@pensar/apex 2.0.1 → 2.0.2-canary.09dbe74f

package/build/{cli-zpdmnz8c.js → cli-2p56h4nq.js}

@@ -1,6 +1,6 @@
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-sgrt7t9v.js";
 import {
   parseTargetUrl
 } from "./cli-c8131c4q.js";
@@ -26,14 +26,14 @@ import {
   scopedLogger,
   streamResponse,
   write
-} from "./cli-z1dapp7v.js";
+} from "./cli-a3pzv462.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-8g5cwvbm.js";
+} from "./cli-r9yh5mka.js";
 import {
   _enum,
   _null,
@@ -64,7 +64,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
+} from "./cli-eg35gebv.js";
 import {
   __commonJS,
   __require,
@@ -42486,8 +42486,8 @@ var require_core3 = __commonJS((exports) => {
   function many1(p) {
     return ab(p, many(p), (head, tail) => [head, ...tail]);
   }
-  function ab(pa, pb, join13) {
-    return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join13(ma.value, vb, data, i, j)));
+  function ab(pa, pb, join14) {
+    return (data, i) => mapOuter(pa(data, i), (ma) => mapInner(pb(data, ma.position), (vb, j) => join14(ma.value, vb, data, i, j)));
   }
   function left(pa, pb) {
     return ab(pa, pb, (va) => va);
@@ -42495,8 +42495,8 @@ var require_core3 = __commonJS((exports) => {
   function right(pa, pb) {
     return ab(pa, pb, (va, vb) => vb);
   }
-  function abc(pa, pb, pc, join13) {
-    return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join13(ma.value, mb.value, vc, data, i, j))));
+  function abc(pa, pb, pc, join14) {
+    return (data, i) => mapOuter(pa(data, i), (ma) => mapOuter(pb(data, ma.position), (mb) => mapInner(pc(data, mb.position), (vc, j) => join14(ma.value, mb.value, vc, data, i, j))));
   }
   function middle(pa, pb, pc) {
     return abc(pa, pb, pc, (ra, rb) => rb);
@@ -71179,7 +71179,7 @@ var require_thread_stream = __commonJS((exports, module) => {
   var { version } = require_package5();
   var { EventEmitter: EventEmitter2 } = __require("events");
   var { Worker } = __require("worker_threads");
-  var { join: join13 } = __require("path");
+  var { join: join14 } = __require("path");
   var { pathToFileURL } = __require("url");
   var { wait } = require_wait();
   var {
@@ -71215,7 +71215,7 @@ var require_thread_stream = __commonJS((exports, module) => {
   function createWorker(stream, opts) {
     const { filename, workerData } = opts;
     const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-    const toExecute = bundlerOverrides["thread-stream-worker"] || join13(__dirname, "lib", "worker.js");
+    const toExecute = bundlerOverrides["thread-stream-worker"] || join14(__dirname, "lib", "worker.js");
     const worker = new Worker(toExecute, {
       ...opts.workerOpts,
       trackUnmanagedFds: false,
@@ -71601,10 +71601,10 @@ var require_thread_stream = __commonJS((exports, module) => {
 // node_modules/pino/lib/transport.js
 var require_transport = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/apex/apex/node_modules/pino/lib";
-  var { createRequire: createRequire2 } = __require("module");
+  var { createRequire: createRequire3 } = __require("module");
   var { existsSync: existsSync9 } = __require("node:fs");
   var getCallers = require_caller();
-  var { join: join13, isAbsolute: isAbsolute2, sep } = __require("node:path");
+  var { join: join14, isAbsolute: isAbsolute2, sep } = __require("node:path");
   var { fileURLToPath } = __require("node:url");
   var sleep = require_atomic_sleep();
   var onExit = require_on_exit_leak_free();
@@ -71757,7 +71757,7 @@ var require_transport = __commonJS((exports, module) => {
       throw new Error("only one of target or targets can be specified");
     }
     if (targets) {
-      target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+      target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
       options.targets = targets.filter((dest) => dest.target).map((dest) => {
         return {
           ...dest,
@@ -71774,7 +71774,7 @@ var require_transport = __commonJS((exports, module) => {
         });
       });
     } else if (pipeline2) {
-      target = bundlerOverrides["pino-worker"] || join13(__dirname, "worker.js");
+      target = bundlerOverrides["pino-worker"] || join14(__dirname, "worker.js");
       options.pipelines = [pipeline2.map((dest) => {
         return {
           ...dest,
@@ -71797,13 +71797,13 @@ var require_transport = __commonJS((exports, module) => {
         return origin;
       }
       if (origin === "pino/file") {
-        return join13(__dirname, "..", "file.js");
+        return join14(__dirname, "..", "file.js");
       }
       let fixTarget2;
       for (const filePath of callers) {
         try {
           const context = filePath === "node:repl" ? process.cwd() + sep : filePath;
-          fixTarget2 = createRequire2(context).resolve(origin);
+          fixTarget2 = createRequire3(context).resolve(origin);
           break;
         } catch (err) {
           continue;
@@ -72726,7 +72726,7 @@ var require_safe_stable_stringify = __commonJS((exports, module) => {
             return circularValue;
           }
           let res = "";
-          let join13 = ",";
+          let join14 = ",";
           const originalIndentation = indentation;
           if (Array.isArray(value)) {
             if (value.length === 0) {
@@ -72740,7 +72740,7 @@ var require_safe_stable_stringify = __commonJS((exports, module) => {
               indentation += spacer;
               res += `
 ${indentation}`;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
             }
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -72748,13 +72748,13 @@ ${indentation}`;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp2 !== undefined ? tmp2 : "null";
-              res += join13;
+              res += join14;
             }
             const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
             res += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+              res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             if (spacer !== "") {
               res += `
@@ -72775,7 +72775,7 @@ ${originalIndentation}`;
           let separator = "";
           if (spacer !== "") {
             indentation += spacer;
-            join13 = `,
+            join14 = `,
 ${indentation}`;
             whitespace = " ";
           }
@@ -72789,13 +72789,13 @@ ${indentation}`;
             const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (keyLength > maximumBreadth) {
             const removedKeys = keyLength - maximumBreadth;
             res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-            separator = join13;
+            separator = join14;
           }
           if (spacer !== "" && separator.length > 1) {
             res = `
@@ -72835,7 +72835,7 @@ ${originalIndentation}`;
           }
           const originalIndentation = indentation;
           let res = "";
-          let join13 = ",";
+          let join14 = ",";
           if (Array.isArray(value)) {
             if (value.length === 0) {
               return "[]";
@@ -72848,7 +72848,7 @@ ${originalIndentation}`;
               indentation += spacer;
               res += `
 ${indentation}`;
-              join13 = `,
+              join14 = `,
 ${indentation}`;
             }
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -72856,13 +72856,13 @@ ${indentation}`;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp2 !== undefined ? tmp2 : "null";
-              res += join13;
+              res += join14;
             }
             const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
             res += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
+              res += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             if (spacer !== "") {
               res += `
@@ -72875,7 +72875,7 @@ ${originalIndentation}`;
           let whitespace = "";
           if (spacer !== "") {
             indentation += spacer;
-            join13 = `,
+            join14 = `,
 ${indentation}`;
             whitespace = " ";
           }
@@ -72884,7 +72884,7 @@ ${indentation}`;
             const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (spacer !== "" && separator.length > 1) {
@@ -72941,20 +72941,20 @@ ${originalIndentation}`;
             indentation += spacer;
             let res2 = `
 ${indentation}`;
-            const join14 = `,
+            const join15 = `,
 ${indentation}`;
             const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
             let i = 0;
             for (;i < maximumValuesToStringify - 1; i++) {
               const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp2 !== undefined ? tmp2 : "null";
-              res2 += join14;
+              res2 += join15;
             }
             const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
             res2 += tmp !== undefined ? tmp : "null";
             if (value.length - 1 > maximumBreadth) {
               const removedKeys = value.length - maximumBreadth - 1;
-              res2 += `${join14}"... ${getItemCount(removedKeys)} not stringified"`;
+              res2 += `${join15}"... ${getItemCount(removedKeys)} not stringified"`;
             }
             res2 += `
 ${originalIndentation}`;
@@ -72970,16 +72970,16 @@ ${originalIndentation}`;
             return '"[Object]"';
           }
           indentation += spacer;
-          const join13 = `,
+          const join14 = `,
 ${indentation}`;
           let res = "";
           let separator = "";
           let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
           if (isTypedArrayWithEntries(value)) {
-            res += stringifyTypedArray(value, join13, maximumBreadth);
+            res += stringifyTypedArray(value, join14, maximumBreadth);
             keys = keys.slice(value.length);
             maximumPropertiesToStringify -= value.length;
-            separator = join13;
+            separator = join14;
           }
           if (deterministic) {
             keys = sort(keys, comparator);
@@ -72990,13 +72990,13 @@ ${indentation}`;
             const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
             if (tmp !== undefined) {
               res += `${separator}${strEscape(key2)}: ${tmp}`;
-              separator = join13;
+              separator = join14;
             }
           }
           if (keyLength > maximumBreadth) {
             const removedKeys = keyLength - maximumBreadth;
             res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-            separator = join13;
+            separator = join14;
           }
           if (separator !== "") {
             res = `
@@ -105309,7 +105309,7 @@ Invalid`)
 });
 
 // src/core/eventBus.ts
-import { EventEmitter } from "events";
+import { EventEmitter } from "node:events";
 var CHILD_BUS_FORWARD_POLICY = {
   "text-delta": "forward",
   "tool-call-start": "forward",
@@ -106392,8 +106392,8 @@ function assertCommandInScope(command, ctx) {
 // src/core/agents/offSecAgent/tools/authenticateSession.ts
 init_dist();
 init_zod();
-import { writeFileSync } from "fs";
-import { join as join2 } from "path";
+import { writeFileSync } from "node:fs";
+import { join as join2 } from "node:path";
 
 // src/core/http/targetHeaders.ts
 function getRegistrableDomain2(hostname) {
@@ -106834,6 +106834,11 @@ or provide username/password directly.`,
   });
 }
 
+// src/core/agents/offSecAgent/tools/playwrightMcp.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { dirname as dirname2, join as join4 } from "node:path";
+
 // node_modules/zod/v4/mini/parse.js
 init_core();
 
@@ -109377,9 +109382,44 @@ function isElectron() {
 // src/core/agents/offSecAgent/tools/playwrightMcp.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { createRequire } from "module";
-import { dirname, join as join3 } from "path";
+
+// src/core/agents/offSecAgent/tools/camoufox.ts
+import { execFile } from "node:child_process";
+import { createRequire } from "node:module";
+import { dirname, join as join3 } from "node:path";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var CAMOUFOX_OPTIONS = {
+  humanize: true,
+  block_webrtc: true
+};
+async function resolveCamoufoxLaunchOptions(headless) {
+  const { launchOptions: camoufoxLaunchOptions } = await import("camoufox-js");
+  return await camoufoxLaunchOptions({
+    ...CAMOUFOX_OPTIONS,
+    headless
+  });
+}
+var ensurePromise = null;
+function ensureCamoufox(log) {
+  if (!ensurePromise) {
+    ensurePromise = (async () => {
+      log?.("Provisioning Camoufox browser (first run downloads ~150MB; cached after)…");
+      const require_ = createRequire(import.meta.url);
+      const pkgPath = require_.resolve("camoufox-js/package.json");
+      const fetchBin = join3(dirname(pkgPath), "dist", "__main__.js");
+      await execFileAsync("node", [fetchBin, "fetch"], {
+        timeout: 300000
+      });
+    })().catch((err) => {
+      ensurePromise = null;
+      throw err;
+    });
+  }
+  return ensurePromise;
+}
+
+// src/core/agents/offSecAgent/tools/playwrightMcp.ts
 var BrowserNavigateInput = exports_external.object({
   url: exports_external.string().describe("Full URL to navigate to"),
   toolCallDescription: exports_external.string().describe("Why you are navigating to this URL")
@@ -109495,6 +109535,7 @@ class PlaywrightMcpSession {
   viewportSize;
   extraHttpHeaders;
   mcpConfigPath = null;
+  cachedCamouOptions = null;
   constructor(options = {}) {
     const { headless, userAgent, viewportSize, extraHttpHeaders } = options;
     this.headless = headless ?? defaultHeadless;
@@ -109504,14 +109545,26 @@ class PlaywrightMcpSession {
     this.extraHttpHeaders = headerSource && Object.keys(headerSource).length > 0 ? { ...headerSource } : undefined;
   }
   resetState() {
+    this.cleanupConfigFile();
     this.mcpClient = null;
     this.mcpTransport = null;
     this.mcpProcess = null;
     this.connectionPromise = null;
     this.disconnecting = false;
   }
-  forceKillProcess() {
-    const proc = this.mcpProcess;
+  cleanupConfigFile() {
+    const configPath = this.mcpConfigPath;
+    if (!configPath)
+      return;
+    this.mcpConfigPath = null;
+    (async () => {
+      try {
+        const fsp = await import("fs/promises");
+        await fsp.unlink(configPath);
+      } catch {}
+    })();
+  }
+  forceKillProcess(proc = this.mcpProcess) {
     if (!proc || proc.exitCode !== null)
       return;
     try {
@@ -109539,41 +109592,40 @@ class PlaywrightMcpSession {
     }
     this.connectionPromise = (async () => {
       try {
-        const require_ = createRequire(import.meta.url);
+        const require_ = createRequire2(import.meta.url);
         const mcpPkgJsonPath = require_.resolve("@playwright/mcp/package.json");
-        const cliPath = join3(dirname(mcpPkgJsonPath), "cli.js");
+        const cliPath = join4(dirname2(mcpPkgJsonPath), "cli.js");
         const args = [cliPath, "--isolated"];
-        if (this.headless) {
-          args.push("--headless");
-        }
-        if (this.userAgent) {
-          args.push("--user-agent", this.userAgent);
-        }
-        if (this.viewportSize) {
-          args.push(`--viewport-size=${this.viewportSize}`);
-        }
-        if (this.extraHttpHeaders) {
-          const os = await import("os");
-          const fsp = await import("fs/promises");
-          const cfg = {
-            browser: {
-              contextOptions: { extraHTTPHeaders: this.extraHttpHeaders }
-            }
-          };
-          this.mcpConfigPath = join3(os.tmpdir(), `pensar-mcp-${process.pid}-${Date.now()}.json`);
-          await fsp.writeFile(this.mcpConfigPath, JSON.stringify(cfg), {
-            encoding: "utf-8",
-            mode: 384
-          });
-          args.push("--config", this.mcpConfigPath);
-        }
-        if (process.getuid?.() === 0) {
-          args.push("--no-sandbox");
-        }
+        await ensureCamoufox();
+        if (!this.cachedCamouOptions) {
+          this.cachedCamouOptions = await resolveCamoufoxLaunchOptions(this.headless);
+        }
+        const camou = this.cachedCamouOptions;
+        const os = await import("node:os");
+        const fsp = await import("node:fs/promises");
+        const cfg = {
+          browser: {
+            browserName: "firefox",
+            launchOptions: {
+              executablePath: camou.executablePath,
+              args: camou.args,
+              firefoxUserPrefs: camou.firefoxUserPrefs,
+              headless: camou.headless
+            },
+            ...this.extraHttpHeaders ? { contextOptions: { extraHTTPHeaders: this.extraHttpHeaders } } : {}
+          }
+        };
+        this.mcpConfigPath = join4(os.tmpdir(), `pensar-mcp-${process.pid}-${Date.now()}.json`);
+        await fsp.writeFile(this.mcpConfigPath, JSON.stringify(cfg), {
+          encoding: "utf-8",
+          mode: 384
+        });
+        args.push("--config", this.mcpConfigPath);
         const transport = new StdioClientTransport({
           command: "node",
           args,
-          stderr: "pipe"
+          stderr: "pipe",
+          env: Object.fromEntries(Object.entries(camou.env).map(([k, v]) => [k, String(v)]))
         });
         const client = new Client({
           name: "apex-browser-agent",
@@ -109607,29 +109659,28 @@ class PlaywrightMcpSession {
     this.disconnecting = true;
     const transport = this.mcpTransport;
     const client = this.mcpClient;
+    const proc = this.mcpProcess;
     this.resetState();
     this.disconnecting = true;
-    if (client) {
-      try {
-        await client.close();
-      } catch {}
-    }
-    if (transport) {
-      try {
-        await transport.close();
-      } catch {}
-    }
-    this.forceKillProcess();
-    if (this.mcpConfigPath) {
-      const configPath = this.mcpConfigPath;
-      this.mcpConfigPath = null;
+    this.forceKillProcess(proc);
+    const CLOSE_TIMEOUT_MS = 5000;
+    let closeTimer;
+    await Promise.race([
       (async () => {
         try {
-          const fsp = await import("fs/promises");
-          await fsp.unlink(configPath);
+          await client?.close();
         } catch {}
-      })();
-    }
+        try {
+          await transport?.close();
+        } catch {}
+      })(),
+      new Promise((resolve) => {
+        closeTimer = setTimeout(resolve, CLOSE_TIMEOUT_MS);
+      })
+    ]);
+    if (closeTimer)
+      clearTimeout(closeTimer);
+    this.cleanupConfigFile();
     this.disconnecting = false;
   }
   isConnected() {
@@ -109953,8 +110004,8 @@ Target base URL: ${targetUrl}`,
         if (base64Data) {
           const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
           const screenshotFilename = `${filename}_${timestamp}.png`;
-          const screenshotPath = join3(evidenceDir, screenshotFilename);
-          const dir = dirname(screenshotPath);
+          const screenshotPath = join4(evidenceDir, screenshotFilename);
+          const dir = dirname2(screenshotPath);
           if (!existsSync2(dir)) {
             mkdirSync(dir, { recursive: true });
           }
@@ -110167,18 +110218,20 @@ The returned cookies can be formatted as a Cookie header for use with http_reque
 // src/core/agents/offSecAgent/tools/sandboxPlaywright.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3, join as join5 } from "node:path";
 var SANDBOX_PW_DIR = "/opt/sandbox-playwright";
 var SANDBOX_EVIDENCE_DIR = "/tmp/evidence";
 var SANDBOX_REFS_FILE = "/tmp/pw-refs.json";
 var SANDBOX_URL_FILE = "/tmp/pw-current-url";
 var SANDBOX_CONSOLE_FILE = "/tmp/pw-console-log.json";
+var SANDBOX_CAMOU_CACHE = "/tmp/pw-camou-opts.json";
 var RESULT_START = "__PW_RESULT__";
 var RESULT_END = "__PW_END__";
 var installationCache = new WeakMap;
+var browserSetupCache = new WeakMap;
 async function checkSandboxPlaywright(sandbox) {
-  const script = `try{require("playwright");console.log("OK")}catch(e){process.exit(1)}`;
+  const script = `(async()=>{try{const{launchPath}=await import("camoufox-js/dist/pkgman.js");require("playwright-core");if(!require("fs").existsSync(launchPath()))process.exit(1);console.log("OK")}catch(e){process.exit(1)}})()`;
   const b64 = Buffer.from(script).toString("base64");
   await sandbox.execute(`mkdir -p ${SANDBOX_PW_DIR} && echo "${b64}" | base64 -d > ${SANDBOX_PW_DIR}/pw_check.js`, { timeout: 10 });
   const result = await sandbox.execute(`node ${SANDBOX_PW_DIR}/pw_check.js`, {
@@ -110189,35 +110242,33 @@ async function checkSandboxPlaywright(sandbox) {
 async function installSandboxPlaywright(sandbox) {
   await sandbox.execute(`mkdir -p ${SANDBOX_PW_DIR}`, { timeout: 10 });
   const isAlpine = (await sandbox.execute("which apk", { timeout: 5 })).success;
+  if (isAlpine) {
+    throw new Error("Camoufox requires a glibc-based sandbox image (Debian/Ubuntu); Alpine/musl is unsupported.");
+  }
   const initResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npm init -y --silent 2>/dev/null`, { timeout: 30 });
   if (!initResult.success) {
     throw new Error(`Failed to init npm project in sandbox: ${initResult.stderr || initResult.stdout}`);
   }
-  const npmInstallCmd = isAlpine ? `cd ${SANDBOX_PW_DIR} && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install playwright 2>&1` : `cd ${SANDBOX_PW_DIR} && npm install playwright 2>&1`;
-  const installResult = await sandbox.execute(npmInstallCmd, { timeout: 300 });
+  const installResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npm install camoufox-js@0.11.1 playwright-core@1.53.1 2>&1`, { timeout: 300 });
   if (!installResult.success) {
-    throw new Error(`Failed to install Playwright in sandbox: ${installResult.stderr || installResult.stdout}`);
+    throw new Error(`Failed to install camoufox-js in sandbox: ${installResult.stderr || installResult.stdout}`);
   }
-  if (isAlpine) {
-    const apkResult = await sandbox.execute("apk add --no-cache chromium nss freetype harfbuzz ca-certificates ttf-freefont 2>&1", { timeout: 120 });
-    if (!apkResult.success) {
-      throw new Error(`Failed to install Chromium via apk: ${apkResult.stderr || apkResult.stdout}`);
-    }
-  } else {
-    await sandbox.execute(`(sudo rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null || rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null || true)`, { timeout: 10 });
-    let browserResult;
-    for (let attempt = 1;attempt <= 3; attempt++) {
-      browserResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && npx playwright install chromium --with-deps 2>&1`, { timeout: 300 });
-      if (browserResult.success)
-        break;
-      if (attempt < 3) {
-        await new Promise((r) => setTimeout(r, 3000));
-      }
-    }
-    if (!browserResult.success) {
-      throw new Error(`Failed to install Chromium in sandbox: ${browserResult.stderr || browserResult.stdout}`);
+  const depsResult = await sandbox.execute(`rm -f /etc/apt/sources.list.d/yarn.list /etc/apt/sources.list.d/yarn.sources 2>/dev/null; cd ${SANDBOX_PW_DIR} && npx playwright@1.53.1 install-deps firefox 2>&1`, { timeout: 300 });
+  if (!depsResult.success) {
+    throw new Error(`Failed to install Firefox system deps in sandbox: ${depsResult.stderr || depsResult.stdout}`);
+  }
+  let fetchResult;
+  for (let attempt = 1;attempt <= 3; attempt++) {
+    fetchResult = await sandbox.execute(`cd ${SANDBOX_PW_DIR} && node ./node_modules/camoufox-js/dist/__main__.js fetch 2>&1`, { timeout: 300 });
+    if (fetchResult.success)
+      break;
+    if (attempt < 3) {
+      await new Promise((r) => setTimeout(r, 3000));
     }
   }
+  if (!fetchResult.success) {
+    throw new Error(`Failed to fetch Camoufox in sandbox: ${fetchResult.stderr || fetchResult.stdout}`);
+  }
 }
 async function ensureSandboxPlaywright(sandbox) {
   let cached = installationCache.get(sandbox);
@@ -110238,42 +110289,59 @@ async function ensureSandboxPlaywright(sandbox) {
   }
 }
 async function ensureSandboxBrowser(sandbox) {
-  await sandbox.execute(`mkdir -p ${SANDBOX_EVIDENCE_DIR} /tmp/pw-user-data`, {
-    timeout: 5
-  });
+  await sandbox.execute(`rm -rf /tmp/pw-user-data ${SANDBOX_CAMOU_CACHE}; mkdir -p ${SANDBOX_EVIDENCE_DIR} /tmp/pw-user-data`, { timeout: 5 });
 }
 async function ensureSandboxReady(sandbox) {
   await ensureSandboxPlaywright(sandbox);
-  await ensureSandboxBrowser(sandbox);
+  let cached = browserSetupCache.get(sandbox);
+  if (!cached) {
+    cached = ensureSandboxBrowser(sandbox);
+    browserSetupCache.set(sandbox, cached);
+    try {
+      await cached;
+    } catch (error) {
+      browserSetupCache.delete(sandbox);
+      throw error;
+    }
+  } else {
+    await cached;
+  }
 }
 async function runPlaywrightScript(sandbox, body, timeout = 60, extraHttpHeaders) {
   const headersJson = extraHttpHeaders && Object.keys(extraHttpHeaders).length > 0 ? JSON.stringify(extraHttpHeaders) : "null";
   const script = `
-const { chromium } = require('playwright');
+const { firefox } = require('playwright-core');
 const fs = require('fs');
 
 (async () => {
+  const { launchOptions } = await import('camoufox-js');
   function resolve(value) {
     process.stdout.write('${RESULT_START}' + JSON.stringify(value) + '${RESULT_END}');
   }
 
-  // Prefer system Chromium (Alpine apk install) over Playwright's bundled binary.
-  let executablePath;
-  for (const p of ['/usr/bin/chromium-browser', '/usr/bin/chromium']) {
-    try { fs.accessSync(p, fs.constants.X_OK); executablePath = p; break; } catch {}
-  }
-
   // Resolved per script invocation so /headers mutations take effect
   // on the next browser tool call.
   const __extraHeaders = ${headersJson};
 
+  // Use the sandbox's virtual display if one is present — Camoufox is far less
+  // detectable headful. Falls back to plain headless, which is still fully
+  // fingerprint-spoofed (just a weaker stealth posture, never vanilla Chromium).
+  const __headless = process.env.DISPLAY ? false : true;
+  // Resolve Camoufox options once per sandbox session and cache to disk so
+  // every tool call presents the same fingerprint on the shared profile dir.
+  let __camou;
+  try {
+    __camou = JSON.parse(fs.readFileSync('${SANDBOX_CAMOU_CACHE}', 'utf-8'));
+  } catch {
+    __camou = await launchOptions({ ...${JSON.stringify(CAMOUFOX_OPTIONS)}, headless: __headless });
+    fs.writeFileSync('${SANDBOX_CAMOU_CACHE}', JSON.stringify(__camou));
+  }
+
   let context;
   const __consoleMessages = [];
   try {
-    context = await chromium.launchPersistentContext('/tmp/pw-user-data', {
-      headless: true,
-      ...(executablePath ? { executablePath } : {}),
-      args: ['--no-sandbox', '--disable-setuid-sandbox', '--disable-dev-shm-usage', '--disable-gpu'],
+    context = await firefox.launchPersistentContext('/tmp/pw-user-data', {
+      ...__camou,
       ...(__extraHeaders ? { extraHTTPHeaders: __extraHeaders } : {}),
     });
     const pages = context.pages();
@@ -110363,7 +110431,7 @@ var BrowserGetCookiesInput2 = exports_external.object({
 });
 function createSandboxBrowserTools(ctx) {
   const sandbox = ctx.sandbox;
-  const evidenceDir = join4(ctx.session.rootPath, "evidence");
+  const evidenceDir = join5(ctx.session.rootPath, "evidence");
   const targetUrl = ctx.target ?? "";
   if (!existsSync3(evidenceDir)) {
     mkdirSync2(evidenceDir, { recursive: true });
@@ -110375,9 +110443,13 @@ function createSandboxBrowserTools(ctx) {
     }
     return setupPromise;
   }
+  let scriptQueue = Promise.resolve();
   function runScript(body, timeout = 60) {
     const resolved = targetUrl ? resolveEffectiveHeaders(resolverSessionFromCtx(ctx), targetUrl) : ctx.session.config?.headers;
-    return runPlaywrightScript(sandbox, body, timeout, stripBrowserManagedHeaders(resolved));
+    const headers = stripBrowserManagedHeaders(resolved);
+    const next = scriptQueue.then(() => runPlaywrightScript(sandbox, body, timeout, headers));
+    scriptQueue = next.then(() => {}, () => {});
+    return next;
   }
   const browser_navigate = tool({
     description: `Navigate the browser to a URL to load and render a page.
@@ -110428,8 +110500,8 @@ Use this to document:
     resolve({ success: true, data: b64, sandboxPath: ${JSON.stringify(sandboxPath)} });
           `, 30);
         if (result.success && result.data) {
-          const localPath = join4(evidenceDir, screenshotFilename);
-          const dir = dirname2(localPath);
+          const localPath = join5(evidenceDir, screenshotFilename);
+          const dir = dirname3(localPath);
           if (!existsSync3(dir)) {
             mkdirSync2(dir, { recursive: true });
           }
@@ -110806,7 +110878,7 @@ The returned cookies can be formatted as a Cookie header for use with http_reque
 // src/core/agents/offSecAgent/tools/browserTools.ts
 init_dist();
 init_zod();
-import { join as join5 } from "path";
+import { join as join6 } from "node:path";
 var BROWSER_TOOL_NAMES = [
   "browser_navigate",
   "browser_snapshot",
@@ -110818,7 +110890,7 @@ var BROWSER_TOOL_NAMES = [
   "browser_get_cookies"
 ];
 function createBrowserToolset(ctx) {
-  const tools = ctx.sandbox ? createSandboxBrowserTools(ctx) : createBrowserTools(ctx.target ?? "", join5(ctx.session.rootPath, "evidence"), "operator", undefined, ctx.abortSignal, undefined, undefined, undefined, ctx.browserSession);
+  const tools = ctx.sandbox ? createSandboxBrowserTools(ctx) : createBrowserTools(ctx.target ?? "", join6(ctx.session.rootPath, "evidence"), "operator", undefined, ctx.abortSignal, undefined, undefined, undefined, ctx.browserSession);
   if (!ctx.credentialManager) {
     return tools;
   }
@@ -110878,7 +110950,7 @@ Credential mode: Instead of passing a raw secret as "value", you can pass ` + `"
           error: "Either value or credentialId + credentialField must be provided"
         };
       }
-      return originalFill.execute({ element, ref, value, toolCallDescription }, { toolCallId: "", messages: [], abortSignal: undefined });
+      return originalFill.execute?.({ element, ref, value, toolCallDescription }, { toolCallId: "", messages: [], abortSignal: undefined });
     }
   });
   return {
@@ -110943,8 +111015,8 @@ init_dist();
 init_zod();
 init_structured();
 init_lazyLogger();
-import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join7 } from "node:path";
 var log = scopedLogger(() => createLogger("complete_authentication"));
 var AUTH_DIR = "auth";
 var AUTH_DATA_FILENAME = "auth-data.json";
@@ -110988,11 +111060,11 @@ This tool marks the end of the authentication flow.`,
       log.info(`Authentication complete: ${result.success ? "SUCCESS" : "FAILED"}`);
       let authDataPath;
       try {
-        const authDir = join6(ctx.session.rootPath, AUTH_DIR);
+        const authDir = join7(ctx.session.rootPath, AUTH_DIR);
         if (!existsSync4(authDir)) {
           mkdirSync3(authDir, { recursive: true });
         }
-        authDataPath = join6(authDir, AUTH_DATA_FILENAME);
+        authDataPath = join7(authDir, AUTH_DATA_FILENAME);
         const authData = {
           authenticated: result.success,
           strategy: result.strategy || "unknown",
@@ -111061,10 +111133,10 @@ async function extractJavascriptEndpoints(params) {
         const patternCopy = new RegExp(pattern.source, pattern.flags);
         for (let match = patternCopy.exec(scriptContent);match !== null; match = patternCopy.exec(scriptContent)) {
           const endpoint = match[1] || match[2];
-          if (endpoint && endpoint.startsWith("/")) {
+          if (endpoint?.startsWith("/")) {
             endpoints.push({
               endpoint,
-              pattern: pattern.source.substring(0, 30) + "...",
+              pattern: `${pattern.source.substring(0, 30)}...`,
               source: "inline-script"
             });
           }
@@ -111208,8 +111280,8 @@ function crawlAuthenticated(ctx) {
 // src/core/agents/offSecAgent/tools/createAttackSurfaceReport.ts
 init_dist();
 init_zod();
-import { writeFileSync as writeFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { writeFileSync as writeFileSync5 } from "node:fs";
+import { join as join8 } from "node:path";
 function createAttackSurfaceReport(ctx) {
   return tool({
     description: `Provide attack surface analysis results to the orchestrator agent.
@@ -111235,7 +111307,7 @@ Call this at the END of your analysis with:
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async (results) => {
-      const resultsPath = join7(ctx.session.rootPath, "attack-surface-results.json");
+      const resultsPath = join8(ctx.session.rootPath, "attack-surface-results.json");
       writeFileSync5(resultsPath, JSON.stringify(results, null, 2));
       return {
         success: true,
@@ -111252,9 +111324,9 @@ init_dist();
 init_zod();
 init_structured();
 init_lazyLogger();
-import { existsSync as existsSync5 } from "fs";
-import { mkdir, writeFile } from "fs/promises";
-import { dirname as dirname3, isAbsolute, resolve } from "path";
+import { existsSync as existsSync5 } from "node:fs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname as dirname4, isAbsolute, resolve } from "node:path";
 var log3 = scopedLogger(() => createLogger("create_file"));
 var createFileInputSchema = exports_external.object({
   path: exports_external.string().describe("Absolute or relative path for the new file"),
@@ -111298,7 +111370,7 @@ async function executeLocalCreate(filePath, content, overwrite) {
         path: filePath
       };
     }
-    const dir = dirname3(filePath);
+    const dir = dirname4(filePath);
     log3.debug(`local: mkdir ${dir}`);
     await mkdir(dir, { recursive: true });
     log3.debug(`local: mkdir done, writing ${content.length} bytes`);
@@ -111332,7 +111404,7 @@ async function executeSandboxCreate(ctx, filePath, content, overwrite) {
         };
       }
     }
-    const dirPath = dirname3(filePath);
+    const dirPath = dirname4(filePath);
     await ctx.sandbox.execute(`mkdir -p "${dirPath}"`);
     const base64Content = Buffer.from(content).toString("base64");
     const writeResult = await ctx.sandbox.execute(`echo "${base64Content}" | base64 -d > "${filePath}"`);
@@ -111362,17 +111434,17 @@ init_dist();
 init_zod();
 
 // src/core/tasks/index.ts
-import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, writeFileSync as writeFileSync6 } from "fs";
-import { join as join8 } from "path";
+import { mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync, writeFileSync as writeFileSync6 } from "node:fs";
+import { join as join9 } from "node:path";
 var HWM_FILENAME = "_hwm.json";
 function ensureDir(dir) {
   mkdirSync4(dir, { recursive: true });
 }
 function taskPath(tasksDir, id) {
-  return join8(tasksDir, `${id}.json`);
+  return join9(tasksDir, `${id}.json`);
 }
 function hwmPath(tasksDir) {
-  return join8(tasksDir, HWM_FILENAME);
+  return join9(tasksDir, HWM_FILENAME);
 }
 function readHighWaterMark(tasksDir) {
   try {
@@ -111445,7 +111517,7 @@ function listTasks(tasksDir, filter) {
     if (!file.endsWith(".json") || file === HWM_FILENAME)
       continue;
     try {
-      const raw = readFileSync(join8(tasksDir, file), "utf-8");
+      const raw = readFileSync(join9(tasksDir, file), "utf-8");
       const task = JSON.parse(raw);
       if (filter?.status && task.status !== filter.status)
         continue;
@@ -111542,8 +111614,8 @@ Examples of good tasks:
 init_dist();
 init_zod();
 init_credentials();
-import { writeFileSync as writeFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join10 } from "node:path";
 init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("delegate_auth"));
@@ -111709,7 +111781,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
         if (credentials) {
           ctx.session.credentialManager.addFromAuthCredentials(credentials);
         }
-        const { runAuthenticationAgent } = await import("./authentication-c0aj9zaz.js");
+        const { runAuthenticationAgent } = await import("./authentication-69q16waz.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const result = await runAuthenticationAgent({
@@ -111728,7 +111800,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
           parentSubagentId: ctx.subagentId
         });
         if (result.success) {
-          const sessionInfoPath = join9(ctx.session.rootPath, "session-info.json");
+          const sessionInfoPath = join10(ctx.session.rootPath, "session-info.json");
           const sessionInfo = {
             authenticated: true,
             username: username || "via_subagent",
@@ -111922,8 +111994,8 @@ function detectBarrier(bodyLower, statusCode) {
 // src/core/agents/offSecAgent/tools/documentApp.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { join as join11 } from "node:path";
 function sanitizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9-_.]/g, "_");
 }
@@ -111962,7 +112034,7 @@ function validateDomainUrl(value) {
   }
 }
 function documentApp(ctx) {
-  const baseAppsPath = join10(ctx.session.rootPath, "apps");
+  const baseAppsPath = join11(ctx.session.rootPath, "apps");
   return tool({
     description: `Document a discovered application during attack surface analysis.
 
@@ -112015,7 +112087,7 @@ Each application creates a JSON file in the apps directory for tracking and anal
       const sanitizedName = sanitizeName(input.appName);
       const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
       const filename = `app_${sanitizedName}_${timestamp}.json`;
-      const filepath = join10(baseAppsPath, filename);
+      const filepath = join11(baseAppsPath, filename);
       const appRecord = {
         ...input,
         discoveredAt: new Date().toISOString(),
@@ -112038,8 +112110,8 @@ Each application creates a JSON file in the apps directory for tracking and anal
 // src/core/agents/offSecAgent/tools/documentEndpoint.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, writeFileSync as writeFileSync9 } from "node:fs";
+import { join as join12 } from "node:path";
 
 // src/core/agents/specialized/attackSurface/blackboxRiskScoring.ts
 var RISK_LEVEL_BASE_SCORE = {
@@ -112091,7 +112163,7 @@ function computeExposure(riskLevel, details) {
   }
   return Math.min(3, Math.max(0, base));
 }
-function computeDataSensitivity(riskLevel, assetType, details) {
+function computeDataSensitivity(riskLevel, _assetType, details) {
   if (riskLevel === "CRITICAL")
     return 3;
   let score = riskLevel === "HIGH" ? 2 : riskLevel === "MEDIUM" ? 1 : 0;
@@ -112389,7 +112461,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
   return threatModelLimiter(async () => {
     if (ctx.abortSignal?.aborted)
       return null;
-    const { CodeAgent } = await import("./agent-4g69jwmq.js");
+    const { CodeAgent } = await import("./agent-m3bsrs09.js");
     const subagentId = `threat-model-${sanitize(input.appName)}-${sanitize(input.routePath)}`;
     ctx.eventBus?.emit("subagent-spawn", {
       subagentId,
@@ -112697,7 +112769,7 @@ var documentEndpointInputSchema = exports_external.object({
   toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
 });
 function documentEndpoint(ctx) {
-  const baseAssetsPath = join11(ctx.session.rootPath, "assets");
+  const baseAssetsPath = join12(ctx.session.rootPath, "assets");
   return tool({
     description: `Document a discovered endpoint during attack surface analysis.
 
@@ -112743,14 +112815,14 @@ Each endpoint creates a JSON file in the assets directory for tracking and analy
           message: `routePath "${input.routePath}" is a full URL. The domain is already stored on the parent application. ` + `Use a path or access pattern instead (e.g. "/api/users", "/{objectKey}?X-Amz-Signature={sig}", "arn:aws:s3:::bucket-name").`
         };
       }
-      const targetDir = join11(baseAssetsPath, sanitizeName2(input.appName));
+      const targetDir = join12(baseAssetsPath, sanitizeName2(input.appName));
       if (!existsSync7(targetDir)) {
         mkdirSync6(targetDir, { recursive: true });
       }
       const sanitizedPath = sanitizeName2(input.routePath);
       const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
       const filename = `asset_${sanitizedPath}_${timestamp}.json`;
-      const filepath = join11(targetDir, filename);
+      const filepath = join12(targetDir, filename);
       const heuristicRiskScore = computeBlackboxRiskScore(input.riskLevel, "endpoint", {
         url: input.routePath,
         method: input.method,
@@ -112819,7 +112891,7 @@ Each endpoint creates a JSON file in the assets directory for tracking and analy
 // src/core/agents/offSecAgent/tools/documentFinding.ts
 init_dist();
 init_zod();
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn2 } from "node:child_process";
 import {
   appendFileSync,
   chmodSync,
@@ -112827,8 +112899,8 @@ import {
   mkdirSync as mkdirSync7,
   unlinkSync,
   writeFileSync as writeFileSync10
-} from "fs";
-import { join as join12 } from "path";
+} from "node:fs";
+import { join as join13 } from "node:path";
 
 // src/lib/cwe/types.ts
 init_zod();
@@ -113327,7 +113399,7 @@ function getMetricDistance(metrics, metric) {
   if (!levels)
     return 0;
   let value;
-  const modifiedMetric = "M" + metric;
+  const modifiedMetric = `M${metric}`;
   const metricsRecord = metrics;
   if (metricsRecord[modifiedMetric] && metricsRecord[modifiedMetric] !== "X") {
     value = metricsRecord[modifiedMetric] ?? "";
@@ -113349,12 +113421,12 @@ function getNextLowerScore(macroVector, position) {
   return MACROVECTOR_LOOKUP[nextMacroVector] ?? null;
 }
 function interpolateScore(metrics, macroVector, baseScore) {
-  const eq1 = parseInt(macroVector[0]);
-  const eq2 = parseInt(macroVector[1]);
-  const eq3 = parseInt(macroVector[2]);
-  const eq4 = parseInt(macroVector[3]);
-  const eq5 = parseInt(macroVector[4]);
-  const eq6 = parseInt(macroVector[5]);
+  const eq1 = parseInt(macroVector[0], 10);
+  const eq2 = parseInt(macroVector[1], 10);
+  const eq3 = parseInt(macroVector[2], 10);
+  const eq4 = parseInt(macroVector[3], 10);
+  const eq5 = parseInt(macroVector[4], 10);
+  const eq6 = parseInt(macroVector[5], 10);
   let meanDistance = 0;
   let eqCount = 0;
   const eq1NextLower = getNextLowerScore(macroVector, 0);
@@ -114063,6 +114135,30 @@ var CVSS_SCORER_SYSTEM_PROMPT = `You are a CVSS 4.0 scoring specialist. Your tas
 - If production-like or confirmed unintentional: **E:A**
 - Severity: typically **HIGH-CRITICAL** for real bypasses, **MEDIUM** for intentional test credentials in sandbox
 
+### Denial of Service / Resource Exhaustion (unbounded input, algorithmic complexity, amplification)
+- Typically: **AV:N, AC:L, AT:N, PR** varies (often **L** for authenticated endpoints), **UI:N**
+- **VC:N, VI:N** — DoS has no confidentiality/integrity impact unless separately demonstrated
+- **VA** must reflect what the evidence actually proves, not the worst case it implies:
+  - **VA:L** when a single request degrades performance or ties up one worker temporarily (the typical demonstrated case). A slow response (e.g. several seconds) for one request is **VA:L**, not **VA:H**.
+  - **VA:H** ONLY when the POC demonstrates a *sustained, service-wide* outage — e.g. proven worker-pool exhaustion at realistic concurrency, or the service staying unavailable to other users. Extrapolating "5-10 concurrent requests would exhaust the pool" is theoretical and does NOT justify **VA:H** unless the POC actually showed it.
+- **E:P** when only the resource-consumption gap was demonstrated; **E:A** only if an actual outage was produced and observed during testing.
+- Severity range: typically **LOW-MEDIUM**. Reserve **HIGH** for a demonstrated full outage with no easy mitigation.
+
+### OAuth Flow Weaknesses (missing PKCE, weak/predictable state, state integrity)
+- These findings describe a *missing or weak control* in an auth flow. The impact (account/session takeover) is only realizable when chained with a *separate* capability: an authorization-code interception path (open redirect, referrer leakage, network MITM) or a forgeable/guessable state.
+- **Do NOT credit full VC:H/VI:H on the vulnerable system unless the interception/forgery chain was actually demonstrated end to end.** If only the absence of PKCE (or a missing signature) was shown, the direct impact on the vulnerable system is limited → prefer **VC:L/VI:L or N** and **E:P**, with **AC:H** and/or **AT:P** to reflect the required preconditions.
+- If a state parameter already binds to the initiating user (e.g. a server-side userId check on return), missing PKCE/signing is largely a **defense-in-depth / best-practice** gap → **LOW** (or informational when state is also unguessable and validated).
+- Severity range: typically **LOW** for "missing PKCE / unsigned state" in isolation; elevate only when a working interception or CSRF-via-state-forgery chain is demonstrated.
+
+## Severity Calibration Principles
+
+Apply these across every vulnerability class. They override the worst-case instinct.
+
+- **Score what was demonstrated, not what could theoretically follow.** The CVSS reflects the impact the POC actually proved on the target, not the maximal impact the weakness might enable in a different configuration or when chained with an undiscovered bug.
+- **Chained / conditional exploitation:** when realizing impact depends on a *separate, undemonstrated* vulnerability or attacker-favorable precondition (interception position, a second bug, a guessed identifier), reflect that in the exploitability metrics (**AC:H**, **AT:P**, exploit maturity **E:P/U**) and do NOT assign full **VC:H/VI:H/VA:H** to the vulnerable system. A finding whose impact is entirely contingent on a missing precondition trends **LOW**.
+- **Security-boundary bypass without proven sensitive exposure:** when a test shows an access-control/authorization boundary was bypassed but the data actually returned is non-sensitive or same-tenant/expected-visible, score the *demonstrated* confidentiality impact (often **VC:L** or **VC:N**), not the boundary's theoretical worst case. Note explicitly in the reasoning what data was (and was not) exposed.
+- **Cross-tenant vs same-tenant matters:** confirmed cross-tenant/cross-user exposure of private data justifies **VC:H**; same-tenant data the identity could plausibly already see does not. If tenancy is unproven, say so and score conservatively.
+
 ## Analysis Instructions
 
 1. Read the finding description and evidence carefully
@@ -114070,8 +114166,8 @@ var CVSS_SCORER_SYSTEM_PROMPT = `You are a CVSS 4.0 scoring specialist. Your tas
 3. Assess complexity based on whether special conditions were needed
 4. Determine privileges based on authentication requirements
 5. Evaluate user interaction based on exploit mechanics
-6. Assess impact on both the vulnerable system AND potential subsequent systems
-7. Since a POC exists and confirmed the vulnerability, E should typically be 'A'
+6. Assess impact on both the vulnerable system AND potential subsequent systems — score what the evidence proves, not the worst case it implies (see Severity Calibration Principles)
+7. Exploit Maturity (E): use **A (Attacked)** only when the POC demonstrated the actual security impact (data accessed, outage produced, session taken over). When the POC only proved the *gap* exists — a missing control, a slow response, a boundary bypass without confirmed sensitive exposure — use **P (POC)**. Do not default to **A** merely because a script ran and exited 0.
 
 Always provide brief reasoning explaining your key decisions.
 
@@ -114103,6 +114199,8 @@ In addition to CVSS metrics, assign one or more CWE identifiers to the finding.
 | Hardcoded Credentials | CWE-798 | CWE-259 (Hard-coded Password), CWE-321 (Hard-coded Crypto Key) |
 | Captcha Bypass | CWE-804 | CWE-837 (Improper Enforcement of Single Access) |
 | Missing Security Headers | CWE-1021 | CWE-693 (Protection Mechanism Failure), CWE-16 (Configuration) |
+| Denial of Service / Resource Exhaustion | CWE-400 | CWE-770 (Allocation Without Limits), CWE-1333 (Inefficient Regex) |
+| OAuth Flow Weakness (missing PKCE, weak state) | CWE-352 | CWE-345 (Insufficient Verification of Authenticity), CWE-1275 (Sensitive Cookie Weak Attributes) |
 
 ### CWE Assignment Rules
 
@@ -114142,7 +114240,7 @@ var MAX_IMPACT_CHARS = 2000;
 function truncateField(value, limit) {
   if (value.length <= limit)
     return value;
-  return value.substring(0, limit) + `
+  return `${value.substring(0, limit)}
 ... [truncated]`;
 }
 function buildScoringPrompt(input) {
@@ -114228,8 +114326,8 @@ function extractContextSummary(messages) {
     return `No additional context available from testing conversation.
 `;
   }
-  return contextParts.join(`
-`) + `
+  return `${contextParts.join(`
+`)}
 `;
 }
 
@@ -114239,7 +114337,7 @@ init_lazyLogger();
 var log6 = scopedLogger(() => createLogger("FindingJudge"));
 async function judgeFinding(input, ctx) {
   try {
-    const { FindingJudgeAgent } = await import("./agent-6nhperp2.js");
+    const { FindingJudgeAgent } = await import("./agent-3n8msbqb.js");
     const agent = new FindingJudgeAgent({
       finding: input,
       model: ctx.model,
@@ -114529,14 +114627,14 @@ CRITICAL RULES — READ BEFORE CALLING:
           description: `POC execution output for ${filename}`
         });
         const timestamp = new Date().toISOString();
-        const outputDir = isVulnerability ? session.findingsPath : join12(session.rootPath, "informational");
+        const outputDir = isVulnerability ? session.findingsPath : join13(session.rootPath, "informational");
         if (!isVulnerability) {
           mkdirSync7(outputDir, { recursive: true });
         }
         let evidenceForPrompt = materializedEvidence;
         if (materializedEvidence.length > EVIDENCE_FILE_THRESHOLD) {
           const evidenceFilename = `${timestamp.split("T")[0]}-${slugify2(input.title, 40)}-evidence.txt`;
-          const evidenceFilePath = join12(outputDir, evidenceFilename);
+          const evidenceFilePath = join13(outputDir, evidenceFilename);
           writeFileSync10(evidenceFilePath, materializedEvidence);
           evidenceForPrompt = materializedEvidence.substring(0, EVIDENCE_FILE_THRESHOLD) + `
 ... [truncated — full output saved to ${evidenceFilename}]`;
@@ -114678,8 +114776,8 @@ CRITICAL RULES — READ BEFORE CALLING:
         const findingId = `${timestamp.split("T")[0]}-${slugify2(finding.title, 50)}`;
         const jsonFilename = `${findingId}.json`;
         const mdFilename = `${findingId}.md`;
-        const jsonPath = join12(outputDir, jsonFilename);
-        const mdPath = join12(outputDir, mdFilename);
+        const jsonPath = join13(outputDir, jsonFilename);
+        const mdPath = join13(outputDir, mdFilename);
         try {
           writeFileSync10(jsonPath, JSON.stringify(findingWithMeta, null, 2));
           const cvssSection = cvssWarning ? `## CVSS 4.0 Assessment
@@ -114762,7 +114860,7 @@ ${finding.references}` : ""}
 `;
           writeFileSync10(mdPath, markdown);
           if (isVulnerability) {
-            const summaryPath = join12(session.rootPath, "findings-summary.md");
+            const summaryPath = join13(session.rootPath, "findings-summary.md");
             const cweTag = cvssResult.cwes?.length ? ` (${cvssResult.cwes.map((c) => c.id).join(", ")})` : "";
             const cvssTag = cvssWarning ? "(estimated)" : `(CVSS ${cvssResult.score})`;
             const summaryEntry = `- [${finding.severity}] ${cvssTag}${cweTag} ${finding.title} - \`findings/${mdFilename}\`
@@ -114820,7 +114918,7 @@ async function executeLocalPoc(ctx, input) {
     mkdirSync7(pocsPath, { recursive: true });
   }
   const { filename, pocContent } = preparePoc(input);
-  const pocPath = join12(pocsPath, filename);
+  const pocPath = join13(pocsPath, filename);
   writeFileSync10(pocPath, pocContent);
   chmodSync(pocPath, 493);
   const { stdout, stderr, exitCode } = await runScript(POC_RUNNERS[input.pocType], pocPath, 60000, ctx.abortSignal);
@@ -114838,7 +114936,7 @@ async function executeSandboxPoc(ctx, input) {
   if (!existsSync8(localPocsPath)) {
     mkdirSync7(localPocsPath, { recursive: true });
   }
-  const localPocPath = join12(localPocsPath, filename);
+  const localPocPath = join13(localPocsPath, filename);
   writeFileSync10(localPocPath, pocContent);
   const sandboxPocPath = `/tmp/pocs/${filename}`;
   const base64Content = Buffer.from(pocContent).toString("base64");
@@ -114871,10 +114969,10 @@ POC file has been deleted.`,
 }
 function cleanupPocFiles(ctx, filename) {
   try {
-    unlinkSync(join12(ctx.session.pocsPath, filename));
+    unlinkSync(join13(ctx.session.pocsPath, filename));
   } catch {}
   try {
-    unlinkSync(join12(ctx.session.pocsPath, `${filename}.output.json`));
+    unlinkSync(join13(ctx.session.pocsPath, `${filename}.output.json`));
   } catch {}
 }
 function sanitizeFilename(str) {
@@ -114935,7 +115033,7 @@ ${commentChar} Created: ${new Date().toISOString()}
 }
 function writePocOutputSidecar(pocsPath, filename, stdout, stderr, exitCode, description) {
   try {
-    const outputPath = join12(pocsPath, `${filename}.output.json`);
+    const outputPath = join13(pocsPath, `${filename}.output.json`);
     writeFileSync10(outputPath, JSON.stringify({
       stdout,
       stderr,
@@ -117765,7 +117863,7 @@ function hasImapAttachments(bodyStructure) {
   return false;
 }
 function truncate(s, max) {
-  return s.length > max ? s.slice(0, max) + `
+  return s.length > max ? `${s.slice(0, max)}
 
 (truncated)` : s;
 }
@@ -118005,7 +118103,8 @@ Sets the read/seen flag on a message so it no longer appears as unread.`,
 
 // src/core/agents/offSecAgent/tools/email/sendEmail.ts
 init_dist();
-import { readFile } from "fs/promises";
+import { readFile } from "node:fs/promises";
+import { basename } from "node:path";
 
 // node_modules/mime-types/index.js
 /*!
@@ -118126,7 +118225,6 @@ var $createTransport = function(transporter, defaults) {
 
 // src/core/agents/offSecAgent/tools/email/sendEmail.ts
 init_zod();
-import { basename } from "path";
 var attachmentSchema = exports_external.object({
   path: exports_external.string().describe("Absolute path to the file on disk to attach. The file is read and included inline."),
   filename: exports_external.string().optional().describe("Override the attachment filename (defaults to the basename of the path)")
@@ -118249,13 +118347,181 @@ var SEND_EMAIL_TOOL_NAME = "send_email";
 // src/core/agents/offSecAgent/tools/executeCommand.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join15 } from "node:path";
+
+// src/core/prompt-injections/index.ts
+init_zod();
+import { createHash } from "node:crypto";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join14, relative, resolve as resolve2, sep } from "node:path";
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+var PromptInjectionCatalogEntrySchema = exports_external.object({
+  id: exports_external.string().min(1),
+  name: exports_external.string().min(1),
+  category: exports_external.enum([
+    "instruction-hijack",
+    "data-exfiltration",
+    "tool-misuse",
+    "role-confusion",
+    "encoding"
+  ]),
+  description: exports_external.string(),
+  tags: exports_external.array(exports_external.string()).default([]),
+  deliveryHints: exports_external.array(exports_external.string()).default([]),
+  expectedObservation: exports_external.string().default(""),
+  payloadPath: exports_external.string().min(1)
+});
+var PromptInjectionLibraryFileSchema = exports_external.union([
+  exports_external.array(PromptInjectionCatalogEntrySchema),
+  exports_external.object({
+    payloads: exports_external.array(PromptInjectionCatalogEntrySchema)
+  }),
+  exports_external.object({
+    injections: exports_external.array(PromptInjectionCatalogEntrySchema)
+  })
+]);
+function isPromptInjectionRef(value) {
+  return typeof value === "object" && value !== null && value.kind === "prompt_injection_ref" && typeof value.id === "string";
+}
+
+class StaticPromptInjectionLibrary {
+  ordered;
+  entries;
+  hashes;
+  constructor(entries) {
+    this.ordered = entries;
+    this.entries = new Map(entries.map((entry) => [entry.id, entry]));
+    this.hashes = new Map(entries.map((entry) => [entry.id, sha256(entry.payload)]));
+  }
+  listCatalog() {
+    return this.ordered.map(({ payload, payloadFilePath: _path, ...entry }) => ({
+      ...entry,
+      payloadHash: sha256(payload)
+    }));
+  }
+  getPayload(id) {
+    return this.entries.get(id)?.payload;
+  }
+  getPayloadFilePath(id) {
+    return this.entries.get(id)?.payloadFilePath;
+  }
+  getPayloadHash(id) {
+    return this.hashes.get(id);
+  }
+  has(id) {
+    return this.entries.has(id);
+  }
+}
+var EMPTY_PROMPT_INJECTION_LIBRARY = new StaticPromptInjectionLibrary([]);
+var SOURCE_CACHE = new Map;
+function resolvePromptInjectionLibrarySource(explicit) {
+  return explicit || process.env.PENSAR_PROMPT_INJECTION_LIBRARY || process.env.APEX_PROMPT_INJECTION_LIBRARY;
+}
+function resolveCatalogPath(source) {
+  if (source.startsWith("https://") || source.startsWith("http://")) {
+    throw new Error("Prompt injection library source must be a local path, not a URL.");
+  }
+  const path = source.startsWith("file://") ? source.slice(7) : source;
+  const resolved = isAbsolute2(path) ? path : resolve2(process.cwd(), path);
+  const stat = statSync2(resolved);
+  if (stat.isDirectory()) {
+    return { catalogPath: join14(resolved, "catalog.json"), root: resolved };
+  }
+  return { catalogPath: resolved, root: dirname5(resolved) };
+}
+function resolvePayloadPath(root, payloadPath) {
+  if (isAbsolute2(payloadPath)) {
+    throw new Error("Prompt injection payloadPath must be relative.");
+  }
+  const resolved = resolve2(root, payloadPath);
+  const relativePath = relative(root, resolved);
+  if (relativePath === ".." || relativePath.startsWith(`..${sep}`)) {
+    throw new Error("Prompt injection payloadPath must stay within the library.");
+  }
+  return resolved;
+}
+function parsePromptInjectionLibrary(raw, root) {
+  const parsed = PromptInjectionLibraryFileSchema.parse(JSON.parse(raw));
+  const catalogEntries = Array.isArray(parsed) ? parsed : ("payloads" in parsed) ? parsed.payloads : parsed.injections;
+  const entries = catalogEntries.map((entry) => {
+    const payloadFile = resolvePayloadPath(root, entry.payloadPath);
+    const payload = readFileSync2(payloadFile, "utf-8");
+    const { payloadPath: _payloadPath, ...safeEntry } = entry;
+    return { ...safeEntry, payload, payloadFilePath: payloadFile };
+  });
+  return new StaticPromptInjectionLibrary(entries);
+}
+async function readSource(source) {
+  if (source.startsWith("https://") || source.startsWith("http://")) {
+    throw new Error("Prompt injection library source must be a local path, not a URL.");
+  }
+  const { catalogPath, root } = resolveCatalogPath(source);
+  return parsePromptInjectionLibrary(readFileSync2(catalogPath, "utf-8"), root);
+}
+async function loadPromptInjectionLibrary(source) {
+  let cached = SOURCE_CACHE.get(source);
+  if (!cached) {
+    cached = readSource(source).catch((err) => {
+      SOURCE_CACHE.delete(source);
+      throw err;
+    });
+    SOURCE_CACHE.set(source, cached);
+  }
+  return cached;
+}
+async function getPromptInjectionLibrary(opts) {
+  if (opts?.library)
+    return opts.library;
+  const source = resolvePromptInjectionLibrarySource(opts?.source);
+  if (!source)
+    return EMPTY_PROMPT_INJECTION_LIBRARY;
+  return loadPromptInjectionLibrary(source);
+}
+function resolvePromptInjectionRefs(value, library) {
+  if (isPromptInjectionRef(value)) {
+    const payload = library.getPayload(value.id);
+    if (!payload)
+      throw new Error(`Unknown prompt injection id: ${value.id}`);
+    return payload;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => resolvePromptInjectionRefs(item, library));
+  }
+  if (typeof value === "object" && value !== null) {
+    const resolved = {};
+    for (const [key, nested] of Object.entries(value)) {
+      resolved[key] = resolvePromptInjectionRefs(nested, library);
+    }
+    return resolved;
+  }
+  return value;
+}
+function redactPromptInjectionPayloads(value, library) {
+  let redacted = value;
+  for (const entry of library.listCatalog()) {
+    const payload = library.getPayload(entry.id);
+    if (!payload)
+      continue;
+    redacted = redacted.split(payload).join(`[PROMPT_INJECTION:${entry.id}]`);
+  }
+  return redacted;
+}
+
+// src/core/agents/offSecAgent/tools/executeCommand.ts
 var MAX_INLINE = 50000;
 var MS_TIMEOUT_THRESHOLD = 1e4;
+var DEFAULT_PROMPT_INJECTION_FILE_ENV = "APEX_PROMPT_INJECTION_FILE";
+var promptInjectionPointerSchema = exports_external.object({
+  id: exports_external.string().min(1).describe("Stable prompt-injection id returned by list_prompt_injections."),
+  envVar: exports_external.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).optional().describe(`Environment variable that will contain the payload file path at runtime. Defaults to ${DEFAULT_PROMPT_INJECTION_FILE_ENV}.`)
+});
 var executeCommandInputSchema = exports_external.object({
   toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing (e.g., 'Scanning for open ports on target')"),
   command: exports_external.string().describe("The shell command to execute"),
+  promptInjection: promptInjectionPointerSchema.optional().describe("Optional runtime prompt-injection file pointer. The tool resolves the id to a local payload file path and exposes that path through envVar. The raw payload text is never inserted into the command."),
   timeout: exports_external.number().optional().describe("Timeout in seconds. If omitted, the command runs until completion or abort."),
   allow_unprotected: exports_external.boolean().optional().describe("Acknowledge that this command will run WITHOUT the session's configured custom HTTP headers because the tool is unrecognized or the command is pipelined. Defaults to false (fail-closed). Use only when you understand the headers will not be applied.")
 });
@@ -118272,13 +118538,13 @@ function maybeSaveFullOutput(raw, ctx) {
   if (raw.length <= MAX_INLINE) {
     return { text: raw || "(no output)" };
   }
-  const outputDir = join13(ctx.session.logsPath, "cmd-output");
+  const outputDir = join15(ctx.session.logsPath, "cmd-output");
   if (!existsSync9(outputDir)) {
     mkdirSync8(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `output-${ts}.txt`;
-  const filePath = join13(outputDir, filename);
+  const filePath = join15(outputDir, filename);
   try {
     writeFileSync11(filePath, raw);
   } catch {
@@ -118296,6 +118562,49 @@ function maybeSaveFullOutput(raw, ctx) {
     file: filePath
   };
 }
+function shellQuote2(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function wrapCommandWithEnv(command, envVars) {
+  if (!envVars || Object.keys(envVars).length === 0)
+    return command;
+  const assignments = Object.entries(envVars).map(([name, value]) => {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+      throw new Error(`Invalid environment variable name: ${name}`);
+    }
+    return `${name}=${shellQuote2(value)}`;
+  }).join(" ");
+  return `env ${assignments} bash -lc ${shellQuote2(command)}`;
+}
+async function resolvePromptInjectionEnv(promptInjection, ctx) {
+  if (!promptInjection)
+    return {};
+  const library = await getPromptInjectionLibrary({
+    library: ctx.promptInjectionLibrary,
+    source: ctx.promptInjectionLibrarySource
+  });
+  const payloadContent = library.getPayload(promptInjection.id);
+  if (payloadContent === undefined) {
+    return {
+      library,
+      error: `Unknown prompt injection id: ${promptInjection.id}`
+    };
+  }
+  const payloadFilePath = library.getPayloadFilePath(promptInjection.id);
+  if (!payloadFilePath) {
+    return {
+      library,
+      error: `Unknown prompt injection id or no payload file path available: ` + promptInjection.id
+    };
+  }
+  return {
+    library,
+    payloadContent,
+    envVars: {
+      [promptInjection.envVar ?? DEFAULT_PROMPT_INJECTION_FILE_ENV]: payloadFilePath
+    }
+  };
+}
 function executeCommand(ctx) {
   return tool({
     description: `Execute a shell command for penetration testing activities.
@@ -118356,10 +118665,18 @@ results to disk before any signal arrives.
 - nmap: prefer --host-timeout, --max-rtt-timeout, and -T4 / --min-rate
   to bound total runtime against slow networks.
 
+PROMPT-INJECTION PAYLOADS:
+- Do not put raw prompt-injection payload text in the command.
+- To run a local harness with a payload, set promptInjection.id to an id from
+  list_prompt_injections and reference "$APEX_PROMPT_INJECTION_FILE" in the
+  command. The tool resolves that variable to the local payload file path only
+  at runtime.
+
 IMPORTANT: Always analyze results and adjust your approach based on findings.`,
     inputSchema: executeCommandInputSchema,
     execute: async ({
       command,
+      promptInjection,
       timeout,
       allow_unprotected
     }) => {
@@ -118398,7 +118715,35 @@ IMPORTANT: Always analyze results and adjust your approach based on findings.`,
           command
         };
       }
-      const effectiveCommand = inject.status === "injected" ? inject.command : command;
+      const commandWithHeaders = inject.status === "injected" ? inject.command : command;
+      let promptInjectionLibrary;
+      let promptInjectionEnvVars;
+      let promptInjectionPayloadContent;
+      try {
+        const resolved = await resolvePromptInjectionEnv(promptInjection, ctx);
+        if (resolved.error) {
+          return {
+            success: false,
+            error: resolved.error,
+            stdout: "",
+            stderr: resolved.error,
+            command
+          };
+        }
+        promptInjectionLibrary = resolved.library;
+        promptInjectionEnvVars = resolved.envVars;
+        promptInjectionPayloadContent = resolved.payloadContent;
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        return {
+          success: false,
+          error: msg,
+          stdout: "",
+          stderr: msg,
+          command
+        };
+      }
+      const redact = (value) => promptInjectionLibrary ? redactPromptInjectionPayloads(value, promptInjectionLibrary) : value;
       if (ctx.sandbox) {
         try {
           const ssmOpts = {};
@@ -118406,13 +118751,38 @@ IMPORTANT: Always analyze results and adjust your approach based on findings.`,
           if (normalizedTimeout != null) {
             ssmOpts.timeout = normalizedTimeout;
           }
-          const result = await ctx.sandbox.execute(effectiveCommand, ssmOpts);
-          const { text: stdout, file: outputFile } = maybeSaveFullOutput(result.stdout, ctx);
+          if (promptInjectionPayloadContent && promptInjection) {
+            const envVarName = promptInjection.envVar ?? DEFAULT_PROMPT_INJECTION_FILE_ENV;
+            const sandboxTempFile = `/tmp/apex_payload_${Date.now()}.txt`;
+            const escapedPayload = promptInjectionPayloadContent.replace(/\\/g, "\\\\").replace(/'/g, "'\\''");
+            const writeCommand = `printf '%s' '${escapedPayload}' > ${sandboxTempFile}`;
+            const writeResult = await ctx.sandbox.execute(writeCommand, {
+              timeout: normalizedTimeout ?? 30
+            });
+            if (!writeResult.success) {
+              const errorMsg = `Failed to write prompt injection payload to sandbox: ${writeResult.stderr || "unknown error"}`;
+              return {
+                success: false,
+                error: errorMsg,
+                stdout: writeResult.stdout,
+                stderr: writeResult.stderr || errorMsg,
+                command
+              };
+            }
+            ssmOpts.envVars = {
+              [envVarName]: sandboxTempFile
+            };
+          } else if (promptInjectionEnvVars) {
+            ssmOpts.envVars = promptInjectionEnvVars;
+          }
+          const result = await ctx.sandbox.execute(commandWithHeaders, ssmOpts);
+          const { text: stdout, file: outputFile } = maybeSaveFullOutput(redact(result.stdout), ctx);
+          const stderr = redact(result.stderr || "");
           return {
             success: result.success,
-            error: !result.success ? result.stderr || "Command failed" : "",
+            error: !result.success ? stderr || "Command failed" : "",
             stdout,
-            stderr: result.stderr || "",
+            stderr,
             command,
             outputFile
           };
@@ -118430,14 +118800,15 @@ IMPORTANT: Always analyze results and adjust your approach based on findings.`,
       if (ctx.persistentShell) {
         try {
           const normalizedTimeout = normalizeExecuteCommandTimeout(timeout);
-          const onData = ctx.eventBus ? (data) => ctx.eventBus.emit("command-output", { data }) : undefined;
-          const result = await ctx.persistentShell.execute(effectiveCommand, normalizedTimeout, onData, ctx.abortSignal);
-          const { text: stdout, file: outputFile } = maybeSaveFullOutput(result.stdout, ctx);
+          const onData = ctx.eventBus ? (data) => ctx.eventBus?.emit("command-output", { data: redact(data) }) : undefined;
+          const result = await ctx.persistentShell.execute(wrapCommandWithEnv(commandWithHeaders, promptInjectionEnvVars), normalizedTimeout, onData, ctx.abortSignal);
+          const { text: stdout, file: outputFile } = maybeSaveFullOutput(redact(result.stdout), ctx);
+          const stderr = redact(result.stderr);
           return {
             success: result.exitCode === 0,
             error: result.exitCode === 124 ? "Command timed out" : result.exitCode !== 0 ? `Exit code: ${result.exitCode}` : "",
             stdout,
-            stderr: result.stderr,
+            stderr,
             command,
             outputFile
           };
@@ -118654,7 +119025,7 @@ BEST PRACTICES:
 // src/core/agents/offSecAgent/tools/grep.ts
 init_dist();
 init_zod();
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn3 } from "node:child_process";
 var grepInputSchema = exports_external.object({
   pattern: exports_external.string().describe("The pattern to search for"),
   directory: exports_external.string().optional().describe("Directory or file path to search in (defaults to current working directory)"),
@@ -118698,7 +119069,7 @@ search with flags or a more specific directory if results are truncated.`,
       const defaultFlags = hasRecursive ? [] : ["-r"];
       const args = [...defaultFlags, ...userFlags, "--", pattern, dir];
       const command = `grep ${args.join(" ")}`;
-      return new Promise((resolve2) => {
+      return new Promise((resolve3) => {
         const child = spawn3("grep", args, {
           cwd,
           stdio: ["ignore", "pipe", "pipe"]
@@ -118712,7 +119083,7 @@ search with flags or a more specific directory if results are truncated.`,
           ctx.abortSignal.addEventListener("abort", abortHandler, {
             once: true
           });
-          abortCleanup = () => ctx.abortSignal.removeEventListener("abort", abortHandler);
+          abortCleanup = () => ctx.abortSignal?.removeEventListener("abort", abortHandler);
         }
         const safeResolve = (result) => {
           if (resolved)
@@ -118720,7 +119091,7 @@ search with flags or a more specific directory if results are truncated.`,
           resolved = true;
           clearTimeout(timeout);
           abortCleanup?.();
-          resolve2(result);
+          resolve3(result);
         };
         const timeout = setTimeout(() => {
           child.kill("SIGTERM");
@@ -118764,28 +119135,44 @@ search with flags or a more specific directory if results are truncated.`,
 // src/core/agents/offSecAgent/tools/httpRequest.ts
 init_dist();
 init_zod();
-import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync12 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { join as join16 } from "node:path";
 var MAX_INLINE_BODY = 5000;
+var promptInjectionRefSchema = exports_external.object({
+  kind: exports_external.literal("prompt_injection_ref"),
+  id: exports_external.string().describe("Stable prompt-injection id returned by list_prompt_injections")
+});
 var httpRequestInputSchema = exports_external.object({
   url: exports_external.string().describe("The URL to request"),
   method: exports_external.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]).default("GET"),
   headers: exports_external.string().optional().describe(`HTTP headers as a JSON-encoded object string, e.g. '{"Content-Type": "application/json", "Authorization": "Bearer token"}'`),
-  body: exports_external.string().optional().describe("Request body (for POST, PUT, PATCH)"),
+  body: exports_external.union([exports_external.string(), promptInjectionRefSchema]).optional().describe("Request body (for POST, PUT, PATCH). To use a hidden prompt-injection payload, pass a PromptInjectionRef object instead of raw payload text."),
   followRedirects: exports_external.boolean().default(false).describe("Whether to follow HTTP redirects (3xx). Defaults to false so you can see redirect responses with Location and Set-Cookie headers."),
   timeout: exports_external.number().default(1e4),
   toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing (e.g., 'Testing SQL injection on login endpoint')")
 });
+function containsPromptInjectionRef(value) {
+  if (typeof value === "object" && value !== null && value.kind === "prompt_injection_ref") {
+    return true;
+  }
+  if (Array.isArray(value)) {
+    return value.some((item) => containsPromptInjectionRef(item));
+  }
+  if (typeof value === "object" && value !== null) {
+    return Object.values(value).some((nested) => containsPromptInjectionRef(nested));
+  }
+  return false;
+}
 function maybeSaveBody(body, ctx) {
   if (body.length <= MAX_INLINE_BODY)
     return { text: body };
-  const outputDir = join14(ctx.session.logsPath, "http-responses");
+  const outputDir = join16(ctx.session.logsPath, "http-responses");
   if (!existsSync10(outputDir)) {
     mkdirSync9(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `response-${ts}.txt`;
-  const filePath = join14(outputDir, filename);
+  const filePath = join16(outputDir, filename);
   try {
     writeFileSync12(filePath, body);
   } catch {
@@ -118868,16 +119255,39 @@ COMMON TESTING PATTERNS:
         }
         throw e;
       }
-      const headers = parseHeaders(rawHeaders);
+      let headers = parseHeaders(rawHeaders);
+      let resolvedBody;
+      let library = EMPTY_PROMPT_INJECTION_LIBRARY;
+      try {
+        const needsLibrary = containsPromptInjectionRef(body) || containsPromptInjectionRef(headers);
+        library = needsLibrary ? await getPromptInjectionLibrary({
+          library: ctx.promptInjectionLibrary,
+          source: ctx.promptInjectionLibrarySource
+        }) : EMPTY_PROMPT_INJECTION_LIBRARY;
+        headers = resolvePromptInjectionRefs(headers, library);
+        resolvedBody = body === undefined ? undefined : String(resolvePromptInjectionRefs(body, library));
+      } catch (e) {
+        return {
+          success: false,
+          error: e instanceof Error ? e.message : String(e),
+          url,
+          method,
+          status: 0,
+          statusText: "",
+          headers: {},
+          body: "",
+          redirected: false
+        };
+      }
       if (ctx.sandbox) {
         return executeSandboxHttpRequest(ctx, {
           url,
           method,
           headers,
-          body,
+          body: resolvedBody,
           followRedirects,
           timeout
-        });
+        }, library);
       }
       let timeoutId;
       try {
@@ -118900,7 +119310,7 @@ COMMON TESTING PATTERNS:
         const response = await targetFetch(resolverSessionFromCtx(ctx), url, {
           method,
           headers,
-          body: body || undefined,
+          body: resolvedBody || undefined,
           redirect: followRedirects ? "follow" : "manual",
           signal: combinedSignal
         });
@@ -118915,12 +119325,17 @@ COMMON TESTING PATTERNS:
         } catch {
           responseBody = "(unable to read response body)";
         }
-        const { text: truncatedBody } = maybeSaveBody(responseBody, ctx);
+        const redactedBody = redactPromptInjectionPayloads(responseBody, library);
+        const redactedHeaders = Object.fromEntries(Object.entries(responseHeaders).map(([key, value]) => [
+          key,
+          redactPromptInjectionPayloads(value, library)
+        ]));
+        const { text: truncatedBody } = maybeSaveBody(redactedBody, ctx);
         return {
           success: true,
           status: response.status,
           statusText: response.statusText,
-          headers: responseHeaders,
+          headers: redactedHeaders,
           body: truncatedBody,
           url: response.url,
           redirected: response.redirected
@@ -118945,7 +119360,7 @@ COMMON TESTING PATTERNS:
     }
   });
 }
-async function executeSandboxHttpRequest(ctx, opts) {
+async function executeSandboxHttpRequest(ctx, opts, library) {
   const { url, method, headers, body, followRedirects, timeout } = opts;
   try {
     let curlCommand = `curl -i -X ${method}`;
@@ -118953,9 +119368,30 @@ async function executeSandboxHttpRequest(ctx, opts) {
     for (const [key, value] of Object.entries(mergedHeaders)) {
       curlCommand += ` -H "${shellQuote(`${key}: ${value}`)}"`;
     }
+    const { sandbox } = ctx;
+    if (!sandbox) {
+      throw new Error("executeSandboxHttpRequest requires a sandbox");
+    }
+    let bodyTempFile = null;
     if (body && ["POST", "PUT", "PATCH"].includes(method)) {
-      const escapedBody = body.replace(/"/g, "\\\"").replace(/\$/g, "\\$");
-      curlCommand += ` -d "${escapedBody}"`;
+      bodyTempFile = `/tmp/apex_http_body_${Date.now()}_${Math.random().toString(36).slice(2, 11)}.txt`;
+      const escapedForPrintf = body.replace(/\\/g, "\\\\").replace(/%/g, "%%");
+      const writeCommand = `printf '%s' '${escapedForPrintf.replace(/'/g, "'\\''")}' > ${bodyTempFile}`;
+      const writeResult = await sandbox.execute(writeCommand, { timeout: 30 });
+      if (!writeResult.success || writeResult.exitCode !== 0) {
+        return {
+          success: false,
+          error: `Failed to write request body to sandbox temp file: ${writeResult.stderr || writeResult.stdout}`,
+          url,
+          method,
+          status: 0,
+          statusText: "",
+          headers: {},
+          body: "",
+          redirected: false
+        };
+      }
+      curlCommand += ` --data-binary @${bodyTempFile}`;
     }
     if (followRedirects) {
       curlCommand += " -L";
@@ -118964,7 +119400,7 @@ async function executeSandboxHttpRequest(ctx, opts) {
     curlCommand += ` --max-time ${timeoutSeconds}`;
     curlCommand += ` "${url}" 2>&1`;
     const ssmTimeout = Math.max(timeoutSeconds, 30);
-    const result = await ctx.sandbox.execute(curlCommand, {
+    const result = await sandbox.execute(curlCommand, {
       timeout: ssmTimeout
     });
     const output = result.stdout || "";
@@ -118991,16 +119427,21 @@ async function executeSandboxHttpRequest(ctx, opts) {
       }
     }
     const statusMatch = statusLine.match(/HTTP\/[\d.]+\s+(\d+)\s+(.+)/);
-    const status = statusMatch ? parseInt(statusMatch[1]) : 0;
+    const status = statusMatch ? parseInt(statusMatch[1], 10) : 0;
     const statusText = statusMatch ? statusMatch[2] : "Unknown";
     const responseBody = lines.slice(bodyStartIndex).join(`
 `);
-    const { text: truncatedBody } = maybeSaveBody(responseBody, ctx);
+    const redactedBody = redactPromptInjectionPayloads(responseBody, library);
+    const redactedHeaders = Object.fromEntries(Object.entries(responseHeaders).map(([key, value]) => [
+      key,
+      redactPromptInjectionPayloads(value, library)
+    ]));
+    const { text: truncatedBody } = maybeSaveBody(redactedBody, ctx);
     return {
       success: status >= 200 && status < 400,
       status,
       statusText,
-      headers: responseHeaders,
+      headers: redactedHeaders,
       body: truncatedBody,
       url,
       redirected: false
@@ -119023,8 +119464,8 @@ async function executeSandboxHttpRequest(ctx, opts) {
 // src/core/agents/offSecAgent/tools/listFiles.ts
 init_dist();
 init_zod();
-import { readdir, stat } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join15, relative, resolve as resolve2 } from "path";
+import { readdir, stat } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join17, relative as relative2, resolve as resolve3 } from "node:path";
 var listFilesInputSchema = exports_external.object({
   directory: exports_external.string().optional().describe("Absolute or relative path to the directory to list (defaults to current working directory)"),
   recursive: exports_external.boolean().optional().describe("If true, list files recursively (default: false)"),
@@ -119044,7 +119485,7 @@ async function listRecursive(dir, maxEntries) {
     }
     for (const entry of entries) {
       total++;
-      const fullPath = join15(current, entry.name);
+      const fullPath = join17(current, entry.name);
       if (entry.isDirectory()) {
         if (results.length < maxEntries)
           results.push(`${fullPath}/`);
@@ -119061,7 +119502,7 @@ async function listRecursive(dir, maxEntries) {
 function toRelative(base, paths) {
   return paths.map((p) => {
     const isDir = p.endsWith("/");
-    const rel = relative(base, isDir ? p.slice(0, -1) : p);
+    const rel = relative2(base, isDir ? p.slice(0, -1) : p);
     return isDir ? `${rel}/` : rel;
   });
 }
@@ -119081,7 +119522,7 @@ Each directory entry is suffixed with "/" for easy identification.`,
       directory,
       recursive = false
     }) => {
-      const dir = directory ? isAbsolute2(directory) ? directory : resolve2(ctx.agentCwd, directory) : ctx.agentCwd;
+      const dir = directory ? isAbsolute3(directory) ? directory : resolve3(ctx.agentCwd, directory) : ctx.agentCwd;
       try {
         const info = await stat(dir);
         if (!info.isDirectory()) {
@@ -119107,7 +119548,7 @@ Each directory entry is suffixed with "/" for easy identification.`,
         }
         const entries = await readdir(dir, { withFileTypes: true });
         const fullPaths = entries.map((e) => {
-          const name = join15(dir, e.name);
+          const name = join17(dir, e.name);
           return e.isDirectory() ? `${name}/` : name;
         });
         const capped = fullPaths.slice(0, MAX_NON_RECURSIVE);
@@ -119237,38 +119678,38 @@ Returns tasks sorted by ID with per-status counts.`,
 }
 
 // src/core/agents/offSecAgent/tools/persistentShell.ts
-import { spawn as spawn4, spawnSync } from "child_process";
-import { randomBytes } from "crypto";
+import { spawn as spawn4, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import {
   closeSync,
   mkdirSync as mkdirSync10,
   openSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   readSync,
-  statSync as statSync2,
+  statSync as statSync3,
   unlinkSync as unlinkSync2
-} from "fs";
-import { tmpdir } from "os";
-import { join as join16 } from "path";
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join18 } from "node:path";
 var MAX_BUFFER = 5000000;
-var APEX_TMP_ROOT = join16(tmpdir(), `apex-shell-${process.pid}`);
+var APEX_TMP_ROOT = join18(tmpdir(), `apex-shell-${process.pid}`);
 try {
   mkdirSync10(APEX_TMP_ROOT, { recursive: true });
 } catch {}
 function readTempfileCapped(path) {
   try {
-    const stat2 = statSync2(path);
+    const stat2 = statSync3(path);
     if (stat2.size === 0)
       return "";
     if (stat2.size <= MAX_BUFFER) {
-      return readFileSync2(path, "utf-8");
+      return readFileSync3(path, "utf-8");
     }
     const fd = openSync(path, "r");
     try {
       const buf = Buffer.alloc(MAX_BUFFER);
       readSync(fd, buf, 0, MAX_BUFFER, stat2.size - MAX_BUFFER);
       return `(stdout truncated)...
-` + buf.toString("utf-8");
+${buf.toString("utf-8")}`;
     } finally {
       closeSync(fd);
     }
@@ -119426,16 +119867,16 @@ class PersistentShell {
       let commandOutput = cmd.authoritativeStdout.substring(0, markerIdx);
       if (cmd.stdoutTruncated) {
         commandOutput = `(stdout truncated)...
-` + commandOutput;
+${commandOutput}`;
       }
-      const effectiveExit = cmd.forcedExitCode != null ? cmd.forcedExitCode : isNaN(naturalExitCode) ? 1 : naturalExitCode;
+      const effectiveExit = cmd.forcedExitCode != null ? cmd.forcedExitCode : Number.isNaN(naturalExitCode) ? 1 : naturalExitCode;
       const effectiveStderr = cmd.forcedStderrSuffix ? (cmd.stderr || "") + cmd.forcedStderrSuffix : cmd.stderr || "";
       unlinkSafe(cmd.outPath);
       unlinkSafe(cmd.errPath);
-      const resolve3 = cmd.resolve;
+      const resolve4 = cmd.resolve;
       this.current = null;
       this.pendingCancel = null;
-      resolve3({
+      resolve4({
         stdout: commandOutput || "(no output)",
         stderr: effectiveStderr,
         exitCode: effectiveExit
@@ -119471,7 +119912,7 @@ class PersistentShell {
     }
     cmd.stderr += chunk;
     if (cmd.stderr.length > MAX_BUFFER) {
-      cmd.stderr = cmd.stderr.substring(0, MAX_BUFFER) + `...
+      cmd.stderr = `${cmd.stderr.substring(0, MAX_BUFFER)}...
 (stderr truncated)`;
     }
   }
@@ -119492,10 +119933,10 @@ class PersistentShell {
       }
       this.ensureAlive();
       const proc = this.proc;
-      if (!proc || !proc.stdin || !proc.stdout || !proc.stderr) {
+      if (!proc?.stdin || !proc.stdout || !proc.stderr) {
         return { stdout: "", stderr: "Failed to spawn shell", exitCode: 1 };
       }
-      return await new Promise((resolve3) => {
+      return await new Promise((resolve4) => {
         let resolved = false;
         let timeoutTimer;
         let abortCleanup;
@@ -119503,8 +119944,8 @@ class PersistentShell {
         const marker = `__APEX_${nonceHex}__`;
         const exitMarkerPrefix = `${marker}_EXIT_`;
         const cutoverMarker = `${marker}_CUTOVER`;
-        const outPath = join16(APEX_TMP_ROOT, `${nonceHex}.out`);
-        const errPath = join16(APEX_TMP_ROOT, `${nonceHex}.err`);
+        const outPath = join18(APEX_TMP_ROOT, `${nonceHex}.out`);
+        const errPath = join18(APEX_TMP_ROOT, `${nonceHex}.err`);
         const pending = {
           streamedStdout: "",
           authoritativeStdout: "",
@@ -119531,7 +119972,7 @@ class PersistentShell {
             pending._activeSalvageId = undefined;
             if (abortCleanup)
               abortCleanup();
-            resolve3(result);
+            resolve4(result);
           }
         };
         this.current = pending;
@@ -119581,7 +120022,7 @@ class PersistentShell {
         ].join(`
 `);
         try {
-          proc.stdin.write(wrapped);
+          proc.stdin?.write(wrapped);
         } catch {
           pending.resolve({
             stdout: "",
@@ -119922,8 +120363,8 @@ Returns discovered endpoints and recommended login approach.`,
 // src/core/agents/offSecAgent/tools/provideComparisonResults.ts
 init_dist();
 init_zod();
-import { writeFileSync as writeFileSync13 } from "fs";
-import { join as join17 } from "path";
+import { writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join19 } from "node:path";
 function provideComparisonResults(ctx) {
   return tool({
     description: `Provide the final comparison results with matched, missed, and extra findings.
@@ -119969,7 +120410,7 @@ Results will be saved to: comparison-results.json in the session directory.`,
         recall,
         precision
       };
-      const resultsPath = join17(ctx.session.rootPath, "comparison-results.json");
+      const resultsPath = join19(ctx.session.rootPath, "comparison-results.json");
       writeFileSync13(resultsPath, JSON.stringify(result, null, 2));
       return {
         success: true,
@@ -119983,8 +120424,8 @@ Results will be saved to: comparison-results.json in the session directory.`,
 // src/core/agents/offSecAgent/tools/readFile.ts
 init_dist();
 init_zod();
-import { readFile as fsReadFile } from "fs/promises";
-import { isAbsolute as isAbsolute3, resolve as resolve3 } from "path";
+import { readFile as fsReadFile } from "node:fs/promises";
+import { isAbsolute as isAbsolute4, resolve as resolve4 } from "node:path";
 var readFileInputSchema = exports_external.object({
   path: exports_external.string().describe("Absolute or relative path to the file to read. Must be a file, not a directory."),
   startLine: exports_external.number().optional().describe("1-based line number to start reading from (inclusive)"),
@@ -120002,7 +120443,7 @@ the end. If only endLine is given, reads from the beginning to that line.
 Output lines are prefixed with their line number for easy reference.`,
     inputSchema: readFileInputSchema,
     execute: async ({ path, startLine, endLine }) => {
-      const resolved = isAbsolute3(path) ? path : resolve3(ctx.agentCwd, path);
+      const resolved = isAbsolute4(path) ? path : resolve4(ctx.agentCwd, path);
       try {
         const raw = await fsReadFile(resolved, "utf-8");
         const allLines = raw.split(`
@@ -120123,7 +120564,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
       });
       if (cwd) {
         try {
-          const { WhiteboxAttackSurfaceAgent } = await import("./index-3cbcjqw1.js");
+          const { WhiteboxAttackSurfaceAgent } = await import("./index-speg9ebc.js");
           const localBus = new AgentEventBus;
           AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
           const agent = new WhiteboxAttackSurfaceAgent({
@@ -120173,7 +120614,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
         }
       }
       try {
-        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-sgph70e4.js");
+        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-80y8j499.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const agent = new BlackboxAttackSurfaceAgent({
@@ -120251,7 +120692,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ target, cwd }) => {
-      const { runPentestWorkflow: workflow } = await import("./pentest-2vsjf0j8.js");
+      const { runPentestWorkflow: workflow } = await import("./pentest-4v06edvf.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -120317,9 +120758,9 @@ async function runWithBoundedConcurrency(items, concurrency, fn, abortSignal) {
   const parentContext = import_api.context.active();
   let nextIdx = 0;
   let completed = 0;
-  await new Promise((resolve4) => {
+  await new Promise((resolve5) => {
     if (items.length === 0) {
-      resolve4();
+      resolve5();
       return;
     }
     let active = 0;
@@ -120328,7 +120769,7 @@ async function runWithBoundedConcurrency(items, concurrency, fn, abortSignal) {
     }
     function next() {
       if (completed >= nextIdx && !canLaunchMore()) {
-        resolve4();
+        resolve5();
         return;
       }
       while (canLaunchMore()) {
@@ -120356,29 +120797,29 @@ init_zod();
 
 // src/core/whitebox/adapters.ts
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/core/whitebox/artifacts.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, join as join18 } from "node:path";
+import { basename as basename2, join as join20 } from "node:path";
 
 // src/core/whitebox/paths.ts
 import { existsSync as existsSync11, realpathSync } from "node:fs";
-import { isAbsolute as isAbsolute4, normalize, relative as relative2, resolve as resolve4 } from "node:path";
+import { isAbsolute as isAbsolute5, normalize, relative as relative3, resolve as resolve5 } from "node:path";
 function resolveWhiteboxCodebaseRoot(input) {
-  return resolve4(normalize(input.codebasePath ?? input.agentCwd));
+  return resolve5(normalize(input.codebasePath ?? input.agentCwd));
 }
 function isUnderRoot(root, candidate) {
-  const rel = relative2(root, candidate);
+  const rel = relative3(root, candidate);
   if (rel === "")
     return true;
-  if (rel.startsWith("..") || isAbsolute4(rel))
+  if (rel.startsWith("..") || isAbsolute5(rel))
     return false;
   return true;
 }
 function resolvePathWithinCodebaseRoot(root, subPath = ".") {
-  const absRoot = resolve4(normalize(root));
-  const candidate = isAbsolute4(subPath) ? resolve4(normalize(subPath)) : resolve4(absRoot, normalize(subPath));
+  const absRoot = resolve5(normalize(root));
+  const candidate = isAbsolute5(subPath) ? resolve5(normalize(subPath)) : resolve5(absRoot, normalize(subPath));
   if (!isUnderRoot(absRoot, candidate)) {
     throw new Error(`Path escapes codebase root: ${subPath}`);
   }
@@ -120401,8 +120842,8 @@ function resolveSessionWhiteboxArtifactPath(input) {
   if (!allowed) {
     throw new Error(`Artifact path must start with logs/whitebox/ or scratchpad/whitebox/: ${input.artifactRelativePath}`);
   }
-  const resolved = resolve4(input.sessionRootPath, posixPath);
-  if (!isUnderRoot(resolve4(input.sessionRootPath), resolved)) {
+  const resolved = resolve5(input.sessionRootPath, posixPath);
+  if (!isUnderRoot(resolve5(input.sessionRootPath), resolved)) {
     throw new Error("Invalid artifact path");
   }
   if (existsSync11(resolved)) {
@@ -120421,10 +120862,10 @@ function safeName(value) {
   return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/\.{2,}/g, ".").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function getWhiteboxLogsDir(session) {
-  return join18(session.logsPath, "whitebox");
+  return join20(session.logsPath, "whitebox");
 }
 function getWhiteboxScratchDir(session) {
-  return join18(session.scratchpadPath, "whitebox");
+  return join20(session.scratchpadPath, "whitebox");
 }
 async function ensureWhiteboxDirs(session) {
   await Promise.all([
@@ -120437,7 +120878,7 @@ async function writeWhiteboxArtifact(input) {
   const baseDir = input.area === "scratchpad" ? getWhiteboxScratchDir(input.session) : getWhiteboxLogsDir(input.session);
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `${timestamp}-${safeName(input.name)}${input.extension ?? ".txt"}`;
-  const absolutePath = join18(baseDir, filename);
+  const absolutePath = join20(baseDir, filename);
   await writeFile2(absolutePath, input.content, "utf-8");
   const relativeRoot = input.area === "scratchpad" ? "scratchpad/whitebox" : "logs/whitebox";
   return {
@@ -120490,7 +120931,7 @@ async function runSpawnBounded(input) {
     };
   }
   const detached = input.detached === true && process.platform !== "win32";
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     const child = spawn5(program, input.command.slice(1), {
       cwd: input.cwd,
       stdio: ["ignore", "pipe", "pipe"],
@@ -120512,7 +120953,7 @@ async function runSpawnBounded(input) {
         clearTimeout(timeoutTimer);
       if (escalateTimer)
         clearTimeout(escalateTimer);
-      resolve5(result);
+      resolve6(result);
     };
     const append = (target, data) => {
       if (totalBytes >= input.maxTotalBytes) {
@@ -120679,7 +121120,7 @@ var WHITEBOX_SCAN_ADAPTERS = [
     id: "npm-audit",
     kind: "dependencies",
     tool: "npm",
-    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join19(profile.rootPath, "package-lock.json"))),
+    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join21(profile.rootPath, "package-lock.json"))),
     buildCommand: () => ["npm", "audit", "--json"],
     parseSummary: (raw) => simpleLineFindings("npm audit", raw)
   },
@@ -120788,15 +121229,15 @@ ${raw.stderr}` : "");
 // src/core/whitebox/candidates.ts
 import { existsSync as existsSync13 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join20 } from "node:path";
+import { join as join22 } from "node:path";
 var CANDIDATES_FILE = "candidates.json";
 var writeLocks = new Map;
 function withCandidateLock(session, fn) {
   const key = session.scratchpadPath;
   const prev = writeLocks.get(key) ?? Promise.resolve();
   let release;
-  const gate = new Promise((resolve5) => {
-    release = resolve5;
+  const gate = new Promise((resolve6) => {
+    release = resolve6;
   });
   writeLocks.set(key, gate);
   return prev.then(fn).finally(() => {
@@ -120815,10 +121256,10 @@ var ALLOWED_TRANSITIONS = {
   deferred: ["hypothesis", "investigating"]
 };
 function candidatesDir(session) {
-  return join20(session.scratchpadPath, "whitebox");
+  return join22(session.scratchpadPath, "whitebox");
 }
 function candidatesPath(session) {
-  return join20(candidatesDir(session), CANDIDATES_FILE);
+  return join22(candidatesDir(session), CANDIDATES_FILE);
 }
 function makeId2(title) {
   const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 48);
@@ -121284,11 +121725,11 @@ import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync11,
   openSync as openSync2,
-  readFileSync as readFileSync3,
+  readFileSync as readFileSync4,
   readSync as readSync2,
-  statSync as statSync3
+  statSync as statSync4
 } from "node:fs";
-import { join as join21 } from "node:path";
+import { join as join23 } from "node:path";
 var MAX_JOB_LOG_INLINE = 40000;
 var MAX_JOB_LOG_BYTES = 10 * 1024 * 1024;
 var PRUNE_AFTER_MS = 60000;
@@ -121363,7 +121804,7 @@ function startWhiteboxJob(input) {
   const logsDir = getWhiteboxLogsDir(input.session);
   mkdirSync11(logsDir, { recursive: true });
   const safeName2 = (input.name ?? "job").replace(/[^a-z0-9._-]+/gi, "-").replace(/\.{2,}/g, ".");
-  const logPath = join21(logsDir, `${id}-${safeName2}.log`);
+  const logPath = join23(logsDir, `${id}-${safeName2}.log`);
   const now = new Date().toISOString();
   writeLog(logPath, `$ ${input.command}
 
@@ -121467,9 +121908,9 @@ function readWhiteboxJobLog(id, sessionId) {
   if (!record3 || !existsSync14(record3.logPath)) {
     return { content: "", truncated: false, record: record3 };
   }
-  const fileSize = statSync3(record3.logPath).size;
+  const fileSize = statSync4(record3.logPath).size;
   if (fileSize <= MAX_JOB_LOG_INLINE) {
-    const raw = readFileSync3(record3.logPath, "utf-8");
+    const raw = readFileSync4(record3.logPath, "utf-8");
     return { content: raw, truncated: false, record: record3 };
   }
   const readBytes = Math.min(fileSize, MAX_JOB_LOG_INLINE);
@@ -121489,12 +121930,12 @@ function readWhiteboxJobLog(id, sessionId) {
   };
 }
 // src/core/whitebox/repoProfile.ts
-import { execFile } from "node:child_process";
+import { execFile as execFile2 } from "node:child_process";
 import { existsSync as existsSync15, realpathSync as realpathSync2 } from "node:fs";
 import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, extname as extname2, join as join22, relative as relative3, resolve as resolve5 } from "node:path";
-import { promisify } from "node:util";
-var execFileAsync = promisify(execFile);
+import { basename as basename3, extname as extname2, join as join24, relative as relative4, resolve as resolve6 } from "node:path";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
 var MAX_PROFILE_FILES = 5000;
 var LANGUAGE_BY_EXTENSION = {
   ".ts": "typescript",
@@ -121580,7 +122021,7 @@ function shouldSkipDir(name) {
 }
 async function walkFiles(rootPath) {
   const files = [];
-  const absRoot = resolve5(rootPath);
+  const absRoot = resolve6(rootPath);
   function isWithinRoot(path) {
     try {
       const real = realpathSync2(path);
@@ -121601,7 +122042,7 @@ async function walkFiles(rootPath) {
     for (const entry of entries) {
       if (files.length >= MAX_PROFILE_FILES)
         return;
-      const fullPath = join22(current, entry.name);
+      const fullPath = join24(current, entry.name);
       if (entry.isDirectory()) {
         if (shouldSkipDir(entry.name))
           continue;
@@ -121611,7 +122052,7 @@ async function walkFiles(rootPath) {
         continue;
       }
       if (entry.isFile()) {
-        files.push(relative3(rootPath, fullPath));
+        files.push(relative4(rootPath, fullPath));
       }
     }
   }
@@ -121663,7 +122104,7 @@ function detectEntryHints(files) {
   return hints.slice(0, 100);
 }
 async function readPackageScripts(rootPath) {
-  const packageJsonPath = join22(rootPath, "package.json");
+  const packageJsonPath = join24(rootPath, "package.json");
   if (!existsSync15(packageJsonPath)) {
     return { buildCommands: [], testCommands: [], runCommands: [] };
   }
@@ -121682,7 +122123,7 @@ async function readPackageScripts(rootPath) {
 }
 async function runGit(rootPath, args) {
   try {
-    const { stdout } = await execFileAsync("git", args, {
+    const { stdout } = await execFileAsync2("git", args, {
       cwd: rootPath,
       timeout: 5000,
       maxBuffer: 1024 * 1024
@@ -121695,7 +122136,7 @@ async function runGit(rootPath, args) {
 async function detectTool(name) {
   const cmd = process.platform === "win32" ? "where" : "which";
   try {
-    const { stdout } = await execFileAsync(cmd, [name], {
+    const { stdout } = await execFileAsync2(cmd, [name], {
       timeout: 2000,
       maxBuffer: 1024 * 64
     });
@@ -121827,7 +122268,7 @@ Returns an array of results with the text output from each agent.`,
   });
 }
 async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
-  const { CodeAgent } = await import("./agent-4g69jwmq.js");
+  const { CodeAgent } = await import("./agent-m3bsrs09.js");
   const subagentId = `coding-agent-${agentIndex}`;
   ctx.eventBus?.emit("subagent-spawn", {
     subagentId,
@@ -121876,8 +122317,8 @@ init_zod();
 init_ai();
 init_structured();
 init_lazyLogger();
-import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync4 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync16, readdirSync as readdirSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join25 } from "node:path";
 var log9 = scopedLogger(() => createLogger("findings:registry"));
 var VULN_CLASS_PATTERNS = [
   [/sql\s*injection/i, "sql-injection"],
@@ -122000,6 +122441,15 @@ ${existingList}
 
 Is the new finding a duplicate of any existing finding?`;
 }
+var SEVERITY_RANK = {
+  CRITICAL: 4,
+  HIGH: 3,
+  MEDIUM: 2,
+  LOW: 1
+};
+function maxSeverity(severities) {
+  return severities.reduce((acc, s) => SEVERITY_RANK[s] > SEVERITY_RANK[acc] ? s : acc, "LOW");
+}
 var RootCauseGroupResultSchema = exports_external.object({
   groups: exports_external.array(exports_external.object({
     groupId: exports_external.string().describe("Short kebab-case identifier for the group"),
@@ -122060,7 +122510,7 @@ class FindingsRegistry {
     log9.debug(`fromDirectory: path=${findingsPath}, jsonFiles=${files.length}`);
     for (const file of files) {
       try {
-        const raw = readFileSync4(join23(findingsPath, file), "utf-8");
+        const raw = readFileSync5(join25(findingsPath, file), "utf-8");
         const finding = JSON.parse(raw);
         if (finding && typeof finding.title === "string" && typeof finding.endpoint === "string") {
           registry.indexFinding(finding);
@@ -122104,19 +122554,19 @@ class FindingsRegistry {
   }
   async register(finding) {
     log9.debug(`register: checking "${finding.title}" endpoint="${finding.endpoint}"`);
-    const fastResult = await new Promise((resolve6) => {
+    const fastResult = await new Promise((resolve7) => {
       this.mutex = this.mutex.then(() => {
         const check = this.isDuplicate(finding);
         if (check.duplicate) {
           log9.debug(`register: DUPLICATE (${check.matchType}) "${finding.title}" matched="${check.matchedFinding?.title}"`);
-          resolve6(check);
+          resolve7(check);
         } else if (!this.model || this.findings.length === 0) {
           this.indexFinding(finding);
           log9.debug(`register: UNIQUE (Tier 1+2, no LLM needed) "${finding.title}" — registry size=${this.size}`);
-          resolve6({ duplicate: false });
+          resolve7({ duplicate: false });
         } else {
           log9.debug(`register: Tier 1+2 pass — proceeding to Tier 3 LLM check for "${finding.title}"`);
-          resolve6(null);
+          resolve7(null);
         }
       });
     });
@@ -122133,16 +122583,16 @@ class FindingsRegistry {
       log9.debug(`register: DUPLICATE (semantic/Tier 3) "${finding.title}" matched="${semanticResult.matchedFinding?.title}"`);
       return semanticResult;
     }
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       this.mutex = this.mutex.then(() => {
         const recheck = this.isDuplicate(finding);
         if (recheck.duplicate) {
           log9.debug(`register: DUPLICATE (race re-check, ${recheck.matchType}) "${finding.title}" matched="${recheck.matchedFinding?.title}"`);
-          resolve6(recheck);
+          resolve7(recheck);
         } else {
           this.indexFinding(finding);
           log9.debug(`register: UNIQUE (all tiers passed) "${finding.title}" — registry size=${this.size}`);
-          resolve6({ duplicate: false });
+          resolve7({ duplicate: false });
         }
       });
     });
@@ -122174,10 +122624,10 @@ class FindingsRegistry {
     return { duplicate: false };
   }
   async unregister(finding) {
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       this.mutex = this.mutex.then(() => {
         this.removeFinding(finding);
-        resolve6();
+        resolve7();
       });
     });
   }
@@ -122202,24 +122652,38 @@ class FindingsRegistry {
       return [];
     }
     const sanitised = [];
-    await new Promise((resolve6) => {
+    await new Promise((resolve7) => {
       this.mutex = this.mutex.then(() => {
+        const baseSeverities = snapshot.map((f) => f.severity);
         for (const group of result.groups) {
           const validIndices = group.findingIndices.filter((i) => i >= 0 && i < snapshot.length);
           if (validIndices.length < 2)
             continue;
+          const normalizedSeverity = maxSeverity(validIndices.map((i) => baseSeverities[i]));
+          const leadFindingIndex = validIndices.reduce((best, i) => {
+            const aRank = SEVERITY_RANK[baseSeverities[i]];
+            const bRank = SEVERITY_RANK[baseSeverities[best]];
+            if (aRank !== bRank) {
+              return aRank > bRank ? i : best;
+            }
+            return (snapshot[i].description?.length ?? 0) > (snapshot[best].description?.length ?? 0) ? i : best;
+          }, validIndices[0]);
           sanitised.push({
             groupId: group.groupId,
             findingIndices: validIndices,
-            rootCause: group.rootCause
+            rootCause: group.rootCause,
+            normalizedSeverity,
+            leadFindingIndex
           });
           for (const idx of validIndices) {
             const finding = snapshot[idx];
             finding.rootCauseGroup = group.groupId;
-            finding.relatedFindings = validIndices.filter((i) => i !== idx).map((i) => snapshot[i].title);
+            finding.severity = normalizedSeverity;
+            finding.rootCauseLead = idx === leadFindingIndex;
+            finding.relatedFindings = validIndices.filter((i) => i !== idx).map((i) => snapshot[i]?.title);
           }
         }
-        resolve6();
+        resolve7();
       });
     });
     return sanitised;
@@ -122250,19 +122714,19 @@ class FindingsRegistry {
 }
 
 // src/core/plan/index.ts
-import { existsSync as existsSync17, readFileSync as readFileSync5 } from "fs";
-import { join as join24 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync6 } from "node:fs";
+import { join as join26 } from "node:path";
 var PLAN_FILENAME = "plan.md";
 function planFilePath(sessionRootPath, subagentId) {
   if (subagentId) {
-    return join24(sessionRootPath, "subagents", `${subagentId}-plan.md`);
+    return join26(sessionRootPath, "subagents", `${subagentId}-plan.md`);
   }
-  return join24(sessionRootPath, PLAN_FILENAME);
+  return join26(sessionRootPath, PLAN_FILENAME);
 }
 function readPlan(sessionRootPath, subagentId) {
   const path = planFilePath(sessionRootPath, subagentId);
   try {
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   } catch {
     return null;
   }
@@ -122310,7 +122774,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
           message: "spawn_pentest_agent requires a model in the tool context."
         };
       }
-      const { TargetedPentestAgent } = await import("./agent-x7n47c84.js");
+      const { TargetedPentestAgent } = await import("./agent-067x1n67.js");
       const findingsRegistry = ctx.findingsRegistry ?? FindingsRegistry.fromDirectory(ctx.session.findingsPath, {
         model: ctx.model,
         authConfig: ctx.authConfig,
@@ -122464,7 +122928,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ targets }) => {
-      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-2vsjf0j8.js");
+      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-4v06edvf.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -122532,7 +122996,7 @@ Only call this when the plan is complete and ready for review.`,
       const planPath = planFilePath(ctx.session.rootPath, scopeId);
       log11.debug(`enter: path=${planPath}`);
       const plan = readPlan(ctx.session.rootPath, scopeId);
-      if (!plan || !plan.trim()) {
+      if (!plan?.trim()) {
         return {
           success: false,
           error: "Plan file not found or empty. Write the plan first using write_plan.",
@@ -122630,8 +123094,8 @@ Use this to:
 // src/core/agents/offSecAgent/tools/updateFile.ts
 init_dist();
 init_zod();
-import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
-import { isAbsolute as isAbsolute5, resolve as resolve6 } from "path";
+import { readFile as readFile6, writeFile as writeFile4 } from "node:fs/promises";
+import { isAbsolute as isAbsolute6, resolve as resolve7 } from "node:path";
 var updateFileInputSchema = exports_external.object({
   path: exports_external.string().describe("Absolute or relative path to the file to update"),
   oldContent: exports_external.string().describe("The exact string to find in the file. Must match character-for-character including whitespace and indentation."),
@@ -122659,7 +123123,7 @@ operation fails with an error — double-check whitespace and indentation.`,
       newContent,
       replaceAll = false
     }) => {
-      const resolved = isAbsolute5(filePath) ? filePath : resolve6(ctx.agentCwd, filePath);
+      const resolved = isAbsolute6(filePath) ? filePath : resolve7(ctx.agentCwd, filePath);
       if (ctx.sandbox) {
         return executeSandboxUpdate(ctx, resolved, oldContent, newContent, replaceAll);
       }
@@ -123099,9 +123563,9 @@ async function handleSearchResponse(response) {
 init_dist();
 init_zod();
 init_structured();
-import { mkdirSync as mkdirSync12 } from "fs";
-import { writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname4 } from "path";
+import { mkdirSync as mkdirSync12 } from "node:fs";
+import { writeFile as writeFile5 } from "node:fs/promises";
+import { dirname as dirname6 } from "node:path";
 init_lazyLogger();
 var log12 = scopedLogger(() => createLogger("write_plan"));
 var writePlanInputSchema = exports_external.object({
@@ -123127,7 +123591,7 @@ Required plan sections:
     execute: async ({ content }) => {
       const scopeId = ctx.planSubagentId ?? ctx.subagentId;
       const planPath = planFilePath(ctx.session.rootPath, scopeId);
-      mkdirSync12(dirname4(planPath), { recursive: true });
+      mkdirSync12(dirname6(planPath), { recursive: true });
       log12.debug(`enter: contentLen=${content.length}, path=${planPath}`);
       try {
         await writeFile5(planPath, content, "utf-8");
@@ -123146,6 +123610,38 @@ Required plan sections:
     }
   });
 }
+// src/core/agents/offSecAgent/tools/listPromptInjections.ts
+init_dist();
+init_zod();
+function listPromptInjections(ctx) {
+  return tool({
+    description: "List available prompt-injection test payloads by safe metadata only. " + "The raw payload text is never returned. Use the returned id as a " + 'PromptInjectionRef: {"kind":"prompt_injection_ref","id":"<id>"} when a tool supports runtime injection references.',
+    inputSchema: exports_external.object({
+      category: exports_external.enum([
+        "instruction-hijack",
+        "data-exfiltration",
+        "tool-misuse",
+        "role-confusion",
+        "encoding"
+      ]).optional().describe("Optional category filter."),
+      tag: exports_external.string().optional().describe("Optional tag filter."),
+      toolCallDescription: exports_external.string().describe("A concise, human-readable description of why you are listing prompt-injection payloads.")
+    }),
+    execute: async ({ category, tag }) => {
+      const library = await getPromptInjectionLibrary({
+        library: ctx.promptInjectionLibrary,
+        source: ctx.promptInjectionLibrarySource
+      });
+      const injections = library.listCatalog().filter((entry) => !category || entry.category === category).filter((entry) => !tag || entry.tags.includes(tag));
+      return {
+        success: true,
+        configured: library.listCatalog().length > 0,
+        count: injections.length,
+        injections
+      };
+    }
+  });
+}
 // src/core/agents/offSecAgent/tools/profileCodebase.ts
 init_dist();
 init_zod();
@@ -123321,7 +123817,7 @@ Use this instead of asking for the whole playbook. Examples:
 // src/core/agents/offSecAgent/tools/runCodeQuery.ts
 init_dist();
 init_zod();
-import { relative as relative4 } from "node:path";
+import { relative as relative5 } from "node:path";
 var MAX_INLINE_MATCHES = 40;
 var MAX_QUERY_CAPTURE_BYTES = 2 * 1024 * 1024;
 var QueryEngineSchema = exports_external.enum(["rg", "grep", "ast-grep", "comby"]);
@@ -123392,7 +123888,7 @@ instead of flooding context with every match. Output size and runtime are bounde
         let targetPathForEngine = ".";
         try {
           const absTarget = resolvePathWithinCodebaseRoot(rootPath, query.path ?? ".");
-          targetPathForEngine = relative4(rootPath, absTarget) || ".";
+          targetPathForEngine = relative5(rootPath, absTarget) || ".";
         } catch (error) {
           results.push({
             engine,
@@ -123757,10 +124253,10 @@ function listWhiteboxCandidates2(ctx) {
 // src/core/agents/offSecAgent/tools/whiteboxJobs.ts
 init_dist();
 init_zod();
-import { isAbsolute as isAbsolute6, relative as relative5, sep } from "node:path";
+import { isAbsolute as isAbsolute7, relative as relative6, sep as sep2 } from "node:path";
 function displayPath(ctx, path) {
-  const prefix = ctx.session.rootPath.endsWith(sep) ? ctx.session.rootPath : `${ctx.session.rootPath}${sep}`;
-  return path === ctx.session.rootPath || path.startsWith(prefix) ? relative5(ctx.session.rootPath, path) : path;
+  const prefix = ctx.session.rootPath.endsWith(sep2) ? ctx.session.rootPath : `${ctx.session.rootPath}${sep2}`;
+  return path === ctx.session.rootPath || path.startsWith(prefix) ? relative6(ctx.session.rootPath, path) : path;
 }
 function startWhiteboxJob2(ctx) {
   return tool({
@@ -123895,9 +124391,9 @@ function stopWhiteboxJob2(ctx) {
   });
 }
 function normalizeArtifactRelativePath(ctx, userPath) {
-  if (isAbsolute6(userPath)) {
-    const rel = relative5(ctx.session.rootPath, userPath);
-    if (rel.startsWith("..") || rel === ".." || isAbsolute6(rel)) {
+  if (isAbsolute7(userPath)) {
+    const rel = relative6(ctx.session.rootPath, userPath);
+    if (rel.startsWith("..") || rel === ".." || isAbsolute7(rel)) {
       throw new Error("Artifact path must be inside the session directory.");
     }
     return rel.replace(/\\/g, "/");
@@ -124030,6 +124526,7 @@ function createAllTools(ctx) {
     add_memory: addMemory2(ctx),
     list_memories: listMemories2(ctx),
     get_memory: getMemory2(ctx),
+    list_prompt_injections: listPromptInjections(ctx),
     ...createEmailToolset(ctx),
     email_list_inboxes: emailListInboxes(ctx),
     email_list_messages: emailListMessages(ctx),
@@ -124092,6 +124589,7 @@ var ALL_TOOL_NAMES = [
   "add_memory",
   "list_memories",
   "get_memory",
+  "list_prompt_injections",
   "email_list_inboxes",
   "email_list_messages",
   "email_get_message",
@@ -124138,6 +124636,7 @@ var PLAN_MODE_TOOL_NAMES = [
   "add_memory",
   "list_memories",
   "get_memory",
+  "list_prompt_injections",
   "email_list_inboxes",
   "email_list_messages",
   "email_get_message",
@@ -124154,9 +124653,9 @@ var PLAN_MODE_TOOL_NAMES = [
 var SKILL_TOOL_NAMES = ["read_skill"];
 
 // src/core/agents/offSecAgent/trace.ts
-import { createHash } from "crypto";
-import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync13 } from "fs";
-import { dirname as dirname5 } from "path";
+import { createHash as createHash2 } from "node:crypto";
+import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync13 } from "node:fs";
+import { dirname as dirname7 } from "node:path";
 var OUTPUT_PREVIEW_LIMIT = 2000;
 var INPUT_PREVIEW_LIMIT = 1000;
 var SYSTEM_PROMPT_HASH_PREFIX_LENGTH = 12;
@@ -124217,7 +124716,7 @@ class StepTraceWriter {
     const now = Date.now();
     this.agentStartTime = now;
     this.lastStepTime = now;
-    mkdirSync13(dirname5(this.tracePath), { recursive: true });
+    mkdirSync13(dirname7(this.tracePath), { recursive: true });
   }
   writeInit(data) {
     const { systemPrompt, ...rest } = data;
@@ -124225,7 +124724,7 @@ class StepTraceWriter {
       type: "init",
       timestamp: new Date().toISOString(),
       agentId: this.agentId,
-      systemPromptHash: createHash("sha256").update(systemPrompt).digest("hex").slice(0, SYSTEM_PROMPT_HASH_PREFIX_LENGTH),
+      systemPromptHash: createHash2("sha256").update(systemPrompt).digest("hex").slice(0, SYSTEM_PROMPT_HASH_PREFIX_LENGTH),
       systemPrompt,
       ...rest
     };
@@ -124341,7 +124840,7 @@ class StepTraceWriter {
   }
   appendRecord(record3) {
     try {
-      appendFileSync3(this.tracePath, JSON.stringify(record3) + `
+      appendFileSync3(this.tracePath, `${JSON.stringify(record3)}
 `);
     } catch {}
     try {
@@ -124356,15 +124855,15 @@ class StepTraceWriter {
 // src/core/agents/offSecAgent/offensiveSecurityAgent.ts
 init_dist();
 init_ai();
-import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
-import { writeFile as writeFile6 } from "fs/promises";
-import { join as join25 } from "path";
+import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "node:fs";
+import { writeFile as writeFile6 } from "node:fs/promises";
+import { join as join27 } from "node:path";
 init_structured();
 init_observability();
 
 // src/core/operator/approvalGate.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { EventEmitter as EventEmitter3 } from "events";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { EventEmitter as EventEmitter3 } from "node:events";
 var DEFAULT_DECISION_TIMEOUT_MS = 15 * 60 * 1000;
 var INTERNAL_ID_PATTERN = /^(apr|act|tc)_\d+_[0-9a-f]{8}$/;
 
@@ -124409,8 +124908,8 @@ class ApprovalGate extends EventEmitter3 {
       tier: 1,
       timestamp: Date.now()
     };
-    return new Promise((resolve7, reject) => {
-      const deferred = { approval, resolve: resolve7, reject };
+    return new Promise((resolve8, reject) => {
+      const deferred = { approval, resolve: resolve8, reject };
       this.pendingApprovals.set(approval.id, deferred);
       const timeoutMs = this.config.decisionTimeoutMs;
       if (timeoutMs !== undefined && timeoutMs > 0) {
@@ -124648,6 +125147,7 @@ class OffensiveSecurityAgent {
   subagentId;
   persistentShell;
   browserSession;
+  ownsBrowserSession;
   abortSignal;
   userPrompt;
   _session;
@@ -124687,19 +125187,22 @@ class OffensiveSecurityAgent {
     }
     if (!input.sandbox) {
       const sessionHeaders = input.target ? resolveEffectiveHeaders(input.session, input.target) : input.session.config?.headers;
+      this.ownsBrowserSession = !input.browserSession;
       this.browserSession = input.browserSession ?? new PlaywrightMcpSession({
         extraHttpHeaders: stripBrowserManagedHeaders(sessionHeaders)
       });
+    } else {
+      this.ownsBrowserSession = false;
     }
-    const messagesDir = input.messagesDir ?? (input.subagentId ? join25(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
-    const tracePath = input.subagentId ? join25(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join25(messagesDir, "trace.jsonl");
+    const messagesDir = input.messagesDir ?? (input.subagentId ? join27(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
+    const tracePath = input.subagentId ? join27(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join27(messagesDir, "trace.jsonl");
     const traceWriter = new StepTraceWriter({
       tracePath,
       agentId: input.subagentId ?? null,
       eventBus: this.eventBus
     });
     const taskDriven = input.session.config?.taskDriven ?? false;
-    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join25(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join25(input.session.rootPath, "tasks") : undefined);
+    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join27(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join27(input.session.rootPath, "tasks") : undefined);
     const credentialManager = input.credentialManager ?? input.session.credentialManager;
     const builtinTools = createAllTools({
       session: input.session,
@@ -124715,6 +125218,8 @@ class OffensiveSecurityAgent {
       credentialManager,
       persistentShell: this.persistentShell,
       skillsRegistry: input.skillsRegistry,
+      promptInjectionLibrary: input.promptInjectionLibrary,
+      promptInjectionLibrarySource: input.promptInjectionLibrarySource ?? input.session.config?.promptInjectionLibrarySource,
       traceWriter,
       tasksDir,
       enableThinking: input.enableThinking,
@@ -124775,7 +125280,7 @@ class OffensiveSecurityAgent {
     if (!existsSync18(messagesDir)) {
       mkdirSync14(messagesDir, { recursive: true });
     }
-    const messagesPath = join25(messagesDir, "messages.json");
+    const messagesPath = join27(messagesDir, "messages.json");
     const initialMessagesRef = {
       current: input.messages ? [...input.messages] : [
         {
@@ -124893,6 +125398,9 @@ class OffensiveSecurityAgent {
         }
       } finally {
         this.persistentShell?.dispose();
+        if (this.ownsBrowserSession && this.browserSession) {
+          await this.browserSession.disconnect().catch(() => {});
+        }
       }
       if (this.abortSignal?.aborted) {
         throw new DOMException("Agent aborted by user", "AbortError");