@pensar/apex 2.1.2 → 2.1.3-canary.082299eb

package/build/{cli-dqkdnd3c.js → cli-db434rd0.js}

@@ -4,27 +4,27 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-35czfv00.js";
+} from "./cli-w5vt3svr.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-d28z7z1b.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-hj3t87r2.js";
+} from "./cli-0kg01x44.js";
 import {
   exports_external,
   init_zod
-} from "./cli-f7d23ded.js";
+} from "./cli-3k1x5rn3.js";
 import {
   config,
   init_config
-} from "./cli-9z6vwf30.js";
+} from "./cli-7bzzjw1f.js";
 import {
   __commonJS,
   __require
@@ -583,6 +583,8 @@ var require_Alias = __commonJS((exports) => {
       });
     }
     resolve(doc, ctx) {
+      if (ctx?.maxAliasCount === 0)
+        throw new ReferenceError("Alias resolution is disabled");
       let nodes;
       if (ctx?.aliasResolveCache) {
         nodes = ctx.aliasResolveCache;
@@ -1362,6 +1364,7 @@ var require_stringify = __commonJS((exports) => {
       nullStr: "null",
       simpleKeys: false,
       singleQuote: null,
+      trailingComma: false,
       trueStr: "true",
       verifyAliasOrder: true
     }, doc.schema.toStringOptions, options);
@@ -1631,18 +1634,18 @@ var require_merge = __commonJS((exports) => {
   };
   var isMergeKey = (ctx, key) => (merge.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
   function addMergeToJSMap(ctx, map, value) {
-    value = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
-    if (identity.isSeq(value))
-      for (const it of value.items)
+    const source = resolveAliasValue(ctx, value);
+    if (identity.isSeq(source))
+      for (const it of source.items)
         mergeValue(ctx, map, it);
-    else if (Array.isArray(value))
-      for (const it of value)
+    else if (Array.isArray(source))
+      for (const it of source)
         mergeValue(ctx, map, it);
     else
-      mergeValue(ctx, map, value);
+      mergeValue(ctx, map, source);
   }
   function mergeValue(ctx, map, value) {
-    const source = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
+    const source = resolveAliasValue(ctx, value);
     if (!identity.isMap(source))
       throw new Error("Merge sources must be maps or map aliases");
     const srcMap = source.toJSON(null, ctx, Map);
@@ -1663,6 +1666,9 @@ var require_merge = __commonJS((exports) => {
     }
     return map;
   }
+  function resolveAliasValue(ctx, value) {
+    return ctx && identity.isAlias(value) ? value.resolve(ctx.doc, ctx) : value;
+  }
   exports.addMergeToJSMap = addMergeToJSMap;
   exports.isMergeKey = isMergeKey;
   exports.merge = merge;
@@ -1870,13 +1876,20 @@ ${indent}${line}` : `
       if (comment)
         reqNewline = true;
       let str = stringify.stringify(item, itemCtx, () => comment = null);
-      if (i < items.length - 1)
+      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+`));
+      if (i < items.length - 1) {
         str += ",";
+      } else if (ctx.options.trailingComma) {
+        if (ctx.options.lineWidth > 0) {
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+        }
+        if (reqNewline) {
+          str += ",";
+        }
+      }
       if (comment)
         str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      if (!reqNewline && (lines.length > linesAtValue || str.includes(`
-`)))
-        reqNewline = true;
       lines.push(str);
       linesAtValue = lines.length;
     }
@@ -2231,7 +2244,7 @@ var require_stringifyNumber = __commonJS((exports) => {
     if (!isFinite(num))
       return isNaN(num) ? ".nan" : num < 0 ? "-.inf" : ".inf";
     let n = Object.is(value, -0) ? "-0" : JSON.stringify(value);
-    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^\d/.test(n)) {
+    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^-?\d/.test(n) && !n.includes("e")) {
       let i = n.indexOf(".");
       if (i < 0) {
         i = n.length;
@@ -4456,7 +4469,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
           while (next === " " || next === "\t")
             next = source[++i + 1];
         } else if (next === "x" || next === "u" || next === "U") {
-          const length = { x: 2, u: 4, U: 8 }[next];
+          const length = next === "x" ? 2 : next === "u" ? 4 : 8;
           res += parseCharCode(source, i + 1, length, onError);
           i += length;
         } else {
@@ -4525,12 +4538,13 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
     const cc = source.substr(offset, length);
     const ok = cc.length === length && /^[0-9a-fA-F]+$/.test(cc);
     const code = ok ? parseInt(cc, 16) : NaN;
-    if (isNaN(code)) {
+    try {
+      return String.fromCodePoint(code);
+    } catch {
       const raw = source.substr(offset - 2, length + 2);
       onError(offset - 2, "BAD_DQ_ESCAPE", `Invalid escape sequence ${raw}`);
       return raw;
     }
-    return String.fromCodePoint(code);
   }
   exports.resolveFlowScalar = resolveFlowScalar;
 });
@@ -4671,17 +4685,22 @@ var require_compose_node = __commonJS((exports) => {
       case "block-map":
       case "block-seq":
       case "flow-collection":
-        node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-        if (anchor)
-          node.anchor = anchor.source.substring(1);
+        try {
+          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+          if (anchor)
+            node.anchor = anchor.source.substring(1);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          onError(token, "RESOURCE_EXHAUSTION", message);
+        }
         break;
       default: {
         const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
         onError(token, "UNEXPECTED_TOKEN", message);
-        node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError);
         isSrcToken = false;
       }
     }
+    node ?? (node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError));
     if (anchor && node.anchor === "")
       onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
     if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -4864,8 +4883,10 @@ ${cb}` : comment;
         }
       }
       if (afterDoc) {
-        Array.prototype.push.apply(doc.errors, this.errors);
-        Array.prototype.push.apply(doc.warnings, this.warnings);
+        for (let i = 0;i < this.errors.length; ++i)
+          doc.errors.push(this.errors[i]);
+        for (let i = 0;i < this.warnings.length; ++i)
+          doc.warnings.push(this.warnings[i]);
       } else {
         doc.errors = this.errors;
         doc.warnings = this.warnings;
@@ -5577,7 +5598,7 @@ var require_lexer = __commonJS((exports) => {
         const n = (yield* this.pushCount(1)) + (yield* this.pushSpaces(true));
         this.indentNext = this.indentValue + 1;
         this.indentValue += n;
-        return yield* this.parseBlockStart();
+        return "block-start";
       }
       return "doc";
     }
@@ -5884,26 +5905,37 @@ var require_lexer = __commonJS((exports) => {
       return 0;
     }
     *pushIndicators() {
-      switch (this.charAt(0)) {
-        case "!":
-          return (yield* this.pushTag()) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "&":
-          return (yield* this.pushUntil(isNotAnchorChar)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "-":
-        case "?":
-        case ":": {
-          const inFlow = this.flowLevel > 0;
-          const ch1 = this.charAt(1);
-          if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
-            if (!inFlow)
-              this.indentNext = this.indentValue + 1;
-            else if (this.flowKey)
-              this.flowKey = false;
-            return (yield* this.pushCount(1)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
+      let n = 0;
+      loop:
+        while (true) {
+          switch (this.charAt(0)) {
+            case "!":
+              n += yield* this.pushTag();
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "&":
+              n += yield* this.pushUntil(isNotAnchorChar);
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "-":
+            case "?":
+            case ":": {
+              const inFlow = this.flowLevel > 0;
+              const ch1 = this.charAt(1);
+              if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
+                if (!inFlow)
+                  this.indentNext = this.indentValue + 1;
+                else if (this.flowKey)
+                  this.flowKey = false;
+                n += yield* this.pushCount(1);
+                n += yield* this.pushSpaces(true);
+                continue loop;
+              }
+            }
           }
+          break loop;
         }
-      }
-      return 0;
+      return n;
     }
     *pushTag() {
       if (this.charAt(1) === "<") {
@@ -6057,6 +6089,13 @@ var require_parser = __commonJS((exports) => {
     while (prev[++i]?.type === "space") {}
     return prev.splice(i, prev.length);
   }
+  function arrayPushArray(target, source) {
+    if (source.length < 1e5)
+      Array.prototype.push.apply(target, source);
+    else
+      for (let i = 0;i < source.length; ++i)
+        target.push(source[i]);
+  }
   function fixFlowSeqItems(fc) {
     if (fc.start.type === "flow-seq-start") {
       for (const it of fc.items) {
@@ -6066,11 +6105,11 @@ var require_parser = __commonJS((exports) => {
           delete it.key;
           if (isFlowToken(it.value)) {
             if (it.value.end)
-              Array.prototype.push.apply(it.value.end, it.sep);
+              arrayPushArray(it.value.end, it.sep);
             else
               it.value.end = it.sep;
           } else
-            Array.prototype.push.apply(it.start, it.sep);
+            arrayPushArray(it.start, it.sep);
           delete it.sep;
         }
       }
@@ -6410,7 +6449,7 @@ var require_parser = __commonJS((exports) => {
               const prev = map.items[map.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 map.items.pop();
                 return;
@@ -6598,7 +6637,7 @@ var require_parser = __commonJS((exports) => {
               const prev = seq.items[seq.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 seq.items.pop();
                 return;

package/build/{cli-ks60cc3h.js → cli-f5javz2k.js}

@@ -11,50 +11,50 @@ var init_package = __esm(() => {
       pensar: "./bin/pensar.js"
     },
     dependencies: {
-      "@ai-sdk/amazon-bedrock": "^4.0.113",
-      "@ai-sdk/anthropic": "^3.0.81",
-      "@ai-sdk/google": "^3.0.37",
+      "@ai-sdk/amazon-bedrock": "^4.0.119",
+      "@ai-sdk/anthropic": "^3.0.85",
+      "@ai-sdk/google": "^3.0.83",
       "@ai-sdk/openai": "3.0.46",
-      "@ai-sdk/openai-compatible": "^2.0.35",
-      "@ai-sdk/provider": "^3.0.8",
-      "@daytonaio/sdk": "^0.112.1",
-      "@googleapis/gmail": "^16.1.1",
+      "@ai-sdk/openai-compatible": "^2.0.51",
+      "@ai-sdk/provider": "^3.0.10",
+      "@daytonaio/sdk": "^0.112.3",
+      "@googleapis/gmail": "^16.1.2",
       "@microsoft/microsoft-graph-client": "^3.0.7",
-      "@modelcontextprotocol/sdk": "^1.0.0",
-      "@openrouter/ai-sdk-provider": "^2.2.3",
-      "@opentelemetry/api": "^1.9.0",
+      "@modelcontextprotocol/sdk": "^1.29.0",
+      "@openrouter/ai-sdk-provider": "^2.9.1",
+      "@opentelemetry/api": "^1.9.1",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.2.2",
       "@playwright/mcp": "^0.0.54",
-      ai: "^6.0.105",
+      ai: "^6.0.208",
       "camoufox-js": "^0.11.1",
-      glob: "^13.0.0",
+      glob: "^13.0.6",
       "highlight.js": "^11.11.1",
-      imapflow: "^1.2.10",
-      mailparser: "^3.9.3",
-      marked: "^16.4.0",
+      imapflow: "^1.4.2",
+      mailparser: "^3.9.11",
+      marked: "^16.4.2",
       "mime-types": "^3.0.2",
-      nodemailer: "^8.0.7",
-      "p-limit": "^7.2.0",
-      react: "^19.2.0",
-      sharp: "^0.34.4",
-      tldts: "^7.0.28",
-      yaml: "^2.8.2",
-      zod: "^4.1.12"
+      nodemailer: "^8.0.11",
+      "p-limit": "^7.3.0",
+      react: "^19.2.7",
+      sharp: "^0.34.5",
+      tldts: "^7.4.3",
+      yaml: "^2.9.0",
+      zod: "^4.4.3"
     },
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
-      "@types/bun": "^1.3.0",
+      "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
-      "@types/nodemailer": "^8.0.0",
-      "@types/react": "^19.2.6",
-      dotenv: "^17.2.3",
-      knip: "^6.12.0",
-      prettier: "^3.8.1",
-      vitest: "^2.1.8"
+      "@types/nodemailer": "^8.0.1",
+      "@types/react": "^19.2.17",
+      dotenv: "^17.4.2",
+      knip: "^6.17.1",
+      prettier: "^3.8.4",
+      vitest: "^2.1.9"
     },
     engines: {
       bun: ">=1.0.0",
@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.2"
+    version: "2.1.3-canary.082299eb"
   };
 });
 

package/build/{cli-gbkj2has.js → cli-nfnfwfcn.js}

@@ -1,15 +1,15 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-w5vt3svr.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-v1aqbv58.js";
+} from "./cli-d28z7z1b.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-f7d23ded.js";
+} from "./cli-3k1x5rn3.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();
@@ -400,6 +400,7 @@ class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       domains,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     let capturedResult = null;
@@ -426,6 +427,7 @@ This ends the agent run — make sure all data is included.`,
       subagentId,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       activeTools: [
         "read_file",

package/build/{cli-6vs0mtsb.js → cli-nn5rxhvz.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-w5vt3svr.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-d28z7z1b.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();
@@ -79,6 +79,7 @@ class CodeAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       excludeTools,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel
     } = opts;
@@ -124,6 +125,7 @@ class CodeAgent extends OffensiveSecurityAgent {
       subagentId,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel,
       stopWhen: stopWhen ?? stepCountIs(1e4),

package/build/{cli-whtdyc0e.js → cli-qdvef4qc.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-w5vt3svr.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-6wwpk9d9.js";
+} from "./cli-35rkgbhd.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-d28z7z1b.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -387,6 +387,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       eventBus,
       subagentId,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     const target = opts.target ?? opts.cwd;
@@ -416,6 +417,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       eventBus,
       subagentId,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       messages: opts.messages,
       activeTools: [
@@ -479,7 +481,7 @@ ${authenticationInstructions}
     authBlock = `⚠️ AUTHENTICATION CREDENTIALS PROVIDED — YOU MUST LOG IN FIRST.
 
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
-Then use browser tools to authenticate. Pass the credentialId to authenticate_session or delegate_to_auth_subagent — secrets are resolved automatically.
+Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.

package/build/cli-sekg25pa.js

@@ -0,0 +1,195 @@
+import {
+  EvidenceFileEntrySchema
+} from "./cli-7g8n2kkk.js";
+import {
+  CweEntrySchema,
+  ValidatedCweEntrySchema,
+  hasCanonicalName
+} from "./cli-w5vt3svr.js";
+import {
+  exports_external,
+  init_zod
+} from "./cli-3k1x5rn3.js";
+
+// src/core/report/schemas.ts
+init_zod();
+var PentestReportFindingSchema = exports_external.object({
+  title: exports_external.string(),
+  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: exports_external.string(),
+  impact: exports_external.string(),
+  evidence: exports_external.string(),
+  endpoint: exports_external.string(),
+  pocPath: exports_external.string(),
+  remediation: exports_external.string(),
+  references: exports_external.string().optional(),
+  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: exports_external.string().optional(),
+  relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+});
+var PentestReportSchema = exports_external.object({
+  version: exports_external.string().regex(/^1\.\d+$/),
+  metadata: exports_external.object({
+    target: exports_external.string(),
+    model: exports_external.string(),
+    timestamp: exports_external.string(),
+    sessionId: exports_external.string(),
+    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
+  }),
+  summary: exports_external.object({
+    totalFindings: exports_external.number(),
+    bySeverity: exports_external.object({
+      CRITICAL: exports_external.number(),
+      HIGH: exports_external.number(),
+      MEDIUM: exports_external.number(),
+      LOW: exports_external.number()
+    })
+  }),
+  findings: exports_external.array(PentestReportFindingSchema)
+});
+var REPORT_VERSION = "1.0";
+
+// src/core/report/builder.ts
+var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function buildPentestReport(findings, context) {
+  const sorted = [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+  const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
+  for (const f of findings) {
+    bySeverity[f.severity]++;
+  }
+  return {
+    version: REPORT_VERSION,
+    metadata: {
+      target: context.target,
+      model: context.model,
+      timestamp: new Date().toISOString(),
+      sessionId: context.sessionId,
+      mode: context.mode
+    },
+    summary: {
+      totalFindings: findings.length,
+      bySeverity
+    },
+    findings: sorted.map((f) => ({
+      title: f.title,
+      severity: f.severity,
+      description: f.description,
+      impact: f.impact,
+      evidence: f.evidence,
+      endpoint: f.endpoint,
+      pocPath: f.pocPath,
+      remediation: f.remediation,
+      references: f.references,
+      cwes: f.cwes,
+      rootCauseGroup: f.rootCauseGroup,
+      relatedFindings: f.relatedFindings,
+      rootCauseLead: f.rootCauseLead,
+      evidenceFiles: f.evidenceFiles
+    }))
+  };
+}
+
+// src/core/report/renderers/json.ts
+function renderJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+
+// src/core/report/renderers/markdown.ts
+function renderMarkdown(report) {
+  const { metadata, findings, summary } = report;
+  const header = [
+    `# Pentest Report — ${metadata.target}`,
+    "",
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}  `,
+    `**Model:** ${metadata.model}  `,
+    `**Mode:** ${metadata.mode}`,
+    "",
+    `**Findings:** ${summary.totalFindings}`,
+    ""
+  ];
+  if (findings.length === 0) {
+    return [
+      ...header,
+      "No findings were identified during this assessment.",
+      ""
+    ].join(`
+`);
+  }
+  const body = findings.map((finding) => renderFinding(finding, metadata)).join(`
+`);
+  return [...header, body].join(`
+`);
+}
+function renderFinding(finding, metadata) {
+  const lines = [
+    `# ${finding.title}`,
+    "",
+    `**Severity:** ${finding.severity}  `,
+    `**Target:** ${metadata.target}  `,
+    `**Endpoint:** ${finding.endpoint}  `,
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}`,
+    "",
+    "## Description",
+    "",
+    finding.description,
+    "",
+    "## Impact",
+    "",
+    finding.impact,
+    "",
+    "## Evidence",
+    "",
+    "```",
+    finding.evidence,
+    "```",
+    "",
+    ...finding.evidenceFiles?.length ? [
+      "## Evidence Files",
+      "",
+      ...finding.evidenceFiles.map((ef) => `- **[${ef.type}]** \`${ef.path}\` — ${ef.description}`),
+      ""
+    ] : [],
+    ...finding.cwes?.length ? [
+      "## CWE Classification",
+      "",
+      ...finding.cwes.map((cwe) => `- **${cwe.id}**${hasCanonicalName(cwe) ? `: ${cwe.name}` : ""} — ${cwe.reasoning}`),
+      ""
+    ] : [],
+    ...finding.rootCauseGroup ? [
+      "## Root Cause Group",
+      "",
+      `**Group:** \`${finding.rootCauseGroup}\``,
+      ...finding.relatedFindings?.length ? [
+        "",
+        "**Related Findings:**",
+        ...finding.relatedFindings.map((rf) => `- ${rf}`)
+      ] : [],
+      ""
+    ] : [],
+    "## POC",
+    "",
+    `Path: \`${finding.pocPath}\``,
+    "",
+    "## Remediation",
+    "",
+    finding.remediation,
+    ...finding.references ? ["", `## References`, "", finding.references] : [],
+    "",
+    "---",
+    "",
+    "*This finding was automatically documented by the Pensar penetration testing agent.*",
+    ""
+  ];
+  return lines.join(`
+`);
+}
+
+// src/core/report/index.ts
+var REPORT_FILENAME_MD = "pentest-report.md";
+var REPORT_FILENAME_JSON = "pentest-report.json";
+
+export { buildPentestReport, renderJson, renderMarkdown, REPORT_FILENAME_MD, REPORT_FILENAME_JSON };