@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/build/cli-vkwch0bc.js

@@ -1,1207 +0,0 @@
-import {
-  REPORT_FILENAME_JSON,
-  REPORT_FILENAME_MD,
-  buildManifestEntries,
-  buildPentestReport,
-  finalizeManifest,
-  formatDurationHmsFromMs,
-  getCompletedAgentIds,
-  loadSubagentMessages,
-  readAgentManifest,
-  renderJson,
-  renderMarkdown,
-  saveSubagentData,
-  updateManifestEntryStatus,
-  writeAgentManifest,
-  writeExecutionMetrics
-} from "./cli-wr7g9qcr.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-y61d9433.js";
-import {
-  EndpointSchema
-} from "./cli-0fy9j5dw.js";
-import {
-  BlackboxAttackSurfaceAgent
-} from "./cli-k4hrygff.js";
-import {
-  createThreatModelPrompt
-} from "./cli-fw5r7pfj.js";
-import {
-  CodeAgent
-} from "./cli-jg7r7y5n.js";
-import {
-  FindingsRegistry,
-  OffensiveSecurityAgent,
-  PLAN_MODE_TOOL_NAMES
-} from "./cli-3w2syxpv.js";
-import {
-  hasToolCall
-} from "./cli-k0tckznm.js";
-import {
-  exports_external1 as exports_external,
-  init_zod
-} from "./cli-0ghkg3w6.js";
-
-// src/core/workflows/pentest.ts
-import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join3 } from "path";
-
-// src/core/utils/concurrency.ts
-async function runWithBoundedConcurrency(items, concurrency, fn, abortSignal) {
-  const results = new Array(items.length).fill(null);
-  let nextIdx = 0;
-  let completed = 0;
-  await new Promise((resolve) => {
-    if (items.length === 0) {
-      resolve();
-      return;
-    }
-    let active = 0;
-    function canLaunchMore() {
-      return active < concurrency && nextIdx < items.length && !abortSignal?.aborted;
-    }
-    function next() {
-      if (completed >= nextIdx && !canLaunchMore()) {
-        resolve();
-        return;
-      }
-      while (canLaunchMore()) {
-        const idx = nextIdx++;
-        active++;
-        fn(items[idx], idx).then((r) => {
-          results[idx] = r;
-        }).catch(() => {
-          results[idx] = null;
-        }).finally(() => {
-          active--;
-          completed++;
-          next();
-        });
-      }
-    }
-    next();
-  });
-  return results;
-}
-
-// src/core/session/loader.ts
-import { join } from "path";
-import { existsSync, readFileSync } from "fs";
-function loadAttackSurfaceResults(rootPath) {
-  const resultsPath = join(rootPath, "attack-surface-results.json");
-  if (!existsSync(resultsPath)) {
-    return null;
-  }
-  try {
-    return JSON.parse(readFileSync(resultsPath, "utf-8"));
-  } catch (e) {
-    console.error("Failed to load attack surface results:", e);
-    return null;
-  }
-}
-
-// src/core/workflows/whiteboxAttackSurface.ts
-init_zod();
-import {
-  writeFileSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync2,
-  existsSync as existsSync2,
-  statSync
-} from "fs";
-import { join as join2 } from "path";
-var DEFAULT_CONCURRENCY = 5;
-function sanitizeName(name) {
-  return name.toLowerCase().replace(/[^a-z0-9-_.]/g, "_");
-}
-var WHITEBOX_CODE_AGENT_SYSTEM_PROMPT = `You are an expert source-code analyst with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
-
-Your focus is on **deployed applications and services** — APIs, web apps, microservices — that listen on a port and serve traffic, as well as **owned cloud resources** (S3 buckets, cloud storage, CDN origins, etc.) that are part of the attack surface. Ignore libraries, shared packages, SDKs, CLI tools, build scripts, and test suites unless they are part of a deployable service.
-
-# Tool Usage Guide
-
-## read_file
-Read the contents of any file. You can read the whole file or a specific line range.
-- When a file is large, read it in chunks using startLine / endLine to stay focused.
-- Follow imports and references — when you see an interesting function call, read its source.
-
-## list_files
-List files and directories. Use this to orient yourself in the codebase.
-- Start by listing the project root or relevant subdirectory to understand the structure.
-- Use recursive=true sparingly on targeted subdirectories to avoid flooding context.
-
-## grep
-Search file contents by pattern. This is your most powerful navigation tool.
-- Use it to find route definitions, middleware, controllers, endpoint registrations, etc.
-- Use -i for case-insensitive searches.
-- Use --include="*.ext" to narrow to relevant file types.
-- Use -C 3 or -C 5 to get context around matches.
-- Use -rn (default for directories) for recursive search with line numbers.
-- Use -l to get just file paths when you need a broad overview of where something appears.
-
-## execute_command
-Run shell commands when needed.
-- Use for build tools, git operations, package managers, linters, etc.
-
-## document_app
-Use this to document each application/service you identify. Persists a JSON record to the session's apps directory.
-
-## document_endpoint
-**This is your primary output tool for endpoints.** Use it to document every endpoint you discover. Each call persists a JSON record to the session's endpoints directory, organized by app.
-
-**HARD RULE — call this tool DIRECTLY, one route at a time.** The moment you have enough information about a route to document it, your very next tool call must be \`document_endpoint\` for that route. Do not defer. Do not batch. Do not collect routes into a list to "process later."
-
-**You MUST NOT, under any circumstances:**
-- Build a manifest, JSON file, list, or array of routes to document later (e.g. \`cat > /tmp/pages.json << EOF [...] EOF\`).
-- Write a shell, Python, or any other script whose purpose is to generate \`document_endpoint\` tool calls.
-- Use a single message to "summarize all the routes I'll document" before documenting them.
-- Stop documentation early because you "have enough" or it's "getting repetitive." If you discovered N routes, you must produce N \`document_endpoint\` calls.
-
-These patterns silently truncate at output-token limits and routes get dropped. The only correct workflow is: discover a route → call \`document_endpoint\` for it → discover the next route → call \`document_endpoint\` for it → ... until every route is documented. Repetition is expected and required.
-
-**CRITICAL — endpoint documentation rules:**
-- **One entry per unique route path.** Do NOT create separate entries for different HTTP methods on the same path. If \`/api/users\` supports GET, POST, and DELETE, that is ONE entry with \`method: ["GET", "POST", "DELETE"]\`.
-- **Use \`method: "PAGE"\`** for web pages and views (non-API routes).
-- **Always set \`appName\`** to the application name provided in your objective.
-- **Always set \`routePath\`** to the HTTP route this endpoint serves (e.g., \`/api/users/:id\`, \`/dashboard\`). This is the URL path a client requests — NOT a source-file path.
-- **Always set \`file\`** to the source-code file where the route is defined (e.g., \`src/routes/users.ts\`). This is NOT the HTTP route.
-- **Set \`line\`** to the line number when determinable.
-- **Set \`handler\`** to the handler function or component name.
-- **Set \`authRequired\`** to true/false based on middleware, guards, or decorators.
-
-
-## response
-When your objective includes structured output, call \`response\` with your final results once you are done. This ends your run.
-
-# Working Approach
-1. **Orient first** — list files and read key entry points to understand the structure.
-2. **Ignore submodules** — check for a \`.gitmodules\` file or run \`git submodule status\`. Any directories that are git submodules are external dependencies and must be **completely excluded** from your analysis.
-3. **Search, then read** — use grep to locate what you need, then read the relevant files.
-4. **Document each item the instant you discover it** — every \`document_app\` / \`document_endpoint\` call must be made directly, one item per call, immediately after you identify it. Never collect items into a manifest, JSON file, or batch script. If you find yourself thinking "let me list all of these and then document them," stop — that pattern silently drops items when output tokens run out.
-5. **Follow the trail** — trace through imports, function calls, and references to build full understanding.
-6. **Be thorough** — don't stop at the first match. Cover everything relevant to the objective. Repetitive \`document_endpoint\` calls are expected; do not summarize, deduplicate, or shortcut them.
-`;
-var AppInfoSchema = exports_external.object({
-  name: exports_external.string().describe("Application or service name"),
-  framework: exports_external.string().describe("Framework or cloud service (e.g. Express, Next.js, Django, FastAPI, Rails, AWS S3, CloudFront)"),
-  description: exports_external.string().describe("Brief description of what this app does"),
-  location: exports_external.string().describe("Path to the app root relative to the repository root, or resource identifier for cloud resources"),
-  type: exports_external.enum([
-    "web_application",
-    "api",
-    "full_stack",
-    "domain",
-    "subdomain",
-    "database",
-    "cloud_resource",
-    "storage"
-  ]).default("web_application").describe("Application type — web_application for frontend apps, api for backend services, " + "full_stack for frameworks like Next.js/Remix that serve both, " + "database for databases, cloud_resource for owned cloud infra, storage for S3/GCS/blob storage")
-});
-var AppsDiscoveryResultSchema = exports_external.object({
-  repoType: exports_external.string().describe("e.g. monorepo, single-app, multi-package"),
-  packageManager: exports_external.string().describe("e.g. npm, yarn, pnpm, pip, cargo, go modules"),
-  apps: exports_external.array(AppInfoSchema).describe("All applications/services discovered in the repository")
-});
-var DiscoverySummarySchema = exports_external.object({
-  endpointsDocumented: exports_external.number().describe("Number of endpoints documented via document_endpoint"),
-  summary: exports_external.string().describe("Brief summary of what was found")
-});
-async function runWhiteboxAttackSurfaceWorkflow(input) {
-  const {
-    codebasePath,
-    model,
-    session,
-    authConfig,
-    abortSignal,
-    eventBus,
-    attackSurfaceRegistry,
-    onStepFinish,
-    onCacheMetrics,
-    domains,
-    projectThreatModel,
-    environments
-  } = input;
-  const appsAgent = new CodeAgent({
-    codebasePath,
-    objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
-    system: WHITEBOX_CODE_AGENT_SYSTEM_PROMPT,
-    model,
-    session,
-    authConfig,
-    abortSignal,
-    attackSurfaceRegistry,
-    eventBus,
-    subagentId: "whitebox-apps-discovery",
-    onStepFinish: (event) => onStepFinish?.(event),
-    onCacheMetrics,
-    responseSchema: AppsDiscoveryResultSchema,
-    projectThreatModel
-  });
-  console.log(`[whitebox-workflow] Phase 1: discovering apps in ${codebasePath}${domains?.length ? ` (${domains.length} known domains)` : ""}`);
-  eventBus?.emit("subagent-spawn", {
-    subagentId: "whitebox-apps-discovery",
-    name: "Whitebox Apps Discovery",
-    input: { codebasePath }
-  });
-  const appsResult = await appsAgent.consume();
-  eventBus?.emit("subagent-complete", {
-    subagentId: "whitebox-apps-discovery",
-    status: "completed"
-  });
-  console.log(`[whitebox-workflow] Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
-  if (appsResult?.apps.length) {
-    for (const app of appsResult.apps) {
-      console.log(`[whitebox-workflow]   app: "${app.name}" type=${app.type} framework="${app.framework}" location="${app.location}"`);
-    }
-  }
-  if (!appsResult || appsResult.apps.length === 0) {
-    return {
-      repoType: appsResult?.repoType ?? "unknown",
-      packageManager: appsResult?.packageManager ?? "unknown",
-      apps: [],
-      summary: {
-        totalApps: 0,
-        totalPages: 0,
-        totalApiEndpoints: 0,
-        totalPentestObjectives: 0
-      }
-    };
-  }
-  const assetsPath = join2(session.rootPath, "assets");
-  mkdirSync(assetsPath, { recursive: true });
-  for (const app of appsResult.apps) {
-    const appDir = join2(assetsPath, sanitizeName(app.name));
-    mkdirSync(appDir, { recursive: true });
-    const metadata = {
-      name: app.name,
-      type: app.type,
-      framework: app.framework,
-      description: app.description,
-      location: app.location
-    };
-    writeFileSync(join2(appDir, "app.json"), JSON.stringify(metadata, null, 2), "utf-8");
-  }
-  const NON_SERVICE_TYPES = ["cloud_resource", "storage", "database"];
-  const serviceApps = appsResult.apps.filter((app) => !NON_SERVICE_TYPES.includes(app.type));
-  const cloudApps = appsResult.apps.filter((app) => NON_SERVICE_TYPES.includes(app.type));
-  console.log(`[whitebox-workflow] Phase 2: ${serviceApps.length} service apps (pages+api each), ${cloudApps.length} cloud resources → ${serviceApps.length * 2 + cloudApps.length} total tasks`);
-  const totalApps = appsResult.apps.length;
-  let completedAppCount = 0;
-  eventBus?.emit("app-analysis-progress", {
-    totalApps,
-    completedApps: 0
-  });
-  const tasks = [
-    ...serviceApps.flatMap((app) => [
-      { appInfo: app, type: "pages" },
-      { appInfo: app, type: "apiEndpoints" }
-    ]),
-    ...cloudApps.map((app) => ({
-      appInfo: app,
-      type: "cloudResourceEndpoints"
-    }))
-  ];
-  const appTaskDoneCount = new Map;
-  for (const app of serviceApps) {
-    appTaskDoneCount.set(app.name, { done: 0, total: 2 });
-  }
-  for (const app of cloudApps) {
-    appTaskDoneCount.set(app.name, { done: 0, total: 1 });
-  }
-  await runWithBoundedConcurrency(tasks, DEFAULT_CONCURRENCY, async (task, _index) => {
-    const subagentId = `${task.type}-${task.appInfo.name}`;
-    console.log(`[whitebox-workflow] Phase 2: spawning agent "${subagentId}" (app="${task.appInfo.name}", type=${task.type}, appType=${task.appInfo.type})`);
-    eventBus?.emit("subagent-spawn", {
-      subagentId,
-      name: task.appInfo.name,
-      input: { app: task.appInfo.name, type: task.type }
-    });
-    const objective = task.type === "pages" ? buildPagesDiscoveryObjective(codebasePath, task.appInfo) : task.type === "cloudResourceEndpoints" ? buildCloudResourceEndpointsObjective(codebasePath, task.appInfo, environments) : buildApiEndpointsDiscoveryObjective(codebasePath, task.appInfo);
-    const agent = new CodeAgent({
-      codebasePath,
-      objective,
-      system: WHITEBOX_CODE_AGENT_SYSTEM_PROMPT,
-      model,
-      session,
-      authConfig,
-      abortSignal,
-      attackSurfaceRegistry,
-      eventBus,
-      subagentId,
-      onStepFinish: (event) => onStepFinish?.(event),
-      onCacheMetrics,
-      responseSchema: DiscoverySummarySchema,
-      excludeTools: ["document_app"],
-      projectThreatModel
-    });
-    try {
-      await agent.consume();
-      console.log(`[whitebox-workflow] Phase 2: agent "${subagentId}" completed`);
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "completed"
-      });
-    } catch (error) {
-      console.error(`[whitebox-workflow] Phase 2: agent "${subagentId}" FAILED:`, error instanceof Error ? error.message : String(error));
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "failed"
-      });
-    }
-    const counter = appTaskDoneCount.get(task.appInfo.name);
-    if (counter) {
-      counter.done++;
-      if (counter.done >= counter.total) {
-        completedAppCount++;
-        eventBus?.emit("app-analysis-progress", {
-          totalApps,
-          completedApps: completedAppCount,
-          appName: task.appInfo.name
-        });
-      }
-    }
-  });
-  console.log(`[whitebox-workflow] Phase 3: reading assets from ${assetsPath}`);
-  const {
-    apps: parsedApps,
-    repoType,
-    packageManager
-  } = readAppsFromAssetsDirectory(assetsPath, appsResult);
-  for (const app of parsedApps) {
-    console.log(`[whitebox-workflow] Phase 3: "${app.name}" → ${app.pages.length} pages, ${app.apiEndpoints.length} API endpoints`);
-  }
-  const apps = parsedApps;
-  const totalPages = apps.reduce((sum, a) => sum + a.pages.length, 0);
-  const totalApiEndpoints = apps.reduce((sum, a) => sum + a.apiEndpoints.length, 0);
-  const totalPentestObjectives = apps.reduce((sum, a) => sum + [...a.pages, ...a.apiEndpoints].reduce((s, ep) => s + ep.pentestObjectives.length, 0), 0);
-  return {
-    repoType,
-    packageManager,
-    apps,
-    summary: {
-      totalApps: apps.length,
-      totalPages,
-      totalApiEndpoints,
-      totalPentestObjectives
-    }
-  };
-}
-function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
-  const repoType = appsDiscovery?.repoType ?? "unknown";
-  const packageManager = appsDiscovery?.packageManager ?? "unknown";
-  if (!existsSync2(assetsPath)) {
-    console.log(`[readAssets] Assets directory does not exist: ${assetsPath}`);
-    return { apps: [], repoType, packageManager };
-  }
-  const entries = readdirSync(assetsPath);
-  console.log(`[readAssets] Found ${entries.length} entries in ${assetsPath}: [${entries.join(", ")}]`);
-  const apps = [];
-  for (const entry of entries) {
-    const entryPath = join2(assetsPath, entry);
-    if (!statSync(entryPath).isDirectory()) {
-      console.log(`[readAssets] Skipping non-directory: ${entry}`);
-      continue;
-    }
-    const appJsonPath = join2(entryPath, "app.json");
-    let metadata;
-    if (existsSync2(appJsonPath)) {
-      try {
-        metadata = JSON.parse(readFileSync2(appJsonPath, "utf-8"));
-      } catch {
-        console.warn(`[readAssets] Skipping app folder with unreadable app.json: ${entry}`);
-        continue;
-      }
-    } else {
-      console.log(`[readAssets] Skipping folder without app.json: ${entry}`);
-      continue;
-    }
-    const pages = [];
-    const apiEndpoints = [];
-    const assetFiles = readdirSync(entryPath).filter((f) => f.endsWith(".json") && f !== "app.json");
-    console.log(`[readAssets] App "${metadata.name}" (${entry}): ${assetFiles.length} asset files`);
-    let parseFailed = 0;
-    for (const file of assetFiles) {
-      try {
-        const raw = readFileSync2(join2(entryPath, file), "utf-8");
-        const data = JSON.parse(raw);
-        const endpoint = assetRecordToEndpoint(data);
-        if (!endpoint) {
-          console.log(`[readAssets]   ${file}: failed schema validation (assetRecordToEndpoint returned null)`);
-          parseFailed++;
-          continue;
-        }
-        if (isPageEndpoint(data)) {
-          pages.push(endpoint);
-        } else {
-          apiEndpoints.push(endpoint);
-        }
-      } catch {
-        console.warn(`[readAssets] Skipping unreadable asset file: ${entry}/${file}`);
-        parseFailed++;
-      }
-    }
-    console.log(`[readAssets] App "${metadata.name}": ${pages.length} pages, ${apiEndpoints.length} API endpoints, ${parseFailed} failed`);
-    apps.push({
-      name: metadata.name,
-      type: metadata.type ?? "web_application",
-      framework: metadata.framework,
-      description: metadata.description,
-      location: metadata.location,
-      pages,
-      apiEndpoints
-    });
-  }
-  return { apps, repoType, packageManager };
-}
-function assetRecordToEndpoint(record) {
-  const rawMethod = record.method;
-  const method = Array.isArray(rawMethod) ? rawMethod.join(", ") : rawMethod ?? "UNKNOWN";
-  const path = record.routePath;
-  const file = record.file ?? "";
-  const parsed = EndpointSchema.safeParse({
-    method,
-    path,
-    handler: record.handler,
-    file,
-    line: record.line,
-    authRequired: record.authRequired,
-    description: record.description,
-    pentestObjectives: record.pentestObjectives ?? [],
-    riskScore: record.riskScore,
-    threatModel: record.threatModel
-  });
-  return parsed.success ? parsed.data : null;
-}
-function isPageEndpoint(record) {
-  const method = record.method;
-  if (typeof method === "string") {
-    return method.toUpperCase() === "PAGE";
-  }
-  if (Array.isArray(method)) {
-    return method.length === 1 && method[0].toUpperCase() === "PAGE";
-  }
-  return false;
-}
-function buildAppsDiscoveryObjective(codebasePath, domains, environments) {
-  const domainSection = domains?.length ? `
-## Known Domains
-The following domains are associated with this project. When you document an application, set the \`domain\` field on \`document_app\` if you can determine which domain the app is served from:
-${domains.map((d) => `- ${d}`).join(`
-`)}
-` : "";
-  const environmentsSection = environments?.length ? `
-## Target Environments
-This project is deployed to the following environments:
-${environments.map((e) => `- **${e}**`).join(`
-`)}
-
-**Per-environment app creation:** When infrastructure-as-code or configuration defines resources that are dynamically named per environment (e.g. environment-prefixed S3 buckets, stage-scoped databases, per-environment API endpoints), you MUST create a **separate app entry for each environment**. Use the environment name as a prefix in the app name (e.g. \`${environments[0]}-user-uploads-bucket\`, \`${environments.length > 1 ? environments[1] : "staging"}-api-gateway\`).
-
-**How to identify environment-scoped resources:**
-- IaC that interpolates a stage/environment variable into resource names (e.g. \`\${stage}-my-bucket\`, \`\${env}-api\`, \`$app.$stage.example.com\`)
-- Separate config blocks, Terraform workspaces, SST stages, or CDK stacks per environment
-- Environment variables or config files that change resource identifiers per stage
-
-**For each environment** (${environments.join(", ")}), create an app entry with:
-- **name**: \`<environment>-<resource-name>\` (e.g. \`${environments[0]}-data-bucket\`)
-- **domain**: Substitute the environment name into the IaC naming pattern to derive the environment-specific URL (e.g. IaC has \`\${stage}-data\` → \`https://${environments[0]}-data.s3.amazonaws.com\`). Omit if no naming pattern exists in the code.
-
-**Shared resources:** If a resource is clearly shared across all environments (e.g. a single CDN distribution, a shared auth service), document it once without an environment prefix.
-` : "";
-  return `# Identify All Applications in the Repository
-
-## Codebase
-- **Path:** ${codebasePath}
-${domainSection}${environmentsSection}
-## Task
-Analyze the repository structure and identify every **deployed application or service** (APIs, web apps, microservices) defined within it. Also discover **cloud resources and external services** referenced in the code that are owned by the target (e.g. S3 buckets, cloud storage, CDN origins, message queues).
-
-**IMPORTANT: Only include deployable apps, services, and owned cloud resources.** Exclude:
-- Libraries, SDKs, and shared packages that are consumed by other code but not deployed on their own
-- Git submodules (external dependencies)
-- Build tools, scripts, CLI utilities, and dev tooling
-- Test suites, fixtures, and test helpers
-- Documentation packages
-- Third-party SaaS services not owned by the target (e.g. Stripe, auth providers)
-
-An app/service qualifies if it **listens on a port, serves HTTP traffic, or runs as a deployed process** (e.g. an Express server, a Next.js app, a Django project, a FastAPI service, a background worker with an API).
-
-A **cloud resource** qualifies if it is an **owned infrastructure resource** referenced in the code — S3 buckets, GCS buckets, Azure Blob Storage, CloudFront distributions, Redis/ElastiCache instances, SQS queues, etc. These are part of the attack surface because they may have misconfigured permissions, public access, or sensitive data.
-
-### Steps
-1. List the root directory and read top-level config files (package.json, requirements.txt, Cargo.toml, go.mod, etc.)
-2. **Check for git submodules** — run \`git submodule status\` or check for a \`.gitmodules\` file. Exclude all submodule directories.
-3. Determine the **repo type**: monorepo (workspaces), single-app, multi-package, etc.
-4. Determine the **package manager**: npm, yarn, pnpm, pip, cargo, go modules, etc.
-5. Identify all **deployable** applications/services (ignoring submodules, libraries, and shared packages):
-   - For monorepos: look at workspace packages that have their own server entry point, Dockerfile, or deploy config — skip packages that are libraries/utilities consumed by other packages
-   - For multi-service repos: look at separate service directories with their own server startup
-   - For single apps: the root is the app
-6. **Discover cloud resources** referenced in the codebase:
-   - Search for S3 bucket references (\`s3://\`, \`new S3Client\`, \`boto3.client('s3')\`, bucket name strings in config)
-   - Search for cloud storage URLs (e.g. \`*.s3.amazonaws.com\`, \`storage.googleapis.com\`)
-   - Search for CDN/distribution configs (CloudFront, Cloudflare, etc.)
-   - Search for message queue references (SQS, SNS, RabbitMQ, etc.)
-   - Search for cache/database endpoints (ElastiCache, Redis, DynamoDB, etc.)
-   - Check infrastructure-as-code files (Terraform, CloudFormation, CDK, Pulumi, SST, serverless.yml)
-   - Document each cloud resource as an app with \`appType: "cloud_resource"\` or \`appType: "storage"\`
-7. For each app/resource, determine:
-   - **name**: the application or service name
-   - **framework**: the web framework or cloud service (e.g. "AWS S3", "CloudFront", "Express")
-   - **description**: brief summary of what it does
-   - **location**: path relative to the repository root (for code) or the resource identifier (for cloud resources)
-   - **type**: classify as \`"web_application"\` for frontend-only apps, \`"api"\` for backend API services, \`"full_stack"\` for frameworks serving both UI and API (Next.js, Remix, Nuxt, SvelteKit, Django with templates, Rails), \`"database"\` for databases, \`"cloud_resource"\` for owned cloud infra (SQS, CDN, etc.), \`"storage"\` for S3/GCS/blob storage.
-
-### Setting the \`domain\` field on \`document_app\` — CRITICAL
-
-**Only set \`domain\` when you can deterministically derive it from evidence** — Known Domains list, IaC resource definitions, configuration files, environment variables, or route definitions. Substituting a known environment/stage name into an IaC naming pattern IS deterministic (e.g. IaC defines \`\${stage}-bucket\` and the target environments include "production" → \`https://production-bucket.s3.amazonaws.com\` is valid). However, do NOT invent domains with no supporting evidence — if no domain can be derived from the source, **omit the \`domain\` field entirely**. A missing domain is far better than a hallucinated one.
-
-When you CAN determine the domain, each resource must have its OWN unique, resource-specific domain. Never reuse a generic domain or another application's domain.
-
-**For web apps and API services:** Use the public-facing URL from the Known Domains list, route configuration, or infrastructure definition (e.g., \`https://console.pensar.dev\`, \`https://api.example.com\`).
-
-**For S3 / GCS / blob storage buckets:** Derive the **actual bucket name** from the infrastructure-as-code. The bucket name is defined in the IaC resource definition (e.g., SST \`new sst.aws.Bucket("ProjectData")\` produces a bucket with a name like \`console-staging-projectdata-abc123\`). Set domain to \`https://{actual-bucket-name}.s3.amazonaws.com\`. If the IaC uses a stage/environment variable in the name, substitute the known environment name (e.g. \`\${stage}-projectdata\` with environment "production" → \`https://production-projectdata.s3.amazonaws.com\`). **NEVER use \`https://s3.amazonaws.com\`** — that is the S3 service, not a bucket. If you cannot determine the bucket name at all, omit the domain.
-
-**For databases (RDS, Aurora, DynamoDB):** Use the cluster/instance endpoint from IaC. If the exact endpoint isn't determinable, omit the domain.
-
-**For Redis / ElastiCache:** Use the cache cluster endpoint if determinable, otherwise omit.
-
-**For SQS queues:** Use \`https://sqs.{region}.amazonaws.com/{account}/{queue-name}\` if determinable, otherwise omit.
-
-**For Lambda functions:** Use the Lambda Function URL or the API Gateway route — NOT a generic API domain shared by all functions. If no concrete URL is determinable, omit.
-
-**For CloudFront / CDN:** Use the distribution domain or custom domain alias if determinable, otherwise omit.
-
-**For WebSocket APIs:** Use the WebSocket endpoint URL if determinable, otherwise omit.
-
-When finished, call the \`response\` tool with your structured findings.`;
-}
-function buildPagesDiscoveryObjective(codebasePath, appInfo) {
-  return `# Find All Web Pages in ${appInfo.name}
-
-## Codebase
-- **Repository root:** ${codebasePath}
-- **App location:** ${appInfo.location}
-- **Framework:** ${appInfo.framework}
-
-## Scope — CRITICAL
-**Only document pages/views that are DEFINED within this application (\`${appInfo.location}\`).** A page belongs to this app if its route definition or component file lives inside \`${appInfo.location}\`.
-
-Do NOT document:
-- Routes defined in other applications or packages (even if this app imports/calls them)
-- External URLs or cloud resource endpoints that this app links to or fetches from
-- API endpoints (those are handled separately)
-
-## Task
-Find ALL web pages, views, and routes that render HTML or serve client-side UI **defined in this application's source code**.
-
-### What to look for (by framework)
-- **React/Next.js**: pages/ or app/ directory, route components, layout files
-- **Express**: res.render(), res.sendFile(), static file serving, template routes
-- **Django**: urls.py patterns pointing to template views, class-based views with template_name
-- **Rails**: routes.rb entries pointing to controller actions that render views
-- **Vue/Nuxt**: pages/ directory, router definitions
-- **FastAPI**: routes returning HTMLResponse, Jinja2 template responses
-- **Spring**: @Controller methods returning view names, Thymeleaf templates
-
-### How to document each page
-For each page, call \`document_endpoint\` with:
-- **appName**: \`${appInfo.name}\`
-- **endpointType**: \`"web-endpoint"\`
-- **description**: Brief description of what this page shows
-- **routePath**: The HTTP route this page serves (e.g., \`/dashboard\`). This is the URL path a client requests — it is the endpoint's identity. NOT a file path.
-- **method**: \`"PAGE"\`
-- **file**: Source-code file where this page is defined (e.g., \`src/pages/dashboard.tsx\`). Must be inside \`${appInfo.location}\`. This is NOT the route.
-- **line**: Line number (if determinable)
-- **handler**: Component or handler name
-- **authRequired**: Whether the page requires authentication
-- **riskLevel**: CRITICAL for admin/auth pages, HIGH for user data, MEDIUM for general, LOW for static/public
-
-### Required workflow — NO MANIFESTS, NO BATCHING
-**You MUST call \`document_endpoint\` directly, one page at a time, the moment you identify a route.** It is a hard error to:
-- Build a JSON file, array, or list of pages-to-document and then "process" it (e.g. \`cat > /tmp/pages.json << EOF [...] EOF\`).
-- Write a Python or shell script that emits \`document_endpoint\` calls.
-- Defer documentation until "the end" or until "you have the full picture."
-- Stop early because the calls feel repetitive or because you've documented "the important ones."
-
-These patterns hit per-message output-token limits and silently drop pages — usually the alphabetically-later ones. The only correct loop is: identify route → call \`document_endpoint\` → identify next route → call \`document_endpoint\` → ...
-
-You may use \`list_files\`, \`grep\`, or \`execute_command\` (e.g. \`find ... -name page.tsx\`) to **enumerate** the routes that exist. That enumeration step is fine and encouraged. What is not allowed is using a script to **emit the documentation calls themselves** — those must come directly from you, one tool call per route.
-
-Be thorough — examine every route file, every page directory, every template **within \`${appInfo.location}\`**. Every page surfaced by your enumeration must result in its own \`document_endpoint\` call. Repetitive calls are expected; do not summarize, deduplicate to "interesting" routes, or skip any.
-
-When finished, call \`response\` with a summary of how many pages you documented. The reported count must equal the number of successful \`document_endpoint\` calls you made.`;
-}
-function buildApiEndpointsDiscoveryObjective(codebasePath, appInfo) {
-  return `# Find All API Endpoints in ${appInfo.name}
-
-## Codebase
-- **Repository root:** ${codebasePath}
-- **App location:** ${appInfo.location}
-- **Framework:** ${appInfo.framework}
-
-## Scope — CRITICAL
-**Only document API routes that are DEFINED within this application (\`${appInfo.location}\`).** An endpoint belongs to this app if its route handler or route definition file lives inside \`${appInfo.location}\`.
-
-Do NOT document:
-- Routes defined in other applications or packages
-- External API calls this app makes to third-party services or other internal services
-- S3 bucket URLs, cloud resource endpoints, or CDN URLs that this app interacts with — those belong to the cloud resource, not this API
-- Web pages/views (those are handled separately)
-
-## Task
-Find ALL API endpoints **whose route definitions live in this application's source code**.
-
-### What to look for (by framework)
-- **Express**: app.get(), app.post(), router.get(), router.post(), router.put(), router.delete(), etc.
-- **Next.js**: app/api/ or pages/api/ route handlers (GET, POST, PUT, DELETE exports)
-- **Django**: urls.py patterns pointing to API views, DRF viewsets, routers, @api_view decorators
-- **FastAPI**: @app.get(), @app.post(), @app.put(), @app.delete() decorators
-- **Rails**: routes.rb API namespaces, resources, controller actions
-- **Spring**: @GetMapping, @PostMapping, @PutMapping, @DeleteMapping, @RequestMapping
-- **Go**: http.HandleFunc, mux.Handle, gin router methods
-
-### How to document each endpoint
-For each **unique route path**, call \`document_endpoint\` with:
-- **appName**: \`${appInfo.name}\`
-- **endpointType**: \`"api-endpoint"\`
-- **description**: Brief description of what this endpoint does across all its methods
-- **routePath**: The HTTP route (e.g., \`/api/users\`, \`/api/orders/:id\`). This is the URL path a client requests — it is the endpoint's identity. NOT a source-file path.
-- **method**: Array of ALL HTTP methods this path supports (e.g., \`["GET", "POST"]\`). **Do NOT create separate entries for each method — consolidate them.**
-- **file**: Source-code file where the endpoint is defined (e.g., \`src/routes/users.ts\`). Must be inside \`${appInfo.location}\`. This is NOT the route.
-- **line**: Line number (if determinable)
-- **handler**: Handler function name (comma-separate if multiple handlers for different methods)
-- **authRequired**: Whether the endpoint requires authentication (true if ANY method requires it)
-- **riskLevel**: CRITICAL for auth/payment/admin, HIGH for user data mutations, MEDIUM for general, LOW for read-only public
-
-**CRITICAL: ONE entry per route path.** If \`/api/products\` has GET (list) and POST (create), document it as ONE entry with \`method: ["GET", "POST"]\`. Do NOT create two separate entries.
-
-**IMPORTANT — Method consolidation for document_endpoint:** When using the \`document_endpoint\` tool, do NOT create separate entries for different HTTP methods on the same route path. For example, if \`/api/users\` supports GET, POST, and DELETE, document it as ONE entry with \`method: ["GET", "POST", "DELETE"]\` and include pentest objectives covering all methods.
-
-### Required workflow — NO MANIFESTS, NO BATCHING
-**You MUST call \`document_endpoint\` directly, one route at a time, the moment you identify it.** It is a hard error to:
-- Build a JSON file, array, or list of endpoints-to-document and then "process" it (e.g. \`cat > /tmp/endpoints.json << EOF [...] EOF\`).
-- Write a Python or shell script that emits \`document_endpoint\` calls.
-- Defer documentation until you've "mapped everything out."
-- Stop early because the calls feel repetitive or because you've covered "the important ones."
-
-These patterns hit per-message output-token limits and silently drop endpoints — usually the alphabetically-later ones. The only correct loop is: identify route → call \`document_endpoint\` → identify next route → call \`document_endpoint\` → ...
-
-You may use \`list_files\`, \`grep\`, or \`execute_command\` to **enumerate** routes (e.g. extracting all route registrations into a list to read). That enumeration step is fine. What is not allowed is using a script to **emit the documentation calls themselves** — those must come directly from you, one tool call per unique route path.
-
-Be thorough — trace through all route registrations, middleware chains, and controller files **within \`${appInfo.location}\`**. Every unique route path your enumeration surfaces must result in its own \`document_endpoint\` call.
-
-When finished, call \`response\` with a summary of how many endpoints you documented. The reported count must equal the number of successful \`document_endpoint\` calls you made.`;
-}
-function buildCloudResourceEndpointsObjective(codebasePath, appInfo, environments) {
-  const envNote = environments?.length ? `
-## Target Environments
-This resource may exist in the following environments: ${environments.join(", ")}. When documenting entry points, use the **environment-specific resource identifiers** (e.g. environment-prefixed bucket names, stage-scoped queue URLs, per-environment ARNs). If the app name already includes an environment prefix, use that environment's resource names in the endpoints.
-` : "";
-  return `# Document Entry Points for Cloud Resource: ${appInfo.name}
-
-## Codebase
-- **Repository root:** ${codebasePath}
-- **Resource location:** ${appInfo.location}
-- **Service:** ${appInfo.framework}
-${envNote}
-## Context — Application Domain
-The parent application for this cloud resource already has a domain/URL associated with it (set via \`document_app\`). **Do NOT create endpoints that simply repeat the base domain URL.** The domain is already stored on the application record — endpoints should document **distinct access patterns** that go beyond the base domain.
-
-## Scope — CRITICAL
-You are documenting the **distinct access patterns and resource identifiers** for this cloud resource — specific ways the resource can be accessed that are NOT just its base domain URL.
-
-Do NOT document:
-- The base domain URL of the resource (e.g. \`https://bucket-name.s3.amazonaws.com\`) — this is already the application's domain
-- Code locations where the app calls/uses this resource (e.g. "line 42 of api.ts calls S3.putObject" is NOT an endpoint)
-- API routes from other apps that happen to interact with this resource
-- Internal SDK calls or client instantiations
-
-DO document:
-- **Specific access patterns** beyond the base domain (e.g. pre-signed URL patterns, static website hosting paths, object key patterns)
-- **Resource ARNs** that represent programmatic access points (e.g. \`arn:aws:s3:::bucket-name\`, \`arn:aws:sqs:region:account:queue-name\`)
-- **Alternative access URLs** (e.g. CDN distribution URL, static website hosting URL, regional endpoint variants)
-- **Queue/topic URLs** for message-based resources
-
-## Task
-Find the **distinct access patterns and resource identifiers** for this cloud resource by reading infrastructure-as-code and configuration.
-
-### Where to find entry point information
-1. **Infrastructure-as-code** — Terraform (*.tf), CloudFormation (*.yaml/*.json), CDK constructs, SST components (sst.config.ts, infra/), Pulumi, serverless.yml — these define the resource and its access configuration
-2. **Configuration files** — .env files, config modules, environment variable definitions that contain resource URLs
-3. **Resource policies** — bucket policies, CORS configs, access control settings that reveal how the resource is exposed
-
-### What qualifies as an entry point (by resource type)
-- **S3 / GCS / Blob Storage**: Pre-signed URL patterns (e.g. \`/{objectKey}?X-Amz-Signature={sig}\`), static website hosting URL, ARN. Do NOT include the plain bucket HTTPS endpoint — that's the app domain.
-- **CloudFront / CDN**: Custom domain aliases, origin access patterns
-- **SQS / SNS / Message Queues**: Queue URL, topic ARN
-- **Lambda / Cloud Functions**: Function URL, API Gateway integration URL
-- **DynamoDB / ElastiCache / Redis**: Connection endpoint URL, ARN
-
-### How to document each entry point
-For each entry point, call \`document_endpoint\` with:
-- **appName**: \`${appInfo.name}\`
-- **endpointType**: \`"asset"\`
-- **description**: What this entry point exposes (e.g., "Pre-signed HTTP URLs for temporary read access to objects", "AWS resource ARN for programmatic access through IAM policies")
-- **routePath**: The specific access pattern, path template, or ARN — this is the endpoint's identity. NOT the base domain URL. Examples: \`/{objectKey}?X-Amz-Signature={signature}&X-Amz-Credential={credential}\`, \`arn:aws:s3:::bucket-name\`, \`https://sqs.region.amazonaws.com/account/queue-name\`
-- **method**: Access methods on the resource (e.g., \`["GET", "PUT"]\` for S3, \`["SendMessage", "ReceiveMessage"]\` for SQS, \`["READ", "WRITE"]\` for generic)
-- **file**: Infrastructure or config file where this resource is defined (e.g., \`infra/storage.ts\`). NOT application code that calls it.
-- **line**: Line number if determinable
-- **authRequired**: Whether external access requires authentication
-- **riskLevel**: CRITICAL for publicly accessible storage with write access or sensitive data, HIGH for resources with broad IAM permissions, MEDIUM for internal resources, LOW for read-only public assets
-
-### Required workflow — NO MANIFESTS, NO BATCHING
-**You MUST call \`document_endpoint\` directly, one entry point at a time, the moment you identify it.** Do not build a JSON file or list of entry points to "process later," and do not write a script that emits \`document_endpoint\` calls. Those patterns hit per-message output-token limits and silently drop entries. The only correct loop is: identify entry point → call \`document_endpoint\` → identify next → call \`document_endpoint\` → ...
-
-When finished, call \`response\` with a summary of how many entry points you documented. The reported count must equal the number of successful \`document_endpoint\` calls you made.`;
-}
-
-// src/core/agents/specialized/pentest/planPrompt.ts
-var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
-
-Your job is to analyze the target, understand its attack surface, and create a comprehensive testing plan. You have READ-ONLY tools available — you can probe the target but NOT exploit it.
-
-Methodology:
-1. RECALL — Call list_memories to check for relevant knowledge from previous engagements.
-2. PROBE — Use http_request and browser tools to understand the target's behavior, technology stack, and input vectors.
-3. ANALYZE — Identify technologies, endpoints, authentication mechanisms, input parameters, and potential vulnerability classes.
-4. PLAN — Write a structured pentest plan via write_plan with the following sections:
-   - **Objective** — engagement goals
-   - **Scope** — in-scope targets, exclusions
-   - **Reconnaissance Findings** — technology stack, endpoints, authentication mechanisms discovered
-   - **Attack Surface Map** — entry points ranked by exposure
-   - **Prioritized Attack Vectors** — ordered by impact, with endpoint, vulnerability class, rationale, and test approach per vector
-   - **Testing Methodology** — concrete techniques and payloads per vector (OWASP categories)
-   - **Estimated Action Tiers** — anticipated T1–T5 action counts for operator awareness
-5. DECOMPOSE — Call create_task for each attack vector in the plan. One task per technique × endpoint combination.
-6. SUBMIT — Call submit_plan when the plan is complete and all tasks are created.
-
-Guidelines:
-- Be thorough in reconnaissance — probe different endpoints, check response headers, test authentication flows
-- Rank attack vectors by likelihood of success and potential impact
-- Each task should be atomic and testable independently
-- Include authentication bypass, injection, access control, and business logic testing as appropriate`;
-function buildPlanPrompt(target, objectives) {
-  const objectiveList = objectives.map((o, i) => `${i + 1}. ${o}`).join(`
-`);
-  return `# Planning Assignment
-
-## Target
-- **URL:** ${target}
-
-## Objectives
-${objectiveList}
-
-## Instructions
-1. Probe the target to understand its behavior and attack surface
-2. Write a comprehensive pentest plan via write_plan
-3. Create tasks for each attack vector via create_task
-4. Submit the plan via submit_plan when complete`;
-}
-
-// src/core/workflows/pentest.ts
-var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
-async function runPentestSwarm(input) {
-  const {
-    targets,
-    model,
-    session,
-    authConfig,
-    abortSignal,
-    findingsRegistry,
-    eventBus,
-    onError,
-    concurrency = DEFAULT_CONCURRENCY2,
-    onStepFinish,
-    enableThinking
-  } = input;
-  const completedIds = getCompletedAgentIds(session);
-  const existingManifest = readAgentManifest(session);
-  const freshEntries = buildManifestEntries(targets);
-  const manifestEntries = freshEntries.map((fresh) => {
-    const existing = existingManifest.find((e) => e.id === fresh.id);
-    if (existing && existing.status === "completed")
-      return existing;
-    return fresh;
-  });
-  writeAgentManifest(session, manifestEntries);
-  const results = await runWithBoundedConcurrency(targets, concurrency, async (target, index) => {
-    const subagentId = `pentest-agent-${index + 1}`;
-    if (completedIds.has(subagentId))
-      return null;
-    const previousMessages = loadSubagentMessages(session, subagentId);
-    let lastMessages = [];
-    const handleStepFinish = (e) => {
-      if (e.response.messages) {
-        lastMessages = e.response.messages;
-      }
-      onStepFinish?.(e);
-    };
-    eventBus?.emit("subagent-spawn", {
-      subagentId,
-      name: target.name,
-      input: { target: target.target, objectives: target.objectives }
-    });
-    if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
-      try {
-        const executionTasksDir = join3(session.rootPath, "subagents", `${subagentId}-tasks`);
-        const planAgent = new OffensiveSecurityAgent({
-          system: PLAN_PHASE_SYSTEM_PROMPT,
-          prompt: buildPlanPrompt(target.target, target.objectives),
-          model,
-          session,
-          target: target.target,
-          mode: "plan",
-          activeTools: [...PLAN_MODE_TOOL_NAMES],
-          stopWhen: hasToolCall("submit_plan"),
-          authConfig,
-          abortSignal,
-          findingsRegistry,
-          subagentId: `${subagentId}-plan`,
-          tasksDir: executionTasksDir,
-          planSubagentId: subagentId,
-          eventBus,
-          enableThinking
-        });
-        await planAgent.consume();
-      } catch (planErr) {
-        console.error(`[pentest-swarm] Plan phase failed for ${subagentId}: ${planErr}`);
-      }
-    }
-    const objectiveStr = target.objectives.join("; ");
-    let agent;
-    try {
-      agent = new TargetedPentestAgent({
-        target: target.target,
-        objectives: target.objectives,
-        model,
-        session,
-        authConfig,
-        abortSignal,
-        findingsRegistry,
-        onStepFinish: handleStepFinish,
-        messages: previousMessages.length > 0 ? previousMessages : undefined,
-        eventBus,
-        subagentId,
-        enableThinking
-      });
-      const result = await agent.consume();
-      saveSubagentData(session, {
-        agentName: subagentId,
-        target: target.target,
-        objective: objectiveStr,
-        status: "completed",
-        findingsCount: result.findings.length,
-        messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
-        userPrompt: agent.userPrompt
-      });
-      updateManifestEntryStatus(session, subagentId, "completed");
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "completed"
-      });
-      return result;
-    } catch (error) {
-      saveSubagentData(session, {
-        agentName: subagentId,
-        target: target.target,
-        objective: objectiveStr,
-        status: "failed",
-        error: error instanceof Error ? error.message : String(error),
-        messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
-        userPrompt: agent?.userPrompt ?? ""
-      });
-      updateManifestEntryStatus(session, subagentId, "failed");
-      eventBus?.emit("subagent-complete", {
-        subagentId,
-        status: "failed"
-      });
-      eventBus?.emit("error", { error, subagentId });
-      onError?.(error);
-      throw error;
-    }
-  }, abortSignal);
-  finalizeManifest(session, manifestEntries, results);
-  return results;
-}
-async function runPentestWorkflow(input) {
-  const {
-    target,
-    cwd,
-    model,
-    session,
-    authConfig,
-    abortSignal,
-    eventBus,
-    onStepFinish,
-    onCacheMetrics,
-    enableThinking,
-    prompt,
-    threatModel
-  } = input;
-  if (prompt || threatModel) {
-    const parts = [];
-    if (threatModel)
-      parts.push(createThreatModelPrompt(threatModel));
-    if (prompt)
-      parts.push(prompt);
-    const combined = parts.join(`
-
-`);
-    if (!session.config) {
-      session.config = {};
-    }
-    session.config.prompt = session.config.prompt ? `${session.config.prompt}
-
-${combined}` : combined;
-  }
-  const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
-  try {
-    const mode = cwd ? "whitebox" : "blackbox";
-    let swarmTargets;
-    const existingResults = loadAttackSurfaceResults(session.rootPath);
-    if (existingResults?.targets && existingResults.targets.length > 0) {
-      swarmTargets = existingResults.targets.map((t) => ({
-        target: t.target,
-        objectives: [t.objective]
-      }));
-      eventBus?.emit("workflow-phase-start", {
-        phase: "discovery",
-        label: "Attack Surface Discovery (cached)"
-      });
-      eventBus?.emit("workflow-phase-complete", {
-        phase: "discovery",
-        summary: {
-          targets: swarmTargets,
-          targetCount: swarmTargets.length,
-          cached: true
-        }
-      });
-    } else {
-      eventBus?.emit("workflow-phase-start", {
-        phase: "discovery",
-        label: `Attack Surface Discovery (${mode})`,
-        metadata: { mode, target }
-      });
-      if (mode === "whitebox") {
-        swarmTargets = await runWhiteboxPhase({
-          codebasePath: cwd,
-          baseTarget: target,
-          model,
-          session,
-          authConfig,
-          abortSignal,
-          eventBus,
-          onStepFinish: wrappedOnStepFinish,
-          onCacheMetrics
-        });
-      } else {
-        swarmTargets = await runBlackboxPhase({
-          target,
-          model,
-          session,
-          authConfig,
-          abortSignal,
-          eventBus,
-          onStepFinish: wrappedOnStepFinish,
-          onCacheMetrics
-        });
-      }
-      eventBus?.emit("workflow-phase-complete", {
-        phase: "discovery",
-        summary: {
-          targets: swarmTargets,
-          targetCount: swarmTargets.length
-        }
-      });
-    }
-    if (abortSignal?.aborted) {
-      throw new DOMException("Pentest aborted by user", "AbortError");
-    }
-    if (swarmTargets.length === 0) {
-      const report2 = buildPentestReport([], {
-        target,
-        model,
-        sessionId: session.id,
-        mode
-      });
-      const mdPath2 = join3(session.rootPath, REPORT_FILENAME_MD);
-      const jsonPath2 = join3(session.rootPath, REPORT_FILENAME_JSON);
-      writeFileSync2(mdPath2, renderMarkdown(report2));
-      writeFileSync2(jsonPath2, renderJson(report2));
-      return {
-        findings: [],
-        findingsPath: session.findingsPath,
-        pocsPath: session.pocsPath,
-        reportPath: mdPath2
-      };
-    }
-    eventBus?.emit("workflow-phase-start", {
-      phase: "pentesting",
-      label: `Pentest Swarm (${swarmTargets.length} targets)`
-    });
-    const findingsRegistry = FindingsRegistry.fromDirectory(session.findingsPath, {
-      model,
-      authConfig,
-      abortSignal
-    });
-    const completedCount = getCompletedAgentIds(session).size;
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm({
-        targets: swarmTargets,
-        model,
-        session,
-        authConfig,
-        abortSignal,
-        findingsRegistry,
-        eventBus,
-        onStepFinish: wrappedOnStepFinish,
-        enableThinking
-      });
-    }
-    if (abortSignal?.aborted) {
-      throw new DOMException("Pentest aborted by user", "AbortError");
-    }
-    eventBus?.emit("workflow-phase-start", {
-      phase: "reporting",
-      label: "Report Generation"
-    });
-    await findingsRegistry.groupByRootCause();
-    const findings = [...findingsRegistry.getFindings()];
-    const report = buildPentestReport(findings, {
-      target,
-      model,
-      sessionId: session.id,
-      mode
-    });
-    const mdPath = join3(session.rootPath, REPORT_FILENAME_MD);
-    const jsonPath = join3(session.rootPath, REPORT_FILENAME_JSON);
-    writeFileSync2(mdPath, renderMarkdown(report));
-    writeFileSync2(jsonPath, renderJson(report));
-    const severityCounts = {};
-    for (const f of findings) {
-      const sev = (f.severity ?? "unknown").toLowerCase();
-      severityCounts[sev] = (severityCounts[sev] ?? 0) + 1;
-    }
-    eventBus?.emit("workflow-phase-complete", {
-      phase: "reporting",
-      summary: {
-        reportPath: mdPath,
-        findingsCount: findings.length,
-        findingsBySeverity: severityCounts
-      }
-    });
-    return {
-      findings,
-      findingsPath: session.findingsPath,
-      pocsPath: session.pocsPath,
-      reportPath: mdPath
-    };
-  } finally {
-    const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
-    writeExecutionMetrics({
-      sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
-      runtime
-    });
-  }
-}
-async function runWhiteboxPhase(opts) {
-  const workflowInput = {
-    codebasePath: opts.codebasePath,
-    model: opts.model,
-    session: opts.session,
-    authConfig: opts.authConfig,
-    abortSignal: opts.abortSignal,
-    eventBus: opts.eventBus,
-    onStepFinish: opts.onStepFinish,
-    onCacheMetrics: opts.onCacheMetrics
-  };
-  const result = await runWhiteboxAttackSurfaceWorkflow(workflowInput);
-  return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => ({
-    target: ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`,
-    objectives: ep.pentestObjectives
-  })));
-}
-async function runBlackboxPhase(opts) {
-  let lastMessages = [];
-  const agentInput = {
-    target: opts.target,
-    model: opts.model,
-    session: opts.session,
-    authConfig: opts.authConfig,
-    abortSignal: opts.abortSignal,
-    eventBus: opts.eventBus,
-    subagentId: "attack-surface-agent",
-    onStepFinish: (e) => {
-      if (e.response.messages) {
-        lastMessages = e.response.messages;
-      }
-      opts.onStepFinish?.(e);
-    },
-    onCacheMetrics: opts.onCacheMetrics
-  };
-  const agent = new BlackboxAttackSurfaceAgent(agentInput);
-  opts.eventBus?.emit("subagent-spawn", {
-    subagentId: "attack-surface-agent",
-    name: "Attack Surface Discovery",
-    input: { target: opts.target }
-  });
-  try {
-    const result = await agent.consume();
-    saveSubagentData(opts.session, {
-      agentName: "attack-surface-agent",
-      target: opts.target,
-      status: "completed",
-      messages: lastMessages
-    });
-    opts.eventBus?.emit("subagent-complete", {
-      subagentId: "attack-surface-agent",
-      status: "completed"
-    });
-    return result.targets.map((t) => ({
-      target: t.target,
-      objectives: [t.objective]
-    }));
-  } catch (e) {
-    saveSubagentData(opts.session, {
-      agentName: "attack-surface-agent",
-      target: opts.target,
-      status: "failed",
-      error: e instanceof Error ? e.message : String(e),
-      messages: lastMessages
-    });
-    opts.eventBus?.emit("subagent-complete", {
-      subagentId: "attack-surface-agent",
-      status: "failed"
-    });
-    throw e;
-  }
-}
-export { DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };