.text,
+                  children: [
+                    "Credits:",
+                    " ",
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                      fg: hasLowBalance ? colors2.warning : colors2.text,
+                      children: [
+                        "$",
+                        balance.toFixed(2)
+                      ]
+                    }, undefined, true, undefined, this)
+                  ]
+                }, undefined, true, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            (hasLowBalance || billingUrl) && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.warning,
+                children: [
+                  billingUrl ? "Your workspace needs credits to use Apex CLI." : "Your credit balance is very low. We recommend at least $30 to run",
+                  `
+`,
+                  billingUrl ? "Press ENTER to open billing and add credits." : "pentests without interruptions. Press ENTER to open billing."
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this),
+            !selectedWorkspace && !connectedWorkspace && appConfig.data.pensarAPIKey && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: "Already connected (legacy key saved in config)"
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: "Pensar models are now available in the model selector."
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ENTER]"
+                  }, undefined, false, undefined, this),
+                  " ",
+                  hasLowBalance || billingUrl ? "Open billing" : "Done",
+                  " ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.error,
+                    children: "[D]"
+                  }, undefined, false, undefined, this),
+                  " Disconnect ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Back"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        step === "error" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.error,
+                children: error40
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              marginTop: 1,
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: colors2.textMuted,
+                children: [
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ENTER]"
+                  }, undefined, false, undefined, this),
+                  " Try again ·",
+                  " ",
+                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                    fg: colors2.primary,
+                    children: "[ESC]"
+                  }, undefined, false, undefined, this),
+                  " Cancel"
+                ]
+              }, undefined, true, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this)
+      ]
+    }, undefined, true, undefined, this)
+  }, undefined, false, undefined, this);
+}
+
 // src/tui/components/commands/provider-manager.tsx
 function ProviderManager() {
   const route = useRoute();
   const _config = useConfig();
-  const [flowState, setFlowState] = import_react48.useState("selecting");
-  const [selectedProvider, setSelectedProvider] = import_react48.useState(null);
+  const isOnboarding = !hasAnyProviderConfigured(_config.data);
+  const [flowState, setFlowState] = import_react50.useState(isOnboarding ? "choosing" : "selecting");
+  const [selectedProvider, setSelectedProvider] = import_react50.useState(null);
   const handleProviderSelected = (providerId) => {
     setSelectedProvider(providerId);
     setFlowState("inputting");
@@ -278178,7 +279357,11 @@ function ProviderManager() {
     });
   };
   const handleAPIKeyCancel = () => {
-    setFlowState("selecting");
+    if (isOnboarding) {
+      setFlowState("choosing");
+    } else {
+      setFlowState("selecting");
+    }
     setSelectedProvider(null);
   };
   const handleClose = () => {
@@ -278187,28 +279370,158 @@ function ProviderManager() {
       path: "home"
     });
   };
+  const handleAuthClose = () => {
+    route.navigate({ type: "base", path: "home" });
+  };
+  const otherProviders = AVAILABLE_PROVIDERS.filter((p) => p.id !== "pensar");
   const selectedProviderInfo = AVAILABLE_PROVIDERS.find((p) => p.id === selectedProvider);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(import_jsx_dev_runtime2.Fragment, {
     children: [
+      flowState === "choosing" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(OnboardingChoice, {
+        onPensarSelected: () => setFlowState("auth"),
+        onOtherSelected: () => setFlowState("selecting")
+      }, undefined, false, undefined, this),
       flowState === "selecting" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ProviderSelection, {
+        providers: isOnboarding ? otherProviders : undefined,
         onProviderSelected: handleProviderSelected,
-        onClose: handleClose
+        onClose: isOnboarding ? () => setFlowState("choosing") : handleClose
       }, undefined, false, undefined, this),
       flowState === "inputting" && selectedProvider && selectedProviderInfo && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(APIKeyInput, {
         provider: selectedProvider,
         providerName: selectedProviderInfo.name,
         onSubmit: handleAPIKeySubmit,
         onCancel: handleAPIKeyCancel
+      }, undefined, false, undefined, this),
+      flowState === "auth" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(AuthFlow, {
+        onClose: handleAuthClose
       }, undefined, false, undefined, this)
     ]
   }, undefined, true, undefined, this);
 }
+function OnboardingChoice({
+  onPensarSelected,
+  onOtherSelected
+}) {
+  const { colors: colors2 } = useTheme();
+  const [highlightedIndex, setHighlightedIndex] = import_react50.useState(0);
+  const choices = [
+    {
+      label: "Pensar",
+      description: "Managed inference — no API keys needed",
+      action: onPensarSelected
+    },
+    {
+      label: "Use other provider",
+      description: "Connect with your own API key (Anthropic, OpenAI, etc.)",
+      action: onOtherSelected
+    }
+  ];
+  useKeyboard((key) => {
+    if (key.name === "up") {
+      setHighlightedIndex((prev) => prev > 0 ? prev - 1 : choices.length - 1);
+      return;
+    }
+    if (key.name === "down") {
+      setHighlightedIndex((prev) => prev < choices.length - 1 ? prev + 1 : 0);
+      return;
+    }
+    if (key.name === "return") {
+      choices[highlightedIndex].action();
+      return;
+    }
+  });
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+    position: "absolute",
+    top: 0,
+    left: 0,
+    zIndex: 1000,
+    width: "100%",
+    height: "100%",
+    justifyContent: "center",
+    alignItems: "center",
+    backgroundColor: "transparent",
+    children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+      width: 70,
+      border: true,
+      borderColor: colors2.primary,
+      backgroundColor: colors2.backgroundPanel,
+      flexDirection: "column",
+      padding: 2,
+      children: [
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "row",
+          marginBottom: 2,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.primary,
+            children: "Get Started"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginBottom: 2,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.textMuted,
+            children: "Choose how to connect an AI provider."
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          flexDirection: "column",
+          gap: 1,
+          children: choices.map((choice2, index) => {
+            const isHighlighted = index === highlightedIndex;
+            return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+              flexDirection: "column",
+              paddingLeft: 1,
+              paddingRight: 1,
+              backgroundColor: isHighlighted ? colors2.backgroundSelected : undefined,
+              onMouseDown: choice2.action,
+              children: [
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: isHighlighted ? colors2.primary : colors2.text,
+                  children: [
+                    isHighlighted ? "▸ " : "  ",
+                    choice2.label
+                  ]
+                }, undefined, true, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: colors2.textMuted,
+                  children: [
+                    "    ",
+                    choice2.description
+                  ]
+                }, undefined, true, undefined, this)
+              ]
+            }, choice2.label, true, undefined, this);
+          })
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginTop: 2,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.textMuted,
+            children: [
+              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                fg: colors2.primary,
+                children: "[↑↓]"
+              }, undefined, false, undefined, this),
+              " Navigate ·",
+              " ",
+              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                fg: colors2.primary,
+                children: "[ENTER]"
+              }, undefined, false, undefined, this),
+              " Select"
+            ]
+          }, undefined, true, undefined, this)
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this)
+  }, undefined, false, undefined, this);
+}
 
 // src/tui/index.tsx
 init_config2();
 
 // src/tui/components/switch.tsx
-var import_react49 = __toESM(require_react(), 1);
+var import_react52 = __toESM(require_react(), 1);
 var CaseSymbol = Symbol("Switch.Case");
 var DefaultSymbol = Symbol("Switch.Default");
 function CaseComponent({
@@ -278231,8 +279544,8 @@ function SwitchComponent({
 }) {
   let matchedChild = null;
   let defaultChild = null;
-  import_react49.default.Children.forEach(children, (child) => {
-    if (import_react49.default.isValidElement(child)) {
+  import_react52.default.Children.forEach(children, (child) => {
+    if (import_react52.default.isValidElement(child)) {
       if (child.type[CaseSymbol]) {
         const caseChild = child;
         if (caseChild.props.when === condition) {
@@ -278345,8 +279658,8 @@ function ResponsibleUseDisclosure({
 }
 
 // src/tui/context/toast.tsx
-var import_react51 = __toESM(require_react(), 1);
-var ToastContext = import_react51.createContext(null);
+var import_react54 = __toESM(require_react(), 1);
+var ToastContext = import_react54.createContext(null);
 var nextId = 0;
 var DEFAULT_DURATION = {
   default: 3000,
@@ -278354,24 +279667,24 @@ var DEFAULT_DURATION = {
   error: 5000
 };
 function ToastProvider({ children }) {
-  const [toasts, setToasts] = import_react51.useState([]);
-  const dismiss = import_react51.useCallback((id) => {
+  const [toasts, setToasts] = import_react54.useState([]);
+  const dismiss = import_react54.useCallback((id) => {
     setToasts((prev) => prev.filter((t2) => t2.id !== id));
   }, []);
-  const toast = import_react51.useCallback((message, variant = "default", duration3) => {
+  const toast = import_react54.useCallback((message, variant = "default", duration3) => {
     const id = nextId++;
     const ms = duration3 ?? DEFAULT_DURATION[variant];
     setToasts((prev) => [...prev, { id, message, variant, duration: ms }]);
     setTimeout(() => dismiss(id), ms);
   }, [dismiss]);
-  const value = import_react51.useMemo(() => ({ toasts, toast, dismiss }), [toasts, toast, dismiss]);
+  const value = import_react54.useMemo(() => ({ toasts, toast, dismiss }), [toasts, toast, dismiss]);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ToastContext.Provider, {
     value,
     children
   }, undefined, false, undefined, this);
 }
 function useToast() {
-  const ctx4 = import_react51.useContext(ToastContext);
+  const ctx4 = import_react54.useContext(ToastContext);
   if (!ctx4)
     throw new Error("useToast() must be used within <ToastProvider>");
   return ctx4;
@@ -278444,11 +279757,11 @@ function ToastContainer() {
 }
 
 // src/tui/components/error-boundary.tsx
-var import_react52 = __toESM(require_react(), 1);
+var import_react55 = __toESM(require_react(), 1);
 var MAX_ERRORS = 3;
 var ERROR_WINDOW_MS = 5000;
 
-class ErrorBoundaryInner extends import_react52.default.Component {
+class ErrorBoundaryInner extends import_react55.default.Component {
   state = {
     hasError: false,
     errorTimestamps: [],
@@ -278479,10 +279792,10 @@ class ErrorBoundaryInner extends import_react52.default.Component {
 }
 function ErrorBoundary2({ children }) {
   const { toast } = useToast();
-  const handleError = import_react52.useCallback((message) => {
+  const handleError = import_react55.useCallback((message) => {
     toast(message, "error");
   }, [toast]);
-  return import_react52.default.createElement(ErrorBoundaryInner, { onError: handleError }, children);
+  return import_react55.default.createElement(ErrorBoundaryInner, { onError: handleError }, children);
 }
 
 // src/tui/index.tsx
@@ -278593,16 +279906,16 @@ function ShortcutsDialog({
 }
 
 // src/tui/components/commands/help-dialog.tsx
-var import_react54 = __toESM(require_react(), 1);
+var import_react57 = __toESM(require_react(), 1);
 function HelpDialog() {
   const { colors: colors2 } = useTheme();
   const { commands: commands2 } = useCommand();
   const route = useRoute();
   const dimensions = useDimensions();
-  const [selectedIndex, setSelectedIndex] = import_react54.useState(0);
-  const [showDetail, setShowDetail] = import_react54.useState(false);
-  const scrollboxRef = import_react54.useRef(null);
-  const commandsByCategory = import_react54.useMemo(() => {
+  const [selectedIndex, setSelectedIndex] = import_react57.useState(0);
+  const [showDetail, setShowDetail] = import_react57.useState(false);
+  const scrollboxRef = import_react57.useRef(null);
+  const commandsByCategory = import_react57.useMemo(() => {
     const grouped = {};
     for (const cmd of commands2) {
       const category = cmd.category || "Other";
@@ -278613,15 +279926,15 @@ function HelpDialog() {
     }
     return grouped;
   }, [commands2]);
-  const flatCommands = import_react54.useMemo(() => {
+  const flatCommands = import_react57.useMemo(() => {
     return commands2;
   }, [commands2]);
-  import_react54.useEffect(() => {
+  import_react57.useEffect(() => {
     if (selectedIndex >= flatCommands.length) {
       setSelectedIndex(Math.max(0, flatCommands.length - 1));
     }
   }, [flatCommands.length, selectedIndex]);
-  import_react54.useEffect(() => {
+  import_react57.useEffect(() => {
     scrollToIndex(scrollboxRef.current, selectedIndex, flatCommands, (cmd) => cmd.name);
   }, [selectedIndex, flatCommands]);
   const handleClose = () => {
@@ -279055,677 +280368,16 @@ function ModelsDisplay() {
   }, undefined, true, undefined, this);
 }
 
-// src/tui/components/commands/auth-flow.tsx
-var import_react57 = __toESM(require_react(), 1);
-init_config2();
-function AuthFlow({ onClose }) {
-  const { colors: colors2 } = useTheme();
-  const appConfig = useConfig();
-  const isConnected = !!(appConfig.data.accessToken || appConfig.data.pensarAPIKey);
-  const [step, setStep] = import_react57.useState(isConnected ? "success" : "start");
-  const [error40, setError] = import_react57.useState(null);
-  const [authMode, setAuthMode] = import_react57.useState(null);
-  const [deviceInfo, setDeviceInfo] = import_react57.useState(null);
-  const [legacyDeviceInfo, setLegacyDeviceInfo] = import_react57.useState(null);
-  const [workspaces, setWorkspaces] = import_react57.useState([]);
-  const [selectedWorkspace, setSelectedWorkspace] = import_react57.useState(null);
-  const [selectedIndex, setSelectedIndex] = import_react57.useState(0);
-  const [billingUrl, setBillingUrl] = import_react57.useState(null);
-  const [balance, setBalance] = import_react57.useState(null);
-  const pollingRef = import_react57.useRef(null);
-  const cancelledRef = import_react57.useRef(false);
-  const connectedWorkspace = appConfig.data.workspaceSlug ? { name: appConfig.data.workspaceSlug, slug: appConfig.data.workspaceSlug } : null;
-  const goHome = () => {
-    onClose();
-  };
-  const cleanup = () => {
-    cancelledRef.current = true;
-    if (pollingRef.current) {
-      clearTimeout(pollingRef.current);
-      pollingRef.current = null;
-    }
-  };
-  import_react57.useEffect(() => {
-    return cleanup;
-  }, []);
-  const openUrl = (url2) => {
-    try {
-      const platform = process.platform;
-      if (platform === "darwin") {
-        Bun.spawn(["open", url2]);
-      } else if (platform === "win32") {
-        Bun.spawn(["cmd", "/c", "start", url2]);
-      } else {
-        Bun.spawn(["xdg-open", url2]);
-      }
-    } catch {}
-  };
-  const startDeviceFlow = async () => {
-    setStep("requesting");
-    setError(null);
-    cancelledRef.current = false;
-    const apiUrl = getPensarApiUrl();
-    console.error(`[auth] apiUrl=${apiUrl}`);
-    try {
-      console.error(`[auth] fetching ${apiUrl}/api/cli/config`);
-      const configResponse = await fetch(`${apiUrl}/api/cli/config`);
-      console.error(`[auth] config response: ${configResponse.status} ${configResponse.statusText}`);
-      if (configResponse.ok) {
-        const cliConfig = await configResponse.json();
-        console.error(`[auth] got workosClientId=${cliConfig.workosClientId.slice(0, 12)}...`);
-        const response = await fetch("https://api.workos.com/user_management/authorize/device", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ client_id: cliConfig.workosClientId })
-        });
-        console.error(`[auth] device authorize response: ${response.status}`);
-        if (response.ok) {
-          const data = await response.json();
-          console.error(`[auth] device code obtained, polling interval=${data.interval}s, expires=${data.expires_in}s`);
-          setAuthMode("workos");
-          setDeviceInfo(data);
-          openUrl(data.verification_uri_complete);
-          setStep("polling");
-          pollForToken(apiUrl, cliConfig.workosClientId, data.device_code, data.interval, data.expires_in);
-          return;
-        }
-      }
-    } catch (e) {
-      console.error(`[auth] WorkOS flow failed, falling back to legacy:`, e);
-    }
-    try {
-      const response = await fetch(`${apiUrl}/auth/device/code`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" }
-      });
-      if (!response.ok) {
-        throw new Error("Failed to start device authorization");
-      }
-      const data = await response.json();
-      setAuthMode("legacy");
-      setLegacyDeviceInfo(data);
-      openUrl(data.verificationUriComplete);
-      setStep("polling");
-      pollForLegacyToken(apiUrl, data.deviceCode, data.interval, data.expiresIn);
-    } catch (err) {
-      setError(err instanceof Error ? err.message : "Failed to start authorization");
-      setStep("error");
-    }
-  };
-  const pollForToken = (apiUrl, clientId, deviceCode, interval, expiresIn) => {
-    const deadline = Date.now() + expiresIn * 1000;
-    const poll = async () => {
-      if (cancelledRef.current)
-        return;
-      if (Date.now() > deadline) {
-        setError("Authorization timed out. Please try again.");
-        setStep("error");
-        return;
-      }
-      try {
-        console.error(`[auth] polling WorkOS authenticate...`);
-        const response = await fetch("https://api.workos.com/user_management/authenticate", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            client_id: clientId,
-            grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-            device_code: deviceCode
-          })
-        });
-        if (cancelledRef.current)
-          return;
-        console.error(`[auth] poll response: ${response.status}`);
-        if (response.status === 400) {
-          pollingRef.current = setTimeout(poll, interval * 1000);
-          return;
-        }
-        if (!response.ok) {
-          const body = await response.text();
-          console.error(`[auth] auth failed: ${response.status} ${body}`);
-          throw new Error("Authentication failed");
-        }
-        const data = await response.json();
-        console.error(`[auth] got tokens, access_token=${data.access_token.length} chars`);
-        await config2.update({
-          accessToken: data.access_token,
-          refreshToken: data.refresh_token
-        });
-        await appConfig.reload();
-        console.error(`[auth] tokens saved, fetching workspaces...`);
-        await fetchWorkspaces(apiUrl, data.access_token);
-      } catch (err) {
-        if (cancelledRef.current)
-          return;
-        console.error(`[auth] poll error, retrying:`, err);
-        pollingRef.current = setTimeout(poll, interval * 1000);
-      }
-    };
-    pollingRef.current = setTimeout(poll, interval * 1000);
-  };
-  const pollForLegacyToken = (apiUrl, deviceCode, interval, expiresIn) => {
-    const deadline = Date.now() + expiresIn * 1000;
-    const poll = async () => {
-      if (cancelledRef.current)
-        return;
-      if (Date.now() > deadline) {
-        setError("Authorization timed out. Please try again.");
-        setStep("error");
-        return;
-      }
-      try {
-        const response = await fetch(`${apiUrl}/auth/device/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ deviceCode })
-        });
-        if (!response.ok) {
-          throw new Error("Failed to check authorization status");
-        }
-        const data = await response.json();
-        if (cancelledRef.current)
-          return;
-        if (data.status === "complete" && data.apiKey) {
-          await config2.update({ pensarAPIKey: data.apiKey });
-          if (data.workspace) {
-            await config2.update({
-              workspaceId: data.workspace.id,
-              workspaceSlug: data.workspace.slug
-            });
-          }
-          appConfig.reload();
-          setSelectedWorkspace(data.workspace ? {
-            ...data.workspace,
-            balance: data.credits?.balance ?? 0,
-            hasPaymentMethod: true
-          } : null);
-          setBalance(data.credits?.balance ?? null);
-          setStep("success");
-          return;
-        }
-        if (data.status === "expired") {
-          setError("Authorization expired. Please try again.");
-          setStep("error");
-          return;
-        }
-        if (data.status === "not_found") {
-          setError("Invalid authorization session. Please try again.");
-          setStep("error");
-          return;
-        }
-        pollingRef.current = setTimeout(poll, interval * 1000);
-      } catch (err) {
-        if (cancelledRef.current)
-          return;
-        pollingRef.current = setTimeout(poll, interval * 1000);
-      }
-    };
-    pollingRef.current = setTimeout(poll, interval * 1000);
-  };
-  const fetchWorkspaces = async (apiUrl, accessToken) => {
-    try {
-      const url2 = `${apiUrl}/api/cli/workspaces`;
-      console.error(`[auth] fetchWorkspaces: ${url2} (token=${accessToken.length} chars)`);
-      const response = await fetch(url2, {
-        headers: { Authorization: `Bearer ${accessToken}` }
-      });
-      console.error(`[auth] workspaces response: ${response.status} ${response.statusText}`);
-      if (!response.ok) {
-        const body = await response.text();
-        console.error(`[auth] workspaces error body: ${body}`);
-        throw new Error(`Failed to fetch workspaces (${response.status})`);
-      }
-      const data = await response.json();
-      console.error(`[auth] got ${data.workspaces.length} workspace(s)`);
-      if (data.workspaces.length === 0) {
-        setError("No workspaces found. Create one at console.pensar.dev");
-        setStep("error");
-        return;
-      }
-      if (data.workspaces.length === 1) {
-        await selectWorkspace(apiUrl, accessToken, data.workspaces[0]);
-        return;
-      }
-      setWorkspaces(data.workspaces);
-      setSelectedIndex(0);
-      setStep("select-workspace");
-    } catch (err) {
-      console.error(`[auth] fetchWorkspaces error:`, err);
-      setError(err instanceof Error ? err.message : "Failed to fetch workspaces");
-      setStep("error");
-    }
-  };
-  const selectWorkspace = async (apiUrl, accessToken, workspace) => {
-    setSelectedWorkspace(workspace);
-    setStep("checking-billing");
-    try {
-      console.error(`[auth] selectWorkspace: ${workspace.id} (${workspace.name})`);
-      const response = await fetch(`${apiUrl}/api/cli/select-workspace`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          Authorization: `Bearer ${accessToken}`
-        },
-        body: JSON.stringify({ workspaceId: workspace.id })
-      });
-      console.error(`[auth] select-workspace response: ${response.status}`);
-      if (!response.ok) {
-        const body = await response.text();
-        console.error(`[auth] select-workspace error: ${body}`);
-        throw new Error("Failed to select workspace");
-      }
-      const data = await response.json();
-      await config2.update({
-        workspaceId: workspace.id,
-        workspaceSlug: workspace.slug
-      });
-      appConfig.reload();
-      setBalance(data.billing.balance);
-      if (!data.confirmed && data.billingUrl) {
-        setBillingUrl(data.billingUrl);
-      }
-      setStep("success");
-    } catch (err) {
-      setError(err instanceof Error ? err.message : "Failed to select workspace");
-      setStep("error");
-    }
-  };
-  const handleDisconnect = async () => {
-    await config2.update({
-      pensarAPIKey: null,
-      accessToken: null,
-      refreshToken: null,
-      workspaceId: null,
-      workspaceSlug: null
-    });
-    appConfig.reload();
-    setAuthMode(null);
-    setSelectedWorkspace(null);
-    setBalance(null);
-    setBillingUrl(null);
-    setDeviceInfo(null);
-    setLegacyDeviceInfo(null);
-    setStep("start");
-  };
-  const hasLowBalance = balance !== null && balance < 1;
-  const effectiveBillingUrl = billingUrl || (selectedWorkspace?.slug ? `${getPensarConsoleUrl()}/${selectedWorkspace.slug}/settings/billing` : connectedWorkspace?.slug ? `${getPensarConsoleUrl()}/${connectedWorkspace.slug}/settings/billing` : `${getPensarConsoleUrl()}/credits`);
-  const openBillingPage = () => {
-    openUrl(effectiveBillingUrl);
-    goHome();
-  };
-  useKeyboard((key) => {
-    key.preventDefault();
-    if (key.name === "escape") {
-      cleanup();
-      goHome();
-      return;
-    }
-    if (step === "start") {
-      if (key.name === "return") {
-        startDeviceFlow();
-      }
-    }
-    if (step === "select-workspace") {
-      if (key.name === "up" && selectedIndex > 0) {
-        setSelectedIndex((i) => i - 1);
-      }
-      if (key.name === "down" && selectedIndex < workspaces.length - 1) {
-        setSelectedIndex((i) => i + 1);
-      }
-      if (key.name === "return" && workspaces[selectedIndex]) {
-        const currentConfig = appConfig.data;
-        const apiUrl = getPensarApiUrl();
-        const accessToken = currentConfig.accessToken;
-        selectWorkspace(apiUrl, accessToken, workspaces[selectedIndex]);
-      }
-    }
-    if (step === "error") {
-      if (key.name === "return") {
-        startDeviceFlow();
-      }
-    }
-    if (step === "success") {
-      if (key.name === "return") {
-        if (hasLowBalance || billingUrl) {
-          openBillingPage();
-        } else {
-          goHome();
-        }
-      }
-      if (key.raw === "d" || key.raw === "D") {
-        handleDisconnect();
-      }
-    }
-  });
-  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(Dialog, {
-    size: "large",
-    onClose: goHome,
-    children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-      flexDirection: "column",
-      width: "100%",
-      alignItems: "flex-start",
-      padding: 1,
-      children: [
-        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          marginBottom: 1,
-          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            fg: colors2.primary,
-            children: "Pensar Console — Managed Inference"
-          }, undefined, false, undefined, this)
-        }, undefined, false, undefined, this),
-        /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          marginBottom: 1,
-          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            fg: colors2.textMuted,
-            children: [
-              "Connect to Pensar Console for usage-based AI inference.",
-              `
-`,
-              "No API keys needed — just a Pensar account with credits."
-            ]
-          }, undefined, true, undefined, this)
-        }, undefined, false, undefined, this),
-        step === "start" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 1,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.text,
-                children: [
-                  "Press ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ENTER]"
-                  }, undefined, false, undefined, this),
-                  " to authorize via your browser."
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ENTER]"
-                  }, undefined, false, undefined, this),
-                  " Connect ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ESC]"
-                  }, undefined, false, undefined, this),
-                  " Cancel"
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this)
-          ]
-        }, undefined, true, undefined, this),
-        step === "requesting" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            fg: colors2.warning,
-            children: "Starting authorization..."
-          }, undefined, false, undefined, this)
-        }, undefined, false, undefined, this),
-        step === "polling" && (deviceInfo || legacyDeviceInfo) && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 1,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.warning,
-                children: "Waiting for browser authorization..."
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.text,
-                children: [
-                  "Your code:",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: deviceInfo?.user_code || legacyDeviceInfo?.userCode
-                  }, undefined, false, undefined, this)
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  "If the browser didn't open, visit:",
-                  `
-`,
-                  deviceInfo?.verification_uri_complete || legacyDeviceInfo?.verificationUriComplete
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ESC]"
-                  }, undefined, false, undefined, this),
-                  " Cancel"
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this)
-          ]
-        }, undefined, true, undefined, this),
-        step === "select-workspace" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 1,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.text,
-                children: "Select a workspace:"
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              flexDirection: "column",
-              marginTop: 1,
-              children: workspaces.map((ws, i) => /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-                children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                  fg: i === selectedIndex ? colors2.primary : colors2.textMuted,
-                  children: [
-                    i === selectedIndex ? "▸ " : "  ",
-                    ws.name,
-                    " ",
-                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                      fg: colors2.textMuted,
-                      children: [
-                        "(",
-                        ws.slug,
-                        ") — $",
-                        ws.balance.toFixed(2)
-                      ]
-                    }, undefined, true, undefined, this)
-                  ]
-                }, undefined, true, undefined, this)
-              }, ws.id, false, undefined, this))
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[↑/↓]"
-                  }, undefined, false, undefined, this),
-                  " Navigate ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ENTER]"
-                  }, undefined, false, undefined, this),
-                  " Select ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ESC]"
-                  }, undefined, false, undefined, this),
-                  " Cancel"
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this)
-          ]
-        }, undefined, true, undefined, this),
-        step === "checking-billing" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            fg: colors2.warning,
-            children: [
-              "Checking billing for ",
-              selectedWorkspace?.name,
-              "..."
-            ]
-          }, undefined, true, undefined, this)
-        }, undefined, false, undefined, this),
-        step === "success" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 1,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.success,
-                children: "Connected to Pensar Console"
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            (selectedWorkspace || connectedWorkspace) && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              flexDirection: "column",
-              children: [
-                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                  fg: colors2.text,
-                  children: [
-                    "Workspace:",
-                    " ",
-                    selectedWorkspace?.name || connectedWorkspace?.name
-                  ]
-                }, undefined, true, undefined, this),
-                balance !== null && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                  fg: colors2.text,
-                  children: [
-                    "Credits:",
-                    " ",
-                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                      fg: hasLowBalance ? colors2.warning : colors2.text,
-                      children: [
-                        "$",
-                        balance.toFixed(2)
-                      ]
-                    }, undefined, true, undefined, this)
-                  ]
-                }, undefined, true, undefined, this)
-              ]
-            }, undefined, true, undefined, this),
-            (hasLowBalance || billingUrl) && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.warning,
-                children: [
-                  billingUrl ? "Your workspace needs credits to use Apex CLI." : "Your credit balance is very low. We recommend at least $30 to run",
-                  `
-`,
-                  billingUrl ? "Press ENTER to open billing and add credits." : "pentests without interruptions. Press ENTER to open billing."
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this),
-            !selectedWorkspace && !connectedWorkspace && appConfig.data.pensarAPIKey && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: "Already connected (legacy key saved in config)"
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: "Pensar models are now available in the model selector."
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ENTER]"
-                  }, undefined, false, undefined, this),
-                  " ",
-                  hasLowBalance || billingUrl ? "Open billing" : "Done",
-                  " ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.error,
-                    children: "[D]"
-                  }, undefined, false, undefined, this),
-                  " Disconnect ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ESC]"
-                  }, undefined, false, undefined, this),
-                  " Back"
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this)
-          ]
-        }, undefined, true, undefined, this),
-        step === "error" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 1,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.error,
-                children: error40
-              }, undefined, false, undefined, this)
-            }, undefined, false, undefined, this),
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              marginTop: 1,
-              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: colors2.textMuted,
-                children: [
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ENTER]"
-                  }, undefined, false, undefined, this),
-                  " Try again ·",
-                  " ",
-                  /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                    fg: colors2.primary,
-                    children: "[ESC]"
-                  }, undefined, false, undefined, this),
-                  " Cancel"
-                ]
-              }, undefined, true, undefined, this)
-            }, undefined, false, undefined, this)
-          ]
-        }, undefined, true, undefined, this)
-      ]
-    }, undefined, true, undefined, this)
-  }, undefined, false, undefined, this);
-}
-
 // src/tui/components/commands/credits-flow.tsx
-var import_react59 = __toESM(require_react(), 1);
-init_tokenRefresh();
+var import_react60 = __toESM(require_react(), 1);
+init_auth();
+init_config2();
 function CreditsFlow({ onOpenAuthDialog }) {
   const route = useRoute();
   const appConfig = useConfig();
-  const [step, setStep] = import_react59.useState("loading");
-  const [credits, setCredits] = import_react59.useState(null);
-  const [error40, setError] = import_react59.useState(null);
+  const [step, setStep] = import_react60.useState("loading");
+  const [credits, setCredits] = import_react60.useState(null);
+  const [error40, setError] = import_react60.useState(null);
   const creditsUrl = `${getPensarConsoleUrl()}/credits`;
   const goHome = () => {
     route.navigate({ type: "base", path: "home" });
@@ -279772,6 +280424,9 @@ function CreditsFlow({ onOpenAuthDialog }) {
         throw new Error("Failed to fetch balance");
       }
       const result = await response.json();
+      if (result.signingKey) {
+        await config2.update({ gatewaySigningKey: result.signingKey });
+      }
       setCredits({
         balance: result.credits.balance,
         workspace: result.workspace.name
@@ -279782,7 +280437,7 @@ function CreditsFlow({ onOpenAuthDialog }) {
       setStep("display");
     }
   };
-  import_react59.useEffect(() => {
+  import_react60.useEffect(() => {
     fetchBalance();
   }, []);
   useKeyboard((key) => {
@@ -280021,10 +280676,10 @@ function CreditsFlow({ onOpenAuthDialog }) {
 }
 
 // src/tui/context/keybinding.tsx
-var import_react65 = __toESM(require_react(), 1);
+var import_react66 = __toESM(require_react(), 1);
 
 // src/tui/keybindings/keybind.tsx
-var import_react61 = __toESM(require_react(), 1);
+var import_react62 = __toESM(require_react(), 1);
 
 // src/tui/keybindings/actions.ts
 var movementActions = [
@@ -280276,7 +280931,7 @@ var allActions = [
 var actionsByKey = new Map(allActions.map((action) => [action.key, action]));
 var actionsById = new Map(allActions.map((action) => [action.id, action]));
 // src/tui/keybindings/keybind.tsx
-var LeaderKeyContext = import_react61.createContext(null);
+var LeaderKeyContext = import_react62.createContext(null);
 // src/tui/keybindings/registry.ts
 function createKeybindings(deps) {
   const {
@@ -280457,7 +281112,7 @@ function matchesKeybind(pressed, combo) {
 }
 
 // src/tui/context/keybinding.tsx
-var KeybindingContext = import_react65.createContext(undefined);
+var KeybindingContext = import_react66.createContext(undefined);
 function KeybindingProvider({
   children,
   deps
@@ -280497,9 +281152,9 @@ function KeybindingProvider({
 }
 
 // src/tui/components/pentest/pentest.tsx
-var import_react73 = __toESM(require_react(), 1);
+var import_react74 = __toESM(require_react(), 1);
 init_report();
-import { existsSync as existsSync26, readdirSync as readdirSync6, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync26, readdirSync as readdirSync6, readFileSync as readFileSync13 } from "fs";
 import { join as join27 } from "path";
 init_session();
 init_loader();
@@ -280529,7 +281184,7 @@ Found ${findings.length} vulnerabilities`);
 init_utils();
 
 // src/tui/components/agent-display.tsx
-var import_react72 = __toESM(require_react(), 1);
+var import_react73 = __toESM(require_react(), 1);
 
 // node_modules/marked/lib/marked.esm.js
 function L2() {
@@ -281905,7 +282560,7 @@ function markdownToStyledText(content, colors2) {
   }
 }
 // src/tui/components/shared/message-utils.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 
 // src/tui/components/shared/type-guards.ts
 function isToolMessage(msg) {
@@ -281914,7 +282569,7 @@ function isToolMessage(msg) {
 
 // src/tui/components/shared/message-utils.ts
 function hashContent(content) {
-  return createHash("sha256").update(content).digest("hex").slice(0, 8);
+  return createHash2("sha256").update(content).digest("hex").slice(0, 8);
 }
 function getStableMessageKey(item, contextId = "root") {
   if (isToolMessage(item)) {
@@ -282861,14 +283516,14 @@ ${preview}${suffix}` : preview + suffix || "POC passed",
   return null;
 }
 // src/tui/components/shared/ascii-spinner.tsx
-var import_react66 = __toESM(require_react(), 1);
+var import_react67 = __toESM(require_react(), 1);
 var SPINNER_FRAMES = ["/", "-", "\\", "|"];
 var SPINNER_INTERVAL = 100;
 function AsciiSpinner({ label, fg: fg2 }) {
   const { colors: colors2 } = useTheme();
   const spinnerColor = fg2 ?? colors2.info;
-  const [frame, setFrame] = import_react66.useState(0);
-  import_react66.useEffect(() => {
+  const [frame, setFrame] = import_react67.useState(0);
+  import_react67.useEffect(() => {
     const interval = setInterval(() => {
       setFrame((f3) => (f3 + 1) % SPINNER_FRAMES.length);
     }, SPINNER_INTERVAL);
@@ -282880,7 +283535,7 @@ function AsciiSpinner({ label, fg: fg2 }) {
   }, undefined, false, undefined, this);
 }
 // src/tui/components/shared/tool-renderer.tsx
-var import_react67 = __toESM(require_react(), 1);
+var import_react68 = __toESM(require_react(), 1);
 var TOOLS_WITH_LOG_WINDOW = new Set([
   "execute_command",
   "run_attack_surface",
@@ -282893,13 +283548,13 @@ var TOOLS_WITH_LOG_WINDOW = new Set([
   "document_vulnerability"
 ]);
 var DEFAULT_SUBAGENT_LOG_LINES = 5;
-var ToolRenderer = import_react67.memo(function ToolRenderer2({
+var ToolRenderer = import_react68.memo(function ToolRenderer2({
   message,
   verbose = false,
   expandedLogs = false
 }) {
   const { colors: colors2 } = useTheme();
-  const [showOutput, setShowOutput] = import_react67.useState(false);
+  const [showOutput, setShowOutput] = import_react68.useState(false);
   if (!isToolMessage(message)) {
     return null;
   }
@@ -283039,7 +283694,7 @@ var ToolRenderer = import_react67.memo(function ToolRenderer2({
     ]
   }, undefined, true, undefined, this);
 });
-var SubagentLogWindow = import_react67.memo(function SubagentLogWindow2({
+var SubagentLogWindow = import_react68.memo(function SubagentLogWindow2({
   subagentId,
   entry,
   expandedLogs
@@ -283096,8 +283751,8 @@ var SubagentLogWindow = import_react67.memo(function SubagentLogWindow2({
   }, undefined, true, undefined, this);
 });
 // src/tui/components/shared/message-renderer.tsx
-var import_react68 = __toESM(require_react(), 1);
-var MessageRenderer = import_react68.memo(function MessageRenderer2({
+var import_react69 = __toESM(require_react(), 1);
+var MessageRenderer = import_react69.memo(function MessageRenderer2({
   message,
   isStreaming = false,
   verbose = false,
@@ -283107,7 +283762,7 @@ var MessageRenderer = import_react68.memo(function MessageRenderer2({
 }) {
   const { colors: colors2 } = useTheme();
   const content = typeof message.content === "string" ? message.content : JSON.stringify(message.content);
-  const displayContent = import_react68.useMemo(() => message.role === "assistant" ? markdownToStyledText(content, colors2) : content, [content, message.role, colors2]);
+  const displayContent = import_react69.useMemo(() => message.role === "assistant" ? markdownToStyledText(content, colors2) : content, [content, message.role, colors2]);
   if (isToolMessage(message)) {
     return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ToolRenderer, {
       message,
@@ -283219,9 +283874,9 @@ var MessageRenderer = import_react68.memo(function MessageRenderer2({
   }, undefined, false, undefined, this);
 });
 // src/tui/components/shared/approval-prompt.tsx
-var import_react69 = __toESM(require_react(), 1);
+var import_react70 = __toESM(require_react(), 1);
 // src/tui/components/shared/message-reducer.ts
-var import_react71 = __toESM(require_react(), 1);
+var import_react72 = __toESM(require_react(), 1);
 // src/tui/components/agent-display.tsx
 function getStableKey(item, contextId = "root") {
   if ("messages" in item) {
@@ -283297,11 +283952,11 @@ function AgentDisplay({
     ]
   }, undefined, true, undefined, this);
 }
-var SubAgentDisplay = import_react72.memo(function SubAgentDisplay2({
+var SubAgentDisplay = import_react73.memo(function SubAgentDisplay2({
   subagent
 }) {
   const { colors: colors2 } = useTheme();
-  const [open, setOpen] = import_react72.useState(false);
+  const [open, setOpen] = import_react73.useState(false);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
     height: open ? 40 : "auto",
     onMouseDown: () => setOpen(!open),
@@ -283356,7 +284011,7 @@ var SubAgentDisplay = import_react72.memo(function SubAgentDisplay2({
     ]
   }, undefined, true, undefined, this);
 });
-var AgentMessage = import_react72.memo(function AgentMessage2({
+var AgentMessage = import_react73.memo(function AgentMessage2({
   message
 }) {
   const { colors: colors2 } = useTheme();
@@ -283465,8 +284120,8 @@ var AgentMessage = import_react72.memo(function AgentMessage2({
 });
 function ToolDetails({ message }) {
   const { colors: colors2 } = useTheme();
-  const [showArgs, setShowArgs] = import_react72.useState(false);
-  const [showResult, setShowResult] = import_react72.useState(false);
+  const [showArgs, setShowArgs] = import_react73.useState(false);
+  const [showResult, setShowResult] = import_react73.useState(false);
   if (message.role !== "tool") {
     return null;
   }
@@ -283572,27 +284227,27 @@ function Pentest({
   const config3 = useConfig();
   const { model, setThinking, setIsExecuting, isExecuting } = useAgent();
   const { stack, externalDialogOpen } = useDialog();
-  const [session, setSession] = import_react73.useState(null);
-  const [error40, setError] = import_react73.useState(null);
-  const [phase, setPhase] = import_react73.useState("loading");
-  const [abortController, setAbortController] = import_react73.useState(null);
-  const [panelMessages, setPanelMessages] = import_react73.useState([]);
-  const panelTextRef = import_react73.useRef("");
-  const panelSourceRef = import_react73.useRef(null);
-  const [pentestAgents, setPentestAgents] = import_react73.useState({});
-  const pentestTextRefs = import_react73.useRef({});
-  const [assets, setAssets] = import_react73.useState([]);
-  const [viewMode, setViewMode] = import_react73.useState("overview");
-  const [selectedAgentId, setSelectedAgentId] = import_react73.useState(null);
-  const [focusedIndex, setFocusedIndex] = import_react73.useState(0);
-  const [showOrchestratorPanel, setShowOrchestratorPanel] = import_react73.useState(false);
-  const [startTime, setStartTime] = import_react73.useState(null);
-  const pentestAgentList = import_react73.useMemo(() => Object.values(pentestAgents).sort((a, b3) => a.createdAt.getTime() - b3.createdAt.getTime()), [pentestAgents]);
-  const selectedAgent = import_react73.useMemo(() => selectedAgentId ? pentestAgents[selectedAgentId] ?? null : null, [pentestAgents, selectedAgentId]);
+  const [session, setSession] = import_react74.useState(null);
+  const [error40, setError] = import_react74.useState(null);
+  const [phase, setPhase] = import_react74.useState("loading");
+  const [abortController, setAbortController] = import_react74.useState(null);
+  const [panelMessages, setPanelMessages] = import_react74.useState([]);
+  const panelTextRef = import_react74.useRef("");
+  const panelSourceRef = import_react74.useRef(null);
+  const [pentestAgents, setPentestAgents] = import_react74.useState({});
+  const pentestTextRefs = import_react74.useRef({});
+  const [assets, setAssets] = import_react74.useState([]);
+  const [viewMode, setViewMode] = import_react74.useState("overview");
+  const [selectedAgentId, setSelectedAgentId] = import_react74.useState(null);
+  const [focusedIndex, setFocusedIndex] = import_react74.useState(0);
+  const [showOrchestratorPanel, setShowOrchestratorPanel] = import_react74.useState(false);
+  const [startTime, setStartTime] = import_react74.useState(null);
+  const pentestAgentList = import_react74.useMemo(() => Object.values(pentestAgents).sort((a, b3) => a.createdAt.getTime() - b3.createdAt.getTime()), [pentestAgents]);
+  const selectedAgent = import_react74.useMemo(() => selectedAgentId ? pentestAgents[selectedAgentId] ?? null : null, [pentestAgents, selectedAgentId]);
   const { width: termWidth } = useDimensions();
   const gridAvailableWidth = showOrchestratorPanel ? Math.floor((termWidth - 4) / 2) - 2 : termWidth - ORCHESTRATOR_PANEL_WIDTH - GRID_OUTER_PADDING;
   const gridColumns = Math.max(1, Math.floor((gridAvailableWidth + GRID_GAP) / (CARD_MIN_WIDTH + GRID_GAP)));
-  import_react73.useEffect(() => {
+  import_react74.useEffect(() => {
     async function load2() {
       try {
         let s2;
@@ -283653,7 +284308,7 @@ function Pentest({
     }
     load2();
   }, [sessionId]);
-  import_react73.useEffect(() => {
+  import_react74.useEffect(() => {
     if (!session)
       return;
     const assetsPath = join27(session.rootPath, "assets");
@@ -283665,7 +284320,7 @@ function Pentest({
         const loaded = [];
         for (const file2 of files) {
           try {
-            const content = readFileSync12(join27(assetsPath, file2), "utf-8");
+            const content = readFileSync13(join27(assetsPath, file2), "utf-8");
             loaded.push(JSON.parse(content));
           } catch {}
         }
@@ -283676,12 +284331,12 @@ function Pentest({
     const interval = setInterval(readAssets, 2000);
     return () => clearInterval(interval);
   }, [session]);
-  import_react73.useEffect(() => {
+  import_react74.useEffect(() => {
     return () => {
       abortController?.abort();
     };
   }, [abortController]);
-  const ensurePentestAgent = import_react73.useCallback((subagentId) => {
+  const ensurePentestAgent = import_react74.useCallback((subagentId) => {
     setPentestAgents((prev) => {
       if (prev[subagentId])
         return prev;
@@ -283698,7 +284353,7 @@ function Pentest({
       };
     });
   }, []);
-  const handleSubagentSpawn = import_react73.useCallback(({
+  const handleSubagentSpawn = import_react74.useCallback(({
     subagentId,
     input
   }) => {
@@ -283718,7 +284373,7 @@ function Pentest({
       }
     }));
   }, []);
-  const handleSubagentComplete = import_react73.useCallback(({ subagentId, status }) => {
+  const handleSubagentComplete = import_react74.useCallback(({ subagentId, status }) => {
     if (!subagentId.startsWith("pentest-agent-"))
       return;
     setPentestAgents((prev) => {
@@ -283731,7 +284386,7 @@ function Pentest({
       };
     });
   }, []);
-  const appendPanelText = import_react73.useCallback((source, text2) => {
+  const appendPanelText = import_react74.useCallback((source, text2) => {
     if (panelSourceRef.current !== source) {
       panelTextRef.current = "";
       panelSourceRef.current = source;
@@ -283756,7 +284411,7 @@ function Pentest({
       ];
     });
   }, []);
-  const appendPentestText = import_react73.useCallback((subagentId, text2) => {
+  const appendPentestText = import_react74.useCallback((subagentId, text2) => {
     ensurePentestAgent(subagentId);
     if (!pentestTextRefs.current[subagentId]) {
       pentestTextRefs.current[subagentId] = "";
@@ -283789,8 +284444,8 @@ function Pentest({
       };
     });
   }, [ensurePentestAgent]);
-  const toolArgsDeltaRef = import_react73.useRef(new Map);
-  const addPanelStreamingToolCall = import_react73.useCallback((toolCallId, toolName) => {
+  const toolArgsDeltaRef = import_react74.useRef(new Map);
+  const addPanelStreamingToolCall = import_react74.useCallback((toolCallId, toolName) => {
     panelTextRef.current = "";
     panelSourceRef.current = null;
     toolArgsDeltaRef.current.set(toolCallId, "");
@@ -283809,7 +284464,7 @@ function Pentest({
       return [...prev, msg];
     });
   }, []);
-  const appendPanelToolCallDelta = import_react73.useCallback((toolCallId, argsTextDelta) => {
+  const appendPanelToolCallDelta = import_react74.useCallback((toolCallId, argsTextDelta) => {
     const prev = toolArgsDeltaRef.current.get(toolCallId) ?? "";
     const accumulated = prev + argsTextDelta;
     toolArgsDeltaRef.current.set(toolCallId, accumulated);
@@ -283832,7 +284487,7 @@ function Pentest({
       return updated;
     });
   }, []);
-  const addPanelToolCall = import_react73.useCallback((toolCallId, toolName, args) => {
+  const addPanelToolCall = import_react74.useCallback((toolCallId, toolName, args) => {
     panelTextRef.current = "";
     panelSourceRef.current = null;
     toolArgsDeltaRef.current.delete(toolCallId);
@@ -283864,7 +284519,7 @@ function Pentest({
       ];
     });
   }, []);
-  const addPentestStreamingToolCall = import_react73.useCallback((subagentId, toolCallId, toolName) => {
+  const addPentestStreamingToolCall = import_react74.useCallback((subagentId, toolCallId, toolName) => {
     pentestTextRefs.current[subagentId] = "";
     ensurePentestAgent(subagentId);
     toolArgsDeltaRef.current.set(toolCallId, "");
@@ -283889,7 +284544,7 @@ function Pentest({
       };
     });
   }, [ensurePentestAgent]);
-  const appendPentestToolCallDelta = import_react73.useCallback((subagentId, toolCallId, argsTextDelta) => {
+  const appendPentestToolCallDelta = import_react74.useCallback((subagentId, toolCallId, argsTextDelta) => {
     const prev = toolArgsDeltaRef.current.get(toolCallId) ?? "";
     const accumulated = prev + argsTextDelta;
     toolArgsDeltaRef.current.set(toolCallId, accumulated);
@@ -283915,7 +284570,7 @@ function Pentest({
       return { ...agents, [subagentId]: { ...agent, messages: updatedMsgs } };
     });
   }, []);
-  const addPentestToolCall = import_react73.useCallback((subagentId, toolCallId, toolName, args) => {
+  const addPentestToolCall = import_react74.useCallback((subagentId, toolCallId, toolName, args) => {
     pentestTextRefs.current[subagentId] = "";
     ensurePentestAgent(subagentId);
     toolArgsDeltaRef.current.delete(toolCallId);
@@ -283976,12 +284631,12 @@ function Pentest({
       }
     ];
   };
-  const updatePanelToolResult = import_react73.useCallback((toolCallId, toolName, result) => {
+  const updatePanelToolResult = import_react74.useCallback((toolCallId, toolName, result) => {
     panelTextRef.current = "";
     panelSourceRef.current = null;
     setPanelMessages((prev) => toolResultUpdater(prev, toolCallId, toolName, result));
   }, []);
-  const updatePentestToolResult = import_react73.useCallback((subagentId, toolCallId, toolName, result) => {
+  const updatePentestToolResult = import_react74.useCallback((subagentId, toolCallId, toolName, result) => {
     pentestTextRefs.current[subagentId] = "";
     setPentestAgents((prev) => {
       const agent = prev[subagentId];
@@ -283996,7 +284651,7 @@ function Pentest({
       };
     });
   }, []);
-  const startPentest = import_react73.useCallback(async (s2) => {
+  const startPentest = import_react74.useCallback(async (s2) => {
     setPhase((prev) => prev === "pentesting" || prev === "reporting" ? prev : "discovery");
     setStartTime(new Date);
     setIsExecuting(true);
@@ -284124,7 +284779,7 @@ function Pentest({
     handleSubagentSpawn,
     handleSubagentComplete
   ]);
-  import_react73.useEffect(() => {
+  import_react74.useEffect(() => {
     if (phase === "completed") {
       setFocusedIndex(pentestAgentList.length);
     }
@@ -284187,7 +284842,7 @@ function Pentest({
       }
     }
   });
-  const openReport = import_react73.useCallback(() => {
+  const openReport = import_react74.useCallback(() => {
     if (!session)
       return;
     const err = openSessionReport(session.rootPath);
@@ -284372,7 +285027,7 @@ function OrchestratorPanel({
 }) {
   const { colors: colors2 } = useTheme();
   const isRunning = phase !== "loading" && phase !== "completed" && phase !== "error";
-  const assetSummary = import_react73.useMemo(() => {
+  const assetSummary = import_react74.useMemo(() => {
     const byType = {};
     for (const a of assets) {
       const key = a.assetType;
@@ -284615,13 +285270,13 @@ function AgentCardGrid({
   onSelectAgent
 }) {
   const { colors: colors2 } = useTheme();
-  const scrollRef = import_react73.useRef(null);
-  import_react73.useEffect(() => {
+  const scrollRef = import_react74.useRef(null);
+  import_react74.useEffect(() => {
     const agent = agents[focusedIndex];
     if (agent)
       scrollToChild(scrollRef.current, agent.id);
   }, [focusedIndex, agents]);
-  const rows = import_react73.useMemo(() => {
+  const rows = import_react74.useMemo(() => {
     const result = [];
     for (let i2 = 0;i2 < agents.length; i2 += gridColumns) {
       result.push(agents.slice(i2, i2 + gridColumns));
@@ -284678,14 +285333,14 @@ function AgentCard({
     completed: colors2.primary,
     failed: colors2.error
   }[agent.status];
-  const lastActivity = import_react73.useMemo(() => {
+  const lastActivity = import_react74.useMemo(() => {
     const last = agent.messages[agent.messages.length - 1];
     if (!last)
       return "Starting...";
     const text2 = typeof last.content === "string" ? last.content.replace(/\n/g, " ").trim() : "Working...";
     return text2.length > 50 ? text2.substring(0, 47) + "..." : text2;
   }, [agent.messages]);
-  const toolCalls = import_react73.useMemo(() => agent.messages.filter((m4) => m4.role === "tool").length, [agent.messages]);
+  const toolCalls = import_react74.useMemo(() => agent.messages.filter((m4) => m4.role === "tool").length, [agent.messages]);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
     id: agent.id,
     flexGrow: 1,
@@ -284873,8 +285528,8 @@ function MetricsBar({
   isExecuting
 }) {
   const { colors: colors2 } = useTheme();
-  const [now2, setNow] = import_react73.useState(Date.now());
-  import_react73.useEffect(() => {
+  const [now2, setNow] = import_react74.useState(Date.now());
+  import_react74.useEffect(() => {
     if (!isExecuting)
       return;
     const interval = setInterval(() => setNow(Date.now()), 1000);
@@ -285017,7 +285672,7 @@ function MetricsBar({
 }
 
 // src/tui/components/operator-dashboard/index.tsx
-var import_react78 = __toESM(require_react(), 1);
+var import_react79 = __toESM(require_react(), 1);
 init_session();
 
 // src/core/api/offesecAgent.ts
@@ -285120,7 +285775,7 @@ function InlineApprovalPrompt2({ approval }) {
 }
 
 // src/tui/components/chat/loading-indicator.tsx
-var import_react75 = __toESM(require_react(), 1);
+var import_react76 = __toESM(require_react(), 1);
 var SPINNER_FRAMES2 = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 var SPINNER_INTERVAL2 = 80;
 var DOTS_FRAMES = ["", ".", "..", "..."];
@@ -285131,15 +285786,15 @@ function LoadingIndicator({
   toolName
 }) {
   const { colors: colors2 } = useTheme();
-  const [spinnerFrame, setSpinnerFrame] = import_react75.useState(0);
-  const [dotsFrame, setDotsFrame] = import_react75.useState(0);
-  import_react75.useEffect(() => {
+  const [spinnerFrame, setSpinnerFrame] = import_react76.useState(0);
+  const [dotsFrame, setDotsFrame] = import_react76.useState(0);
+  import_react76.useEffect(() => {
     const interval = setInterval(() => {
       setSpinnerFrame((f3) => (f3 + 1) % SPINNER_FRAMES2.length);
     }, SPINNER_INTERVAL2);
     return () => clearInterval(interval);
   }, []);
-  import_react75.useEffect(() => {
+  import_react76.useEffect(() => {
     const interval = setInterval(() => {
       setDotsFrame((f3) => (f3 + 1) % DOTS_FRAMES.length);
     }, DOTS_INTERVAL);
@@ -285393,7 +286048,7 @@ function MessageList({
 }
 
 // src/tui/components/chat/input-area.tsx
-var import_react76 = __toESM(require_react(), 1);
+var import_react77 = __toESM(require_react(), 1);
 function NormalInputAreaInner({
   value,
   onChange,
@@ -285415,10 +286070,10 @@ function NormalInputAreaInner({
 }) {
   const { colors: colors2, theme, mode: colorMode } = useTheme();
   const { inputValue, setInputValue } = useInput();
-  const promptRef = import_react76.useRef(null);
-  const isExternalUpdate = import_react76.useRef(false);
-  const prevValueRef = import_react76.useRef(value);
-  import_react76.useEffect(() => {
+  const promptRef = import_react77.useRef(null);
+  const isExternalUpdate = import_react77.useRef(false);
+  const prevValueRef = import_react77.useRef(value);
+  import_react77.useEffect(() => {
     const prevValue = prevValueRef.current;
     prevValueRef.current = value;
     if (value !== prevValue && value !== inputValue) {
@@ -285427,7 +286082,7 @@ function NormalInputAreaInner({
       promptRef.current?.setValue(value);
     }
   }, [value, inputValue, setInputValue]);
-  import_react76.useEffect(() => {
+  import_react77.useEffect(() => {
     if (isExternalUpdate.current) {
       isExternalUpdate.current = false;
       return;
@@ -285602,7 +286257,7 @@ function ApprovalInputArea2({
   lastDeclineNote
 }) {
   const { colors: colors2 } = useTheme();
-  const [focusedElement, setFocusedElement] = import_react76.useState(0);
+  const [focusedElement, setFocusedElement] = import_react77.useState(0);
   useKeyboard((key) => {
     if (key.name === "up") {
       setFocusedElement((prev) => Math.max(0, prev - 1));
@@ -285895,7 +286550,7 @@ function navigateDown(selectedIndex, queueLength) {
 }
 
 // src/tui/components/operator-dashboard/index.tsx
-import { existsSync as existsSync27, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync14 } from "fs";
 import { join as join28 } from "path";
 function OperatorDashboard({
   sessionId,
@@ -285929,29 +286584,29 @@ function OperatorDashboard({
     clear: clearDialog,
     setSize: setDialogSize
   } = useDialog();
-  const autocompleteOptions = import_react78.useMemo(() => {
+  const autocompleteOptions = import_react79.useMemo(() => {
     const skillSlugs = new Set(skills.map((s2) => `/${slugify(s2.name)}`));
     return filterOperatorAutocomplete(allAutocompleteOptions, skillSlugs);
   }, [allAutocompleteOptions, skills]);
-  const [session, setSession] = import_react78.useState(null);
-  const [loading, setLoading] = import_react78.useState(true);
-  const [error40, setError] = import_react78.useState(null);
-  const pendingNameRef = import_react78.useRef(null);
-  const [status, setStatus] = import_react78.useState("idle");
-  const abortControllerRef = import_react78.useRef(null);
-  const generationRef = import_react78.useRef(0);
-  const cancelHandleRef = import_react78.useRef({
+  const [session, setSession] = import_react79.useState(null);
+  const [loading, setLoading] = import_react79.useState(true);
+  const [error40, setError] = import_react79.useState(null);
+  const pendingNameRef = import_react79.useRef(null);
+  const [status, setStatus] = import_react79.useState("idle");
+  const abortControllerRef = import_react79.useRef(null);
+  const generationRef = import_react79.useRef(0);
+  const cancelHandleRef = import_react79.useRef({
     cancel: () => false
   });
-  const commandCancelledRef = import_react78.useRef(false);
-  const [messages, setMessages] = import_react78.useState([]);
-  const textRef = import_react78.useRef("");
-  const conversationRef = import_react78.useRef([]);
-  const [inputValue, setInputValue] = import_react78.useState("");
-  const [queuedMessages, setQueuedMessages] = import_react78.useState([]);
-  const [selectedQueueIndex, setSelectedQueueIndex] = import_react78.useState(-1);
-  const queuedMessagesRef = import_react78.useRef([]);
-  import_react78.useEffect(() => {
+  const commandCancelledRef = import_react79.useRef(false);
+  const [messages, setMessages] = import_react79.useState([]);
+  const textRef = import_react79.useRef("");
+  const conversationRef = import_react79.useRef([]);
+  const [inputValue, setInputValue] = import_react79.useState("");
+  const [queuedMessages, setQueuedMessages] = import_react79.useState([]);
+  const [selectedQueueIndex, setSelectedQueueIndex] = import_react79.useState(-1);
+  const queuedMessagesRef = import_react79.useRef([]);
+  import_react79.useEffect(() => {
     queuedMessagesRef.current = queuedMessages;
     if (queuedMessages.length === 0) {
       setSelectedQueueIndex(-1);
@@ -285959,17 +286614,17 @@ function OperatorDashboard({
       setSelectedQueueIndex(queuedMessages.length - 1);
     }
   }, [queuedMessages, selectedQueueIndex]);
-  const [operatorState, setOperatorState] = import_react78.useState(() => createInitialOperatorState("manual", true));
-  const approvalGateRef = import_react78.useRef(new ApprovalGate({ requireApproval: true }));
-  const [pendingApprovals, setPendingApprovals] = import_react78.useState([]);
-  const [lastApprovedAction, setLastApprovedAction] = import_react78.useState(null);
-  const [verboseMode, setVerboseMode] = import_react78.useState(false);
-  const [expandedLogs, setExpandedLogs] = import_react78.useState(false);
-  const tokenUsageRef = import_react78.useRef(tokenUsage);
-  import_react78.useEffect(() => {
+  const [operatorState, setOperatorState] = import_react79.useState(() => createInitialOperatorState("manual", true));
+  const approvalGateRef = import_react79.useRef(new ApprovalGate({ requireApproval: true }));
+  const [pendingApprovals, setPendingApprovals] = import_react79.useState([]);
+  const [lastApprovedAction, setLastApprovedAction] = import_react79.useState(null);
+  const [verboseMode, setVerboseMode] = import_react79.useState(false);
+  const [expandedLogs, setExpandedLogs] = import_react79.useState(false);
+  const tokenUsageRef = import_react79.useRef(tokenUsage);
+  import_react79.useEffect(() => {
     tokenUsageRef.current = tokenUsage;
   }, [tokenUsage]);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     const gate = approvalGateRef.current;
     const onApprovalNeeded = () => {
       setPendingApprovals(gate.getPendingApprovals());
@@ -285991,7 +286646,7 @@ function OperatorDashboard({
       gate.off("approval-resolved", onApprovalResolved);
     };
   }, []);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     async function loadSession() {
       try {
         if (sessionId) {
@@ -286048,10 +286703,10 @@ function OperatorDashboard({
     }
     loadSession();
   }, [sessionId]);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     return () => setSessionCwd(null);
   }, [setSessionCwd]);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     if (!session)
       return;
     resetTokenUsage();
@@ -286069,7 +286724,7 @@ function OperatorDashboard({
       });
     } catch {}
   }, [session, addTokenUsage, resetTokenUsage]);
-  const appendText = import_react78.useCallback((text2) => {
+  const appendText = import_react79.useCallback((text2) => {
     textRef.current += text2;
     const accumulated = textRef.current;
     setMessages((prev) => {
@@ -286085,8 +286740,8 @@ function OperatorDashboard({
       ];
     });
   }, []);
-  const toolArgsDeltaRef = import_react78.useRef(new Map);
-  const addStreamingToolCall = import_react78.useCallback((toolCallId, toolName) => {
+  const toolArgsDeltaRef = import_react79.useRef(new Map);
+  const addStreamingToolCall = import_react79.useCallback((toolCallId, toolName) => {
     textRef.current = "";
     toolArgsDeltaRef.current.set(toolCallId, {
       toolName,
@@ -286105,7 +286760,7 @@ function OperatorDashboard({
       }
     ]);
   }, []);
-  const appendToolCallDelta = import_react78.useCallback((toolCallId, argsTextDelta) => {
+  const appendToolCallDelta = import_react79.useCallback((toolCallId, argsTextDelta) => {
     const entry = toolArgsDeltaRef.current.get(toolCallId);
     const accumulated = (entry?.accumulated ?? "") + argsTextDelta;
     toolArgsDeltaRef.current.set(toolCallId, {
@@ -286127,7 +286782,7 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const addToolCall = import_react78.useCallback((toolCallId, toolName, args) => {
+  const addToolCall = import_react79.useCallback((toolCallId, toolName, args) => {
     textRef.current = "";
     toolArgsDeltaRef.current.delete(toolCallId);
     setMessages((prev) => {
@@ -286156,7 +286811,7 @@ function OperatorDashboard({
       ];
     });
   }, []);
-  const updateToolResult = import_react78.useCallback((toolCallId, _toolName, result) => {
+  const updateToolResult = import_react79.useCallback((toolCallId, _toolName, result) => {
     textRef.current = "";
     setMessages((prev) => {
       const idx = prev.findIndex((m4) => isToolMessage(m4) && m4.toolCallId === toolCallId);
@@ -286167,10 +286822,10 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const cmdOutputBufRef = import_react78.useRef("");
-  const cmdFlushTimerRef = import_react78.useRef(null);
+  const cmdOutputBufRef = import_react79.useRef("");
+  const cmdFlushTimerRef = import_react79.useRef(null);
   const MAX_LOG_LINES = 200;
-  const flushCommandOutput = import_react78.useCallback(() => {
+  const flushCommandOutput = import_react79.useCallback(() => {
     const buf = cmdOutputBufRef.current;
     if (!buf)
       return;
@@ -286200,7 +286855,7 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const onCommandOutput = import_react78.useCallback((data) => {
+  const onCommandOutput = import_react79.useCallback((data) => {
     cmdOutputBufRef.current += data;
     if (!cmdFlushTimerRef.current) {
       cmdFlushTimerRef.current = setInterval(() => {
@@ -286208,7 +286863,7 @@ function OperatorDashboard({
       }, 150);
     }
   }, [flushCommandOutput]);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     return () => {
       if (cmdFlushTimerRef.current) {
         clearInterval(cmdFlushTimerRef.current);
@@ -286216,7 +286871,7 @@ function OperatorDashboard({
       }
     };
   }, []);
-  const appendLogToActiveTool = import_react78.useCallback((line) => {
+  const appendLogToActiveTool = import_react79.useCallback((line) => {
     setMessages((prev) => {
       const idx = prev.findLastIndex((m4) => isToolMessage(m4) && (m4.status === "pending" || m4.status === "streaming"));
       if (idx === -1)
@@ -286231,7 +286886,7 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const initSubagent = import_react78.useCallback((subagentId, name26) => {
+  const initSubagent = import_react79.useCallback((subagentId, name26) => {
     setMessages((prev) => {
       const idx = prev.findLastIndex((m4) => isToolMessage(m4) && (m4.status === "pending" || m4.status === "streaming"));
       if (idx === -1)
@@ -286246,7 +286901,7 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const completeSubagent = import_react78.useCallback((subagentId, status2) => {
+  const completeSubagent = import_react79.useCallback((subagentId, status2) => {
     setMessages((prev) => {
       const idx = prev.findLastIndex((m4) => isToolMessage(m4) && (m4.status === "pending" || m4.status === "streaming"));
       if (idx === -1)
@@ -286264,7 +286919,7 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const appendLogToSubagent = import_react78.useCallback((subagentId, line) => {
+  const appendLogToSubagent = import_react79.useCallback((subagentId, line) => {
     setMessages((prev) => {
       const idx = prev.findLastIndex((m4) => isToolMessage(m4) && (m4.status === "pending" || m4.status === "streaming"));
       if (idx === -1)
@@ -286286,13 +286941,13 @@ function OperatorDashboard({
       return updated;
     });
   }, []);
-  const handleApprove = import_react78.useCallback(() => {
+  const handleApprove = import_react79.useCallback(() => {
     const pending = approvalGateRef.current.getPendingApprovals();
     if (pending.length > 0) {
       approvalGateRef.current.approve(pending[0].id);
     }
   }, []);
-  const handleAutoApprove = import_react78.useCallback(() => {
+  const handleAutoApprove = import_react79.useCallback(() => {
     approvalGateRef.current.updateConfig({ requireApproval: false });
     setOperatorState((prev) => ({ ...prev, requireApproval: false }));
     const pending = approvalGateRef.current.getPendingApprovals();
@@ -286300,7 +286955,7 @@ function OperatorDashboard({
       approvalGateRef.current.approve(p.id);
     }
   }, []);
-  const runAgent = import_react78.useCallback(async (prompt) => {
+  const runAgent = import_react79.useCallback(async (prompt) => {
     if (abortControllerRef.current) {
       abortControllerRef.current.abort();
       abortControllerRef.current = null;
@@ -286454,7 +287109,7 @@ function OperatorDashboard({
           const rootPath = agentResult.session.rootPath;
           const mp = join28(rootPath, "messages.json");
           if (existsSync27(mp)) {
-            const raw = JSON.parse(readFileSync13(mp, "utf-8"));
+            const raw = JSON.parse(readFileSync14(mp, "utf-8"));
             if (Array.isArray(raw) && raw.length > 0) {
               conversationRef.current = sessions.getResumeMessages(raw);
             }
@@ -286514,7 +287169,7 @@ function OperatorDashboard({
     setThinking,
     setIsExecuting
   ]);
-  const handleSubmit = import_react78.useCallback((value) => {
+  const handleSubmit = import_react79.useCallback((value) => {
     const pending = approvalGateRef.current.getPendingApprovals();
     const result = resolveSubmit(value, status, pending.length > 0);
     if (result.denyPending) {
@@ -286532,16 +287187,16 @@ function OperatorDashboard({
     setInputValue("");
     runAgent(result.prompt);
   }, [status, runAgent]);
-  const initialMessageSentRef = import_react78.useRef(false);
-  const runAgentRef = import_react78.useRef(runAgent);
+  const initialMessageSentRef = import_react79.useRef(false);
+  const runAgentRef = import_react79.useRef(runAgent);
   runAgentRef.current = runAgent;
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     if (!loading && initialMessage && !initialMessageSentRef.current) {
       initialMessageSentRef.current = true;
       runAgentRef.current(initialMessage);
     }
   }, [loading, initialMessage]);
-  import_react78.useEffect(() => {
+  import_react79.useEffect(() => {
     if (status !== "idle")
       return;
     const queue = queuedMessagesRef.current;
@@ -286552,7 +287207,7 @@ function OperatorDashboard({
     setSelectedQueueIndex(-1);
     runAgentRef.current(next);
   }, [status]);
-  const showModelPicker = import_react78.useCallback(() => {
+  const showModelPicker = import_react79.useCallback(() => {
     setDialogSize("large");
     showDialog(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
       flexDirection: "column",
@@ -286614,7 +287269,7 @@ function OperatorDashboard({
     clearDialog,
     setDialogSize
   ]);
-  const handleCommandExecute = import_react78.useCallback(async (command) => {
+  const handleCommandExecute = import_react79.useCallback(async (command) => {
     const action = routeCommand(command, resolveSkillContent);
     switch (action.type) {
       case "show-models":
@@ -286632,7 +287287,7 @@ function OperatorDashboard({
         return;
     }
   }, [resolveSkillContent, handleSubmit, executeCommand2, showModelPicker]);
-  const handleAbort = import_react78.useCallback(() => {
+  const handleAbort = import_react79.useCallback(() => {
     if (!abortControllerRef.current)
       return;
     const action = resolveAbortAction(commandCancelledRef.current, () => cancelHandleRef.current.cancel());
@@ -286663,7 +287318,7 @@ function OperatorDashboard({
       try {
         const messagesPath = join28(session.rootPath, "messages.json");
         if (existsSync27(messagesPath)) {
-          const raw = JSON.parse(readFileSync13(messagesPath, "utf-8"));
+          const raw = JSON.parse(readFileSync14(messagesPath, "utf-8"));
           if (Array.isArray(raw) && raw.length > 0) {
             conversationRef.current = sessions.getResumeMessages(raw);
           }
@@ -286682,7 +287337,7 @@ function OperatorDashboard({
       ];
     });
   }, [session, setThinking, setIsExecuting]);
-  const toggleApproval = import_react78.useCallback(() => {
+  const toggleApproval = import_react79.useCallback(() => {
     setOperatorState((prev) => {
       const newVal = !prev.requireApproval;
       approvalGateRef.current.updateConfig({ requireApproval: newVal });
@@ -286916,7 +287571,7 @@ function OperatorDashboard({
 }
 
 // src/tui/components/commands/theme-picker.tsx
-var import_react80 = __toESM(require_react(), 1);
+var import_react81 = __toESM(require_react(), 1);
 init_config2();
 function ThemePicker({ onClose }) {
   const dimensions = useDimensions();
@@ -286929,15 +287584,15 @@ function ThemePicker({ onClose }) {
     toggleMode,
     setMode
   } = useTheme();
-  const [selectedIndex, setSelectedIndex] = import_react80.useState(() => Math.max(0, availableThemes.indexOf(theme.name)));
-  const originalThemeRef = import_react80.useRef(theme.name);
-  const originalModeRef = import_react80.useRef(mode);
-  const handleClose = import_react80.useCallback(() => {
+  const [selectedIndex, setSelectedIndex] = import_react81.useState(() => Math.max(0, availableThemes.indexOf(theme.name)));
+  const originalThemeRef = import_react81.useRef(theme.name);
+  const originalModeRef = import_react81.useRef(mode);
+  const handleClose = import_react81.useCallback(() => {
     setTheme(originalThemeRef.current);
     setMode(originalModeRef.current);
     onClose();
   }, [setTheme, setMode, onClose]);
-  const handleConfirm = import_react80.useCallback(async () => {
+  const handleConfirm = import_react81.useCallback(async () => {
     const currentThemeName = availableThemes[selectedIndex];
     if (currentThemeName) {
       await config2.update({ theme: currentThemeName });
@@ -287066,16 +287721,16 @@ function ThemePicker({ onClose }) {
 }
 
 // src/tui/components/commands/create-skill-wizard.tsx
-var import_react82 = __toESM(require_react(), 1);
+var import_react83 = __toESM(require_react(), 1);
 function CreateSkillWizard() {
   const { colors: colors2 } = useTheme();
   const route = useRoute();
-  const [step, setStep] = import_react82.useState("name");
-  const [name26, setName] = import_react82.useState("");
-  const [description, setDescription] = import_react82.useState("");
-  const [content, setContent] = import_react82.useState("");
-  const [error40, setError] = import_react82.useState(null);
-  const [confirmFocused, setConfirmFocused] = import_react82.useState(0);
+  const [step, setStep] = import_react83.useState("name");
+  const [name26, setName] = import_react83.useState("");
+  const [description, setDescription] = import_react83.useState("");
+  const [content, setContent] = import_react83.useState("");
+  const [error40, setError] = import_react83.useState(null);
+  const [confirmFocused, setConfirmFocused] = import_react83.useState(0);
   const slug = slugify(name26);
   async function handleSave() {
     if (!name26.trim() || !content.trim())
@@ -289951,7 +290606,7 @@ async function detectTerminalMode(timeoutMs = 1000) {
 }
 
 // src/tui/console-theme.ts
-var import_react84 = __toESM(require_react(), 1);
+var import_react85 = __toESM(require_react(), 1);
 var withAlpha = (rgba, a) => RGBA.fromValues(rgba.r, rgba.g, rgba.b, a);
 var overlayThemeRef = {
   current: null
@@ -289974,7 +290629,7 @@ function buildConsoleOptions(themeColors) {
 function ConsoleThemeSync() {
   const { colors: colors2 } = useTheme();
   const renderer = useRenderer();
-  import_react84.useEffect(() => {
+  import_react85.useEffect(() => {
     overlayThemeRef.current = colors2;
     const c = renderer.console;
     c.backgroundColor = withAlpha(colors2.backgroundPanel, 0.85);
@@ -290062,17 +290717,17 @@ function setupAutoCopy(renderer, copyToClipboard) {
 
 // src/tui/index.tsx
 function App({ appConfig }) {
-  const [focusIndex, setFocusIndex] = import_react87.useState(0);
-  const [cwd, setCwd] = import_react87.useState(process.cwd());
-  const [ctrlCPressTime, setCtrlCPressTime] = import_react87.useState(null);
-  const [showExitWarning, setShowExitWarning] = import_react87.useState(false);
-  const [inputKey, setInputKey] = import_react87.useState(0);
-  const [showSessionsDialog, setShowSessionsDialog] = import_react87.useState(false);
-  const [showShortcutsDialog, setShowShortcutsDialog] = import_react87.useState(false);
-  const [showThemeDialog, setShowThemeDialog] = import_react87.useState(false);
-  const [showAuthDialog, setShowAuthDialog] = import_react87.useState(false);
-  const [showPentestDialog, setShowPentestDialog] = import_react87.useState(false);
-  const [pendingPentestFlags, setPendingPentestFlags] = import_react87.useState(undefined);
+  const [focusIndex, setFocusIndex] = import_react88.useState(0);
+  const [cwd, setCwd] = import_react88.useState(process.cwd());
+  const [ctrlCPressTime, setCtrlCPressTime] = import_react88.useState(null);
+  const [showExitWarning, setShowExitWarning] = import_react88.useState(false);
+  const [inputKey, setInputKey] = import_react88.useState(0);
+  const [showSessionsDialog, setShowSessionsDialog] = import_react88.useState(false);
+  const [showShortcutsDialog, setShowShortcutsDialog] = import_react88.useState(false);
+  const [showThemeDialog, setShowThemeDialog] = import_react88.useState(false);
+  const [showAuthDialog, setShowAuthDialog] = import_react88.useState(false);
+  const [showPentestDialog, setShowPentestDialog] = import_react88.useState(false);
+  const [pendingPentestFlags, setPendingPentestFlags] = import_react88.useState(undefined);
   const navigableItems = ["command-input"];
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ConfigProvider, {
     config: appConfig,
@@ -290159,14 +290814,14 @@ function AppContent({
   const { toast } = useToast();
   const { refocusPrompt } = useFocus();
   const { setExternalDialogOpen } = useDialog();
-  import_react87.useEffect(() => {
+  import_react88.useEffect(() => {
     checkForUpdate().then(({ updateAvailable, currentVersion, latestVersion }) => {
       if (!updateAvailable)
         return;
       toast(`Update available: v${currentVersion} → v${latestVersion}. Run: pensar upgrade`, "warn", 8000);
     });
   }, []);
-  import_react87.useEffect(() => {
+  import_react88.useEffect(() => {
     if (route.data.type !== "base")
       return;
     if (!config3.data.responsibleUseAccepted && route.data.path !== "disclosure") {
@@ -290175,12 +290830,12 @@ function AppContent({
       route.navigate({ type: "base", path: "providers" });
     }
   }, [config3.data.responsibleUseAccepted, route.data]);
-  import_react87.useEffect(() => {
+  import_react88.useEffect(() => {
     if (showThemeDialog || showAuthDialog || showPentestDialog) {
       setExternalDialogOpen(true);
     }
   }, [showThemeDialog, showAuthDialog, showPentestDialog]);
-  import_react87.useEffect(() => {
+  import_react88.useEffect(() => {
     if (showExitWarning) {
       const timer = setTimeout(() => {
         setShowExitWarning(false);
@@ -290300,7 +290955,7 @@ function CommandDisplay({
     await config3.update({ responsibleUseAccepted: true });
     route.navigate({
       type: "base",
-      path: "home"
+      path: "providers"
     });
   };
   if (route.data.type === "base") {