@pensar/apex 2.1.3-canary.0e6728fd → 2.1.3-canary.3779ef4b

package/build/{agent-8xtrxjyz.js → agent-4kv26n9t.js}

@@ -4,19 +4,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-gpbm6crd.js";
+} from "./cli-tvepp3a1.js";
 import"./cli-9fsre5pt.js";
-import"./cli-7r4v9hdr.js";
-import"./cli-dqvnva4d.js";
-import"./cli-j8gbfzaw.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
 import"./cli-c8131c4q.js";
-import"./cli-twfafzdw.js";
-import"./cli-c25w7dwp.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-xbn0wpey.js";
-import"./cli-zf4s30wk.js";
-import"./cli-08gv62zx.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/agent-6k30js8g.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-fd8tng9v.js";
+import"./cli-9fsre5pt.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
+import"./cli-c8131c4q.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-jysnj2vg.js → agent-9xr1jbvh.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-j8gbfzaw.js";
+} from "./cli-7mnp7fd6.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-twfafzdw.js";
-import"./cli-c25w7dwp.js";
+} from "./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
 import {
   exports_external,
   init_zod
 } from "./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-xbn0wpey.js";
-import"./cli-zf4s30wk.js";
-import"./cli-08gv62zx.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/{apps-bak1k8v0.js → apps-tqmya359.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-s31p2dd0.js";
-import"./cli-tbtta1qx.js";
-import"./cli-2r1wgr70.js";
-import"./cli-gpbm6crd.js";
-import"./cli-j89sg0bf.js";
-import"./cli-s5d8z6v2.js";
-import"./cli-4kk337yc.js";
+} from "./cli-j37jjm60.js";
+import"./cli-2kpw8jj1.js";
+import"./cli-exz3a4ns.js";
+import"./cli-tvepp3a1.js";
+import"./cli-0fvw086q.js";
+import"./cli-fd8tng9v.js";
+import"./cli-5sfep5pp.js";
 import"./cli-9fsre5pt.js";
-import"./cli-7r4v9hdr.js";
-import"./cli-dqvnva4d.js";
-import"./cli-j8gbfzaw.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-twfafzdw.js";
-import"./cli-c25w7dwp.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-xbn0wpey.js";
-import"./cli-zf4s30wk.js";
-import"./cli-08gv62zx.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-y8k6bahv.js → auth-dp6kjq88.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-s31p2dd0.js";
-import"./cli-tbtta1qx.js";
-import"./cli-2r1wgr70.js";
-import"./cli-gpbm6crd.js";
-import"./cli-j89sg0bf.js";
-import"./cli-s5d8z6v2.js";
-import"./cli-4kk337yc.js";
+import"./cli-j37jjm60.js";
+import"./cli-2kpw8jj1.js";
+import"./cli-exz3a4ns.js";
+import"./cli-tvepp3a1.js";
+import"./cli-0fvw086q.js";
+import"./cli-fd8tng9v.js";
+import"./cli-5sfep5pp.js";
 import"./cli-9fsre5pt.js";
-import"./cli-7r4v9hdr.js";
-import"./cli-dqvnva4d.js";
-import"./cli-j8gbfzaw.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-twfafzdw.js";
+import"./cli-qt03y53f.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-c25w7dwp.js";
+} from "./cli-mc47464w.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-xbn0wpey.js";
-import"./cli-zf4s30wk.js";
-import"./cli-08gv62zx.js";
+} from "./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-rz2a414m.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-0fvw086q.js";
+import"./cli-9fsre5pt.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
+import"./cli-c8131c4q.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-f5b6gaab.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-exz3a4ns.js";
+import"./cli-9fsre5pt.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
+import"./cli-c8131c4q.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-xkt0tw6t.js → blackboxPentest-kpm5sh4q.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-tbtta1qx.js";
-import"./cli-2r1wgr70.js";
-import"./cli-gpbm6crd.js";
-import"./cli-s5d8z6v2.js";
-import"./cli-4kk337yc.js";
+} from "./cli-2kpw8jj1.js";
+import"./cli-exz3a4ns.js";
+import"./cli-tvepp3a1.js";
+import"./cli-fd8tng9v.js";
+import"./cli-5sfep5pp.js";
 import"./cli-9fsre5pt.js";
-import"./cli-7r4v9hdr.js";
-import"./cli-dqvnva4d.js";
-import"./cli-j8gbfzaw.js";
+import"./cli-9m4gwavm.js";
+import"./cli-z6advcmx.js";
+import"./cli-7mnp7fd6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-twfafzdw.js";
-import"./cli-c25w7dwp.js";
+import"./cli-qt03y53f.js";
+import"./cli-mc47464w.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-xbn0wpey.js";
-import"./cli-zf4s30wk.js";
-import"./cli-08gv62zx.js";
+import"./cli-pbx6qtf1.js";
+import"./cli-f6njpb4j.js";
+import"./cli-3m4awymw.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-j89sg0bf.js → cli-0fvw086q.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-j8gbfzaw.js";
+} from "./cli-7mnp7fd6.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();

package/build/{cli-tbtta1qx.js → cli-2kpw8jj1.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-2r1wgr70.js";
+} from "./cli-exz3a4ns.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-gpbm6crd.js";
+} from "./cli-tvepp3a1.js";
 import {
   CodeAgent
-} from "./cli-s5d8z6v2.js";
+} from "./cli-fd8tng9v.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-4kk337yc.js";
+} from "./cli-5sfep5pp.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-7r4v9hdr.js";
+} from "./cli-9m4gwavm.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -28,7 +28,7 @@ import {
   hasCanonicalName,
   pLimit,
   runWithBoundedConcurrency
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -40,7 +40,7 @@ import {
   init_session,
   init_structured,
   scopedLogger
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 import {
   exports_external,
   init_zod

package/build/{cli-08gv62zx.js → cli-3m4awymw.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.3-canary.0e6728fd"
+    version: "2.1.3-canary.3779ef4b"
   };
 });
 

package/build/{cli-4kk337yc.js → cli-5sfep5pp.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 import {
   exports_external,
   init_zod,

package/build/{cli-tasyg3ks.js → cli-5x795dxt.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-j8gbfzaw.js → cli-7mnp7fd6.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-7r4v9hdr.js → cli-9m4gwavm.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   exports_external,
   init_zod

package/build/{cli-2r1wgr70.js → cli-exz3a4ns.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-j8gbfzaw.js";
+} from "./cli-7mnp7fd6.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/{cli-zf4s30wk.js → cli-f6njpb4j.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-08gv62zx.js";
+} from "./cli-3m4awymw.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-s5d8z6v2.js → cli-fd8tng9v.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-s31p2dd0.js → cli-j37jjm60.js}

@@ -4,19 +4,19 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-c25w7dwp.js";
+} from "./cli-mc47464w.js";
 import {
   exports_external,
   init_zod
@@ -24,7 +24,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-xbn0wpey.js";
+} from "./cli-pbx6qtf1.js";
 import {
   __commonJS,
   __require

package/build/{cli-c25w7dwp.js → cli-mc47464w.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-xbn0wpey.js";
+} from "./cli-pbx6qtf1.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-xbn0wpey.js → cli-pbx6qtf1.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-zf4s30wk.js";
+} from "./cli-f6njpb4j.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-twfafzdw.js → cli-qt03y53f.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-c25w7dwp.js";
+} from "./cli-mc47464w.js";
 import {
   AISDKError,
   APICallError,
@@ -86,11 +86,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-xbn0wpey.js";
+} from "./cli-pbx6qtf1.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-08gv62zx.js";
+} from "./cli-3m4awymw.js";
 import {
   __callDispose,
   __commonJS,
@@ -41867,7 +41867,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-64xtwggx.js");
+    const { config: appConfig } = await import("./index-3r8abyxc.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }

package/build/{cli-gpbm6crd.js → cli-tvepp3a1.js}

@@ -5,7 +5,7 @@ import {
   createReportErrorTool,
   isMemoryEnabled,
   readPlan
-} from "./cli-dqvnva4d.js";
+} from "./cli-z6advcmx.js";
 import {
   createLogger,
   hasToolCall,
@@ -13,7 +13,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-twfafzdw.js";
+} from "./cli-qt03y53f.js";
 import {
   exports_external,
   init_zod
@@ -170,6 +170,7 @@ var SECTION_POC_PORTABILITY = `POC Script Portability Requirements:
 - Prefer built-in shell features over external commands when possible
 - If a PoC requires a specific non-standard tool, check for it at the start and exit with a clear error message if missing`;
 var SECTION_BROWSER_INTERACTION = `Browser Interaction:
+- Lean on the browser for testing wherever it applies. For anything interactive, stateful, client-side, or auth-gated — login flows, multi-step forms, SPA/JavaScript-driven behavior, DOM-based XSS, CSRF, and any page that only behaves correctly with a rendered, logged-in session — drive the test through the browser (browser_navigate / browser_click / browser_fill / browser_snapshot) rather than raw requests. The browser preserves your authenticated session and executes client-side logic that http_request / curl cannot see. Fall back to http_request / execute_command (curl) for stateless API-level checks, header inspection, and high-volume payload fuzzing.
 - Use browser_navigate to load pages, browser_snapshot to inspect the DOM, and browser_screenshot for visual evidence
 - Use browser_click and browser_fill to interact with forms, buttons, and input fields — essential for testing login flows, search fields, and other interactive elements
 - Screenshot liberally so the user can follow along. Whenever you are driving a browser, treat screenshots as the primary way the user watches your work. Err heavily on the side of more screenshots rather than fewer.
@@ -186,7 +187,9 @@ var SECTION_AUTHENTICATION = `Authentication:
 - After a successful login, capture the resulting session credentials and reuse them for raw requests. For a browser login, call browser_get_cookies to extract the session cookies (including httpOnly ones) — pass them as the Cookie header to http_request, or as -H "Cookie: ..." / -b flags to execute_command (curl). Any worker you spawn automatically inherits a snapshot of your authenticated browser session.
 - For http_request: include the captured Cookie and any Authorization headers on every call. For execute_command (curl): include -H "Cookie: ..." and/or -H "Authorization: ..." flags.
 - If a request returns 401/403 after you logged in yourself, your captured session may have expired — re-authenticate the same way you did originally and refresh your session cookies/tokens.
-- If you cannot authenticate with the available credentials, or another runtime condition blocks all testing, call report_error with a clear, specific message instead of giving up silently or documenting a non-finding.`;
+- Do NOT spin your wheels on authentication. If you have followed the credential Context instructions and still cannot authenticate, do NOT try to work around it — do NOT register a new account, self-sign-up, or fabricate credentials. Those are not the credentials under test and only pollute results. Make at most a couple of genuine attempts, then call report_error with reason "authentication_failed" and a specific message describing exactly what you tried and how it failed.
+- If you cannot authenticate with the available credentials, or another runtime condition blocks all testing, call report_error with a clear, specific message instead of giving up silently or documenting a non-finding.
+- Do NOT complete destructive or state-changing account actions. When testing a password-reset, account-recovery, email-change, or account-deletion flow, demonstrate the flaw (e.g. a predictable/guessable reset token, a reset that can be triggered for another user, or a flow missing authorization) WITHOUT actually finishing the action on the real account under test — never set a new password, consume a real reset token, change the account email, or delete the account. Doing so can lock you or the operator out and invalidate the credentials. Stop at the point that proves impact and document that instead.`;
 var SECTION_CREDENTIAL_DISCOVERY = `Credential & Secret Discovery:
 - When you find exposed configuration in client-side code (JS bundles, HTML source, config files), distinguish between:
   - SENSITIVE SECRETS (API keys granting backend access, database credentials, JWT signing keys, private keys, service account tokens) — document as a HIGH/CRITICAL finding
@@ -456,7 +459,11 @@ ${SECTION_SOURCE_CODE_PROHIBITION}
 Your methodology:
 1. ORIENT — Call list_memories to review any existing knowledge from previous engagements (target-specific notes, successful techniques, false positive patterns, technology context). Use what you find to shape your plan.
 2. PLAN — State the objectives you have been given and outline your high-level orchestration plan in plain text BEFORE any tool calls. For each objective, briefly state what attack class the worker should focus on (e.g. "Objective 1 → SQL injection, focus on /api/users id parameter"). Output this plan as a text message — not as a tool call.
-3. RECON — Perform LIGHT initial reconnaissance to confirm the target is reachable and understand baseline behavior. Use http_request for a handful of probes, browser_navigate + browser_snapshot to see the surface, and execute_command sparingly. Do NOT begin exploitation here — that is the workers' job. Note any anomalies (unusual error responses, exposed headers, framework fingerprints, surprising endpoint behavior) for the final exploratory worker.
+3. RECON & AUTHENTICATE — Perform LIGHT initial reconnaissance to confirm the target is reachable and understand baseline behavior. Use http_request for a handful of probes, browser_navigate + browser_snapshot to see the surface, and execute_command sparingly. Do NOT begin exploitation here — that is the workers' job. Note any anomalies (unusual error responses, exposed headers, framework fingerprints, surprising endpoint behavior) for the final exploratory worker.
+   - If authentication is required (an "Existing Authentication Session" section is absent and the target / objectives need a logged-in session), you MUST authenticate NOW, in YOUR browser, BEFORE any fan-out. Follow the "Available Credentials" instructions exactly — use the method each credential's Context describes (e.g. a token/API exchange via execute_command or http_request) rather than defaulting to a browser login; only drive the browser login flow (browser_navigate + browser_fill with credentialId/credentialField) when the Context does not specify how.
+   - VERIFY the session before fanning out: request a protected resource and confirm it does NOT return 401/403. Use browser_get_cookies to capture the session cookies for reuse in raw http_request / curl calls.
+   - Authenticating HERE (not in the workers) is critical: each worker you spawn inherits a snapshot of YOUR browser's authenticated cookies + localStorage at spawn time, so ONE successful login up front propagates to every worker. Do NOT instruct workers to re-authenticate.
+   - If you cannot authenticate and the objectives require it, call report_error with reason "authentication_failed" and a specific message BEFORE spawning any workers — do not fan out unauthenticated workers that will all fail, and do not report non-findings.
 4. FAN OUT — For EACH objective, call spawn_pentest_agent EXACTLY ONCE. Each spawn dispatches a focused worker that will perform the full PLAN → VERIFY → PREPARE → TEST → EXPLOIT → DOCUMENT loop on its objective. Workers write findings to the shared findings registry — you do NOT need to forward findings between them.
 5. CHAIN & EXPLORE — After all per-objective workers complete, call spawn_pentest_agent ONE FINAL TIME with a synthesized objective that:
    a. Summarizes what earlier workers confirmed or ruled out (so the exploratory worker doesn't re-do their work).
@@ -595,6 +602,7 @@ Do NOT discover or enumerate other endpoints or services. Focus exclusively on t
 1. Call list_memories to review any prior knowledge relevant to this target or engagement.
 2. State the objectives and outline your orchestration plan in plain text BEFORE any tool calls — one bullet per objective, briefly naming the attack class each worker should focus on.
 3. Perform LIGHT initial recon (a handful of http_request probes, browser_navigate + browser_snapshot to see the surface). Do NOT begin exploitation here — that is the workers' job. Note any anomalies you observe for the final exploratory worker.
+   - AUTHENTICATE FIRST if the target/objectives need a logged-in session and no "Existing Authentication Session" is provided: log in ONCE in YOUR browser during this recon step, following the "Available Credentials" instructions exactly (prefer the credential Context's method; use credentialId/credentialField so secrets resolve securely). Verify the session with a protected request (expect NOT 401/403) and capture cookies via browser_get_cookies. Every worker inherits your authenticated browser snapshot, so do this BEFORE fan-out and do NOT have workers re-authenticate. If you cannot authenticate and the objectives require it, call report_error with reason "authentication_failed" instead of fanning out.
 4. Call spawn_pentest_agent EXACTLY ONCE PER OBJECTIVE. For every spawn:
    - Set \`target\` to the FULL URL from the assignment above (domain + endpoint path) — pass it through verbatim. Do not strip the path or rewrite the host. Workers do not perform endpoint discovery; they deeply test the path you hand them.
    - Pass the matching objective in the \`objectives\` array (a single-element array).