@pensar/apex 2.0.1-canary.dbd5280d → 2.0.2-canary.9e4e15cf

package/build/{cli-bhmpwat8.js → cli-qdh225p7.js}

@@ -1,6 +1,6 @@
 import {
   detectOSAndEnhancePrompt
-} from "./cli-p34rdn2x.js";
+} from "./cli-w1nb1y6h.js";
 import {
   parseTargetUrl
 } from "./cli-c8131c4q.js";
@@ -26,14 +26,14 @@ import {
   scopedLogger,
   streamResponse,
   write
-} from "./cli-q4n0b0zg.js";
+} from "./cli-dk63pna5.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-xjc8ep0h.js";
+} from "./cli-p904s2yj.js";
 import {
   _enum,
   _null,
@@ -64,7 +64,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-36r75bvs.js";
+} from "./cli-kxpba6jy.js";
 import {
   __commonJS,
   __require,
@@ -42486,8 +42486,8 @@ var require_core3 = __commonJS((exports) => {
   function many1(p) {
     return ab(p, many(p), (head, tail) => [head, ...tail]);
   }
-  function ab(pa, pb, join13) {
-    return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join13(ma.value, vb, data, i, j)));
+  function ab(pa, pb, join14) {
+    return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join14(ma.value, vb, data, i, j)));
   }
   function left(pa, pb) {
     return ab(pa, pb, (va) => va);
@@ -42495,8 +42495,8 @@ var require_core3 = __commonJS((exports) => {
   function right(pa, pb) {
     return ab(pa, pb, (va, vb) => vb);
   }
-  function abc(pa, pb, pc, join13) {
-    return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join13(ma.value, mb.value, vc, data, i, j))));
+  function abc(pa, pb, pc, join14) {
+    return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join14(ma.value, mb.value, vc, data, i, j))));
   }
   function middle(pa, pb, pc) {
     return abc(pa, pb, pc, (ra, rb) => rb);
@@ -71179,7 +71179,7 @@ var require_thread_stream = __commonJS((exports, module) => {
   var { version } = require_package5();
   var { EventEmitter: EventEmitter2 } = __require("events");
   var { Worker } = __require("worker_threads");
-  var { join: join13 } = __require("path");
+  var { join: join14 } = __require("path");
   var { pathToFileURL } = __require("url");
   var { wait } = require_wait();
   var {
@@ -71215,7 +71215,7 @@ var require_thread_stream = __commonJS((exports, module) => {
   function createWorker(stream, opts) {
     const { filename, workerData } = opts;
     const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-    const toExecute = bundlerOverrides["thread-stream-worker"] || join13(__dirname, "lib", "worker.js");
+    const toExecute = bundlerOverrides["thread-stream-worker"] || join14(__dirname, "lib", "worker.js");
     const worker = new Worker(toExecute, {
       ...opts.workerOpts,
       trackUnmanagedFds: false,
@@ -71601,10 +71601,10 @@ var require_thread_stream = __commonJS((exports, module) => {
 // node_modules/pino/lib/transport.js
 var require_transport = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/apex/apex/node_modules/pino/lib";
-  var { createRequire: createRequire2 } = __require("module");
+  var { createRequire: createRequire3 } = __require("module");
   var { existsSync: existsSync9 } = __require("node:fs");
   var getCallers = require_caller();
-  var { join: join13, isAbsolute: isAbsolute2, sep } = __require("node:path");
+  var { join: join14, isAbsolute: isAbsolute2, sep } = __require("node:path");
   var { fileURLToPath } = __require("node:url");
   var sleep = require_atomic_sleep();
   var onExit = require_on_exit_leak_free();
@@ -71757,7 +71757,7 @@ var require_transport = __commonJS((exports, module) => {
       throw new Error("only one of target or targets can be specified");
     }
     if (targets) {
-      target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+      target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
       options.targets = targets.filter((dest) => dest.target).map((dest) => {
         return {
           ...dest,
@@ -71774,7 +71774,7 @@ var require_transport = __commonJS((exports, module) => {
         });
       });
     } else if (pipeline2) {
-      target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+      target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
       options.pipelines = [pipeline2.map((dest) => {
         return {
           ...dest,
@@ -71797,13 +71797,13 @@ var require_transport = __commonJS((exports, module) => {
         return origin;
       }
       if (origin === "pino/file") {
-        return join13(__dirname, "..", "file.js");
+        return join14(__dirname, "..", "file.js");
       }
       let fixTarget2;
       for (const filePath of callers) {
         try {
           const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
-          fixTarget2 = createRequire2(context).resolve(origin);
+          fixTarget2 = createRequire3(context).resolve(origin);
           break;
         } catch (err) {
           continue;
@@ -72726,7 +72726,7 @@ var require_safe_stable_stringify = __commonJS((exports, module) => {
             return circularValue;
           }
           let res = "";
-          let join13 = ",";
+          let join14 = ",";
           const originalIndentation = indentation;
           if (Array.isArray(value)) {
             if (value.length === 0) {
@@ -72740,7 +72740,7 @@ var require_safe_stable_stringify = __commonJS((exports, module) => {
               indentation += spacer;
               res += `
 ${indentation}`;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
             }
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -72748,13 +72748,13 @@ ${indentation}`;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp2 !== undefined ? tmp2 : "null";
-              res += join13;
+              res += join14;
             }
             const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
             res += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+              res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             if (spacer !== "") {
               res += `
@@ -72775,7 +72775,7 @@ ${originalIndentation}`;
           let separator = "";
           if (spacer !== "") {
             indentation += spacer;
-            join13 = `,
+            join14 = `,
 ${indentation}`;
             whitespace = " ";
           }
@@ -72789,13 +72789,13 @@ ${indentation}`;
             const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (keyLength > maximumBreadth) {
             const removedKeys = keyLength - maximumBreadth;
             res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-            separator = join13;
+            separator = join14;
           }
           if (spacer !== "" && separator.length > 1) {
             res = `
@@ -72835,7 +72835,7 @@ ${originalIndentation}`;
           }
           const originalIndentation = indentation;
           let res = "";
-          let join13 = ",";
+          let join14 = ",";
           if (Array.isArray(value)) {
             if (value.length === 0) {
               return "[]";
@@ -72848,7 +72848,7 @@ ${originalIndentation}`;
               indentation += spacer;
               res += `
 ${indentation}`;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
             }
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -72856,13 +72856,13 @@ ${indentation}`;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp2 !== undefined ? tmp2 : "null";
-              res += join13;
+              res += join14;
             }
             const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
             res += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+              res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             if (spacer !== "") {
               res += `
@@ -72875,7 +72875,7 @@ ${originalIndentation}`;
           let whitespace = "";
           if (spacer !== "") {
             indentation += spacer;
-            join13 = `,
+            join14 = `,
 ${indentation}`;
             whitespace = " ";
           }
@@ -72884,7 +72884,7 @@ ${indentation}`;
             const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (spacer !== "" && separator.length > 1) {
@@ -72941,20 +72941,20 @@ ${originalIndentation}`;
             indentation += spacer;
             let res2 = `
 ${indentation}`;
-            const join14 = `,
+            const join15 = `,
 ${indentation}`;
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
             let i = 0;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp2 !== undefined ? tmp2 : "null";
-              res2 += join14;
+              res2 += join15;
             }
             const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
             res2 += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res2 += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
+              res2 += `${join15}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             res2 += `
 ${originalIndentation}`;
@@ -72970,16 +72970,16 @@ ${originalIndentation}`;
             return '"[Object]"';
           }
           indentation += spacer;
-          const join13 = `,
+          const join14 = `,
 ${indentation}`;
           let res = "";
           let separator = "";
           let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
           if (isTypedArrayWithEntries(value)) {
-            res += stringifyTypedArray(value, join13, maximumBreadth);
+            res += stringifyTypedArray(value, join14, maximumBreadth);
             keys = keys.slice(value.length);
             maximumPropertiesToStringify -= value.length;
-            separator = join13;
+            separator = join14;
           }
           if (deterministic) {
             keys = sort(keys, comparator);
@@ -72990,13 +72990,13 @@ ${indentation}`;
             const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}: ${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (keyLength > maximumBreadth) {
             const removedKeys = keyLength - maximumBreadth;
             res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-            separator = join13;
+            separator = join14;
           }
           if (separator !== "") {
             res = `
@@ -109378,8 +109378,46 @@ function isElectron() {
 init_dist();
 init_zod();
 import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { createRequire } from "module";
-import { dirname, join as join3 } from "path";
+import { createRequire as createRequire2 } from "module";
+import { dirname as dirname2, join as join4 } from "path";
+
+// src/core/agents/offSecAgent/tools/camoufox.ts
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname, join as join3 } from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var CAMOUFOX_OPTIONS = {
+  humanize: true,
+  block_webrtc: true
+};
+async function resolveCamoufoxLaunchOptions(headless) {
+  const { launchOptions: camoufoxLaunchOptions } = await import("camoufox-js");
+  return await camoufoxLaunchOptions({
+    ...CAMOUFOX_OPTIONS,
+    headless
+  });
+}
+var ensurePromise = null;
+function ensureCamoufox(log) {
+  if (!ensurePromise) {
+    ensurePromise = (async () => {
+      log?.("Provisioning Camoufox browser (first run downloads ~150MB; cached after)…");
+      const require_ = createRequire(import.meta.url);
+      const pkgPath = require_.resolve("camoufox-js/package.json");
+      const fetchBin = join3(dirname(pkgPath), "dist", "__main__.js");
+      await execFileAsync("node", [fetchBin, "fetch"], {
+        timeout: 300000
+      });
+    })().catch((err) => {
+      ensurePromise = null;
+      throw err;
+    });
+  }
+  return ensurePromise;
+}
+
+// src/core/agents/offSecAgent/tools/playwrightMcp.ts
 var BrowserNavigateInput = exports_external.object({
   url: exports_external.string().describe("Full URL to navigate to"),
   toolCallDescription: exports_external.string().describe("Why you are navigating to this URL")
@@ -109495,6 +109533,7 @@ class PlaywrightMcpSession {
   viewportSize;
   extraHttpHeaders;
   mcpConfigPath = null;
+  cachedCamouOptions = null;
   constructor(options = {}) {
     const { headless, userAgent, viewportSize, extraHttpHeaders } = options;
     this.headless = headless ?? defaultHeadless;
@@ -109504,12 +109543,25 @@ class PlaywrightMcpSession {
     this.extraHttpHeaders = headerSource && Object.keys(headerSource).length > 0 ? { ...headerSource } : undefined;
   }
   resetState() {
+    this.cleanupConfigFile();
     this.mcpClient = null;
     this.mcpTransport = null;
     this.mcpProcess = null;
     this.connectionPromise = null;
     this.disconnecting = false;
   }
+  cleanupConfigFile() {
+    const configPath = this.mcpConfigPath;
+    if (!configPath)
+      return;
+    this.mcpConfigPath = null;
+    (async () => {
+      try {
+        const fsp = await import("fs/promises");
+        await fsp.unlink(configPath);
+      } catch {}
+    })();
+  }
   forceKillProcess(proc = this.mcpProcess) {
     if (!proc || proc.exitCode !== null)
       return;
@@ -109538,41 +109590,40 @@ class PlaywrightMcpSession {
     }
     this.connectionPromise = (async () => {
       try {
-        const require_ = createRequire(import.meta.url);
+        const require_ = createRequire2(import.meta.url);
         const mcpPkgJsonPath = require_.resolve("@playwright/mcp/package.json");
-        const cliPath = join3(dirname(mcpPkgJsonPath), "cli.js");
+        const cliPath = join4(dirname2(mcpPkgJsonPath), "cli.js");
         const args = [cliPath, "--isolated"];
-        if (this.headless) {
-          args.push("--headless");
-        }
-        if (this.userAgent) {
-          args.push("--user-agent", this.userAgent);
-        }
-        if (this.viewportSize) {
-          args.push(`--viewport-size=${this.viewportSize}`);
-        }
-        if (this.extraHttpHeaders) {
-          const os = await import("os");
-          const fsp = await import("fs/promises");
-          const cfg = {
-            browser: {
-              contextOptions: { extraHTTPHeaders: this.extraHttpHeaders }
-            }
-          };
-          this.mcpConfigPath = join3(os.tmpdir(), `pensar-mcp-${process.pid}-${Date.now()}.json`);
-          await fsp.writeFile(this.mcpConfigPath, JSON.stringify(cfg), {
-            encoding: "utf-8",
-            mode: 384
-          });
-          args.push("--config", this.mcpConfigPath);
-        }
-        if (process.getuid?.() === 0) {
-          args.push("--no-sandbox");
-        }
+        await ensureCamoufox();
+        if (!this.cachedCamouOptions) {
+          this.cachedCamouOptions = await resolveCamoufoxLaunchOptions(this.headless);
+        }
+        const camou = this.cachedCamouOptions;
+        const os = await import("os");
+        const fsp = await import("fs/promises");
+        const cfg = {
+          browser: {
+            browserName: "firefox",
+            launchOptions: {
+              executablePath: camou.executablePath,
+              args: camou.args,
+              firefoxUserPrefs: camou.firefoxUserPrefs,
+              headless: camou.headless
+            },
+            ...this.extraHttpHeaders ? { contextOptions: { extraHTTPHeaders: this.extraHttpHeaders } } : {}
+          }
+        };
+        this.mcpConfigPath = join4(os.tmpdir(), `pensar-mcp-${process.pid}-${Date.now()}.json`);
+        await fsp.writeFile(this.mcpConfigPath, JSON.stringify(cfg), {
+          encoding: "utf-8",
+          mode: 384
+        });
+        args.push("--config", this.mcpConfigPath);
         const transport = new StdioClientTransport({
           command: "node",
           args,
-          stderr: "pipe"
+          stderr: "pipe",
+          env: Object.fromEntries(Object.entries(camou.env).map(([k, v]) => [k, String(v)]))
         });
         const client = new Client({
           name: "apex-browser-agent",
@@ -109627,16 +109678,7 @@ class PlaywrightMcpSession {
     ]);
     if (closeTimer)
       clearTimeout(closeTimer);
-    if (this.mcpConfigPath) {
-      const configPath = this.mcpConfigPath;
-      this.mcpConfigPath = null;
-      (async () => {
-        try {
-          const fsp = await import("fs/promises");
-          await fsp.unlink(configPath);
-        } catch {}
-      })();
-    }
+    this.cleanupConfigFile();
     this.disconnecting = false;
   }
   isConnected() {
@@ -109960,8 +110002,8 @@ Target base URL: ${targetUrl}`,
         if (base64Data) {
           const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
           const screenshotFilename = `${filename}_${timestamp}.png`;
-          const screenshotPath = join3(evidenceDir, screenshotFilename);
-          const dir = dirname(screenshotPath);
+          const screenshotPath = join4(evidenceDir, screenshotFilename);
+          const dir = dirname2(screenshotPath);
           if (!existsSync2(dir)) {
             mkdirSync(dir, { recursive: true });
           }
@@ -110175,17 +110217,19 @@ The returned cookies can be formatted as a Cookie header for use with http_reque
 init_dist();
 init_zod();
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 var SANDBOX_PW_DIR = "/opt/sandbox-playwright";
 var SANDBOX_EVIDENCE_DIR = "/tmp/evidence";
 var SANDBOX_REFS_FILE = "/tmp/pw-refs.json";
 var SANDBOX_URL_FILE = "/tmp/pw-current-url";
 var SANDBOX_CONSOLE_FILE = "/tmp/pw-console-log.json";
+var SANDBOX_CAMOU_CACHE = "/tmp/pw-camou-opts.json";
 var RESULT_START = "__PW_RESULT__";
 var RESULT_END = "__PW_END__";
 var installationCache = new WeakMap;
+var browserSetupCache = new WeakMap;
 async function checkSandboxPlaywright(sandbox) {
-  const script = `try{require("playwright");console.log("OK")}catch(e){process.exit(1)}`;
+  const script = `(async()=>{try{const{launchPath}=await import("camoufox-js/dist/pkgman.js");require("playwright-core");if(!require("fs").existsSync(launchPath()))process.exit(1);console.log("OK")}catch(e){process.exit(1)}})()`;
   const b64 = Buffer.from(script).toString("base64");
   await sandbox.execute(`mkdir -p ${SANDBOX_PW_DIR} && echo "${b64}" | base64 -d > ${SANDBOX_PW_DIR}/pw_check.js`, { timeout: 10 });
   const result = await sandbox.execute(`node ${SANDBOX_PW_DIR}/pw_check.js`, {
@@ -110196,35 +110240,33 @@ async function checkSandboxPlaywright(sandbox) {
 async function installSandboxPlaywright(sandbox) {
   await sandbox.execute(`mkdir -p ${SANDBOX_PW_DIR}`, { timeout: 10 });
   const isAlpine = (await sandbox.execute("which apk", { timeout: 5 })).success;
+  if (isAlpine) {
+    throw new Error("Camoufox requires a glibc-based sandbox image (Debian/Ubuntu); Alpine/musl is unsupported.");
+  }
   const initResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npm init -y --silent 2>/dev/null`, { timeout: 30 });
   if (!initResult.success) {
     throw new Error(`Failed to init npm project in sandbox: ${initResult.stderr || initResult.stdout}`);
   }
-  const npmInstallCmd = isAlpine ? `cd ${SANDBOX_PW_DIR} && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install playwright 2>&1` : `cd ${SANDBOX_PW_DIR} && npm install playwright 2>&1`;
-  const installResult = await sandbox.execute(npmInstallCmd, { timeout: 300 });
+  const installResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npm install camoufox-js@0.11.1 playwright-core@1.53.1 2>&1`, { timeout: 300 });
   if (!installResult.success) {
-    throw new Error(`Failed to install Playwright in sandbox: ${installResult.stderr || installResult.stdout}`);
+    throw new Error(`Failed to install camoufox-js in sandbox: ${installResult.stderr || installResult.stdout}`);
   }
-  if (isAlpine) {
-    const apkResult = await sandbox.execute("apk add --no-cache chromium nss freetype harfbuzz ca-certificates ttf-freefont 2>&1", { timeout: 120 });
-    if (!apkResult.success) {
-      throw new Error(`Failed to install Chromium via apk: ${apkResult.stderr || apkResult.stdout}`);
-    }
-  } else {
-    await sandbox.execute(`(sudo rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null || rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null || true)`, { timeout: 10 });
-    let browserResult;
-    for (let attempt = 1;attempt <= 3; attempt++) {
-      browserResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npx playwright install chromium --with-deps 2>&1`, { timeout: 300 });
-      if (browserResult.success)
-        break;
-      if (attempt < 3) {
-        await new Promise((r) => setTimeout(r, 3000));
-      }
-    }
-    if (!browserResult.success) {
-      throw new Error(`Failed to install Chromium in sandbox: ${browserResult.stderr || browserResult.stdout}`);
+  const depsResult = await sandbox.execute(`rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null; cd ${SANDBOX_PW_DIR} && npx playwright@1.53.1 install-deps firefox 2>&1`, { timeout: 300 });
+  if (!depsResult.success) {
+    throw new Error(`Failed to install Firefox system deps in sandbox: ${depsResult.stderr || depsResult.stdout}`);
+  }
+  let fetchResult;
+  for (let attempt = 1;attempt <= 3; attempt++) {
+    fetchResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && node ./node_modules/camoufox-js/dist/__main__.js fetch 2>&1`, { timeout: 300 });
+    if (fetchResult.success)
+      break;
+    if (attempt < 3) {
+      await new Promise((r) => setTimeout(r, 3000));
     }
   }
+  if (!fetchResult.success) {
+    throw new Error(`Failed to fetch Camoufox in sandbox: ${fetchResult.stderr || fetchResult.stdout}`);
+  }
 }
 async function ensureSandboxPlaywright(sandbox) {
   let cached = installationCache.get(sandbox);
@@ -110245,42 +110287,59 @@ async function ensureSandboxPlaywright(sandbox) {
   }
 }
 async function ensureSandboxBrowser(sandbox) {
-  await sandbox.execute(`mkdir -p ${SANDBOX_EVIDENCE_DIR} /tmp/pw-user-data`, {
-    timeout: 5
-  });
+  await sandbox.execute(`rm -rf /tmp/pw-user-data ${SANDBOX_CAMOU_CACHE}; mkdir -p ${SANDBOX_EVIDENCE_DIR} /tmp/pw-user-data`, { timeout: 5 });
 }
 async function ensureSandboxReady(sandbox) {
   await ensureSandboxPlaywright(sandbox);
-  await ensureSandboxBrowser(sandbox);
+  let cached = browserSetupCache.get(sandbox);
+  if (!cached) {
+    cached = ensureSandboxBrowser(sandbox);
+    browserSetupCache.set(sandbox, cached);
+    try {
+      await cached;
+    } catch (error) {
+      browserSetupCache.delete(sandbox);
+      throw error;
+    }
+  } else {
+    await cached;
+  }
 }
 async function runPlaywrightScript(sandbox, body, timeout = 60, extraHttpHeaders) {
   const headersJson = extraHttpHeaders && Object.keys(extraHttpHeaders).length > 0 ? JSON.stringify(extraHttpHeaders) : "null";
   const script = `
-const { chromium } = require('playwright');
+const { firefox } = require('playwright-core');
 const fs = require('fs');
 
 (async () => {
+  const { launchOptions } = await import('camoufox-js');
   function resolve(value) {
     process.stdout.write('${RESULT_START}' + JSON.stringify(value) + '${RESULT_END}');
   }
 
-  // Prefer system Chromium (Alpine apk install) over Playwright's bundled binary.
-  let executablePath;
-  for (const p of ['/usr/bin/chromium-browser', '/usr/bin/chromium']) {
-    try { fs.accessSync(p, fs.constants.X_OK); executablePath = p; break; } catch {}
-  }
-
   // Resolved per script invocation so /headers mutations take effect
   // on the next browser tool call.
   const __extraHeaders = ${headersJson};
 
+  // Use the sandbox's virtual display if one is present — Camoufox is far less
+  // detectable headful. Falls back to plain headless, which is still fully
+  // fingerprint-spoofed (just a weaker stealth posture, never vanilla Chromium).
+  const __headless = process.env.DISPLAY ? false : true;
+  // Resolve Camoufox options once per sandbox session and cache to disk so
+  // every tool call presents the same fingerprint on the shared profile dir.
+  let __camou;
+  try {
+    __camou = JSON.parse(fs.readFileSync('${SANDBOX_CAMOU_CACHE}', 'utf-8'));
+  } catch {
+    __camou = await launchOptions({ ...${JSON.stringify(CAMOUFOX_OPTIONS)}, headless: __headless });
+    fs.writeFileSync('${SANDBOX_CAMOU_CACHE}', JSON.stringify(__camou));
+  }
+
   let context;
   const __consoleMessages = [];
   try {
-    context = await chromium.launchPersistentContext('/tmp/pw-user-data', {
-      headless: true,
-      ...(executablePath ? { executablePath } : {}),
-      args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu'],
+    context = await firefox.launchPersistentContext('/tmp/pw-user-data', {
+      ...__camou,
       ...(__extraHeaders ? { extraHTTPHeaders: __extraHeaders } : {}),
     });
     const pages = context.pages();
@@ -110370,7 +110429,7 @@ var BrowserGetCookiesInput2 = exports_external.object({
 });
 function createSandboxBrowserTools(ctx) {
   const sandbox = ctx.sandbox;
-  const evidenceDir = join4(ctx.session.rootPath, "evidence");
+  const evidenceDir = join5(ctx.session.rootPath, "evidence");
   const targetUrl = ctx.target ?? "";
   if (!existsSync3(evidenceDir)) {
     mkdirSync2(evidenceDir, { recursive: true });
@@ -110382,9 +110441,13 @@ function createSandboxBrowserTools(ctx) {
     }
     return setupPromise;
   }
+  let scriptQueue = Promise.resolve();
   function runScript(body, timeout = 60) {
     const resolved = targetUrl ? resolveEffectiveHeaders(resolverSessionFromCtx(ctx), targetUrl) : ctx.session.config?.headers;
-    return runPlaywrightScript(sandbox, body, timeout, stripBrowserManagedHeaders(resolved));
+    const headers = stripBrowserManagedHeaders(resolved);
+    const next = scriptQueue.then(() => runPlaywrightScript(sandbox, body, timeout, headers));
+    scriptQueue = next.then(() => {}, () => {});
+    return next;
   }
   const browser_navigate = tool({
     description: `Navigate the browser to a URL to load and render a page.
@@ -110435,8 +110498,8 @@ Use this to document:
     resolve({ success: true, data: b64, sandboxPath: ${JSON.stringify(sandboxPath)} });
           `, 30);
         if (result.success && result.data) {
-          const localPath = join4(evidenceDir, screenshotFilename);
-          const dir = dirname2(localPath);
+          const localPath = join5(evidenceDir, screenshotFilename);
+          const dir = dirname3(localPath);
           if (!existsSync3(dir)) {
             mkdirSync2(dir, { recursive: true });
           }
@@ -110813,7 +110876,7 @@ The returned cookies can be formatted as a Cookie header for use with http_reque
 // src/core/agents/offSecAgent/tools/browserTools.ts
 init_dist();
 init_zod();
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var BROWSER_TOOL_NAMES = [
   "browser_navigate",
   "browser_snapshot",
@@ -110825,7 +110888,7 @@ var BROWSER_TOOL_NAMES = [
   "browser_get_cookies"
 ];
 function createBrowserToolset(ctx) {
-  const tools = ctx.sandbox ? createSandboxBrowserTools(ctx) : createBrowserTools(ctx.target ?? "", join5(ctx.session.rootPath, "evidence"), "operator", undefined, ctx.abortSignal, undefined, undefined, undefined, ctx.browserSession);
+  const tools = ctx.sandbox ? createSandboxBrowserTools(ctx) : createBrowserTools(ctx.target ?? "", join6(ctx.session.rootPath, "evidence"), "operator", undefined, ctx.abortSignal, undefined, undefined, undefined, ctx.browserSession);
   if (!ctx.credentialManager) {
     return tools;
   }
@@ -110951,7 +111014,7 @@ init_zod();
 init_structured();
 init_lazyLogger();
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var log = scopedLogger(() => createLogger("complete_authentication"));
 var AUTH_DIR = "auth";
 var AUTH_DATA_FILENAME = "auth-data.json";
@@ -110995,11 +111058,11 @@ This tool marks the end of the authentication flow.`,
       log.info(`Authentication complete: ${result.success ? "SUCCESS" : "FAILED"}`);
       let authDataPath;
       try {
-        const authDir = join6(ctx.session.rootPath, AUTH_DIR);
+        const authDir = join7(ctx.session.rootPath, AUTH_DIR);
         if (!existsSync4(authDir)) {
           mkdirSync3(authDir, { recursive: true });
         }
-        authDataPath = join6(authDir, AUTH_DATA_FILENAME);
+        authDataPath = join7(authDir, AUTH_DATA_FILENAME);
         const authData = {
           authenticated: result.success,
           strategy: result.strategy || "unknown",
@@ -111216,7 +111279,7 @@ function crawlAuthenticated(ctx) {
 init_dist();
 init_zod();
 import { writeFileSync as writeFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function createAttackSurfaceReport(ctx) {
   return tool({
     description: `Provide attack surface analysis results to the orchestrator agent.
@@ -111242,7 +111305,7 @@ Call this at the END of your analysis with:
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async (results) => {
-      const resultsPath = join7(ctx.session.rootPath, "attack-surface-results.json");
+      const resultsPath = join8(ctx.session.rootPath, "attack-surface-results.json");
       writeFileSync5(resultsPath, JSON.stringify(results, null, 2));
       return {
         success: true,
@@ -111261,7 +111324,7 @@ init_structured();
 init_lazyLogger();
 import { existsSync as existsSync5 } from "fs";
 import { mkdir, writeFile } from "fs/promises";
-import { dirname as dirname3, isAbsolute, resolve } from "path";
+import { dirname as dirname4, isAbsolute, resolve } from "path";
 var log3 = scopedLogger(() => createLogger("create_file"));
 var createFileInputSchema = exports_external.object({
   path: exports_external.string().describe("Absolute or relative path for the new file"),
@@ -111305,7 +111368,7 @@ async function executeLocalCreate(filePath, content, overwrite) {
         path: filePath
       };
     }
-    const dir = dirname3(filePath);
+    const dir = dirname4(filePath);
     log3.debug(`local: mkdir ${dir}`);
     await mkdir(dir, { recursive: true });
     log3.debug(`local: mkdir done, writing ${content.length} bytes`);
@@ -111339,7 +111402,7 @@ async function executeSandboxCreate(ctx, filePath, content, overwrite) {
         };
       }
     }
-    const dirPath = dirname3(filePath);
+    const dirPath = dirname4(filePath);
     await ctx.sandbox.execute(`mkdir -p "${dirPath}"`);
     const base64Content = Buffer.from(content).toString("base64");
     const writeResult = await ctx.sandbox.execute(`echo "${base64Content}" | base64 -d > "${filePath}"`);
@@ -111370,16 +111433,16 @@ init_zod();
 
 // src/core/tasks/index.ts
 import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, writeFileSync as writeFileSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var HWM_FILENAME = "_hwm.json";
 function ensureDir(dir) {
   mkdirSync4(dir, { recursive: true });
 }
 function taskPath(tasksDir, id) {
-  return join8(tasksDir, `${id}.json`);
+  return join9(tasksDir, `${id}.json`);
 }
 function hwmPath(tasksDir) {
-  return join8(tasksDir, HWM_FILENAME);
+  return join9(tasksDir, HWM_FILENAME);
 }
 function readHighWaterMark(tasksDir) {
   try {
@@ -111452,7 +111515,7 @@ function listTasks(tasksDir, filter) {
     if (!file.endsWith(".json") || file === HWM_FILENAME)
       continue;
     try {
-      const raw = readFileSync(join8(tasksDir, file), "utf-8");
+      const raw = readFileSync(join9(tasksDir, file), "utf-8");
       const task = JSON.parse(raw);
       if (filter?.status && task.status !== filter.status)
         continue;
@@ -111550,7 +111613,7 @@ init_dist();
 init_zod();
 init_credentials();
 import { writeFileSync as writeFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("delegate_auth"));
@@ -111716,7 +111779,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
         if (credentials) {
           ctx.session.credentialManager.addFromAuthCredentials(credentials);
         }
-        const { runAuthenticationAgent } = await import("./authentication-ee80ydxj.js");
+        const { runAuthenticationAgent } = await import("./authentication-3p84dzrr.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const result = await runAuthenticationAgent({
@@ -111735,7 +111798,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
           parentSubagentId: ctx.subagentId
         });
         if (result.success) {
-          const sessionInfoPath = join9(ctx.session.rootPath, "session-info.json");
+          const sessionInfoPath = join10(ctx.session.rootPath, "session-info.json");
           const sessionInfo = {
             authenticated: true,
             username: username || "via_subagent",
@@ -111930,7 +111993,7 @@ function detectBarrier(bodyLower, statusCode) {
 init_dist();
 init_zod();
 import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 function sanitizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9-_.]/g, "_");
 }
@@ -111969,7 +112032,7 @@ function validateDomainUrl(value) {
   }
 }
 function documentApp(ctx) {
-  const baseAppsPath = join10(ctx.session.rootPath, "apps");
+  const baseAppsPath = join11(ctx.session.rootPath, "apps");
   return tool({
     description: `Document a discovered application during attack surface analysis.
 
@@ -112022,7 +112085,7 @@ Each application creates a JSON file in the apps directory for tracking and anal
       const sanitizedName = sanitizeName(input.appName);
       const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
       const filename = `app_${sanitizedName}_${timestamp}.json`;
-      const filepath = join10(baseAppsPath, filename);
+      const filepath = join11(baseAppsPath, filename);
       const appRecord = {
         ...input,
         discoveredAt: new Date().toISOString(),
@@ -112046,7 +112109,7 @@ Each application creates a JSON file in the apps directory for tracking and anal
 init_dist();
 init_zod();
 import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/core/agents/specialized/attackSurface/blackboxRiskScoring.ts
 var RISK_LEVEL_BASE_SCORE = {
@@ -112396,7 +112459,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
   return threatModelLimiter(async () => {
     if (ctx.abortSignal?.aborted)
       return null;
-    const { CodeAgent } = await import("./agent-vnhgzmm9.js");
+    const { CodeAgent } = await import("./agent-ssm6x6qs.js");
     const subagentId = `threat-model-${sanitize(input.appName)}-${sanitize(input.routePath)}`;
     ctx.eventBus?.emit("subagent-spawn", {
       subagentId,
@@ -112704,7 +112767,7 @@ var documentEndpointInputSchema = exports_external.object({
   toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
 });
 function documentEndpoint(ctx) {
-  const baseAssetsPath = join11(ctx.session.rootPath, "assets");
+  const baseAssetsPath = join12(ctx.session.rootPath, "assets");
   return tool({
     description: `Document a discovered endpoint during attack surface analysis.
 
@@ -112750,14 +112813,14 @@ Each endpoint creates a JSON file in the assets directory for tracking and analy
           message: `routePath "${input.routePath}" is a full URL. The domain is already stored on the parent application. ` + `Use a path or access pattern instead (e.g. "/api/users", "/{objectKey}?X-Amz-Signature={sig}", "arn:aws:s3:::bucket-name").`
         };
       }
-      const targetDir = join11(baseAssetsPath, sanitizeName2(input.appName));
+      const targetDir = join12(baseAssetsPath, sanitizeName2(input.appName));
       if (!existsSync7(targetDir)) {
         mkdirSync6(targetDir, { recursive: true });
       }
       const sanitizedPath = sanitizeName2(input.routePath);
       const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
       const filename = `asset_${sanitizedPath}_${timestamp}.json`;
-      const filepath = join11(targetDir, filename);
+      const filepath = join12(targetDir, filename);
       const heuristicRiskScore = computeBlackboxRiskScore(input.riskLevel, "endpoint", {
         url: input.routePath,
         method: input.method,
@@ -112835,7 +112898,7 @@ import {
   unlinkSync,
   writeFileSync as writeFileSync10
 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/lib/cwe/types.ts
 init_zod();
@@ -114272,7 +114335,7 @@ init_lazyLogger();
 var log6 = scopedLogger(() => createLogger("FindingJudge"));
 async function judgeFinding(input, ctx) {
   try {
-    const { FindingJudgeAgent } = await import("./agent-gcbmtsg9.js");
+    const { FindingJudgeAgent } = await import("./agent-1zfxfgfr.js");
     const agent = new FindingJudgeAgent({
       finding: input,
       model: ctx.model,
@@ -114562,14 +114625,14 @@ CRITICAL RULES — READ BEFORE CALLING:
           description: `POC execution output for ${filename}`
         });
         const timestamp = new Date().toISOString();
-        const outputDir = isVulnerability ? session.findingsPath : join12(session.rootPath, "informational");
+        const outputDir = isVulnerability ? session.findingsPath : join13(session.rootPath, "informational");
         if (!isVulnerability) {
           mkdirSync7(outputDir, { recursive: true });
         }
         let evidenceForPrompt = materializedEvidence;
         if (materializedEvidence.length > EVIDENCE_FILE_THRESHOLD) {
           const evidenceFilename = `${timestamp.split("T")[0]}-${slugify2(input.title, 40)}-evidence.txt`;
-          const evidenceFilePath = join12(outputDir, evidenceFilename);
+          const evidenceFilePath = join13(outputDir, evidenceFilename);
           writeFileSync10(evidenceFilePath, materializedEvidence);
           evidenceForPrompt = materializedEvidence.substring(0, EVIDENCE_FILE_THRESHOLD) + `
 ... [truncated — full output saved to ${evidenceFilename}]`;
@@ -114711,8 +114774,8 @@ CRITICAL RULES — READ BEFORE CALLING:
         const findingId = `${timestamp.split("T")[0]}-${slugify2(finding.title, 50)}`;
         const jsonFilename = `${findingId}.json`;
         const mdFilename = `${findingId}.md`;
-        const jsonPath = join12(outputDir, jsonFilename);
-        const mdPath = join12(outputDir, mdFilename);
+        const jsonPath = join13(outputDir, jsonFilename);
+        const mdPath = join13(outputDir, mdFilename);
         try {
           writeFileSync10(jsonPath, JSON.stringify(findingWithMeta, null, 2));
           const cvssSection = cvssWarning ? `## CVSS 4.0 Assessment
@@ -114795,7 +114858,7 @@ ${finding.references}` : ""}
 `;
           writeFileSync10(mdPath, markdown);
           if (isVulnerability) {
-            const summaryPath = join12(session.rootPath, "findings-summary.md");
+            const summaryPath = join13(session.rootPath, "findings-summary.md");
             const cweTag = cvssResult.cwes?.length ? ` (${cvssResult.cwes.map((c) => c.id).join(", ")})` : "";
             const cvssTag = cvssWarning ? "(estimated)" : `(CVSS ${cvssResult.score})`;
             const summaryEntry = `- [${finding.severity}] ${cvssTag}${cweTag} ${finding.title} - \`findings/${mdFilename}\`
@@ -114853,7 +114916,7 @@ async function executeLocalPoc(ctx, input) {
     mkdirSync7(pocsPath, { recursive: true });
   }
   const { filename, pocContent } = preparePoc(input);
-  const pocPath = join12(pocsPath, filename);
+  const pocPath = join13(pocsPath, filename);
   writeFileSync10(pocPath, pocContent);
   chmodSync(pocPath, 493);
   const { stdout, stderr, exitCode } = await runScript(POC_RUNNERS[input.pocType], pocPath, 60000, ctx.abortSignal);
@@ -114871,7 +114934,7 @@ async function executeSandboxPoc(ctx, input) {
   if (!existsSync8(localPocsPath)) {
     mkdirSync7(localPocsPath, { recursive: true });
   }
-  const localPocPath = join12(localPocsPath, filename);
+  const localPocPath = join13(localPocsPath, filename);
   writeFileSync10(localPocPath, pocContent);
   const sandboxPocPath = `/tmp/pocs/${filename}`;
   const base64Content = Buffer.from(pocContent).toString("base64");
@@ -114904,10 +114967,10 @@ POC file has been deleted.`,
 }
 function cleanupPocFiles(ctx, filename) {
   try {
-    unlinkSync(join12(ctx.session.pocsPath, filename));
+    unlinkSync(join13(ctx.session.pocsPath, filename));
   } catch {}
   try {
-    unlinkSync(join12(ctx.session.pocsPath, `${filename}.output.json`));
+    unlinkSync(join13(ctx.session.pocsPath, `${filename}.output.json`));
   } catch {}
 }
 function sanitizeFilename(str) {
@@ -114968,7 +115031,7 @@ ${commentChar} Created: ${new Date().toISOString()}
 }
 function writePocOutputSidecar(pocsPath, filename, stdout, stderr, exitCode, description) {
   try {
-    const outputPath = join12(pocsPath, `${filename}.output.json`);
+    const outputPath = join13(pocsPath, `${filename}.output.json`);
     writeFileSync10(outputPath, JSON.stringify({
       stdout,
       stderr,
@@ -118283,7 +118346,7 @@ var SEND_EMAIL_TOOL_NAME = "send_email";
 init_dist();
 init_zod();
 import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 var MAX_INLINE = 50000;
 var MS_TIMEOUT_THRESHOLD = 1e4;
 var executeCommandInputSchema = exports_external.object({
@@ -118305,13 +118368,13 @@ function maybeSaveFullOutput(raw, ctx) {
   if (raw.length <= MAX_INLINE) {
     return { text: raw || "(no output)" };
   }
-  const outputDir = join13(ctx.session.logsPath, "cmd-output");
+  const outputDir = join14(ctx.session.logsPath, "cmd-output");
   if (!existsSync9(outputDir)) {
     mkdirSync8(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `output-${ts}.txt`;
-  const filePath = join13(outputDir, filename);
+  const filePath = join14(outputDir, filename);
   try {
     writeFileSync11(filePath, raw);
   } catch {
@@ -118798,7 +118861,7 @@ search with flags or a more specific directory if results are truncated.`,
 init_dist();
 init_zod();
 import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync12 } from "fs";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 var MAX_INLINE_BODY = 5000;
 var httpRequestInputSchema = exports_external.object({
   url: exports_external.string().describe("The URL to request"),
@@ -118812,13 +118875,13 @@ var httpRequestInputSchema = exports_external.object({
 function maybeSaveBody(body, ctx) {
   if (body.length <= MAX_INLINE_BODY)
     return { text: body };
-  const outputDir = join14(ctx.session.logsPath, "http-responses");
+  const outputDir = join15(ctx.session.logsPath, "http-responses");
   if (!existsSync10(outputDir)) {
     mkdirSync9(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `response-${ts}.txt`;
-  const filePath = join14(outputDir, filename);
+  const filePath = join15(outputDir, filename);
   try {
     writeFileSync12(filePath, body);
   } catch {
@@ -119057,7 +119120,7 @@ async function executeSandboxHttpRequest(ctx, opts) {
 init_dist();
 init_zod();
 import { readdir, stat } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join15, relative, resolve as resolve2 } from "path";
+import { isAbsolute as isAbsolute2, join as join16, relative, resolve as resolve2 } from "path";
 var listFilesInputSchema = exports_external.object({
   directory: exports_external.string().optional().describe("Absolute or relative path to the directory to list (defaults to current working directory)"),
   recursive: exports_external.boolean().optional().describe("If true, list files recursively (default: false)"),
@@ -119077,7 +119140,7 @@ async function listRecursive(dir, maxEntries) {
     }
     for (const entry of entries) {
       total++;
-      const fullPath = join15(current, entry.name);
+      const fullPath = join16(current, entry.name);
       if (entry.isDirectory()) {
         if (results.length < maxEntries)
           results.push(`${fullPath}/`);
@@ -119140,7 +119203,7 @@ Each directory entry is suffixed with "/" for easy identification.`,
         }
         const entries = await readdir(dir, { withFileTypes: true });
         const fullPaths = entries.map((e) => {
-          const name = join15(dir, e.name);
+          const name = join16(dir, e.name);
           return e.isDirectory() ? `${name}/` : name;
         });
         const capped = fullPaths.slice(0, MAX_NON_RECURSIVE);
@@ -119282,9 +119345,9 @@ import {
   unlinkSync as unlinkSync2
 } from "fs";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var MAX_BUFFER = 5000000;
-var APEX_TMP_ROOT = join16(tmpdir(), `apex-shell-${process.pid}`);
+var APEX_TMP_ROOT = join17(tmpdir(), `apex-shell-${process.pid}`);
 try {
   mkdirSync10(APEX_TMP_ROOT, { recursive: true });
 } catch {}
@@ -119536,8 +119599,8 @@ class PersistentShell {
         const marker = `__APEX_${nonceHex}__`;
         const exitMarkerPrefix = `${marker}_EXIT_`;
         const cutoverMarker = `${marker}_CUTOVER`;
-        const outPath = join16(APEX_TMP_ROOT, `${nonceHex}.out`);
-        const errPath = join16(APEX_TMP_ROOT, `${nonceHex}.err`);
+        const outPath = join17(APEX_TMP_ROOT, `${nonceHex}.out`);
+        const errPath = join17(APEX_TMP_ROOT, `${nonceHex}.err`);
         const pending = {
           streamedStdout: "",
           authoritativeStdout: "",
@@ -119956,7 +120019,7 @@ Returns discovered endpoints and recommended login approach.`,
 init_dist();
 init_zod();
 import { writeFileSync as writeFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function provideComparisonResults(ctx) {
   return tool({
     description: `Provide the final comparison results with matched, missed, and extra findings.
@@ -120002,7 +120065,7 @@ Results will be saved to: comparison-results.json in the session directory.`,
         recall,
         precision
       };
-      const resultsPath = join17(ctx.session.rootPath, "comparison-results.json");
+      const resultsPath = join18(ctx.session.rootPath, "comparison-results.json");
       writeFileSync13(resultsPath, JSON.stringify(result, null, 2));
       return {
         success: true,
@@ -120156,7 +120219,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
       });
       if (cwd) {
         try {
-          const { WhiteboxAttackSurfaceAgent } = await import("./index-dg9804xb.js");
+          const { WhiteboxAttackSurfaceAgent } = await import("./index-kjky8ack.js");
           const localBus = new AgentEventBus;
           AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
           const agent = new WhiteboxAttackSurfaceAgent({
@@ -120206,7 +120269,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
         }
       }
       try {
-        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-yyjvgxwd.js");
+        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-dn68r23n.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const agent = new BlackboxAttackSurfaceAgent({
@@ -120284,7 +120347,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ target, cwd }) => {
-      const { runPentestWorkflow: workflow } = await import("./pentest-9q2g54yy.js");
+      const { runPentestWorkflow: workflow } = await import("./pentest-043y2x03.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -120389,11 +120452,11 @@ init_zod();
 
 // src/core/whitebox/adapters.ts
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 
 // src/core/whitebox/artifacts.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, join as join18 } from "node:path";
+import { basename as basename2, join as join19 } from "node:path";
 
 // src/core/whitebox/paths.ts
 import { existsSync as existsSync11, realpathSync } from "node:fs";
@@ -120454,10 +120517,10 @@ function safeName(value) {
   return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/\.{2,}/g, ".").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function getWhiteboxLogsDir(session) {
-  return join18(session.logsPath, "whitebox");
+  return join19(session.logsPath, "whitebox");
 }
 function getWhiteboxScratchDir(session) {
-  return join18(session.scratchpadPath, "whitebox");
+  return join19(session.scratchpadPath, "whitebox");
 }
 async function ensureWhiteboxDirs(session) {
   await Promise.all([
@@ -120470,7 +120533,7 @@ async function writeWhiteboxArtifact(input) {
   const baseDir = input.area === "scratchpad" ? getWhiteboxScratchDir(input.session) : getWhiteboxLogsDir(input.session);
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `${timestamp}-${safeName(input.name)}${input.extension ?? ".txt"}`;
-  const absolutePath = join18(baseDir, filename);
+  const absolutePath = join19(baseDir, filename);
   await writeFile2(absolutePath, input.content, "utf-8");
   const relativeRoot = input.area === "scratchpad" ? "scratchpad/whitebox" : "logs/whitebox";
   return {
@@ -120712,7 +120775,7 @@ var WHITEBOX_SCAN_ADAPTERS = [
     id: "npm-audit",
     kind: "dependencies",
     tool: "npm",
-    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join19(profile.rootPath, "package-lock.json"))),
+    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join20(profile.rootPath, "package-lock.json"))),
     buildCommand: () => ["npm", "audit", "--json"],
     parseSummary: (raw) => simpleLineFindings("npm audit", raw)
   },
@@ -120821,7 +120884,7 @@ ${raw.stderr}` : "");
 // src/core/whitebox/candidates.ts
 import { existsSync as existsSync13 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 var CANDIDATES_FILE = "candidates.json";
 var writeLocks = new Map;
 function withCandidateLock(session, fn) {
@@ -120848,10 +120911,10 @@ var ALLOWED_TRANSITIONS = {
   deferred: ["hypothesis", "investigating"]
 };
 function candidatesDir(session) {
-  return join20(session.scratchpadPath, "whitebox");
+  return join21(session.scratchpadPath, "whitebox");
 }
 function candidatesPath(session) {
-  return join20(candidatesDir(session), CANDIDATES_FILE);
+  return join21(candidatesDir(session), CANDIDATES_FILE);
 }
 function makeId2(title) {
   const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 48);
@@ -121321,7 +121384,7 @@ import {
   readSync as readSync2,
   statSync as statSync3
 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var MAX_JOB_LOG_INLINE = 40000;
 var MAX_JOB_LOG_BYTES = 10 * 1024 * 1024;
 var PRUNE_AFTER_MS = 60000;
@@ -121396,7 +121459,7 @@ function startWhiteboxJob(input) {
   const logsDir = getWhiteboxLogsDir(input.session);
   mkdirSync11(logsDir, { recursive: true });
   const safeName2 = (input.name ?? "job").replace(/[^a-z0-9._-]+/gi, "-").replace(/\.{2,}/g, ".");
-  const logPath = join21(logsDir, `${id}-${safeName2}.log`);
+  const logPath = join22(logsDir, `${id}-${safeName2}.log`);
   const now = new Date().toISOString();
   writeLog(logPath, `$ ${input.command}
 
@@ -121522,12 +121585,12 @@ function readWhiteboxJobLog(id, sessionId) {
   };
 }
 // src/core/whitebox/repoProfile.ts
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { existsSync as existsSync15, realpathSync as realpathSync2 } from "node:fs";
 import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, extname as extname2, join as join22, relative as relative3, resolve as resolve5 } from "node:path";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
+import { basename as basename3, extname as extname2, join as join23, relative as relative3, resolve as resolve5 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
 var MAX_PROFILE_FILES = 5000;
 var LANGUAGE_BY_EXTENSION = {
   ".ts": "typescript",
@@ -121634,7 +121697,7 @@ async function walkFiles(rootPath) {
     for (const entry of entries) {
       if (files.length >= MAX_PROFILE_FILES)
         return;
-      const fullPath = join22(current, entry.name);
+      const fullPath = join23(current, entry.name);
       if (entry.isDirectory()) {
         if (shouldSkipDir(entry.name))
           continue;
@@ -121696,7 +121759,7 @@ function detectEntryHints(files) {
   return hints.slice(0, 100);
 }
 async function readPackageScripts(rootPath) {
-  const packageJsonPath = join22(rootPath, "package.json");
+  const packageJsonPath = join23(rootPath, "package.json");
   if (!existsSync15(packageJsonPath)) {
     return { buildCommands: [], testCommands: [], runCommands: [] };
   }
@@ -121715,7 +121778,7 @@ async function readPackageScripts(rootPath) {
 }
 async function runGit(rootPath, args) {
   try {
-    const { stdout } = await execFileAsync("git", args, {
+    const { stdout } = await execFileAsync2("git", args, {
       cwd: rootPath,
       timeout: 5000,
       maxBuffer: 1024 * 1024
@@ -121728,7 +121791,7 @@ async function runGit(rootPath, args) {
 async function detectTool(name) {
   const cmd = process.platform === "win32" ? "where" : "which";
   try {
-    const { stdout } = await execFileAsync(cmd, [name], {
+    const { stdout } = await execFileAsync2(cmd, [name], {
       timeout: 2000,
       maxBuffer: 1024 * 64
     });
@@ -121860,7 +121923,7 @@ Returns an array of results with the text output from each agent.`,
   });
 }
 async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
-  const { CodeAgent } = await import("./agent-vnhgzmm9.js");
+  const { CodeAgent } = await import("./agent-ssm6x6qs.js");
   const subagentId = `coding-agent-${agentIndex}`;
   ctx.eventBus?.emit("subagent-spawn", {
     subagentId,
@@ -121910,7 +121973,7 @@ init_ai();
 init_structured();
 init_lazyLogger();
 import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var log9 = scopedLogger(() => createLogger("findings:registry"));
 var VULN_CLASS_PATTERNS = [
   [/sql\s*injection/i, "sql-injection"],
@@ -122102,7 +122165,7 @@ class FindingsRegistry {
     log9.debug(`fromDirectory: path=${findingsPath}, jsonFiles=${files.length}`);
     for (const file of files) {
       try {
-        const raw = readFileSync4(join23(findingsPath, file), "utf-8");
+        const raw = readFileSync4(join24(findingsPath, file), "utf-8");
         const finding = JSON.parse(raw);
         if (finding && typeof finding.title === "string" && typeof finding.endpoint === "string") {
           registry.indexFinding(finding);
@@ -122307,13 +122370,13 @@ class FindingsRegistry {
 
 // src/core/plan/index.ts
 import { existsSync as existsSync17, readFileSync as readFileSync5 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 var PLAN_FILENAME = "plan.md";
 function planFilePath(sessionRootPath, subagentId) {
   if (subagentId) {
-    return join24(sessionRootPath, "subagents", `${subagentId}-plan.md`);
+    return join25(sessionRootPath, "subagents", `${subagentId}-plan.md`);
   }
-  return join24(sessionRootPath, PLAN_FILENAME);
+  return join25(sessionRootPath, PLAN_FILENAME);
 }
 function readPlan(sessionRootPath, subagentId) {
   const path = planFilePath(sessionRootPath, subagentId);
@@ -122366,7 +122429,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
           message: "spawn_pentest_agent requires a model in the tool context."
         };
       }
-      const { TargetedPentestAgent } = await import("./agent-hkmr0qfx.js");
+      const { TargetedPentestAgent } = await import("./agent-1jp62njk.js");
       const findingsRegistry = ctx.findingsRegistry ?? FindingsRegistry.fromDirectory(ctx.session.findingsPath, {
         model: ctx.model,
         authConfig: ctx.authConfig,
@@ -122520,7 +122583,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ targets }) => {
-      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-9q2g54yy.js");
+      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-043y2x03.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -123157,7 +123220,7 @@ init_zod();
 init_structured();
 import { mkdirSync as mkdirSync12 } from "fs";
 import { writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { dirname as dirname5 } from "path";
 init_lazyLogger();
 var log12 = scopedLogger(() => createLogger("write_plan"));
 var writePlanInputSchema = exports_external.object({
@@ -123183,7 +123246,7 @@ Required plan sections:
     execute: async ({ content }) => {
       const scopeId = ctx.planSubagentId ?? ctx.subagentId;
       const planPath = planFilePath(ctx.session.rootPath, scopeId);
-      mkdirSync12(dirname4(planPath), { recursive: true });
+      mkdirSync12(dirname5(planPath), { recursive: true });
       log12.debug(`enter: contentLen=${content.length}, path=${planPath}`);
       try {
         await writeFile5(planPath, content, "utf-8");
@@ -124212,7 +124275,7 @@ var SKILL_TOOL_NAMES = ["read_skill"];
 // src/core/agents/offSecAgent/trace.ts
 import { createHash } from "crypto";
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var OUTPUT_PREVIEW_LIMIT = 2000;
 var INPUT_PREVIEW_LIMIT = 1000;
 var SYSTEM_PROMPT_HASH_PREFIX_LENGTH = 12;
@@ -124273,7 +124336,7 @@ class StepTraceWriter {
     const now = Date.now();
     this.agentStartTime = now;
     this.lastStepTime = now;
-    mkdirSync13(dirname5(this.tracePath), { recursive: true });
+    mkdirSync13(dirname6(this.tracePath), { recursive: true });
   }
   writeInit(data) {
     const { systemPrompt, ...rest } = data;
@@ -124414,7 +124477,7 @@ init_dist();
 init_ai();
 import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
 import { writeFile as writeFile6 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 init_structured();
 init_observability();
 
@@ -124751,15 +124814,15 @@ class OffensiveSecurityAgent {
     } else {
       this.ownsBrowserSession = false;
     }
-    const messagesDir = input.messagesDir ?? (input.subagentId ? join25(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
-    const tracePath = input.subagentId ? join25(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join25(messagesDir, "trace.jsonl");
+    const messagesDir = input.messagesDir ?? (input.subagentId ? join26(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
+    const tracePath = input.subagentId ? join26(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join26(messagesDir, "trace.jsonl");
     const traceWriter = new StepTraceWriter({
       tracePath,
       agentId: input.subagentId ?? null,
       eventBus: this.eventBus
     });
     const taskDriven = input.session.config?.taskDriven ?? false;
-    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join25(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join25(input.session.rootPath, "tasks") : undefined);
+    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join26(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join26(input.session.rootPath, "tasks") : undefined);
     const credentialManager = input.credentialManager ?? input.session.credentialManager;
     const builtinTools = createAllTools({
       session: input.session,
@@ -124835,7 +124898,7 @@ class OffensiveSecurityAgent {
     if (!existsSync18(messagesDir)) {
       mkdirSync14(messagesDir, { recursive: true });
     }
-    const messagesPath = join25(messagesDir, "messages.json");
+    const messagesPath = join26(messagesDir, "messages.json");
     const initialMessagesRef = {
       current: input.messages ? [...input.messages] : [
         {