@pensar/apex 2.1.3-canary.fff17bfd → 2.2.0

package/build/{cli-nth9zebw.js → cli-tz9yg4ew.js}

@@ -1,13 +1,20 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-tg7mcs43.js";
+} from "./cli-1re2kv5v.js";
+import {
+  REPORT_FILENAME_JSON,
+  REPORT_FILENAME_MD,
+  buildPentestReport,
+  renderJson,
+  renderMarkdown
+} from "./cli-2jn8104w.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-9wd7jy2s.js";
+} from "./cli-n114n8mk.js";
 import {
   CodeAgent
-} from "./cli-fj04wady.js";
+} from "./cli-knqx15w6.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,20 +22,16 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-a1acedxf.js";
-import {
-  EvidenceFileEntrySchema
-} from "./cli-9h847y2w.js";
+} from "./cli-7e5ad5js.js";
 import {
-  CweEntrySchema,
   FindingsRegistry,
   OffensiveSecurityAgent,
   PLAN_MODE_TOOL_NAMES,
-  ValidatedCweEntrySchema,
-  hasCanonicalName,
+  grpcAuthorityTarget,
   pLimit,
-  runWithBoundedConcurrency
-} from "./cli-akhax3yn.js";
+  runWithBoundedConcurrency,
+  toGrpcPentestContext
+} from "./cli-xbdn034b.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -36,20 +39,21 @@ import {
   createLogger,
   hasToolCall,
   init_dist,
+  init_id,
   init_lazyLogger,
   init_session,
   init_structured,
+  newSessionId,
   scopedLogger
-} from "./cli-v34r5t8t.js";
+} from "./cli-6kx46ck0.js";
 import {
-  exports_external,
-  init_zod
-} from "./cli-29yqhrjq.js";
+  __require
+} from "./cli-8rxa073f.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
 import { existsSync as existsSync13, readdirSync as readdirSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 
 // src/core/agents/specialized/pentest/planPrompt.ts
 var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
@@ -76,14 +80,23 @@ Guidelines:
 - Rank attack vectors by likelihood of success and potential impact
 - Each task should be atomic and testable independently
 - Include authentication bypass, injection, access control, and business logic testing as appropriate`;
-function buildPlanPrompt(target, objectives) {
+function buildPlanPrompt(target, objectives, grpc) {
   const objectiveList = objectives.map((o, i) => `${i + 1}. ${o}`).join(`
 `);
+  const grpcSection = grpc ? `
+## gRPC Target
+This target is a **gRPC method**, not a plain HTTP endpoint — plan gRPC-specific attack vectors (reflection/schema recovery, per-method missing-auth, BOLA on request-message IDs, metadata trust, \`:path\` authz bypass, protobuf fuzzing, streaming abuse) rather than HTTP-centric ones.
+- **Transport:** ${grpc.transport}
+- **Service:** ${grpc.serviceFqn}
+- **Method:** ${grpc.method}${grpc.streamingType ? `
+- **Streaming:** ${grpc.streamingType}` : ""}${grpc.host ? `
+- **Authority (host):** ${grpc.host}` : ""}
+` : "";
   return `# Planning Assignment
 
 ## Target
 - **URL:** ${target}
-
+${grpcSection}
 ## Objectives
 ${objectiveList}
 
@@ -97,185 +110,6 @@ ${objectiveList}
 // src/core/workflows/pentest.ts
 init_structured();
 
-// src/core/report/schemas.ts
-init_zod();
-var PentestReportFindingSchema = exports_external.object({
-  title: exports_external.string(),
-  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
-  description: exports_external.string(),
-  impact: exports_external.string(),
-  evidence: exports_external.string(),
-  endpoint: exports_external.string(),
-  pocPath: exports_external.string(),
-  remediation: exports_external.string(),
-  references: exports_external.string().optional(),
-  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
-  rootCauseGroup: exports_external.string().optional(),
-  relatedFindings: exports_external.array(exports_external.string()).optional(),
-  rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
-});
-var PentestReportSchema = exports_external.object({
-  version: exports_external.string().regex(/^1\.\d+$/),
-  metadata: exports_external.object({
-    target: exports_external.string(),
-    model: exports_external.string(),
-    timestamp: exports_external.string(),
-    sessionId: exports_external.string(),
-    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
-  }),
-  summary: exports_external.object({
-    totalFindings: exports_external.number(),
-    bySeverity: exports_external.object({
-      CRITICAL: exports_external.number(),
-      HIGH: exports_external.number(),
-      MEDIUM: exports_external.number(),
-      LOW: exports_external.number()
-    })
-  }),
-  findings: exports_external.array(PentestReportFindingSchema)
-});
-var REPORT_VERSION = "1.0";
-
-// src/core/report/builder.ts
-var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
-function buildPentestReport(findings, context) {
-  const sorted = [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
-  const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
-  for (const f of findings) {
-    bySeverity[f.severity]++;
-  }
-  return {
-    version: REPORT_VERSION,
-    metadata: {
-      target: context.target,
-      model: context.model,
-      timestamp: new Date().toISOString(),
-      sessionId: context.sessionId,
-      mode: context.mode
-    },
-    summary: {
-      totalFindings: findings.length,
-      bySeverity
-    },
-    findings: sorted.map((f) => ({
-      title: f.title,
-      severity: f.severity,
-      description: f.description,
-      impact: f.impact,
-      evidence: f.evidence,
-      endpoint: f.endpoint,
-      pocPath: f.pocPath,
-      remediation: f.remediation,
-      references: f.references,
-      cwes: f.cwes,
-      rootCauseGroup: f.rootCauseGroup,
-      relatedFindings: f.relatedFindings,
-      rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
-    }))
-  };
-}
-// src/core/report/renderers/json.ts
-function renderJson(report) {
-  return JSON.stringify(report, null, 2);
-}
-// src/core/report/renderers/markdown.ts
-function renderMarkdown(report) {
-  const { metadata, findings, summary } = report;
-  const header = [
-    `# Pentest Report — ${metadata.target}`,
-    "",
-    `**Date:** ${metadata.timestamp}  `,
-    `**Session:** ${metadata.sessionId}  `,
-    `**Model:** ${metadata.model}  `,
-    `**Mode:** ${metadata.mode}`,
-    "",
-    `**Findings:** ${summary.totalFindings}`,
-    ""
-  ];
-  if (findings.length === 0) {
-    return [
-      ...header,
-      "No findings were identified during this assessment.",
-      ""
-    ].join(`
-`);
-  }
-  const body = findings.map((finding) => renderFinding(finding, metadata)).join(`
-`);
-  return [...header, body].join(`
-`);
-}
-function renderFinding(finding, metadata) {
-  const lines = [
-    `# ${finding.title}`,
-    "",
-    `**Severity:** ${finding.severity}  `,
-    `**Target:** ${metadata.target}  `,
-    `**Endpoint:** ${finding.endpoint}  `,
-    `**Date:** ${metadata.timestamp}  `,
-    `**Session:** ${metadata.sessionId}`,
-    "",
-    "## Description",
-    "",
-    finding.description,
-    "",
-    "## Impact",
-    "",
-    finding.impact,
-    "",
-    "## Evidence",
-    "",
-    "```",
-    finding.evidence,
-    "```",
-    "",
-    ...finding.evidenceFiles?.length ? [
-      "## Evidence Files",
-      "",
-      ...finding.evidenceFiles.map((ef) => `- **[${ef.type}]** \`${ef.path}\` — ${ef.description}`),
-      ""
-    ] : [],
-    ...finding.cwes?.length ? [
-      "## CWE Classification",
-      "",
-      ...finding.cwes.map((cwe) => `- **${cwe.id}**${hasCanonicalName(cwe) ? `: ${cwe.name}` : ""} — ${cwe.reasoning}`),
-      ""
-    ] : [],
-    ...finding.rootCauseGroup ? [
-      "## Root Cause Group",
-      "",
-      `**Group:** \`${finding.rootCauseGroup}\``,
-      ...finding.relatedFindings?.length ? [
-        "",
-        "**Related Findings:**",
-        ...finding.relatedFindings.map((rf) => `- ${rf}`)
-      ] : [],
-      ""
-    ] : [],
-    "## POC",
-    "",
-    `Path: \`${finding.pocPath}\``,
-    "",
-    "## Remediation",
-    "",
-    finding.remediation,
-    ...finding.references ? ["", `## References`, "", finding.references] : [],
-    "",
-    "---",
-    "",
-    "*This finding was automatically documented by the Pensar penetration testing agent.*",
-    ""
-  ];
-  return lines.join(`
-`);
-}
-
-// src/core/report/index.ts
-var REPORT_FILENAME_MD = "pentest-report.md";
-var REPORT_FILENAME_JSON = "pentest-report.json";
-
 // src/core/session/execution-metrics.ts
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -363,6 +197,7 @@ init_lazyLogger();
 init_structured();
 init_lazyLogger();
 init_session();
+init_id();
 import {
   existsSync as existsSync2,
   mkdirSync,
@@ -441,15 +276,34 @@ function readAgentManifest(session) {
   }
 }
 function buildManifestEntries(targets) {
-  return targets.map((t, i) => ({
-    id: `pentest-agent-${i + 1}`,
-    name: `Pentest Agent ${i + 1}`,
-    target: t.target,
-    vulnerabilityClass: t.objectives[0] || "general",
-    objective: t.objectives.join("; "),
-    status: "running",
-    spawnedAt: new Date().toISOString()
-  }));
+  return targets.map((t, i) => {
+    const sessionId = newSessionId();
+    return {
+      id: sessionId,
+      sessionId,
+      name: `Pentest Agent ${i + 1}`,
+      target: t.target,
+      vulnerabilityClass: t.objectives[0] || "general",
+      objective: t.objectives.join("; "),
+      status: "running",
+      spawnedAt: new Date().toISOString()
+    };
+  });
+}
+function reconcileManifestOnResume(existing, fresh) {
+  return fresh.map((f, i) => {
+    const prev = existing[i];
+    if (!prev || prev.target !== f.target)
+      return f;
+    if (prev.status === "completed")
+      return prev;
+    return {
+      ...f,
+      id: prev.id,
+      sessionId: prev.sessionId ?? prev.id,
+      spawnedAt: prev.spawnedAt
+    };
+  });
 }
 function finalizeManifest(session, entries, results) {
   const finalManifest = entries.map((entry, i) => {
@@ -470,7 +324,7 @@ function updateManifestEntryStatus(session, agentId, status) {
 }
 function getCompletedAgentIds(session) {
   const manifest = readAgentManifest(session);
-  return new Set(manifest.filter((e) => e.id.startsWith("pentest-agent-") && e.status === "completed").map((e) => e.id));
+  return new Set(manifest.filter((e) => e.status === "completed").map((e) => e.id));
 }
 function parseSubagentFilename(filename) {
   if (filename.startsWith("attack-surface-agent")) {
@@ -611,6 +465,17 @@ function convertModelMessagesToUI(messages) {
 }
 function loadSubagents(rootPath) {
   const subagentsPath = join2(rootPath, SUBAGENTS_DIR);
+  const manifestNameById = new Map;
+  {
+    const manifestPath2 = join2(rootPath, MANIFEST_FILE);
+    if (existsSync2(manifestPath2)) {
+      try {
+        const manifest = JSON.parse(readFileSync2(manifestPath2, "utf-8"));
+        for (const entry of manifest)
+          manifestNameById.set(entry.id, entry.name);
+      } catch {}
+    }
+  }
   const subagents = [];
   const agentNameIndex = new Map;
   if (existsSync2(subagentsPath)) {
@@ -654,7 +519,7 @@ function loadSubagents(rootPath) {
         agentNameIndex.set(data.agentName, subagents.length);
         subagents.push({
           id: data.agentName,
-          name: data.agentName === "attack-surface-agent" ? "Attack Surface Discovery" : name,
+          name: manifestNameById.get(data.agentName) ?? (data.agentName === "attack-surface-agent" ? "Attack Surface Discovery" : name),
           type: agentType,
           target: data.target || "Unknown",
           messages,
@@ -685,7 +550,7 @@ function loadSubagents(rootPath) {
         agentNameIndex.set(entry, subagents.length);
         subagents.push({
           id: entry,
-          name,
+          name: manifestNameById.get(entry) ?? name,
           type: agentType,
           target: "Unknown",
           messages,
@@ -762,16 +627,14 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 
 // src/core/agents/specialized/whiteboxAttackSurface/endpointDocumentationAgent.ts
+init_id();
 init_structured();
 init_lazyLogger();
 var log3 = scopedLogger(() => createLogger("endpoint-documentation-agent"));
 var ENDPOINT_DOCUMENTATION_CONCURRENCY = 10;
-function slug(name) {
-  return name.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
-}
 function getDocumentMethod(endpoint) {
   return endpoint.kind === "page" ? ["PAGE"] : endpoint.method;
 }
@@ -782,6 +645,18 @@ function buildEndpointDocumentationObjective(opts) {
   const methodDisplay = documentMethod.join(",");
   const methodValue = JSON.stringify(documentMethod.length === 1 ? documentMethod[0] : documentMethod);
   const endpointType = endpoint.kind === "page" ? "web-endpoint" : "api-endpoint";
+  const isGrpc = !!endpoint.transport && endpoint.transport !== "http";
+  const grpcSection = isGrpc ? `
+## gRPC (deterministically extracted by surface)
+
+This endpoint is a **gRPC method**, not a plain HTTP route. \`routePath\` is the wire path \`/package.Service/Method\` — do NOT glue a host onto it.
+
+- **transport**: ${endpoint.transport}
+- **grpc.serviceFqn**: ${endpoint.grpc?.serviceFqn ?? "(derive from routePath)"}
+- **grpc.method**: ${endpoint.grpc?.method ?? "(derive from routePath)"}
+- **grpc.streamingType**: ${endpoint.grpc?.streamingType ?? "unary"}
+` : "";
+  const grpcInstruction = isGrpc ? ` Because this is a gRPC method, ALSO pass \`transport: "${endpoint.transport}"\` and a \`grpc\` object built from the values above (\`serviceFqn\`, \`method\`, \`streamingType\`, plus \`schemaSource: "proto"\`); you MAY add \`reflectionAvailable\` or \`frontingGatewayOperation\` when the source makes them clear.` : "";
   const auth = endpoint.auth.length > 0 ? endpoint.auth.join(", ") : "none";
   const authPrefill = endpoint.auth.length > 0;
   return `# Document Endpoint: ${methodDisplay} ${endpoint.path}
@@ -801,10 +676,10 @@ function buildEndpointDocumentationObjective(opts) {
 - **endpointType**: ${endpointType}
 - **auth signals**: ${auth}
 - **prefilled authRequired**: ${authPrefill}
-
+${grpcSection}
 ## Task
 
-Document this **single endpoint** by calling \`document_endpoint\` exactly once. Use the deterministic fields above as-is for \`appName\` (\`"${app.name}"\`), \`routePath\`, \`method\` (\`${methodValue}\`), \`endpointType\` (\`"${endpointType}"\`), \`file\`, \`line\`, and \`handler\`. The remaining fields you must produce yourself:
+Document this **single endpoint** by calling \`document_endpoint\` exactly once. Use the deterministic fields above as-is for \`appName\` (\`"${app.name}"\`), \`routePath\`, \`method\` (\`${methodValue}\`), \`endpointType\` (\`"${endpointType}"\`), \`file\`, \`line\`, and \`handler\`.${grpcInstruction} The remaining fields you must produce yourself:
 
 - **authRequired**: start from the prefilled value above. Override only after reading the middleware chain at the indicated file when the signals are genuinely ambiguous.
 - **description**: 1–2 sentences explaining what this endpoint does in plain English. Read the handler at \`${endpoint.file}:${endpoint.line}\` to ground it.
@@ -840,11 +715,12 @@ async function runEndpointDocumentationAgent(opts) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     projectThreatModel,
     parentSubagentId,
     agentLimiter
   } = opts;
-  const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
+  const subagentId = newSessionId();
   const displayMethod = getDocumentMethod(endpoint);
   const displayName = `${app.name}: ${displayMethod.join(",")} ${endpoint.path}`;
   eventBus?.emit("subagent-spawn", {
@@ -875,10 +751,12 @@ async function runEndpointDocumentationAgent(opts) {
     attackSurfaceRegistry,
     eventBus,
     subagentId,
+    subagentName: displayName,
     onStepFinish: (event) => onStepFinish?.(event),
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: DiscoverySummarySchema,
     excludeTools: ["document_app", "list_files", "grep"],
     projectThreatModel
@@ -916,13 +794,16 @@ async function runAppEndpointDocumentation(opts) {
   }
 }
 
+// src/core/workflows/whiteboxAttackSurface.ts
+init_id();
+
 // src/core/integrations/surface/index.ts
 import { existsSync as existsSync10 } from "node:fs";
-import { dirname as dirname2, relative as relative3, resolve as resolve2, sep } from "node:path";
+import { dirname as dirname3, relative as relative3, resolve as resolve2, sep } from "node:path";
 
 // node_modules/@pensar/surface/dist/index.js
 import { existsSync as existsSync9, readdirSync as readdirSync9, readFileSync as readFileSync8 } from "fs";
-import { join as join14, resolve } from "path";
+import { join as join15, resolve } from "path";
 import { readdirSync as readdirSync2, readFileSync as readFileSync4, lstatSync, realpathSync } from "fs";
 import { join as join4, relative, extname } from "path";
 import { readdirSync as readdirSync22, existsSync as existsSync4, lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
@@ -3624,16 +3505,17 @@ var jsYaml = {
 };
 
 // node_modules/@pensar/surface/dist/index.js
+import { dirname as dirname2, join as join9 } from "path";
 import { existsSync as existsSync5, readFileSync as readFileSync5, readdirSync as readdirSync5 } from "fs";
-import { join as join10, basename as basename2 } from "path";
+import { join as join11, basename as basename2 } from "path";
 import { readFileSync as readFileSync42 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { existsSync as existsSync6, readFileSync as readFileSync6, readdirSync as readdirSync6 } from "fs";
-import { join as join11 } from "path";
-import { existsSync as existsSync7, readdirSync as readdirSync7 } from "fs";
 import { join as join12 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync7 } from "fs";
+import { join as join13 } from "path";
 import { existsSync as existsSync8, readFileSync as readFileSync7, readdirSync as readdirSync8 } from "fs";
-import { join as join13, basename as basename3 } from "path";
+import { join as join14, basename as basename3 } from "path";
 var EndpointIndex = class {
   _endpoints;
   _byFramework = null;
@@ -3979,6 +3861,10 @@ function endpoint(e) {
     auth: e.auth ?? [],
     internal: false
   };
+  if (e.transport)
+    ep.transport = e.transport;
+  if (e.grpc)
+    ep.grpc = e.grpc;
   if (e.service)
     ep.service = e.service;
   if (e.handlerFile)
@@ -4014,6 +3900,7 @@ var flask = {
       bpPrefixes[v] = p;
     }
     const routeRe = /@(\w+)\.(?:route|get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"](?:\s*,\s*methods\s*=\s*\[([^\]]*)\])?\s*\)(.*?)(?:async\s+)?def\s+(\w+)\s*\(/gs;
+    const bodyEndRe = /^(?:@\w|(?:async\s+)?def\s|class\s)/m;
     for (const f of pyFiles) {
       const content = ctx.readFile(f);
       if (!content)
@@ -4038,9 +3925,15 @@ var flask = {
         }
         const auth = findAuthDecorators(between);
         const params = extractPathParams(fullPath);
+        const bodyStart = m.index + m[0].length;
+        const rest = content.slice(bodyStart);
+        const endMatch = bodyEndRe.exec(rest);
+        const body = endMatch ? rest.slice(0, endMatch.index) : rest;
+        const kind = /\brender_template(?:_string)?\s*\(/.test(body) ? "page" : "api";
         for (const method of methods) {
           endpoints.push(endpoint({
             method,
+            kind,
             path: fullPath,
             handler: funcName,
             file: rel,
@@ -4081,7 +3974,7 @@ var fastapi = {
     for (const [v, p] of Object.entries(includePrefixes)) {
       routerPrefixes[v] = p;
     }
-    const routeRe = /@(\w+)\.(get|post|put|delete|patch|head|options|websocket)\s*\(\s*['"]([^'"]+)['"]\s*(?:,.*?)?\)(.*?)(?:async\s+)?def\s+(\w+)\s*\(([^)]*)\)/gs;
+    const routeRe = /@(\w+)\.(get|post|put|delete|patch|head|options|websocket)\s*\(\s*['"]([^'"]+)['"]\s*((?:,.*?)?)\)(.*?)(?:async\s+)?def\s+(\w+)\s*\(([^)]*)\)/gs;
     for (const f of pyFiles) {
       const content = ctx.readFile(f);
       if (!content)
@@ -4092,13 +3985,21 @@ var fastapi = {
         const varName = m[1];
         let httpMethod = m[2].toUpperCase();
         const routePath = m[3];
-        const between = m[4];
-        const funcName = m[5];
-        const funcParams = m[6];
+        const decoratorArgs = m[4];
+        const between = m[5];
+        const funcName = m[6];
+        const funcParams = m[7];
         const line = lines.lineAt(m.index);
         const isWebSocket = httpMethod === "WEBSOCKET";
         if (isWebSocket)
           httpMethod = "WS";
+        const bodyStart = m.index + m[0].length;
+        const after = content.slice(bodyStart, bodyStart + 4000);
+        const nextRouteRe = /\n(?=@\w+\.|def\s|async\s+def\s)/;
+        const nextMatch = after.match(nextRouteRe);
+        const body = nextMatch ? after.slice(0, nextMatch.index) : after;
+        const isPage = !isWebSocket && (/response_class\s*=\s*\w*HTMLResponse\b/.test(decoratorArgs) || /\bHTMLResponse\s*\(/.test(body) || /\.TemplateResponse\s*\(/.test(body));
+        const kind = isWebSocket ? "websocket" : isPage ? "page" : "api";
         const prefix = routerPrefixes[varName] ?? "";
         const fullPath = normalizePath(prefix + routePath);
         const auth = findAuthDecorators(between + funcParams);
@@ -4114,7 +4015,7 @@ var fastapi = {
         }
         endpoints.push(endpoint({
           method: httpMethod,
-          kind: isWebSocket ? "websocket" : "api",
+          kind,
           path: fullPath,
           handler: funcName,
           file: rel,
@@ -4129,12 +4030,105 @@ var fastapi = {
   }
 };
 var PY_EXTS3 = [".py"];
+var PAGE_CBV_BASES = /* @__PURE__ */ new Set([
+  "TemplateView",
+  "ListView",
+  "DetailView",
+  "CreateView",
+  "UpdateView",
+  "DeleteView",
+  "FormView"
+]);
 var django = {
   id: "django",
   detect: { depKeywords: ["django"], markers: ["manage.py"], scope: "all" },
   extract(ctx) {
     const endpoints = [];
     const pyFiles = ctx.iterFiles(PY_EXTS3);
+    const dirOf2 = (f) => {
+      const norm = f.replace(/\\/g, "/");
+      const i2 = norm.lastIndexOf("/");
+      return i2 < 0 ? "" : norm.slice(0, i2);
+    };
+    const classesByDir = /* @__PURE__ */ new Map;
+    const funcsByDir = /* @__PURE__ */ new Map;
+    const globalClasses = {};
+    const globalFuncs = {};
+    const classRe = /^class\s+(\w+)\s*\(([^)]*)\)\s*:/gm;
+    const funcRe = /^(?:async\s+)?def\s+(\w+)\s*\([^)]*\)\s*(?:->[^:\n]+)?:[ \t]*\n?([\s\S]*?)(?=^(?:(?:async\s+)?def |class )|$(?![\s\S]))/gm;
+    for (const f of pyFiles) {
+      const content = ctx.readFile(f);
+      if (!content)
+        continue;
+      const dir = dirOf2(f);
+      const dirClasses = classesByDir.get(dir) ?? {};
+      const dirFuncs = funcsByDir.get(dir) ?? {};
+      for (const m of content.matchAll(classRe)) {
+        const name = m[1];
+        const bases = m[2].split(",").map((b) => b.trim()).filter(Boolean).map((b) => b.split(".").pop().replace(/\s+/g, ""));
+        dirClasses[name] = { bases };
+        globalClasses[name] = { bases };
+      }
+      for (const m of content.matchAll(funcRe)) {
+        const name = m[1];
+        const body = m[2] ?? "";
+        dirFuncs[name] = { body };
+        globalFuncs[name] = { body };
+      }
+      classesByDir.set(dir, dirClasses);
+      funcsByDir.set(dir, dirFuncs);
+    }
+    const resolveHandlerName = (viewRef) => {
+      const parts = viewRef.split(".");
+      const last = parts[parts.length - 1];
+      if ((last === "as_view" || last === "as_asgi") && parts.length >= 2) {
+        return parts[parts.length - 2];
+      }
+      return last;
+    };
+    const lookupInApp = (byDir, global, name, dir) => {
+      const exact = byDir.get(dir)?.[name];
+      if (exact)
+        return exact;
+      let best;
+      const prefix = dir + "/";
+      for (const [d, rec] of byDir) {
+        if (!d.startsWith(prefix))
+          continue;
+        const def = rec[name];
+        if (def && (!best || d.length < best.depth)) {
+          best = { def, depth: d.length };
+        }
+      }
+      return best?.def ?? global[name];
+    };
+    const lookupClass = (name, dir) => lookupInApp(classesByDir, globalClasses, name, dir);
+    const lookupFunc = (name, dir) => lookupInApp(funcsByDir, globalFuncs, name, dir);
+    const isPageClass = (name, dir, seen = /* @__PURE__ */ new Set) => {
+      if (seen.has(name))
+        return false;
+      seen.add(name);
+      const cls = lookupClass(name, dir);
+      if (!cls)
+        return false;
+      for (const b of cls.bases) {
+        if (PAGE_CBV_BASES.has(b))
+          return true;
+        if (isPageClass(b, dir, seen))
+          return true;
+      }
+      return false;
+    };
+    const classifyView = (viewRef, dir) => {
+      const handler = resolveHandlerName(viewRef);
+      if (lookupClass(handler, dir)) {
+        return isPageClass(handler, dir) ? "page" : "api";
+      }
+      const fn = lookupFunc(handler, dir);
+      if (fn && /\brender\s*\(/.test(fn.body))
+        return "page";
+      return "api";
+    };
     const urlFiles = pyFiles.filter((f) => {
       const name = f.split("/").pop();
       return name === "urls.py" || name === "routes.py";
@@ -4164,16 +4158,19 @@ var django = {
           break;
         }
       }
+      const urlDir = dirOf2(f);
       const lines = buildLineIndex(content);
       for (const m of content.matchAll(directPathRe)) {
         const routePath = m[1];
         const viewRef = m[2];
         const line = lines.lineAt(m.index);
         const fullPath = normalizePath(ownPrefix + routePath);
+        const kind = classifyView(viewRef, urlDir);
         endpoints.push(endpoint({
           method: "ANY",
+          kind,
           path: fullPath,
-          handler: viewRef.split(".").pop(),
+          handler: resolveHandlerName(viewRef),
           file: rel,
           line,
           framework: "django",
@@ -4207,10 +4204,119 @@ var django = {
         }
       }
     }
+    const wsBlockRe = /websocket_urlpatterns\s*=\s*\[([\s\S]*?)\]/g;
+    const wsEntryRe = /(?:re_path|path|url)\s*\(\s*r?['"]([^'"]*)['"]\s*,\s*(\w[\w.]*)/g;
+    for (const f of pyFiles) {
+      const content = ctx.readFile(f);
+      if (!content || !content.includes("websocket_urlpatterns"))
+        continue;
+      const rel = ctx.rel(f);
+      const lines = buildLineIndex(content);
+      for (const block of content.matchAll(wsBlockRe)) {
+        const blockBody = block[1];
+        const blockOffset = block.index + block[0].indexOf(blockBody);
+        for (const m of blockBody.matchAll(wsEntryRe)) {
+          const routePath = m[1];
+          const consumerRef = m[2];
+          const absOffset = blockOffset + m.index;
+          const line = lines.lineAt(absOffset);
+          const fullPath = normalizePath(routePath);
+          endpoints.push(endpoint({
+            method: "WS",
+            kind: "websocket",
+            path: fullPath,
+            handler: resolveHandlerName(consumerRef),
+            file: rel,
+            line,
+            framework: "django",
+            params: extractPathParams(fullPath)
+          }));
+        }
+      }
+    }
     return endpoints;
   }
 };
 var JS_EXTS = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx"];
+var PAGE_RENDER_RE = /\bres\s*\.\s*render\s*\(/;
+var PAGE_SENDFILE_RE = /\bres\s*\.\s*sendFile\s*\(/;
+function findMatchingParen(content, start) {
+  let depth = 0;
+  let i2 = start;
+  const len = content.length;
+  while (i2 < len) {
+    const ch = content[i2];
+    if (ch === "/" && content[i2 + 1] === "/") {
+      const nl = content.indexOf(`
+`, i2);
+      if (nl === -1)
+        return -1;
+      i2 = nl + 1;
+      continue;
+    }
+    if (ch === "/" && content[i2 + 1] === "*") {
+      const end = content.indexOf("*/", i2 + 2);
+      if (end === -1)
+        return -1;
+      i2 = end + 2;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      i2++;
+      while (i2 < len) {
+        const c = content[i2];
+        if (c === "\\") {
+          i2 += 2;
+          continue;
+        }
+        if (c === ch) {
+          i2++;
+          break;
+        }
+        i2++;
+      }
+      continue;
+    }
+    if (ch === "`") {
+      i2++;
+      while (i2 < len) {
+        const c = content[i2];
+        if (c === "\\") {
+          i2 += 2;
+          continue;
+        }
+        if (c === "`") {
+          i2++;
+          break;
+        }
+        if (c === "$" && content[i2 + 1] === "{") {
+          i2 += 2;
+          let d = 1;
+          while (i2 < len && d > 0) {
+            const cc = content[i2];
+            if (cc === "{")
+              d++;
+            else if (cc === "}")
+              d--;
+            i2++;
+          }
+          continue;
+        }
+        i2++;
+      }
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}") {
+      depth--;
+      if (depth === 0 && ch === ")")
+        return i2;
+    }
+    i2++;
+  }
+  return -1;
+}
 var express = {
   id: "express",
   detect: {
@@ -4232,28 +4338,49 @@ var express = {
         mountPrefixes[m[2]] = m[1];
       }
     }
-    const routeRe = /(\w+)\s*\.\s*(get|post|put|delete|patch|all|head|options)\s*\(\s*['"]([^'"]+)['"]\s*,\s*(.*?)\)/gs;
+    const routeOpenerRe = /(\w+)\s*\.\s*(get|post|put|delete|patch|all|head|options|ws)\s*\(\s*(['"])([^'"]+)\3\s*,/g;
     for (const f of jsFiles) {
       const content = ctx.readFile(f);
       if (!content)
         continue;
       const rel = ctx.rel(f);
       const lines = buildLineIndex(content);
-      for (const m of content.matchAll(routeRe)) {
+      for (const m of content.matchAll(routeOpenerRe)) {
         const varName = m[1];
-        let httpMethod = m[2].toUpperCase();
-        const routePath = m[3];
-        const handlerArgs = m[4];
-        const line = lines.lineAt(m.index);
+        const methodTok = m[2].toLowerCase();
+        const routePath = m[4];
+        const matchStart = m.index;
+        const line = lines.lineAt(matchStart);
+        const openParen = content.indexOf("(", matchStart);
+        if (openParen === -1)
+          continue;
+        const closeParen = findMatchingParen(content, openParen);
+        if (closeParen === -1)
+          continue;
+        const callBody = content.slice(openParen + 1, closeParen);
+        const afterPathComma = callBody.indexOf(",");
+        const handlerArgs = afterPathComma >= 0 ? callBody.slice(afterPathComma + 1) : callBody;
+        const isWs = methodTok === "ws";
+        let httpMethod = methodTok.toUpperCase();
         if (httpMethod === "ALL")
           httpMethod = "ANY";
+        if (isWs)
+          httpMethod = "WS";
         const prefix = mountPrefixes[varName] ?? "";
         const fullPath = normalizePath(prefix + routePath);
-        const handlerMatch = handlerArgs.match(/(\w+)\s*[,)]/);
+        const handlerNameMatch = handlerArgs.match(/^\s*(\w+)\s*[,)]/);
+        const handlerName = handlerNameMatch ? handlerNameMatch[1] : "<anonymous>";
+        let kind = "api";
+        if (isWs) {
+          kind = "websocket";
+        } else if (PAGE_RENDER_RE.test(handlerArgs) || PAGE_SENDFILE_RE.test(handlerArgs)) {
+          kind = "page";
+        }
         endpoints.push(endpoint({
           method: httpMethod,
+          kind,
           path: fullPath,
-          handler: handlerMatch ? handlerMatch[1] : "<anonymous>",
+          handler: handlerName,
           file: rel,
           line,
           framework: "express",
@@ -4262,9 +4389,219 @@ var express = {
         }));
       }
     }
+    const ioOfRe = /\b(\w+)\s*\.\s*of\s*\(\s*(['"])([^'"]+)\2\s*\)/g;
+    const ioOnConnRe = /\b(\w+)\s*\.\s*on\s*\(\s*(['"])connection\2\s*,\s*(.*?)\)/gs;
+    const wsServerRe = /new\s+(?:WebSocket\s*\.\s*Server|WebSocketServer)\s*\(/g;
+    for (const f of jsFiles) {
+      const content = ctx.readFile(f);
+      if (!content)
+        continue;
+      const rel = ctx.rel(f);
+      const lines = buildLineIndex(content);
+      const importsSocketIo = /(?:from\s+|require\(\s*)['"]socket\.io['"]/.test(content);
+      const ioInstances = /* @__PURE__ */ new Set;
+      if (importsSocketIo) {
+        for (const m of content.matchAll(/\b(\w+)\s*=\s*new\s+(?:Server|SocketIOServer|IOServer)\s*\(/g))
+          ioInstances.add(m[1]);
+        for (const m of content.matchAll(/\b(\w+)\s*=\s*require\(\s*['"]socket\.io['"]\s*\)\s*\(/g))
+          ioInstances.add(m[1]);
+        const factories = /* @__PURE__ */ new Set;
+        for (const m of content.matchAll(/\b(\w+)\s*=\s*require\(\s*['"]socket\.io['"]\s*\)(?!\s*\()/g))
+          factories.add(m[1]);
+        for (const m of content.matchAll(/import\s+(\w+)\s+from\s+['"]socket\.io['"]/g))
+          factories.add(m[1]);
+        for (const fac of factories) {
+          for (const m of content.matchAll(new RegExp(`\\b(\\w+)\\s*=\\s*${fac}\\s*\\(`, "g")))
+            ioInstances.add(m[1]);
+        }
+      }
+      const namespacePaths = /* @__PURE__ */ new Set;
+      let emittedRootIo = false;
+      if (ioInstances.size > 0) {
+        for (const m of content.matchAll(ioOfRe)) {
+          if (!ioInstances.has(m[1]))
+            continue;
+          const ns = m[3];
+          namespacePaths.add(ns);
+          endpoints.push(endpoint({
+            method: "WS",
+            kind: "websocket",
+            path: normalizePath(ns),
+            handler: "<anonymous>",
+            file: rel,
+            line: lines.lineAt(m.index),
+            framework: "express",
+            params: extractPathParams(normalizePath(ns))
+          }));
+        }
+        for (const m of content.matchAll(ioOnConnRe)) {
+          if (!ioInstances.has(m[1]))
+            continue;
+          if (!namespacePaths.has("/")) {
+            endpoints.push(endpoint({
+              method: "WS",
+              kind: "websocket",
+              path: "/",
+              handler: "<anonymous>",
+              file: rel,
+              line: lines.lineAt(m.index),
+              framework: "express"
+            }));
+            emittedRootIo = true;
+          }
+          break;
+        }
+      }
+      ioOnConnRe.lastIndex = 0;
+      const hasRootIoEndpoint = namespacePaths.has("/") || emittedRootIo;
+      if (!hasRootIoEndpoint) {
+        for (const m of content.matchAll(wsServerRe)) {
+          endpoints.push(endpoint({
+            method: "WS",
+            kind: "websocket",
+            path: "/",
+            handler: "<anonymous>",
+            file: rel,
+            line: lines.lineAt(m.index),
+            framework: "express"
+          }));
+          break;
+        }
+      }
+    }
     return endpoints;
   }
 };
+function maskComments(src) {
+  let out = "";
+  let i2 = 0;
+  const n = src.length;
+  while (i2 < n) {
+    const c = src[i2];
+    if (c === '"' || c === "'" || c === "`") {
+      out += c;
+      i2++;
+      while (i2 < n) {
+        if (src[i2] === "\\" && i2 + 1 < n) {
+          out += src[i2] + src[i2 + 1];
+          i2 += 2;
+          continue;
+        }
+        out += src[i2];
+        const done = src[i2] === c;
+        i2++;
+        if (done)
+          break;
+      }
+    } else if (c === "/" && src[i2 + 1] === "/") {
+      while (i2 < n && src[i2] !== `
+`) {
+        out += " ";
+        i2++;
+      }
+    } else if (c === "/" && src[i2 + 1] === "*") {
+      out += "  ";
+      i2 += 2;
+      while (i2 < n && !(src[i2] === "*" && src[i2 + 1] === "/")) {
+        out += src[i2] === `
+` ? `
+` : " ";
+        i2++;
+      }
+      if (i2 < n) {
+        out += "  ";
+        i2 += 2;
+      }
+    } else {
+      out += c;
+      i2++;
+    }
+  }
+  return out;
+}
+function classDecoratorBlock(content, classStart) {
+  const lineStart = (pos) => {
+    let p = pos;
+    while (p > 0 && content[p - 1] !== `
+`)
+      p--;
+    return p;
+  };
+  const isStackLine = (line) => line === "" || line.startsWith("@") || line.startsWith("//") || line.startsWith("/*") || line.startsWith("*") || line.endsWith(",") || line.endsWith("(") || line.endsWith(")");
+  const endsPrevStatement = (line) => line.endsWith("}") || line.endsWith(";");
+  let start = lineStart(classStart);
+  while (start > 0) {
+    const prev = lineStart(start - 1);
+    const line = content.slice(prev, start - 1).trim();
+    if (endsPrevStatement(line))
+      break;
+    if (!isStackLine(line))
+      break;
+    start = prev;
+  }
+  return content.slice(start, classStart);
+}
+function findClasses(content) {
+  const classes = [];
+  const classRe = /\bclass\s+(\w+)/g;
+  const scan = maskComments(content);
+  for (const m of scan.matchAll(classRe)) {
+    const start = m.index;
+    const name = m[1];
+    const decorators = classDecoratorBlock(content, start);
+    if (classes.length > 0)
+      classes[classes.length - 1].end = start;
+    classes.push({ start, end: content.length, name, decorators });
+  }
+  return classes;
+}
+function methodDecoratorBlock(content, offset) {
+  const lineStart = (pos) => {
+    let p = pos;
+    while (p > 0 && content[p - 1] !== `
+`)
+      p--;
+    return p;
+  };
+  const isStackLine = (line) => line === "" || line.startsWith("@") || line.startsWith("//") || line.startsWith("/*") || line.startsWith("*") || line.endsWith(",") || line.endsWith("(") || line.endsWith(")");
+  const endsPrevStatement = (line) => line.endsWith("}") || line.endsWith(";");
+  let start = lineStart(offset);
+  while (start > 0) {
+    const prev = lineStart(start - 1);
+    const line = content.slice(prev, start - 1).trim();
+    if (endsPrevStatement(line))
+      break;
+    if (!isStackLine(line))
+      break;
+    start = prev;
+  }
+  let end = offset;
+  while (end < content.length && content[end] !== `
+`)
+    end++;
+  while (end < content.length) {
+    const nextStart = end + 1;
+    let nextEnd = nextStart;
+    while (nextEnd < content.length && content[nextEnd] !== `
+`)
+      nextEnd++;
+    const line = content.slice(nextStart, nextEnd).trim();
+    if (line === "") {
+      end = nextEnd;
+      continue;
+    }
+    if (line.startsWith("@") || line.startsWith("//") || line.startsWith("*")) {
+      end = nextEnd;
+      continue;
+    }
+    if (line.endsWith(",") || line.endsWith(")")) {
+      end = nextEnd;
+      continue;
+    }
+    break;
+  }
+  return content.slice(start, end);
+}
 var nestjs = {
   id: "nestjs",
   detect: { depKeywords: ["@nestjs/core"], markers: [], scope: "root" },
@@ -4272,31 +4609,77 @@ var nestjs = {
     const endpoints = [];
     const tsFiles = ctx.iterFiles([".ts"]);
     const controllerRe = /@Controller\s*\(\s*['"]([^'"]*)['"]\s*\)/;
+    const wsGatewayRe = /@WebSocketGateway\s*\(([^)]*)\)|@WebSocketGateway\b/;
     const methodRe = /@(Get|Post|Put|Delete|Patch|Head|Options)\s*\(\s*['"]?([^'")]*?)['"]?\s*\)(.*?)(?:async\s+)?(\w+)\s*\(/gs;
+    const subscribeRe = /@SubscribeMessage\s*\(\s*['"]([^'"]*)['"]\s*\)(.*?)(?:async\s+)?(\w+)\s*\(/gs;
+    const grpcRe = /@(GrpcMethod|GrpcStreamMethod)\s*\(([^)]*)\)[\s\S]{0,160}?(?:async\s+)?(\w+)\s*\(/g;
     const guardRe = /@UseGuards?\s*\(\s*(\w+)/g;
     for (const f of tsFiles) {
       const content = ctx.readFile(f);
-      if (!content || !content.includes("@Controller"))
+      if (!content)
+        continue;
+      if (!content.includes("@Controller") && !content.includes("@WebSocketGateway") && !content.includes("@Grpc"))
         continue;
       const rel = ctx.rel(f);
-      const ctrlMatch = controllerRe.exec(content);
-      const controllerPrefix = ctrlMatch?.[1] ?? "";
-      const classAuth = [];
-      const classIdx = content.indexOf("class ");
-      if (classIdx > 0) {
-        const preClass = content.slice(0, classIdx);
+      const lines = buildLineIndex(content);
+      const classes = findClasses(content);
+      const fileCtrlMatch = controllerRe.exec(content);
+      const fileControllerPrefix = fileCtrlMatch?.[1] ?? "";
+      const fileClassAuth = [];
+      const firstClassIdx = content.indexOf("class ");
+      if (firstClassIdx > 0) {
+        const preClass = content.slice(0, firstClassIdx);
         for (const gm of preClass.matchAll(guardRe)) {
-          classAuth.push(`@UseGuards(${gm[1]})`);
+          fileClassAuth.push(`@UseGuards(${gm[1]})`);
         }
       }
-      const lines = buildLineIndex(content);
+      const classAt = (offset) => {
+        for (const c of classes) {
+          if (offset >= c.start && offset < c.end)
+            return c;
+        }
+        return null;
+      };
+      const classCtx = /* @__PURE__ */ new Map;
+      for (const c of classes) {
+        const ctrl = controllerRe.exec(c.decorators);
+        const prefix = ctrl?.[1] ?? "";
+        const auth = [];
+        for (const gm of c.decorators.matchAll(guardRe)) {
+          auth.push(`@UseGuards(${gm[1]})`);
+        }
+        const ws = wsGatewayRe.exec(c.decorators);
+        const isGateway = !!ws;
+        let wsNamespace = "";
+        if (ws && ws[1]) {
+          const nsMatch = /namespace\s*:\s*['"]([^'"]*)['"]/.exec(ws[1]);
+          if (nsMatch)
+            wsNamespace = nsMatch[1];
+        }
+        classCtx.set(c.name, { prefix, auth, isGateway, wsNamespace });
+      }
       for (const m of content.matchAll(methodRe)) {
         const httpMethod = m[1].toUpperCase();
         const routePath = m[2];
         const between = m[3];
-        const handler = m[4];
-        const line = lines.lineAt(m.index);
-        const fullPath = normalizePath(controllerPrefix + "/" + routePath);
+        let handler = m[4];
+        const offset = m.index;
+        const line = lines.lineAt(offset);
+        if (between.includes("@")) {
+          const fwd = content.slice(offset, offset + 600);
+          const after = fwd.indexOf(")");
+          if (after >= 0) {
+            const handlerRe = /(?:@\w+\s*\([^)]*\)\s*)*(?:async\s+)?(\w+)\s*\(/g;
+            handlerRe.lastIndex = after + 1;
+            const hm = handlerRe.exec(fwd);
+            if (hm)
+              handler = hm[1];
+          }
+        }
+        const cls = classAt(offset);
+        const prefix = cls ? classCtx.get(cls.name)?.prefix ?? "" : fileControllerPrefix;
+        const classAuth = cls ? classCtx.get(cls.name)?.auth ?? [] : fileClassAuth;
+        const fullPath = normalizePath(prefix + "/" + routePath);
         const params = extractPathParams(fullPath);
         const methodAuth = [...classAuth];
         for (const gm of between.matchAll(/@UseGuards?\s*\(\s*(\w+)/g)) {
@@ -4309,6 +4692,9 @@ var nestjs = {
         for (const pm of searchText.matchAll(/@Param\s*\(\s*['"]?(\w+)/g)) {
           params.push({ name: pm[1], location: "path", required: true });
         }
+        const decoratorBlock = methodDecoratorBlock(content, offset);
+        const hasRender = /@Render\s*\(/.test(decoratorBlock);
+        const kind = hasRender ? "page" : "api";
         endpoints.push(endpoint({
           method: httpMethod,
           path: fullPath,
@@ -4316,10 +4702,64 @@ var nestjs = {
           file: rel,
           line,
           framework: "nestjs",
+          kind,
           params,
           auth: methodAuth
         }));
       }
+      for (const m of content.matchAll(subscribeRe)) {
+        const eventName = m[1];
+        const between = m[2];
+        const handler = m[3];
+        const offset = m.index;
+        const line = lines.lineAt(offset);
+        const cls = classAt(offset);
+        if (!cls)
+          continue;
+        const info = classCtx.get(cls.name);
+        if (!info || !info.isGateway)
+          continue;
+        const fullPath = normalizePath((info.wsNamespace || "") + "/" + eventName);
+        const methodAuth = [...info.auth];
+        for (const gm of between.matchAll(/@UseGuards?\s*\(\s*(\w+)/g)) {
+          methodAuth.push(`@UseGuards(${gm[1]})`);
+        }
+        endpoints.push(endpoint({
+          method: "WS",
+          path: fullPath,
+          handler,
+          file: rel,
+          line,
+          framework: "nestjs",
+          kind: "websocket",
+          params: extractPathParams(fullPath),
+          auth: methodAuth
+        }));
+      }
+      for (const m of content.matchAll(grpcRe)) {
+        const decorator = m[1];
+        const args = [...m[2].matchAll(/['"]([^'"]+)['"]/g)].map((a) => a[1]);
+        const handler = m[3];
+        const offset = m.index;
+        const line = lines.lineAt(offset);
+        const cls = classAt(offset);
+        const service = args[0] ?? (cls?.name ?? "").replace(/Controller$/, "");
+        const method = args[1] ?? handler.charAt(0).toUpperCase() + handler.slice(1);
+        endpoints.push(endpoint({
+          method: "ANY",
+          path: `/${service}/${method}`,
+          handler,
+          file: rel,
+          line,
+          framework: "nestjs",
+          transport: "grpc",
+          grpc: {
+            serviceFqn: service,
+            method,
+            streamingType: decorator === "GrpcStreamMethod" ? "bidi" : "unary"
+          }
+        }));
+      }
     }
     return endpoints;
   }
@@ -4535,9 +4975,50 @@ var nextjs = {
 };
 var GO_EXTS = [".go"];
 var GO_GROUP_RE = /(\w+)\s*[:=]+\s*(\w+)\.Group\s*\(\s*['"]([^'"]+)['"]/g;
+var dirOf = (f) => {
+  const norm = f.replace(/\\/g, "/");
+  const i2 = norm.lastIndexOf("/");
+  return i2 < 0 ? "" : norm.slice(0, i2);
+};
+var GORILLA_WS_IMPORT_RE = /["']github\.com\/gorilla\/websocket["']/;
+var UPGRADE_CALL_RE = /\.\s*Upgrade\s*\(/;
+function findWebsocketHandlers(ctx, goFiles) {
+  const byDir = /* @__PURE__ */ new Map;
+  const funcRe = /\bfunc\s+(?:\([^)]*\)\s+)?(\w+)\s*\([^)]*\)[^{]*\{/g;
+  for (const f of goFiles) {
+    const content = ctx.readFile(f);
+    if (!content)
+      continue;
+    if (!GORILLA_WS_IMPORT_RE.test(content))
+      continue;
+    const dir = dirOf(f);
+    const set2 = byDir.get(dir) ?? /* @__PURE__ */ new Set;
+    for (const m of content.matchAll(funcRe)) {
+      const name = m[1];
+      const bodyStart = m.index + m[0].length;
+      let depth = 1;
+      let i2 = bodyStart;
+      const len = content.length;
+      while (i2 < len && depth > 0) {
+        const ch = content[i2];
+        if (ch === "{")
+          depth++;
+        else if (ch === "}")
+          depth--;
+        i2++;
+      }
+      const body = content.slice(bodyStart, i2 - 1);
+      if (UPGRADE_CALL_RE.test(body))
+        set2.add(name);
+    }
+    byDir.set(dir, set2);
+  }
+  return byDir;
+}
 function extractGoFramework(ctx, framework, routeRe) {
   const endpoints = [];
   const goFiles = ctx.iterFiles(GO_EXTS);
+  const wsHandlersByDir = findWebsocketHandlers(ctx, goFiles);
   const groupPrefixes = {};
   const groupParents = {};
   for (const f of goFiles) {
@@ -4567,6 +5048,8 @@ function extractGoFramework(ctx, framework, routeRe) {
       continue;
     const rel = ctx.rel(f);
     const lines = buildLineIndex(content);
+    const fileImportsGorilla = GORILLA_WS_IMPORT_RE.test(content);
+    const wsHandlers = wsHandlersByDir.get(dirOf(f)) ?? /* @__PURE__ */ new Set;
     for (const m of content.matchAll(routeRe)) {
       const varName = m[1];
       let httpMethod = m[2].toUpperCase();
@@ -4577,11 +5060,15 @@ function extractGoFramework(ctx, framework, routeRe) {
         httpMethod = "ANY";
       const prefix = resolved[varName] ?? "";
       const fullPath = normalizePath(prefix + routePath);
-      const handlerMatch = handlerArgs.match(/(\w+)\s*[,)]/);
+      const idMatches = [...handlerArgs.matchAll(/(\w+)/g)];
+      const handlerName = idMatches.length > 0 ? idMatches[idMatches.length - 1][1] : "<anonymous>";
+      const inlineUpgrade = fileImportsGorilla && UPGRADE_CALL_RE.test(handlerArgs);
+      const isWebsocket = wsHandlers.has(handlerName) || inlineUpgrade;
       endpoints.push(endpoint({
-        method: httpMethod,
+        method: isWebsocket ? "WS" : httpMethod,
+        kind: isWebsocket ? "websocket" : "api",
         path: fullPath,
-        handler: handlerMatch ? handlerMatch[1] : "<anonymous>",
+        handler: handlerName,
         file: rel,
         line,
         framework,
@@ -4631,18 +5118,23 @@ var netHttp = {
     const endpoints = [];
     const goFiles = ctx.iterFiles(GO_EXTS);
     const handleRe = /(?:http\.HandleFunc|mux\.HandleFunc|http\.Handle|mux\.Handle)\s*\(\s*['"]([^'"]+)['"]\s*,\s*(\w+)/g;
+    const wsHandlersByDir = findWebsocketHandlers(ctx, goFiles);
     for (const f of goFiles) {
       const content = ctx.readFile(f);
       if (!content)
         continue;
       const rel = ctx.rel(f);
+      const wsHandlers = wsHandlersByDir.get(dirOf(f)) ?? /* @__PURE__ */ new Set;
       const lines = buildLineIndex(content);
       for (const m of content.matchAll(handleRe)) {
         const fullPath = normalizePath(m[1]);
+        const handlerName = m[2];
+        const isWebsocket = wsHandlers.has(handlerName);
         endpoints.push(endpoint({
-          method: "ANY",
+          method: isWebsocket ? "WS" : "ANY",
+          kind: isWebsocket ? "websocket" : "api",
           path: fullPath,
-          handler: m[2],
+          handler: handlerName,
           file: rel,
           line: lines.lineAt(m.index),
           framework: "net_http",
@@ -4727,6 +5219,34 @@ var METHOD_MAP = {
   DeleteMapping: "DELETE",
   PatchMapping: "PATCH"
 };
+function collectClassContexts(content) {
+  const out = [];
+  const classRe = /\bclass\s+\w+/g;
+  for (const m of content.matchAll(classRe)) {
+    const classStart = m.index;
+    const windowStart = Math.max(0, classStart - 600);
+    let preamble = content.slice(windowStart, classStart);
+    const lastBrace = Math.max(preamble.lastIndexOf("}"), preamble.lastIndexOf(";"));
+    if (lastBrace >= 0)
+      preamble = preamble.slice(lastBrace + 1);
+    const hasRest = /@RestController\b/.test(preamble);
+    const hasController = /@Controller\b/.test(preamble);
+    if (!hasRest && !hasController)
+      continue;
+    out.push({ start: classStart, kind: hasRest ? "api" : "page" });
+  }
+  return out;
+}
+function kindForOffset(classes, offset) {
+  let current = "api";
+  for (const c of classes) {
+    if (c.start <= offset)
+      current = c.kind;
+    else
+      break;
+  }
+  return current;
+}
 var spring = {
   id: "spring",
   detect: { depKeywords: ["spring-boot"], markers: [], scope: "root" },
@@ -4736,6 +5256,7 @@ var spring = {
     const classMappingRe = /@RequestMapping\s*\(\s*(?:value\s*=\s*)?['"]([^'"]+)['"]/;
     const methodMappingRe = /@(GetMapping|PostMapping|PutMapping|DeleteMapping|PatchMapping)\s*\(\s*(?:value\s*=\s*)?['"]?([^'")]*?)['"]?\s*\)(.*?)(?:public|private|protected)?\s*\w[\w<>,\s]*\s+(\w+)\s*\(/gs;
     const reqMappingMethodRe = /@RequestMapping\s*\([^)]*method\s*=\s*RequestMethod\.(\w+)[^)]*(?:value\s*=\s*)?['"]?([^'")]*?)['"]?[^)]*\)(.*?)(?:public|private|protected)?\s*\w[\w<>,\s]*\s+(\w+)\s*\(/gs;
+    const wsMappingRe = /@(MessageMapping|SubscribeMapping)\s*\(\s*(?:value\s*=\s*)?['"]([^'"]+)['"]\s*\)(.*?)(?:public|private|protected)?\s*\w[\w<>,\s]*\s+(\w+)\s*\(/gs;
     for (const f of javaFiles) {
       const content = ctx.readFile(f);
       if (!content)
@@ -4744,6 +5265,7 @@ var spring = {
       const cm = classMappingRe.exec(content);
       const classPrefix = cm?.[1] ?? "";
       const lines = buildLineIndex(content);
+      const classCtxs = collectClassContexts(content);
       for (const m of content.matchAll(methodMappingRe)) {
         const fullPath = normalizePath(classPrefix + "/" + m[2]);
         endpoints.push(endpoint({
@@ -4753,6 +5275,7 @@ var spring = {
           file: rel,
           line: lines.lineAt(m.index),
           framework: "spring",
+          kind: kindForOffset(classCtxs, m.index),
           params: extractPathParams(fullPath),
           auth: findAuthDecorators(m[3])
         }));
@@ -4766,6 +5289,21 @@ var spring = {
           file: rel,
           line: lines.lineAt(m.index),
           framework: "spring",
+          kind: kindForOffset(classCtxs, m.index),
+          params: extractPathParams(fullPath),
+          auth: findAuthDecorators(m[3])
+        }));
+      }
+      for (const m of content.matchAll(wsMappingRe)) {
+        const fullPath = normalizePath(m[2]);
+        endpoints.push(endpoint({
+          method: "WS",
+          path: fullPath,
+          handler: m[4],
+          file: rel,
+          line: lines.lineAt(m.index),
+          framework: "spring",
+          kind: "websocket",
           params: extractPathParams(fullPath),
           auth: findAuthDecorators(m[3])
         }));
@@ -4782,6 +5320,53 @@ var REST_ACTIONS = [
   ["PATCH", "update", "/:id"],
   ["DELETE", "destroy", "/:id"]
 ];
+function createControllerResolver(ctx) {
+  const kindCache = /* @__PURE__ */ new Map;
+  function controllerPath(className) {
+    const parts = className.replace(/Controller$/i, "").split("::").map((p) => p.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").toLowerCase()).filter(Boolean);
+    return join32(ctx.repoPath, "app", "controllers", ...parts.slice(0, -1), `${parts[parts.length - 1]}_controller.rb`);
+  }
+  function classNameFromRef(ref) {
+    const head = ref.split("#")[0];
+    if (head.includes("::")) {
+      return head.endsWith("Controller") ? head : `${head}Controller`;
+    }
+    const segs = head.split("/").filter(Boolean);
+    const camel = segs.map((s) => s.split("_").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(""));
+    return camel.join("::") + "Controller";
+  }
+  function classifyClass(className, seen) {
+    const cached = kindCache.get(className);
+    if (cached)
+      return cached;
+    if (seen.has(className))
+      return "api";
+    seen.add(className);
+    const path = controllerPath(className);
+    const src = ctx.readFile(path);
+    if (!src)
+      return "api";
+    const m = /class\s+([A-Za-z0-9_:]+)\s*<\s*([A-Za-z0-9_:]+(?:::[A-Za-z0-9_]+)*)/.exec(src);
+    if (!m)
+      return "api";
+    const parent = m[2];
+    let kind;
+    if (parent === "ActionController::Base")
+      kind = "page";
+    else if (parent === "ActionController::API")
+      kind = "api";
+    else
+      kind = classifyClass(parent, seen);
+    kindCache.set(className, kind);
+    return kind;
+  }
+  return {
+    resolve(controllerRef) {
+      const className = classNameFromRef(controllerRef);
+      return classifyClass(className, /* @__PURE__ */ new Set);
+    }
+  };
+}
 var rails = {
   id: "rails",
   detect: {
@@ -4797,35 +5382,63 @@ var rails = {
       return endpoints;
     ctx.filesScanned++;
     const rel = ctx.rel(routesFile);
-    const routeRe = /(get|post|put|patch|delete)\s+['"]([^'"]+)['"](?:\s*,\s*to:\s*['"]([^'"]+)['"])?/g;
+    const resolver = createControllerResolver(ctx);
+    const routeRe = /(get|post|put|patch|delete)\s+['"]([^'"]+)['"](?:\s*(?:,\s*to:|=>)\s*['"]([^'"]+)['"])?/g;
     const resourcesRe = /resources?\s+:(\w+)/g;
-    const namespaceRe = /namespace\s+:(\w+)/g;
-    const namespaces = [];
-    for (const line of content.split(`
-`)) {
-      const nsM = namespaceRe.exec(line);
-      if (nsM)
-        namespaces.push(nsM[1]);
-      namespaceRe.lastIndex = 0;
-    }
-    const prefix = namespaces.length ? "/" + namespaces.join("/") : "";
+    const namespaceLineRe = /\bnamespace\s+:(\w+)\b/;
     const lines = buildLineIndex(content);
+    const sourceLines = content.split(`
+`);
+    const nsStack = [];
+    let depth = 0;
+    const prefixAtLine = new Array(sourceLines.length + 1).fill("");
+    for (let i2 = 0;i2 < sourceLines.length; i2++) {
+      const line = sourceLines[i2];
+      const code = line.replace(/#.*$/, "");
+      const nsM = namespaceLineRe.exec(code);
+      if (nsM) {
+        nsStack.push({ name: nsM[1], depth });
+      }
+      const endMatches = /^\s*end\b/.test(code);
+      if (endMatches) {
+        depth = Math.max(0, depth - 1);
+        while (nsStack.length > 0 && nsStack[nsStack.length - 1].depth >= depth) {
+          nsStack.pop();
+        }
+      }
+      const doMatches = code.match(/\bdo\b(?:\s*\|[^|]*\|)?\s*$/);
+      if (doMatches)
+        depth++;
+      const prefix = nsStack.length ? "/" + nsStack.map((n) => n.name).join("/") : "";
+      prefixAtLine[i2 + 1] = prefix;
+    }
+    const prefixAt = (offset) => {
+      const ln = lines.lineAt(offset);
+      return prefixAtLine[ln] ?? "";
+    };
     for (const m of content.matchAll(routeRe)) {
+      const prefix = prefixAt(m.index);
       const fullPath = normalizePath(prefix + "/" + m[2]);
+      const handler = m[3] || m[2].replace(/\//g, "_");
+      const kind = m[3] ? resolver.resolve(m[3]) : "api";
       endpoints.push(endpoint({
         method: m[1].toUpperCase(),
         path: fullPath,
-        handler: m[3] || m[2].replace(/\//g, "_"),
+        handler,
         file: rel,
         line: lines.lineAt(m.index),
         framework: "rails",
+        kind,
         params: extractPathParams(fullPath)
       }));
     }
     for (const m of content.matchAll(resourcesRe)) {
       const resource = m[1];
       const line = lines.lineAt(m.index);
+      const prefix = prefixAt(m.index);
       const base = normalizePath(prefix + "/" + resource);
+      const controllerRef = (prefix.replace(/^\//, "") + "/" + resource).replace(/^\/+/, "").replace(/\/+/g, "/");
+      const kind = resolver.resolve(`${controllerRef}#index`);
       for (const [method, action, suffix] of REST_ACTIONS) {
         const fullPath = normalizePath(base + suffix);
         endpoints.push(endpoint({
@@ -4835,6 +5448,7 @@ var rails = {
           file: rel,
           line,
           framework: "rails",
+          kind,
           params: extractPathParams(fullPath)
         }));
       }
@@ -4864,7 +5478,9 @@ var laravel = {
         continue;
       ctx.filesScanned++;
       const rel = ctx.rel(rf);
+      const isWeb = rf.endsWith("web.php");
       const filePrefix = rf.endsWith("api.php") ? "/api" : "";
+      const kind = isWeb ? "page" : "api";
       const groupPrefixes = [];
       for (const pm of content.matchAll(prefixGroupRe)) {
         groupPrefixes.push(pm[1]);
@@ -4891,6 +5507,7 @@ var laravel = {
           file: rel,
           line: lines.lineAt(m.index),
           framework: "laravel",
+          kind,
           params: extractPathParams(fullPath),
           auth: [...fileAuth]
         }));
@@ -5279,6 +5896,160 @@ var openapi = {
     return endpoints;
   }
 };
+var CONNECT_HINTS = [
+  "connectrpc.com/connect",
+  "@connectrpc/",
+  "protoc-gen-connect",
+  "connect-go",
+  "connect-es",
+  "connectrpc"
+];
+var CONNECT_DEP_FILES = [
+  "buf.gen.yaml",
+  "buf.yaml",
+  "package.json",
+  "go.mod"
+];
+function makeConnectResolver(ctx) {
+  const memo = /* @__PURE__ */ new Map;
+  const root = ctx.repoPath;
+  const dirUsesConnect = (dir) => {
+    const cached = memo.get(dir);
+    if (cached !== undefined)
+      return cached;
+    let result = false;
+    for (const name of CONNECT_DEP_FILES) {
+      const c = ctx.readFile(join9(dir, name));
+      if (c && CONNECT_HINTS.some((h) => c.toLowerCase().includes(h))) {
+        result = true;
+        break;
+      }
+    }
+    if (!result && dir !== root && dir.startsWith(root)) {
+      const parent = dirname2(dir);
+      if (parent !== dir)
+        result = dirUsesConnect(parent);
+    }
+    memo.set(dir, result);
+    return result;
+  };
+  return (file) => dirUsesConnect(dirname2(file));
+}
+function stripComments(src) {
+  let out = "";
+  for (let i2 = 0;i2 < src.length; ) {
+    const c = src[i2];
+    if (c === '"' || c === "'") {
+      out += c;
+      i2++;
+      while (i2 < src.length && src[i2] !== c) {
+        if (src[i2] === "\\" && i2 + 1 < src.length) {
+          out += src[i2] + src[i2 + 1];
+          i2 += 2;
+        } else {
+          out += src[i2];
+          i2++;
+        }
+      }
+      if (i2 < src.length) {
+        out += src[i2];
+        i2++;
+      }
+    } else if (c === "/" && src[i2 + 1] === "/") {
+      while (i2 < src.length && src[i2] !== `
+`) {
+        out += " ";
+        i2++;
+      }
+    } else if (c === "/" && src[i2 + 1] === "*") {
+      out += "  ";
+      i2 += 2;
+      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) {
+        out += src[i2] === `
+` ? `
+` : " ";
+        i2++;
+      }
+      if (i2 < src.length) {
+        out += "  ";
+        i2 += 2;
+      }
+    } else {
+      out += c;
+      i2++;
+    }
+  }
+  return out;
+}
+function streaming(client, server) {
+  if (client && server)
+    return "bidi";
+  if (client)
+    return "client_stream";
+  if (server)
+    return "server_stream";
+  return "unary";
+}
+var PACKAGE_RE = /\bpackage\s+([A-Za-z_][\w.]*)\s*;/;
+var SERVICE_RE = /\bservice\s+([A-Za-z_]\w*)\s*\{/g;
+var RPC_RE = /\brpc\s+([A-Za-z_]\w*)\s*\(\s*(stream\s+)?[.\w]+\s*\)\s*returns\s*\(\s*(stream\s+)?[.\w]+\s*\)/g;
+var grpc = {
+  id: "grpc",
+  detect: (_repoPath, ctx) => ctx.iterFiles([".proto"]).length > 0,
+  extract(ctx) {
+    const endpoints = [];
+    const connectForFile = makeConnectResolver(ctx);
+    for (const file of ctx.iterFiles([".proto"])) {
+      const raw = ctx.readFile(file);
+      if (!raw)
+        continue;
+      const framework = connectForFile(file) ? "connect" : "grpc";
+      const transport = framework === "connect" ? "connect" : "grpc";
+      const src = stripComments(raw);
+      const rel = ctx.rel(file);
+      const lines = buildLineIndex(raw);
+      const pkg = PACKAGE_RE.exec(src)?.[1] ?? "";
+      const services = [];
+      SERVICE_RE.lastIndex = 0;
+      let s;
+      while (s = SERVICE_RE.exec(src)) {
+        services.push({ name: s[1], index: s.index });
+      }
+      if (!services.length)
+        continue;
+      RPC_RE.lastIndex = 0;
+      let m;
+      while (m = RPC_RE.exec(src)) {
+        let svc = null;
+        for (const cand of services) {
+          if (cand.index < m.index)
+            svc = cand;
+          else
+            break;
+        }
+        if (!svc)
+          continue;
+        const serviceFqn = pkg ? `${pkg}.${svc.name}` : svc.name;
+        const method = m[1];
+        endpoints.push(endpoint({
+          method: "ANY",
+          path: `/${serviceFqn}/${method}`,
+          handler: method,
+          file: rel,
+          line: lines.lineAt(m.index),
+          framework,
+          transport,
+          grpc: {
+            serviceFqn,
+            method,
+            streamingType: streaming(!!m[2], !!m[3])
+          }
+        }));
+      }
+    }
+    return endpoints;
+  }
+};
 var ALL_EXTRACTORS = [
   flask,
   fastapi,
@@ -5296,9 +6067,11 @@ var ALL_EXTRACTORS = [
   laravel,
   sst,
   serverActions,
-  openapi
+  openapi,
+  grpc
 ];
 var EXTRACTOR_MAP = new Map(ALL_EXTRACTORS.map((e) => [e.id, e]));
+EXTRACTOR_MAP.set("connect", grpc);
 function getExtractor(id) {
   return EXTRACTOR_MAP.get(id);
 }
@@ -5330,7 +6103,7 @@ var PY_DEP_TO_TYPE = [
 ];
 function inferServiceType(absDir) {
   try {
-    const content = readFileSync42(join9(absDir, "package.json"), "utf-8");
+    const content = readFileSync42(join10(absDir, "package.json"), "utf-8");
     const lower = content.toLowerCase();
     for (const [dep, type2] of PKG_DEP_TO_TYPE) {
       if (lower.includes(`"${dep}"`))
@@ -5339,7 +6112,7 @@ function inferServiceType(absDir) {
     return "generic";
   } catch {}
   try {
-    const content = readFileSync42(join9(absDir, "go.mod"), "utf-8");
+    const content = readFileSync42(join10(absDir, "go.mod"), "utf-8");
     for (const [dep, type2] of GO_DEP_TO_TYPE) {
       if (content.includes(dep))
         return type2;
@@ -5347,7 +6120,7 @@ function inferServiceType(absDir) {
     return "generic";
   } catch {}
   try {
-    const content = readFileSync42(join9(absDir, "Cargo.toml"), "utf-8");
+    const content = readFileSync42(join10(absDir, "Cargo.toml"), "utf-8");
     for (const [dep, type2] of CARGO_DEP_TO_TYPE) {
       if (content.includes(dep))
         return type2;
@@ -5355,7 +6128,7 @@ function inferServiceType(absDir) {
     return "generic";
   } catch {}
   try {
-    const content = readFileSync42(join9(absDir, "requirements.txt"), "utf-8");
+    const content = readFileSync42(join10(absDir, "requirements.txt"), "utf-8");
     for (const [dep, type2] of PY_DEP_TO_TYPE) {
       if (content.includes(dep))
         return type2;
@@ -5376,7 +6149,7 @@ function expandWorkspaceGlobs(repoPath, patterns) {
     const clean = pattern.replace(/\/+$/, "");
     if (clean.endsWith("/*") || clean.endsWith("/**")) {
       const parentDir = clean.replace(/\/\*\*?$/, "");
-      const absParent = join10(repoPath, parentDir);
+      const absParent = join11(repoPath, parentDir);
       try {
         for (const entry of readdirSync5(absParent, { withFileTypes: true })) {
           if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
@@ -5385,7 +6158,7 @@ function expandWorkspaceGlobs(repoPath, patterns) {
         }
       } catch {}
     } else {
-      if (existsSync5(join10(repoPath, clean))) {
+      if (existsSync5(join11(repoPath, clean))) {
         dirs.push(clean);
       }
     }
@@ -5393,7 +6166,7 @@ function expandWorkspaceGlobs(repoPath, patterns) {
   return dirs;
 }
 function detectWorkspaces(repoPath, _ctx, _existing) {
-  const rootPkgPath = join10(repoPath, "package.json");
+  const rootPkgPath = join11(repoPath, "package.json");
   let rootPkg;
   try {
     rootPkg = readFileSync5(rootPkgPath, "utf-8");
@@ -5418,7 +6191,7 @@ function detectWorkspaces(repoPath, _ctx, _existing) {
   return dirsToServices(repoPath, dirs);
 }
 function detectPnpmWorkspaces(repoPath) {
-  const wsPath = join10(repoPath, "pnpm-workspace.yaml");
+  const wsPath = join11(repoPath, "pnpm-workspace.yaml");
   let content;
   try {
     content = readFileSync5(wsPath, "utf-8");
@@ -5448,7 +6221,7 @@ function detectPnpmWorkspaces(repoPath) {
 function dirsToServices(repoPath, dirs) {
   const services = [];
   for (const dir of dirs) {
-    const pkgPath = join10(repoPath, dir, "package.json");
+    const pkgPath = join11(repoPath, dir, "package.json");
     let pkgContent;
     try {
       pkgContent = readFileSync5(pkgPath, "utf-8");
@@ -5464,7 +6237,7 @@ function dirsToServices(repoPath, dirs) {
     }
     services.push({
       name,
-      type: inferServiceType(join10(repoPath, dir)),
+      type: inferServiceType(join11(repoPath, dir)),
       root: dir
     });
   }
@@ -5531,7 +6304,7 @@ function isInfraService(name) {
   return INFRA_SUFFIXES.some((suffix) => lower.endsWith(suffix));
 }
 function hasSourceCode(absDir) {
-  if (SOURCE_MARKERS.some((f) => existsSync6(join11(absDir, f))))
+  if (SOURCE_MARKERS.some((f) => existsSync6(join12(absDir, f))))
     return true;
   try {
     const entries = readdirSync6(absDir, { withFileTypes: true });
@@ -5541,7 +6314,7 @@ function hasSourceCode(absDir) {
       if (!entry.isDirectory() || entry.name.startsWith("."))
         continue;
       try {
-        const subEntries = readdirSync6(join11(absDir, entry.name));
+        const subEntries = readdirSync6(join12(absDir, entry.name));
         if (subEntries.some((e) => SOURCE_EXTENSIONS.some((ext) => e.endsWith(ext))))
           return true;
       } catch {}
@@ -5561,7 +6334,7 @@ function detectCompose(repoPath, _ctx, existing) {
   let composeContent = null;
   for (const name of composeNames) {
     try {
-      composeContent = readFileSync6(join11(repoPath, name), "utf-8");
+      composeContent = readFileSync6(join12(repoPath, name), "utf-8");
       break;
     } catch {}
   }
@@ -5586,26 +6359,26 @@ function detectCompose(repoPath, _ctx, existing) {
       continue;
     if (isInfraService(name))
       continue;
-    const absDir = join11(repoPath, root);
+    const absDir = join12(repoPath, root);
     if (!existsSync6(absDir) || !hasSourceCode(absDir))
       continue;
     services.push({
       name,
-      type: inferServiceType(join11(repoPath, root)),
+      type: inferServiceType(join12(repoPath, root)),
       root
     });
   }
   return services;
 }
 function detectSstServices(repoPath, ctx, existing) {
-  if (!existsSync7(join12(repoPath, "sst.config.ts")))
+  if (!existsSync7(join13(repoPath, "sst.config.ts")))
     return [];
-  const infraDir = join12(repoPath, "infra");
+  const infraDir = join13(repoPath, "infra");
   if (!existsSync7(infraDir))
     return [];
   let files;
   try {
-    files = readdirSync7(infraDir).filter((f) => f.endsWith(".ts")).map((f) => join12(infraDir, f));
+    files = readdirSync7(infraDir).filter((f) => f.endsWith(".ts")).map((f) => join13(infraDir, f));
   } catch {
     return [];
   }
@@ -5651,7 +6424,7 @@ function detectDirectories(repoPath, _ctx, existing) {
   if (existing.length > 0)
     return [];
   const services = [];
-  const rootHasMarker = SERVICE_MARKERS.some((f) => existsSync8(join13(repoPath, f)));
+  const rootHasMarker = SERVICE_MARKERS.some((f) => existsSync8(join14(repoPath, f)));
   if (rootHasMarker) {
     const name = inferRootName(repoPath);
     services.push({
@@ -5668,11 +6441,11 @@ function detectDirectories(repoPath, _ctx, existing) {
     return [];
   }
   for (const child of children) {
-    const hasMarker = SERVICE_MARKERS.some((f) => existsSync8(join13(repoPath, child, f)));
+    const hasMarker = SERVICE_MARKERS.some((f) => existsSync8(join14(repoPath, child, f)));
     if (hasMarker) {
       services.push({
         name: child,
-        type: inferServiceType(join13(repoPath, child)),
+        type: inferServiceType(join14(repoPath, child)),
         root: child
       });
     }
@@ -5680,7 +6453,7 @@ function detectDirectories(repoPath, _ctx, existing) {
   const claimedRoots = new Set(services.map((s) => s.root));
   const serviceDirs = ["src/services", "services", "apps", "src"];
   for (const svcDir of serviceDirs) {
-    const absDir = join13(repoPath, svcDir);
+    const absDir = join14(repoPath, svcDir);
     if (!existsSync8(absDir))
       continue;
     try {
@@ -5690,11 +6463,11 @@ function detectDirectories(repoPath, _ctx, existing) {
         const childPath = svcDir + "/" + entry.name;
         if (claimedRoots.has(childPath))
           continue;
-        const hasMarker = SERVICE_MARKERS.some((f) => existsSync8(join13(repoPath, childPath, f)));
+        const hasMarker = SERVICE_MARKERS.some((f) => existsSync8(join14(repoPath, childPath, f)));
         if (hasMarker) {
           services.push({
             name: entry.name,
-            type: inferServiceType(join13(repoPath, childPath)),
+            type: inferServiceType(join14(repoPath, childPath)),
             root: childPath
           });
         }
@@ -5705,7 +6478,7 @@ function detectDirectories(repoPath, _ctx, existing) {
 }
 function inferRootName(repoPath) {
   try {
-    const pkg = JSON.parse(readFileSync7(join13(repoPath, "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync7(join14(repoPath, "package.json"), "utf-8"));
     if (pkg.name)
       return stripOrgScope(pkg.name);
   } catch {}
@@ -5787,7 +6560,7 @@ function readDepFiles(repoPath) {
   const rootParts = [];
   for (const fname of DEP_FILENAMES) {
     try {
-      rootParts.push(readFileSync8(join14(repoPath, fname), "utf-8"));
+      rootParts.push(readFileSync8(join15(repoPath, fname), "utf-8"));
     } catch {}
   }
   const workspaceParts = [];
@@ -5796,7 +6569,7 @@ function readDepFiles(repoPath) {
       if (!child.isDirectory() || SKIP_DIRS.has(child.name) || child.name.startsWith("."))
         continue;
       try {
-        workspaceParts.push(readFileSync8(join14(repoPath, child.name, "package.json"), "utf-8"));
+        workspaceParts.push(readFileSync8(join15(repoPath, child.name, "package.json"), "utf-8"));
       } catch {}
     }
   } catch {}
@@ -5815,10 +6588,10 @@ function getChildDirs(repoPath) {
 }
 function findMarkerFile(repoPath, markers, childDirs) {
   for (const marker of markers) {
-    if (existsSync9(join14(repoPath, marker)))
+    if (existsSync9(join15(repoPath, marker)))
       return true;
     for (const child of childDirs) {
-      if (existsSync9(join14(repoPath, child, marker)))
+      if (existsSync9(join15(repoPath, child, marker)))
         return true;
     }
   }
@@ -5854,7 +6627,7 @@ function detectFrameworks(repoPath, ctx) {
       detected.push(extractor.id);
     }
   }
-  if (!GO_FRAMEWORKS.some((gf) => detected.includes(gf)) && existsSync9(join14(repoPath, "go.mod"))) {
+  if (!GO_FRAMEWORKS.some((gf) => detected.includes(gf)) && existsSync9(join15(repoPath, "go.mod"))) {
     for (const f of ctx.iterFiles([".go"])) {
       const content = ctx.readFile(f);
       if (content && /"net\/http"/.test(content)) {
@@ -5869,7 +6642,7 @@ function detectFrameworksInServices(repoPath, services, ctx, alreadyDetected) {
   const additional = [];
   const seen = new Set(alreadyDetected);
   for (const svc of services) {
-    const svcPath = join14(repoPath, svc.root);
+    const svcPath = join15(repoPath, svc.root);
     if (!existsSync9(svcPath))
       continue;
     const deps = readDepFiles(svcPath);
@@ -5895,7 +6668,7 @@ function detectFrameworksInServices(repoPath, services, ctx, alreadyDetected) {
         seen.add(extractor.id);
       }
     }
-    if (!GO_FRAMEWORKS.some((gf) => seen.has(gf)) && !seen.has("net_http") && existsSync9(join14(svcPath, "go.mod"))) {
+    if (!GO_FRAMEWORKS.some((gf) => seen.has(gf)) && !seen.has("net_http") && existsSync9(join15(svcPath, "go.mod"))) {
       for (const f of ctx.iterFiles([".go"])) {
         const content = ctx.readFile(f);
         if (content && /"net\/http"/.test(content)) {
@@ -5999,15 +6772,19 @@ function mapRaw(repoPath, options = {}) {
     filesScanned: ctx.filesScanned
   };
 }
+var isProtoGrpc = (ep) => ep.framework === "grpc" || ep.framework === "connect";
 function map2(repoPath, options = {}) {
   const raw = mapRaw(repoPath, options);
-  const seen = /* @__PURE__ */ new Set;
+  const indexByKey = /* @__PURE__ */ new Map;
   const unique = [];
   for (const ep of raw.endpoints) {
-    const key = `${ep.method}::${ep.path}`;
-    if (!seen.has(key)) {
-      seen.add(key);
+    const key = `${ep.transport ?? "http"}::${ep.method}::${ep.path}`;
+    const idx = indexByKey.get(key);
+    if (idx === undefined) {
+      indexByKey.set(key, unique.length);
       unique.push(ep);
+    } else if (isProtoGrpc(ep) && !isProtoGrpc(unique[idx])) {
+      unique[idx] = ep;
     }
   }
   const filtered = options.includeInternal ? unique : unique.filter((e) => !e.internal);
@@ -6088,7 +6865,7 @@ function findDependencyRoot(appPath, repoRoot) {
     }
     if (current === absRoot)
       break;
-    const parent = dirname2(current);
+    const parent = dirname3(current);
     if (parent === current)
       break;
     if (!parent.startsWith(absRoot))
@@ -6113,7 +6890,9 @@ function consolidateBySameRoute(endpoints) {
         framework: ep.framework,
         kind: ep.kind,
         auth: [...ep.auth],
-        internal: ep.internal
+        internal: ep.internal,
+        transport: ep.transport,
+        grpc: ep.grpc
       });
       handlerSets.set(key, new Set(ep.handler ? [ep.handler] : []));
       continue;
@@ -6234,6 +7013,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     domains,
     projectThreatModel,
     environments,
@@ -6242,6 +7022,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
   } = input;
   const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
   const agentLimiter = (fn) => agentSlots(fn);
+  const WORKFLOW_UMBRELLA_ID = newSessionId();
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6252,17 +7033,18 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     abortSignal,
     attackSurfaceRegistry,
     eventBus,
-    subagentId: "whitebox-apps-discovery",
+    subagentId: WORKFLOW_UMBRELLA_ID,
+    subagentName: "Whitebox Apps Discovery",
     onStepFinish: (event) => onStepFinish?.(event),
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: AppsDiscoveryResultSchema,
     projectThreatModel,
     excludeTools: ["document_endpoint"]
   });
   log4.info(`Phase 1: discovering apps in ${codebasePath}${domains?.length ? ` (${domains.length} known domains)` : ""}`);
-  const WORKFLOW_UMBRELLA_ID = "whitebox-apps-discovery";
   eventBus?.emit("subagent-spawn", {
     subagentId: WORKFLOW_UMBRELLA_ID,
     name: "Whitebox Apps Discovery",
@@ -6292,12 +7074,12 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       }
     };
   }
-  const assetsPath = join15(session.rootPath, "assets");
+  const assetsPath = join16(session.rootPath, "assets");
   mkdirSync2(assetsPath, { recursive: true });
   for (const app of appsResult.apps) {
-    const appDir = join15(assetsPath, sanitizeName(app.name));
+    const appDir = join16(assetsPath, sanitizeName(app.name));
     mkdirSync2(appDir, { recursive: true });
-    writeFileSync3(join15(appDir, "app.json"), JSON.stringify(toAppMetadata(app), null, 2), "utf-8");
+    writeFileSync3(join16(appDir, "app.json"), JSON.stringify(toAppMetadata(app), null, 2), "utf-8");
   }
   log4.info(`Phase 2: surfaceIntegrationEnabled=${surfaceIntegrationEnabled}`);
   const NON_SERVICE_TYPES = ["cloud_resource", "storage", "database"];
@@ -6323,7 +7105,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     });
   }
   const spawnDiscoveryAgent = async (app, type2, objective) => {
-    const subagentId = `${type2}-${app.name}`;
+    const subagentId = newSessionId();
     const appNodeId = appNodeIdFor(app.name);
     log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type2}, appType=${app.type})`);
     eventBus?.emit("subagent-spawn", {
@@ -6343,10 +7125,12 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       attackSurfaceRegistry,
       eventBus,
       subagentId,
+      subagentName: TASK_TYPE_LABELS[type2],
       onStepFinish: (event) => onStepFinish?.(event),
       onCacheMetrics,
       openAIReasoningEffort,
       enableThinking,
+      thinkingEffort,
       responseSchema: DiscoverySummarySchema,
       excludeTools: ["document_app"],
       projectThreatModel
@@ -6384,7 +7168,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
           spawnApiEndpointsAgent(app)
         ]);
       } else {
-        const surfaceResult = mapAppWithSurface(join15(codebasePath, app.location), codebasePath, { isSingleAppRepo: serviceApps.length === 1 });
+        const surfaceResult = mapAppWithSurface(join16(codebasePath, app.location), codebasePath, { isSingleAppRepo: serviceApps.length === 1 });
         if (surfaceResult.mode === "surface") {
           log4.debug(`${app.name}: surface-driven (${surfaceResult.endpoints.length} endpoints, frameworks=${surfaceResult.frameworks.join(",")})`);
           await runAppEndpointDocumentation({
@@ -6402,6 +7186,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             onCacheMetrics,
             openAIReasoningEffort,
             enableThinking,
+            thinkingEffort,
             projectThreatModel,
             parentSubagentId: appNodeId,
             agentLimiter
@@ -6471,12 +7256,12 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
   log4.debug(`readAssets: found ${entries.length} entries in ${assetsPath}: [${entries.join(", ")}]`);
   const apps = [];
   for (const entry of entries) {
-    const entryPath = join15(assetsPath, entry);
+    const entryPath = join16(assetsPath, entry);
     if (!statSync2(entryPath).isDirectory()) {
       log4.debug(`readAssets: skipping non-directory: ${entry}`);
       continue;
     }
-    const appJsonPath = join15(entryPath, "app.json");
+    const appJsonPath = join16(entryPath, "app.json");
     let metadata;
     if (existsSync12(appJsonPath)) {
       try {
@@ -6496,7 +7281,7 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
     let parseFailed = 0;
     for (const file of assetFiles) {
       try {
-        const raw = readFileSync9(join15(entryPath, file), "utf-8");
+        const raw = readFileSync9(join16(entryPath, file), "utf-8");
         const data = JSON.parse(raw);
         const endpoint2 = assetRecordToEndpoint(data);
         if (!endpoint2) {
@@ -6542,7 +7327,9 @@ function assetRecordToEndpoint(record) {
     description: record.description,
     pentestObjectives: record.pentestObjectives ?? [],
     riskScore: record.riskScore,
-    threatModel: record.threatModel
+    threatModel: record.threatModel,
+    transport: record.transport,
+    grpc: record.grpc
   });
   return parsed.success ? parsed.data : null;
 }
@@ -6743,6 +7530,15 @@ Find ALL API endpoints **whose route definitions live in this application's sour
 - **Rails**: routes.rb API namespaces, resources, controller actions
 - **Spring**: @GetMapping, @PostMapping, @PutMapping, @DeleteMapping, @RequestMapping
 - **Go**: http.HandleFunc, mux.Handle, gin router methods
+- **gRPC**: \`.proto\` service definitions (\`service X { rpc Method (Req) returns (Resp); }\`), \`buf.yaml\`/\`buf.gen.yaml\`, or generated gRPC stubs
+
+### gRPC / Connect services — do NOT flatten into HTTP paths
+A gRPC method looks like a path (\`/package.Service/Method\`) but is NOT an HTTP route. When this app defines gRPC/Connect services, document **one \`document_endpoint\` per \`rpc\` method** with:
+- **endpointType**: \`"api-endpoint"\` (a gRPC method is still an API endpoint)
+- **transport**: \`"grpc"\` (or \`"grpc_web"\` / \`"connect"\` if the service is served that way)
+- **routePath**: the wire path \`/package.Service/Method\` (e.g. \`/account.v1.AccountService/GetAccount\`) — do NOT prepend a host
+- **grpc**: \`{ serviceFqn, method, streamingType, schemaSource: "proto" }\` where \`serviceFqn\` is the fully-qualified service (\`account.v1.AccountService\`), \`method\` is the rpc name, and \`streamingType\` is one of \`unary | server_stream | client_stream | bidi\` (based on the \`stream\` keywords in the rpc signature). Set \`reflectionAvailable: true\` if the server registers the gRPC reflection service.
+- If a REST/GraphQL gateway (e.g. grpc-gateway annotations, a GraphQL resolver, a Connect handler) maps to this rpc, set \`grpc.frontingGatewayOperation\` — prefer marking this whenever a gateway mapping exists, since it's what lets us later compute "shadow" methods (proto methods reachable directly but NOT exposed via the gateway, where auth checks usually live).
 
 ### How to document each endpoint
 For each **unique route path**, call \`document_endpoint\` with:
@@ -6756,6 +7552,7 @@ For each **unique route path**, call \`document_endpoint\` with:
 - **handler**: Handler function name (comma-separate if multiple handlers for different methods)
 - **authRequired**: Whether the endpoint requires authentication (true if ANY method requires it)
 - **riskLevel**: CRITICAL for auth/payment/admin, HIGH for user data mutations, MEDIUM for general, LOW for read-only public
+- **transport / grpc**: for gRPC / Connect / gRPC-Web methods, this checklist is not enough — ALSO pass the \`transport\` and \`grpc\` fields exactly as described in the "gRPC / Connect services" section above. Never document an \`rpc\` as a plain HTTP route.
 
 **CRITICAL: ONE entry per route path.** If \`/api/products\` has GET (list) and POST (create), document it as ONE entry with \`method: ["GET", "POST"]\`. Do NOT create two separate entries.
 
@@ -6865,21 +7662,19 @@ async function runPentestSwarm(input) {
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     display
   } = input;
   const completedIds = getCompletedAgentIds(session);
   const existingManifest = readAgentManifest(session);
   const freshEntries = buildManifestEntries(targets);
-  const manifestEntries = freshEntries.map((fresh) => {
-    const existing = existingManifest.find((e) => e.id === fresh.id);
-    if (existing && existing.status === "completed")
-      return existing;
-    return fresh;
-  });
+  const manifestEntries = reconcileManifestOnResume(existingManifest, freshEntries);
   writeAgentManifest(session, manifestEntries);
   const results = await runWithBoundedConcurrency(targets, concurrency, async (target, index) => {
-    const subagentId = `pentest-agent-${index + 1}`;
+    const entry = manifestEntries[index];
+    const subagentId = entry.id;
+    const subagentName = target.name ?? entry.name;
     if (completedIds.has(subagentId))
       return null;
     const previousMessages = loadSubagentMessages(session, subagentId);
@@ -6892,18 +7687,19 @@ async function runPentestSwarm(input) {
     };
     eventBus?.emit("subagent-spawn", {
       subagentId,
-      name: target.name,
+      name: subagentName,
       input: { target: target.target, objectives: target.objectives }
     });
     if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
       try {
-        const executionTasksDir = join17(session.rootPath, "subagents", `${subagentId}-tasks`);
+        const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
-          prompt: buildPlanPrompt(target.target, target.objectives),
+          prompt: buildPlanPrompt(target.target, target.objectives, target.grpc),
           model,
           session,
           target: target.target,
+          grpc: target.grpc,
           mode: "plan",
           activeTools: [...PLAN_MODE_TOOL_NAMES],
           stopWhen: hasToolCall("submit_plan"),
@@ -6911,10 +7707,12 @@ async function runPentestSwarm(input) {
           abortSignal,
           findingsRegistry,
           subagentId: `${subagentId}-plan`,
+          subagentName: `${subagentName} (plan)`,
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
           enableThinking,
+          thinkingEffort,
           openAIReasoningEffort,
           display
         });
@@ -6928,6 +7726,7 @@ async function runPentestSwarm(input) {
     try {
       agent = new TargetedPentestAgent({
         target: target.target,
+        grpc: target.grpc,
         objectives: target.objectives,
         model,
         session,
@@ -6938,7 +7737,9 @@ async function runPentestSwarm(input) {
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
+        subagentName,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort,
         display
       });
@@ -6984,6 +7785,10 @@ async function runPentestSwarm(input) {
   return results;
 }
 async function runPentestWorkflow(input) {
+  if (input.fastStrike) {
+    const { runFastStrike } = await import("./fastStrike-9tm6bedh.js");
+    return runFastStrike(input);
+  }
   const {
     target,
     cwd,
@@ -6995,6 +7800,7 @@ async function runPentestWorkflow(input) {
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     prompt,
     threatModel,
@@ -7100,8 +7906,8 @@ ${combined}` : combined;
         sessionId: session.id,
         mode
       });
-      const mdPath2 = join17(session.rootPath, REPORT_FILENAME_MD);
-      const jsonPath2 = join17(session.rootPath, REPORT_FILENAME_JSON);
+      const mdPath2 = join18(session.rootPath, REPORT_FILENAME_MD);
+      const jsonPath2 = join18(session.rootPath, REPORT_FILENAME_JSON);
       writeFileSync4(mdPath2, renderMarkdown(report2));
       writeFileSync4(jsonPath2, renderJson(report2));
       return {
@@ -7132,6 +7938,7 @@ ${combined}` : combined;
         eventBus,
         onStepFinish: wrappedOnStepFinish,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort
       });
     }
@@ -7150,8 +7957,8 @@ ${combined}` : combined;
       sessionId: session.id,
       mode
     });
-    const mdPath = join17(session.rootPath, REPORT_FILENAME_MD);
-    const jsonPath = join17(session.rootPath, REPORT_FILENAME_JSON);
+    const mdPath = join18(session.rootPath, REPORT_FILENAME_MD);
+    const jsonPath = join18(session.rootPath, REPORT_FILENAME_JSON);
     writeFileSync4(mdPath, renderMarkdown(report));
     writeFileSync4(jsonPath, renderJson(report));
     const severityCounts = {};
@@ -7196,10 +8003,14 @@ async function runWhiteboxPhase(opts) {
     surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled
   };
   const result = await runWhiteboxAttackSurfaceWorkflow(workflowInput);
-  return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => ({
-    target: ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`,
-    objectives: ep.pentestObjectives
-  })));
+  return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => {
+    const grpc2 = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
+    return {
+      target: grpcAuthorityTarget(grpc2, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
+      objectives: ep.pentestObjectives,
+      grpc: grpc2
+    };
+  }));
 }
 async function runBlackboxPhase(opts) {
   let lastMessages = [];
@@ -7257,4 +8068,4 @@ async function runBlackboxPhase(opts) {
     throw e;
   }
 }
-export { REPORT_FILENAME_MD, readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };
+export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };