@pensar/apex 2.1.3-canary.fff17bfd → 2.2.0

package/build/{cli-akhax3yn.js → cli-xbdn034b.js}

@@ -1,6 +1,6 @@
 import {
   detectOSAndEnhancePrompt
-} from "./cli-g6cjpbr9.js";
+} from "./cli-s43t5ay0.js";
 import {
   parseTargetUrl
 } from "./cli-c8131c4q.js";
@@ -30,15 +30,16 @@ import {
   scopedLogger,
   stepCountIs,
   streamResponse,
+  withSubagentSessionBaggage,
   write
-} from "./cli-v34r5t8t.js";
+} from "./cli-6kx46ck0.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-k941a7ft.js";
+} from "./cli-4tc6888c.js";
 import {
   _enum,
   _null,
@@ -65,11 +66,11 @@ import {
   tool,
   union,
   unknown
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import {
   config,
   init_config
-} from "./cli-qb3eddc7.js";
+} from "./cli-51dkmt5p.js";
 import {
   __commonJS,
   __require,
@@ -99665,7 +99666,7 @@ class AgentEventBus {
   }
   emitStreamPart(chunk, ids) {
     const ctx = typeof ids === "string" ? { subagentId: ids } : ids ?? {};
-    const subagentId = ctx.subagentId ?? ctx.sessionId;
+    const subagentId = ctx.subagentId;
     const sessionId = ctx.sessionId;
     const messageId = ctx.messageId;
     switch (chunk.type) {
@@ -99909,11 +99910,11 @@ You can perform the full lifecycle of a penetration test and support a wide rang
 You run inside Pensar Apex, and the \`pensar\` CLI is available on this machine. Invoke it through \`execute_command\` to perform Console/workspace operations your other tools don't cover — most importantly managing the **attack surface** and triaging results. These commands act on the workspace the user connected with \`pensar login\` and print JSON to stdout, so you can parse and chain them.
 
 - **Attack surface (apps & endpoints)** — \`pensar apps\` (list), \`apps get <appId>\`, \`apps create\`, \`apps update <appId>\`, \`apps delete <appId>\`; endpoints via \`apps endpoints <appId>\`, \`apps endpoint <endpointId>\`, \`apps endpoint-create <appId>\`, \`apps endpoint-update <endpointId>\`, \`apps endpoint-delete <endpointId>\`; and \`apps search <query>\` / \`apps search-endpoints <query>\`.
-- **Issues & fixes** — \`pensar issues [--status --severity --scan --branch]\`, \`issues get <id>\`, \`issues update <id>\`; \`pensar fixes <issueId>\`, \`fixes get <fixId>\`.
+- **Issues & fixes** — \`pensar issues [--status --severity --scan --branch]\`, \`issues get <id>\`, \`issues update <id>\`, \`issues retest <id>\`; \`pensar fixes <issueId>\`, \`fixes get <fixId>\`.
 - **Scans** — \`pensar pentests\`, \`pentests get <id>\`, \`pentests dispatch [--branch --level]\`.
 - **Agent logs** — \`pensar logs <issueId>\`, \`logs search <issueId> <query>\`.
 
-Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI is the source of truth. These commands require the user to be logged in; if one reports it is not authenticated, tell the user to run \`pensar login\` rather than attempting the device flow yourself. Confirm with the user before any mutating command (\`create\`/\`update\`/\`delete\`, \`endpoint-*\`, \`pentests dispatch\`, \`issues update\`). Do NOT launch nested engagements from here (\`pensar pentest\`, \`pensar targeted-pentest\`, \`pensar operator\`, or \`pensar -p\`) — use your own tools for testing.
+Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI is the source of truth. These commands require the user to be logged in; if one reports it is not authenticated, tell the user to run \`pensar login\` rather than attempting the device flow yourself. Confirm with the user before any mutating command (\`create\`/\`update\`/\`delete\`, \`endpoint-*\`, \`pentests dispatch\`, \`issues update\`, \`issues retest\`). Do NOT launch nested engagements from here (\`pensar pentest\`, \`pensar targeted-pentest\`, \`pensar operator\`, or \`pensar -p\`) — use your own tools for testing.
 
 # How to Work
 
@@ -102688,12 +102689,25 @@ var CAMOUFOX_OPTIONS = {
   humanize: true,
   block_webrtc: true
 };
+var MEMORY_FIREFOX_PREFS = {
+  "fission.autostart": false,
+  "dom.ipc.processCount": 1,
+  "dom.ipc.processPrelaunch.enabled": false,
+  "browser.cache.disk.enable": false,
+  "browser.cache.memory.enable": false,
+  "browser.sessionhistory.max_total_viewers": 0
+};
 async function resolveCamoufoxLaunchOptions(headless) {
   const { launchOptions: camoufoxLaunchOptions } = await import("camoufox-js");
-  return await camoufoxLaunchOptions({
+  const opts = await camoufoxLaunchOptions({
     ...CAMOUFOX_OPTIONS,
     headless
   });
+  opts.firefoxUserPrefs = {
+    ...opts.firefoxUserPrefs,
+    ...MEMORY_FIREFOX_PREFS
+  };
+  return opts;
 }
 var ensurePromise = null;
 function ensureCamoufox(log) {
@@ -102805,6 +102819,16 @@ function withTimeout(promise2, ms, message) {
   });
   return Promise.race([promise2, timeout]).finally(() => clearTimeout(timer));
 }
+function readProcStartTime(pid) {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    const afterComm = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const starttime = Number(afterComm[19]);
+    return Number.isFinite(starttime) ? starttime : null;
+  } catch {
+    return null;
+  }
+}
 function collectDescendantPids(rootPid) {
   let entries;
   try {
@@ -102907,11 +102931,16 @@ class PlaywrightMcpSession {
   forceKillProcess(proc = this.mcpProcess) {
     if (!proc || proc.exitCode !== null)
       return;
-    const descendants = proc.pid ? collectDescendantPids(proc.pid) : [];
+    const rootPid = proc.pid ?? null;
+    const descendants = rootPid != null ? collectDescendantPids(rootPid) : [];
+    const descendantStarts = new Map;
+    for (const pid of descendants) {
+      descendantStarts.set(pid, readProcStartTime(pid));
+    }
     try {
-      if (proc.pid) {
+      if (rootPid != null) {
         try {
-          process.kill(-proc.pid, "SIGKILL");
+          process.kill(-rootPid, "SIGKILL");
         } catch {
           proc.kill("SIGKILL");
         }
@@ -102920,6 +102949,12 @@ class PlaywrightMcpSession {
       }
     } catch {}
     for (const pid of descendants) {
+      const expected = descendantStarts.get(pid);
+      if (expected != null) {
+        const now = readProcStartTime(pid);
+        if (now == null || now !== expected)
+          continue;
+      }
       try {
         process.kill(pid, "SIGKILL");
       } catch {}
@@ -104892,6 +104927,10 @@ const fs = require('fs');
   try {
     context = await firefox.launchPersistentContext('/tmp/pw-user-data', {
       ...__camou,
+      // Layer memory prefs over Camoufox's fingerprint prefs (ours win); see
+      // MEMORY_FIREFOX_PREFS in ./camoufox — collapses Fission/content-process
+      // fan-out that otherwise costs ~3 GB across the run.
+      firefoxUserPrefs: { ...__camou.firefoxUserPrefs, ...${JSON.stringify(MEMORY_FIREFOX_PREFS)} },
       ...(__extraHeaders ? { extraHTTPHeaders: __extraHeaders } : {}),
     });
     const pages = context.pages();
@@ -105094,6 +105133,7 @@ Use this to document:
             mkdirSync2(dir, { recursive: true });
           }
           writeFileSync2(localPath, Buffer.from(result.data, "base64"));
+          sandbox.execute(`rm -f ${sandboxPath}`, { timeout: 10 }).catch(() => {});
           return {
             success: true,
             path: localPath,
@@ -106412,6 +106452,7 @@ init_zod();
 init_credentials();
 import { writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join10 } from "node:path";
+init_id();
 init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("delegate_auth"));
@@ -106498,6 +106539,8 @@ IMPORTANT: Pass protectedEndpoints in authHints when you've discovered 401/403 e
       authHints,
       reason
     }) => {
+      const subagentId = newSessionId();
+      const subagentName = "Authentication Agent";
       try {
         if (!ctx.model) {
           return {
@@ -106523,9 +106566,9 @@ IMPORTANT: Pass protectedEndpoints in authHints when you've discovered 401/403 e
             tokens = { ...stored.tokens };
           }
         }
-        const subagentId = "auth-agent";
         ctx.eventBus?.emit("subagent-spawn", {
           subagentId,
+          name: subagentName,
           input: { target, reason },
           parentSubagentId: ctx.subagentId
         });
@@ -106570,7 +106613,7 @@ IMPORTANT: Pass protectedEndpoints in authHints when you've discovered 401/403 e
         if (credentials) {
           ctx.session.credentialManager.addFromAuthCredentials(credentials);
         }
-        const { runAuthenticationAgent } = await import("./authentication-h1zxd74t.js");
+        const { runAuthenticationAgent } = await import("./authentication-tqx2brcv.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const result = await runAuthenticationAgent({
@@ -106581,7 +106624,9 @@ IMPORTANT: Pass protectedEndpoints in authHints when you've discovered 401/403 e
           authConfig: ctx.authConfig,
           abortSignal: ctx.abortSignal,
           eventBus: localBus,
-          subagentId
+          subagentId,
+          subagentName,
+          secretValues: ctx.secretValues
         });
         ctx.eventBus?.emit("subagent-complete", {
           subagentId,
@@ -106635,7 +106680,7 @@ Auth data saved to: ${result.authDataPath}` : ""}` : `Authentication subagent fa
         };
       } catch (error) {
         ctx.eventBus?.emit("subagent-complete", {
-          subagentId: "auth-agent",
+          subagentId,
           status: "failed",
           parentSubagentId: ctx.subagentId
         });
@@ -106896,6 +106941,87 @@ Each application creates a JSON file in the apps directory for tracking and anal
   });
 }
 
+// src/core/agents/specialized/attackSurface/grpcSchema.ts
+init_zod();
+var EndpointTransportEnum = exports_external.enum([
+  "http",
+  "grpc",
+  "grpc_web",
+  "connect"
+]);
+var GrpcStreamingTypeEnum = exports_external.enum([
+  "unary",
+  "server_stream",
+  "client_stream",
+  "bidi"
+]);
+var GrpcSchemaSourceEnum = exports_external.enum([
+  "proto",
+  "reflection",
+  "protoset",
+  "js_bundle",
+  "gateway_derived",
+  "unknown"
+]);
+var GrpcGatewayTypeEnum = exports_external.enum(["rest", "graphql", "connect"]);
+var GrpcEndpointMetadataSchema = exports_external.object({
+  serviceFqn: exports_external.string().describe("Fully-qualified service name, e.g. 'account.v1.AccountService'"),
+  method: exports_external.string().describe("RPC method name, e.g. 'GetAccount'"),
+  streamingType: GrpcStreamingTypeEnum.default("unary"),
+  reflectionAvailable: exports_external.boolean().optional(),
+  schemaSource: GrpcSchemaSourceEnum.optional(),
+  host: exports_external.string().nullish().describe("Authority override; null falls back to the app domain"),
+  frontingGatewayOperation: exports_external.object({
+    gatewayType: GrpcGatewayTypeEnum,
+    operation: exports_external.string()
+  }).nullish()
+});
+var GrpcPentestContextSchema = exports_external.object({
+  transport: exports_external.enum(["grpc", "grpc_web", "connect"]),
+  serviceFqn: exports_external.string(),
+  method: exports_external.string(),
+  streamingType: GrpcStreamingTypeEnum.optional(),
+  reflectionAvailable: exports_external.boolean().optional(),
+  schemaSource: GrpcSchemaSourceEnum.optional(),
+  host: exports_external.string().nullish().describe("Authority override; null falls back to the app domain"),
+  frontingGatewayOperation: exports_external.object({
+    gatewayType: GrpcGatewayTypeEnum,
+    operation: exports_external.string()
+  }).nullish()
+});
+function deriveGrpcMetadataFromPath(path) {
+  if (!path)
+    return;
+  const wire = path.replace(/^\//, "").split("?")[0];
+  const slash = wire.lastIndexOf("/");
+  if (slash <= 0 || slash === wire.length - 1)
+    return;
+  return { serviceFqn: wire.slice(0, slash), method: wire.slice(slash + 1) };
+}
+function toGrpcPentestContext(transport, grpc, path) {
+  if (!transport || transport === "http")
+    return;
+  const derived = grpc ?? deriveGrpcMetadataFromPath(path);
+  if (!derived)
+    return;
+  return {
+    transport,
+    serviceFqn: derived.serviceFqn,
+    method: derived.method,
+    streamingType: derived.streamingType,
+    reflectionAvailable: derived.reflectionAvailable,
+    schemaSource: derived.schemaSource,
+    host: derived.host,
+    frontingGatewayOperation: derived.frontingGatewayOperation
+  };
+}
+function grpcAuthorityTarget(grpc, path) {
+  if (!grpc?.host)
+    return;
+  const wirePath = path.startsWith("/") ? path : `/${path}`;
+  return `grpc://${grpc.host}${wirePath}`;
+}
+
 // src/core/agents/offSecAgent/tools/documentEndpoint.ts
 init_dist();
 init_zod();
@@ -107218,6 +107344,7 @@ function validateConcurrency(concurrency) {
 
 // src/core/agents/offSecAgent/tools/threatModelGenerator.ts
 init_zod();
+init_id();
 init_structured();
 init_lazyLogger();
 var log5 = scopedLogger(() => createLogger("threat-model-generator"));
@@ -107242,8 +107369,8 @@ var PentestObjectiveSchema = exports_external.object({
 });
 var SCHEMA_SOURCE_UNAVAILABLE_NOTE = "If the handler source is unreachable in your environment (source-unavailable mode — see prompt body), cite the grounding source you actually read (endpoint description, route table, OpenAPI spec, README) instead of `file:line` and tag the claim `[unverified: source unavailable]`. Never fabricate `file:line` references or invent code paths.";
 var ThreatModelResultSchema = exports_external.object({
-  businessLogic: exports_external.string().describe("Comprehensive narrative (aim for 800-2000 words) of what this endpoint does and the " + "rules it must uphold. Use markdown headings. Cover, in order: " + "(1) Purpose — what the endpoint accomplishes in user terms. " + "(2) Actors — who legitimately interacts with it, what they can do, how they authenticate. " + "(3) Data flow — inputs (with channel and trust level), transformations, side effects, outputs. " + "(4) Invariants — falsifiable business rules the endpoint must uphold, with enforcement " + "location (file:line) and confidence level. " + "(5) Trust boundaries — what actually guards each crossing (not what should). " + "(6) Analysis gaps — what you did NOT trace into and why. " + "Cite file:line for every concrete claim. Prefer completeness over brevity. " + SCHEMA_SOURCE_UNAVAILABLE_NOTE),
-  threatModel: exports_external.string().describe("Comprehensive threat model (aim for 800-2000 words) grounded in the business logic. " + "Use markdown headings. Cover: " + "(1) Attacker profiles — 2-4 realistic attackers with motivation, skill, position, and goal. " + "(2) Attack vectors — enumerate thoroughly (typically 8-15 for a non-trivial endpoint). " + "Each vector must reference a concrete input from the business logic, the invariant it " + "would break, the mechanism, the observable signal of success, an attacker profile, " + "likelihood, and impact. Cite file:line. " + "(3) Risk assessment — worst-case impact and vector prioritization. " + "Do not include generic OWASP filler ungrounded in evidence you actually read. " + SCHEMA_SOURCE_UNAVAILABLE_NOTE),
+  businessLogic: exports_external.string().describe("Comprehensive narrative (aim for 800-2000 words) of what this endpoint does and the " + "rules it must uphold. Use markdown headings. Cover, in order: " + "(1) Purpose — what the endpoint accomplishes in user terms. " + "(2) Actors — who legitimately interacts with it, what they can do, how they authenticate. " + "(3) Data flow — inputs including implicit framework-provided entry points reachable through the endpoint (with channel and trust level), transformations, side effects, outputs. " + "(4) Invariants — falsifiable business rules the endpoint must uphold, with enforcement " + "location (file:line) and confidence level. " + "(5) Trust boundaries — what actually guards each crossing (not what should). " + "(6) Analysis gaps — what you did NOT trace into and why. " + "Cite file:line for every concrete claim. Prefer completeness over brevity. " + SCHEMA_SOURCE_UNAVAILABLE_NOTE),
+  threatModel: exports_external.string().describe("Comprehensive threat model (aim for 800-2000 words) grounded in the business logic. " + "Use markdown headings. Cover: " + "(1) Attacker profiles — 2-4 realistic attackers with motivation, skill, position, and goal. " + "(2) Attack vectors — enumerate thoroughly (typically 8-15 for a non-trivial endpoint). " + "Each vector must reference a concrete entry point from the business logic (including implicit framework-provided entry points), the invariant it " + "would break, the mechanism, the observable signal of success, an attacker profile, " + "likelihood, and impact. Cite file:line. " + "(3) Risk assessment — worst-case impact and vector prioritization. " + "Do not include generic OWASP filler ungrounded in evidence you actually read. " + SCHEMA_SOURCE_UNAVAILABLE_NOTE),
   exposure: exports_external.number().min(0).max(3).describe("Exposure Level (0-3): how reachable is this endpoint by an attacker? " + "3 = Public, no authentication required. " + "2 = Standard authenticated user can reach it. " + "1 = Requires privileged/admin role. " + "0 = Private, internal-only, IP-restricted, or behind a service mesh."),
   exposureReasoning: exports_external.string().describe("Cite specific code/config signals (file:line) that determined the exposure score: " + "route registration, auth middleware, role guards, IP allowlists, network placement. " + "E.g. 'Route registered on public router with no auth middleware (app.ts:18). " + "Handler does not check req.user.' " + SCHEMA_SOURCE_UNAVAILABLE_NOTE),
   dataSensitivity: exports_external.number().min(0).max(3).describe("Data Sensitivity (0-3): how sensitive is the data this endpoint reads, writes, or returns? " + "3 = PII, PHI, financial records, passwords, tokens, secrets, session material. " + "2 = Business-operations data, tenant configs, internal settings, non-public metadata. " + "1 = Low-value user data (public profile, preferences). " + "0 = No meaningful data (static content, health checks, public catalog)."),
@@ -107277,11 +107404,12 @@ async function generateThreatModelForEndpoint(ctx, input) {
   return threatModelLimiter(async () => {
     if (ctx.abortSignal?.aborted)
       return null;
-    const { CodeAgent } = await import("./agent-7ab546zf.js");
-    const subagentId = `threat-model-${sanitize(input.appName)}-${sanitize(input.routePath)}`;
+    const { CodeAgent } = await import("./agent-3cdfwxcd.js");
+    const subagentId = newSessionId();
+    const subagentName = `Threat Model: ${input.routePath}`;
     ctx.eventBus?.emit("subagent-spawn", {
       subagentId,
-      name: `Threat Model: ${input.routePath}`,
+      name: subagentName,
       input: { app: input.appName, endpoint: input.routePath },
       parentSubagentId: ctx.subagentId
     });
@@ -107307,6 +107435,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
       abortSignal: childAbort.signal,
       eventBus: localBus,
       subagentId,
+      subagentName,
       responseSchema: ThreatModelResultSchema,
       stopWhen: stepCountIs(THREAT_MODEL_MAX_STEPS),
       excludeTools: ["document_endpoint", "document_app"]
@@ -107356,6 +107485,13 @@ function buildThreatModelPrompt(input, projectThreatModel) {
   const lineRange = input.line ? `around line ${input.line}` : "";
   const authInfo = input.authRequired ? "Authentication required" : "No authentication required";
   const methodStr = Array.isArray(input.method) ? input.method.join(", ") : input.method ?? "unknown";
+  const isGrpc = !!input.transport && input.transport !== "http";
+  const grpcSection = isGrpc ? `- **Transport**: ${input.transport} — this is a **gRPC method**, not an HTTP route. \`Path\` is the wire path \`/package.Service/Method\`; do NOT model it as a REST URL.
+- **gRPC service**: ${input.grpc?.serviceFqn ?? "(derive from Path)"}
+- **gRPC method**: ${input.grpc?.method ?? "(derive from Path)"}
+- **Streaming**: ${input.grpc?.streamingType ?? "unary"}
+The threat model and pentest objectives must be gRPC-specific (reflection/schema recovery, per-method missing-auth, BOLA on request-message IDs, metadata trust, \`:path\` authz bypass, protobuf fuzzing, streaming abuse) rather than HTTP-centric.
+` : "";
   let prompt = `# Endpoint Analysis
 
 ## Target Endpoint
@@ -107366,7 +107502,7 @@ function buildThreatModelPrompt(input, projectThreatModel) {
 - **Handler**: ${input.handler ?? "unknown"}
 - **Auth**: ${authInfo}
 - **Description**: ${input.description}
-
+${grpcSection}
 ## Reading the code
 
 1. Read the source file at \`${input.file ?? "(unknown)"}\` ${lineRange ? `(${lineRange})` : ""} to understand the implementation.
@@ -107389,7 +107525,7 @@ Produce a comprehensive narrative of what this endpoint does and what must be tr
 Who legitimately interacts with this endpoint. For each actor list their role, what they can legitimately do via this endpoint, and how they authenticate (session cookie, JWT, signed webhook, mTLS, API key, IP allowlist, etc.).
 
 ### Data Flow
-- **Inputs**: each input the handler accepts — name, channel (path / query / body / header / cookie / file / env / upstream-service / queue / webhook), trust level (untrusted / semi-trusted / trusted), and any observed validation. Cite file:line.
+- **Inputs**: each input reachable through this endpoint — name, channel (path / query / body / header / cookie / file / env / upstream-service / queue / webhook / server-action / rsc), trust level (untrusted / semi-trusted / trusted), and any observed validation. Include not just what the handler's signature accepts but implicit, framework-provided entry points a client can reach through this endpoint (e.g. server actions invoked from a page, RSC data fetches, framework-generated routes). Cite file:line.
 - **Transformations**: the ordered steps the handler takes — fetch, validate, authorize, compute, call external service. Cite file:line for each.
 - **Side effects**: every write the handler causes — DB writes, external API calls, email/queue/file writes, auth-state changes, payments. Name the target (table, service, queue).
 - **Outputs**: what the response body, headers, and status codes contain.
@@ -107444,10 +107580,29 @@ Before enumerating, name the 1–3 **functional roles** this endpoint plays (fro
 
 This is a **recall checklist, not a license to invent.** Skip role classes that have no anchor in this endpoint's code. Endpoint-specific vectors that don't fall under a listed role are welcome — mark them "endpoint-specific". Endpoint descriptions that name a role (e.g. "AI assistant", "payment intent", "webhook receiver", "password reset") are a strong signal to classify the corresponding role; if the handler source is unreachable, classify the role anyway and proceed under **source-unavailable mode** (defined in the reading-the-code section) — vectors still emit, but they're tagged \`[unverified: source unavailable]\` and capped at \`p1\` in Part 4.
 
+#### Step 1b — recall framework-derived surface
+
+Identify the framework and stack this endpoint runs on — from the code where available (package.json, config, imports, file-system conventions), or from the endpoint description in source-unavailable mode. Frameworks expose implicit, convention-based surface that is reachable *through* this endpoint but never appears as an explicit route in the endpoint list. Enumerate it and fold it into this endpoint's threat model and test plan.
+
+The classes below are high-signal framework sharp edges, with a few frameworks named under each. **They are examples to jog recall — not an exhaustive catalog, and not a fixed list of frameworks.** The named frameworks are illustrations; every stack has its own version of each class, and classes not listed here exist too. Skip any class with no anchor in this endpoint's code, and **generalize the same reasoning to whatever framework you actually detect**, including ones not named here — the point is the *class of sharp edge*, not the specific example.
+
+| Framework sharp-edge class (examples) | Where it shows up (example frameworks) | Probe / confirming signal |
+|---|---|---|
+| **Hidden data/RPC endpoint reachable by suffix or header** — auth enforced in the UI component, not the loader/action/endpoint | e.g. Next.js server actions (POST the page URL + \`Next-Action: <hash>\`), RSC stream (\`RSC: 1\`); Remix / React Router \`<route>.data\` or \`?_data=<id>\`; SvelteKit \`<route>/__data.json\`, \`+server.ts\`; Nuxt \`<route>/_payload.json\`, \`/__nuxt_island/<Name>_<hash>?props=\`, \`server/api/**\`; FastAPI \`/openapi.json\` | Hit the data URL directly with no / other-tenant session; a 200 with data instead of 302/401 means access control lives only in the UI |
+| **Debug/error mode shipped to prod → secret leak, often RCE** — force a 500 and fingerprint the framework error UI | e.g. Django technical-500 (dumps \`SECRET_KEY\`), Flask/Werkzeug \`/console\`, Rails dev pages + \`/rails/info\`, Laravel Ignition (\`POST /_ignition/execute-solution\` = unauth RCE), ASP.NET dev-exception page / \`elmah.axd\` / \`Trace.axd\`, Nuxt devtools + \`/_nuxt/*.map\` | Trigger an unhandled error; a framework-styled traceback means debug is on — chase the signing secret or the console/Ignition RCE from there |
+| **Conventional admin / introspection / actuator paths** | e.g. Spring \`/actuator/{env,heapdump,mappings,gateway/routes}\` (heapdump → creds, env → RCE), Django \`/admin\`, Laravel \`/telescope\` \`/horizon\`, Rails \`/rails/info/routes\` | GET the known paths directly; 200 = exposed (\`/actuator/heapdump\` returning an \`octet-stream\` hprof is the tell) |
+| **Signing key / app secret → cookie & session forgery (sometimes RCE)** | e.g. Django \`SECRET_KEY\` (+ pickle sessions → RCE), Flask \`SECRET_KEY\`, Rails \`secret_key_base\` (Marshal cookie → RCE), Laravel \`APP_KEY\`, ASP.NET \`machineKey\` / ViewState | Recover the key via a debug/config leak, forge an elevated session cookie, replay it |
+| **"Public" env by naming prefix → secret inlined into the client bundle** | e.g. Next \`NEXT_PUBLIC_*\`, SvelteKit \`PUBLIC_*\` (\`/_app/env.js\`), Nuxt \`runtimeConfig.public\` (\`__NUXT_DATA__\`) | Grep \`/_next/static\`, \`/_app/immutable\`, and hydration blobs for secret-shaped values and \`.map\` files |
+| **ORM mass-assignment via binding defaults** | e.g. Django \`ModelForm fields='__all__'\` / DRF, Rails \`permit!\`, Laravel \`$guarded = []\`, NestJS missing \`whitelist: true\`, FastAPI missing \`response_model\` (over-serializes \`hashed_password\`) | Over-post \`is_admin\` / \`role\` / \`owner_id\`; check whether it persists or leaks |
+| **Built-in fetch or image proxy → SSRF / traversal** | e.g. Next \`/_next/image?url=\`, Nuxt \`/_ipx/\`, Rails \`open()\` / open-uri | Point it at \`http://169.254.169.254/…\` or an internal host; a proxied or timing-differentiated response confirms |
+| **Framework expression / deserialization RCE** | e.g. Spring SpEL (\`#{T(java.lang.Runtime)…}\`) and data-binding classloader (\`class.module.classLoader.*\`), ASP.NET ViewState / Json.NET \`$type\`, Rails YAML/Marshal, template injection in Jinja / Blade / ERB, Node prototype pollution (\`__proto__[x]\`) | A framework-specific canary (\`#{7*7}\`, \`{{7*7}}\`, a bad-\`$type\` error, \`__proto__\` reflection) that proves evaluation |
+
+Treat any framework-derived surface you find this way as in-scope for this endpoint whenever this endpoint can reach it, and carry it into Part 4's test plan.
+
 #### Step 2 — enumerate
 
 Each vector must:
-- Reference a concrete **input** from Part 1's data flow (the entry point).
+- Reference a concrete **entry point** — an input from Part 1's data flow, including the framework-derived entry points captured there (Step 1b).
 - Reference the **invariant(s)** from Part 1 that it would break, when applicable. If a vector is a config/infrastructure concern with no business invariant, say so.
 - Describe the **mechanism** concretely — reference actual parameters, data flows, and code patterns you observed. Cite file:line (or, in source-unavailable mode, the grounding source you read — see the reading-the-code section).
 - State the **observable signal** of a successful exploit (what you would see externally to confirm it worked).
@@ -107563,9 +107718,6 @@ function flattenPentestObjective(o) {
   ].join(`
 `);
 }
-function sanitize(s) {
-  return s.toLowerCase().replace(/[^a-z0-9-_.]/g, "_");
-}
 
 // src/core/agents/offSecAgent/tools/documentEndpoint.ts
 function sanitizeName2(name) {
@@ -107574,7 +107726,9 @@ function sanitizeName2(name) {
 var documentEndpointInputSchema = exports_external.object({
   appName: exports_external.string().describe("Name of the parent application this endpoint belongs to. " + "Must match the appName used in a prior document_app call."),
   routePath: exports_external.string().describe("The endpoint's unique identity — its HTTP route or access pattern. " + "This is the URL path a client requests, NOT a source-file path. " + "Examples: '/api/users', '/dashboard', '/auth/login', " + "'/{objectKey}?X-Amz-Signature=...', 'arn:aws:s3:::bucket-name'. " + "For cloud-resource endpoints (endpointType 'asset') use the specific " + "access pattern, not the base domain URL (which is stored on the parent " + "application). The route path is the endpoint's display identity — there " + "is no separate name field."),
-  endpointType: exports_external.enum(["api-endpoint", "web-endpoint", "asset"]).describe("Type of endpoint: 'api-endpoint' for REST/GraphQL APIs, " + "'web-endpoint' for pages/views, 'asset' for other resources"),
+  endpointType: exports_external.enum(["api-endpoint", "web-endpoint", "asset"]).describe("Type of endpoint: 'api-endpoint' for REST/GraphQL APIs, " + "'web-endpoint' for pages/views, 'asset' for other resources. " + "A gRPC method is still 'api-endpoint' — set `transport` to mark it gRPC."),
+  transport: EndpointTransportEnum.optional().describe("Wire transport. Omit or 'http' for normal endpoints. Set 'grpc' " + "(or 'grpc_web' / 'connect') for a gRPC method and populate `grpc`."),
+  grpc: GrpcEndpointMetadataSchema.optional().describe("gRPC attributes — required when transport is a gRPC variant. Put the " + "wire path '/package.Service/Method' in `routePath`; do not glue on a host."),
   description: exports_external.string().describe("Detailed description of the endpoint including what it does"),
   method: exports_external.union([exports_external.string(), exports_external.array(exports_external.string())]).optional().describe("HTTP method(s) supported (e.g., 'GET', 'POST', or ['GET', 'POST', 'DELETE']). " + "Use 'PAGE' for web pages/views."),
   handler: exports_external.string().optional().describe("Handler function or component name (whitebox analysis)"),
@@ -107671,7 +107825,9 @@ Each endpoint creates a JSON file in the assets directory for tracking and analy
         line: input.line,
         handler: input.handler,
         authRequired: input.authRequired,
-        description: input.description
+        description: input.description,
+        transport: input.transport,
+        grpc: input.grpc
       };
       const threatModelOutput = await generateThreatModelForEndpoint(ctx, subagentInput);
       const riskScore = threatModelOutput?.riskScore ?? heuristicRiskScore;
@@ -107707,6 +107863,8 @@ Each endpoint creates a JSON file in the assets directory for tracking and analy
         appName: input.appName,
         routePath: input.routePath,
         endpointType: input.endpointType,
+        transport: input.transport,
+        grpc: input.grpc,
         riskLevel: input.riskLevel,
         filepath,
         businessLogic: businessLogic ?? undefined,
@@ -107747,6 +107905,7 @@ function hasCanonicalName(cwe) {
 }
 
 // src/core/agents/offSecAgent/tools/documentFinding.ts
+init_id();
 init_structured();
 init_lazyLogger();
 
@@ -109168,7 +109327,7 @@ init_lazyLogger();
 var log6 = scopedLogger(() => createLogger("FindingJudge"));
 async function judgeFinding(input, ctx) {
   try {
-    const { FindingJudgeAgent } = await import("./agent-c06jb5zv.js");
+    const { FindingJudgeAgent } = await import("./agent-yayy5x2a.js");
     const agent = new FindingJudgeAgent({
       finding: input,
       model: ctx.model,
@@ -109177,9 +109336,11 @@ async function judgeFinding(input, ctx) {
       abortSignal: ctx.abortSignal,
       eventBus: ctx.eventBus,
       subagentId: ctx.subagentId,
+      subagentName: ctx.subagentName,
       sandbox: ctx.sandbox,
       target: input.target ?? ctx.target ?? ctx.session.targets[0],
       enableThinking: ctx.enableThinking,
+      thinkingEffort: ctx.thinkingEffort,
       openAIReasoningEffort: ctx.openAIReasoningEffort
     });
     const result = await agent.consume();
@@ -109402,10 +109563,11 @@ CRITICAL RULES — READ BEFORE CALLING:
             vulnerabilityClass: input.vulnerabilityClass
           }
         };
-        const judgeSubagentId = nextJudgeSubagentId(ctx.subagentId);
+        const judgeSubagentId = newSessionId();
+        const judgeSubagentName = "Finding Judge";
         ctx.eventBus?.emit("subagent-spawn", {
           subagentId: judgeSubagentId,
-          name: "Finding Judge",
+          name: judgeSubagentName,
           input: { title: input.title, endpoint: input.endpoint },
           parentSubagentId: ctx.subagentId
         });
@@ -109420,9 +109582,11 @@ CRITICAL RULES — READ BEFORE CALLING:
             abortSignal: ctx.abortSignal,
             eventBus: judgeBus,
             subagentId: judgeSubagentId,
+            subagentName: judgeSubagentName,
             sandbox: ctx.sandbox,
             target: ctx.target,
             enableThinking: ctx.enableThinking,
+            thinkingEffort: ctx.thinkingEffort,
             openAIReasoningEffort: ctx.openAIReasoningEffort
           });
         } catch (error) {
@@ -109735,14 +109899,6 @@ ${finding.references}` : ""}
     }
   });
 }
-var judgeCounters = new Map;
-function nextJudgeSubagentId(parentSubagentId) {
-  const key = parentSubagentId ?? "";
-  const next = (judgeCounters.get(key) ?? 0) + 1;
-  judgeCounters.set(key, next);
-  const prefix = parentSubagentId ? `${parentSubagentId}-` : "";
-  return `${prefix}finding-judge-${next}`;
-}
 async function executeLocalPoc(ctx, input) {
   const pocsPath = ctx.session.pocsPath;
   if (!existsSync8(pocsPath)) {
@@ -113266,7 +113422,306 @@ var SEND_EMAIL_TOOL_NAME = "send_email";
 init_dist();
 init_zod();
 import { existsSync as existsSync9, mkdirSync as mkdirSync8, writeFileSync as writeFileSync10 } from "node:fs";
+import { join as join15 } from "node:path";
+
+// src/core/agents/offSecAgent/tools/agentScratch.ts
 import { join as join14 } from "node:path";
+function agentLogsDir(ctx) {
+  return ctx.subagentId ? join14(ctx.session.rootPath, "subagents", ctx.subagentId, "logs") : ctx.session.logsPath;
+}
+
+// src/core/agents/offSecAgent/tools/destructiveGuard.ts
+var NOT_DESTRUCTIVE = { destructive: false };
+function safeDecode2(input) {
+  let out = input ?? "";
+  for (let pass = 0;pass < 2; pass++) {
+    const decoded = out.replace(/\+/g, " ").replace(/%[0-9a-fA-F]{2}/g, (m) => {
+      try {
+        return decodeURIComponent(m);
+      } catch {
+        return m;
+      }
+    });
+    if (decoded === out)
+      break;
+    out = decoded;
+  }
+  return out;
+}
+var SQL_SEP = String.raw`(?:\s|/\*[\s\S]*?\*/)+`;
+var SQL_DESTRUCTIVE_STATEMENT = new RegExp(`(?:drop${SQL_SEP}(?:table|database|schema|index|view|column|role|user|sequence|trigger|function|procedure)` + `|truncate${SQL_SEP}(?:table${SQL_SEP})?[\`"\\w]` + `|delete${SQL_SEP}from${SQL_SEP}[\`"\\w]` + `|alter${SQL_SEP}table${SQL_SEP}[^;]*\\bdrop\\b)`, "i");
+var SQL_STATEMENT_START = new RegExp(`^\\s*['"\`;)\\s]*(?:${SQL_DESTRUCTIVE_STATEMENT.source})`, "i");
+var SQL_INJECTION_CONTEXT = new RegExp(`['"\`]\\s*;?\\s*(?:${SQL_DESTRUCTIVE_STATEMENT.source})|;\\s*(?:${SQL_DESTRUCTIVE_STATEMENT.source})`, "i");
+function httpCarriesDestructiveSql(decoded) {
+  if (!SQL_DESTRUCTIVE_STATEMENT.test(decoded))
+    return false;
+  return SQL_STATEMENT_START.test(decoded) || SQL_INJECTION_CONTEXT.test(decoded);
+}
+var NOSQL_HTTP_DESTRUCTIVE = /\bdb(?:\.\w+)+\.(?:drop(?:Database)?|deleteMany|remove)\s*\(|\.dropDatabase\s*\(|\.drop\s*\(\s*\)|\bdeleteMany\s*\(\s*\{|(?:^|[\n;])\s*(?:flushall|flushdb)\b/i;
+var NOSQL_CMD_DESTRUCTIVE = /\bdb(?:\.\w+)*\.(?:drop(?:Database)?|deleteMany|remove)\s*\(|\.dropDatabase\s*\(|\.drop\s*\(\s*\)|\bflushall\b|\bflushdb\b/i;
+var WRITE_METHODS = new Set(["POST", "PUT", "PATCH"]);
+var DESTRUCTIVE_PATH_PATTERN = /(?:^|[/_?&=.-])(?:delete|destroy|drop|purge|truncate|wipe|obliterate|nuke|remove|hard[-_]?delete|force[-_]?delete)(?:[/_?&=.-]|$)/i;
+var METHOD_OVERRIDE_DELETE_PATTERN = /(?:_method|x-http-method-override|x-http-method|x-method-override|x-method|httpmethod)\s*[=:]\s*['"]?delete\b/i;
+var CMD_BOUNDARY = String.raw`(?:^|[\n;&|(]|&&|\|\||-[a-z]*c\s+["']?)\s*(?:sudo\s+)?`;
+var HOME_REF = /^(?:~[^/]*|\$\{?HOME\}?)(?:\/|$)/;
+function normalizeRmTarget(raw) {
+  const unquoted = raw.replace(/^['"]|['"]$/g, "");
+  if (HOME_REF.test(unquoted))
+    return "~";
+  if (!unquoted.startsWith("/"))
+    return unquoted;
+  const stack = [];
+  for (const seg of unquoted.split("/")) {
+    if (seg === "" || seg === ".")
+      continue;
+    if (seg === "..") {
+      stack.pop();
+      continue;
+    }
+    stack.push(seg);
+  }
+  return `/${stack.join("/")}`;
+}
+function isDangerousRm(command) {
+  const rmRe = /\brm\b([^\n;|&]*)/gi;
+  for (const match of command.matchAll(rmRe)) {
+    const args = match[1] ?? "";
+    const hasRecursive = /(?:^|\s)(?:-[a-z]*r[a-z]*|--recursive)\b/i.test(args);
+    const hasForce = /(?:^|\s)(?:-[a-z]*f[a-z]*|--force)\b/i.test(args);
+    if (!hasRecursive || !hasForce)
+      continue;
+    if (/--no-preserve-root/i.test(args))
+      return true;
+    for (const rawToken of args.split(/\s+/)) {
+      if (!rawToken || rawToken.startsWith("-"))
+        continue;
+      if (/^['"]?\/\*/.test(rawToken))
+        return true;
+      const norm = normalizeRmTarget(rawToken);
+      if (norm === "~")
+        return true;
+      if (norm === "/")
+        return true;
+      if (/^\/(?:etc|var|usr|bin|sbin|boot|lib|lib64|root|home|opt|srv|sys|proc|dev)(?:\/|$)/i.test(norm)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+var HOST_DESTRUCTIVE_RULES = [
+  { id: "rm-rf-root", test: isDangerousRm },
+  {
+    id: "dd-to-device",
+    test: (c) => {
+      const m = new RegExp(`${CMD_BOUNDARY}dd\\b[^\\n;|&]*\\bof=\\s*['"]?(/dev/\\S+)`, "i").exec(c);
+      if (!m)
+        return false;
+      const dev = m[1].replace(/['"].*$/, "");
+      return !/^\/dev\/(?:null|zero|full|random|urandom|stdout|stderr|tty|fd\/)/i.test(dev);
+    }
+  },
+  {
+    id: "mkfs",
+    test: (c) => new RegExp(`${CMD_BOUNDARY}(?:/s?bin/)?mkfs(?:\\.\\w+)?\\b`, "i").test(c)
+  },
+  {
+    id: "clobber-device",
+    test: (c) => />\s*['"]?\/dev\/(?:sd|nvme|hd|vd|xvd|mapper|disk|loop|dm-|md)/i.test(c)
+  },
+  {
+    id: "fork-bomb",
+    test: (c) => /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/.test(c)
+  },
+  {
+    id: "power-state",
+    test: (c) => new RegExp(`${CMD_BOUNDARY}(?:/(?:usr/)?s?bin/)?(?:shutdown|reboot|halt|poweroff)\\b`, "i").test(c) || new RegExp(`${CMD_BOUNDARY}init\\s+0\\b`, "i").test(c)
+  }
+];
+var HTTP_CLIENT_PATTERN = /\b(?:curl|wget|xh|httpie)\b/i;
+var URL_IN_COMMAND = /https?:\/\/[^\s"'`;|&)<>]+/gi;
+var CURL_DELETE = /(?:-X|--request|--method)[=\s]*['"]?delete\b/i;
+var HTTPIE_METHOD = new RegExp(`${CMD_BOUNDARY}(?:https?|xh|httpie)\\s+(?:-{1,2}\\S+\\s+)*(delete|post|put|patch)\\b`, "i");
+var CURL_WRITE_METHOD = /(?:-X|--request|--method)[=\s]*['"]?(?:post|put|patch)\b/i;
+var CURL_DATA_FLAG = /(?:^|\s)(?:-d|--data(?:-raw|-binary|-urlencode|-ascii)?|-F|--form|--json|--post-data|--post-file|--body-data|--body-file)\b/i;
+var JS_METHOD_DELETE = /\bmethod\s*:\s*['"`]?\s*delete\b/i;
+var JS_HTTP_CLIENT_HINT = /\b(?:fetch|axios|got|ky|superagent|needle|node-fetch|undici|phin|XMLHttpRequest|xhr)\b|\.\s*(?:request|open)\s*\(/i;
+var JS_CLIENT_DELETE_CALL = /\b(?:axios|got|ky|superagent|needle|supertest|phin|page|apiContext|apiRequestContext|request)\s*(?:\.\s*\w+)*\.\s*delete\s*\(/i;
+function classifyCommandHttp(command) {
+  const decoded = safeDecode2(command);
+  const httpieMethod = HTTPIE_METHOD.exec(command)?.[1]?.toLowerCase();
+  const hasShellHttpClient = HTTP_CLIENT_PATTERN.test(command) || httpieMethod !== undefined;
+  const hasJsHttpClient = JS_HTTP_CLIENT_HINT.test(command);
+  if (hasShellHttpClient && (CURL_DELETE.test(command) || httpieMethod === "delete")) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-http-delete",
+      reason: "command issues an HTTP DELETE against the target"
+    };
+  }
+  if (JS_METHOD_DELETE.test(command) && hasJsHttpClient || JS_CLIENT_DELETE_CALL.test(command)) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-script-http-delete",
+      reason: "command runs an in-script HTTP DELETE (fetch/axios/Playwright) against the target"
+    };
+  }
+  if ((hasShellHttpClient || hasJsHttpClient) && METHOD_OVERRIDE_DELETE_PATTERN.test(decoded)) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "cmd-http-override-delete",
+      reason: "command overrides the HTTP method to DELETE"
+    };
+  }
+  if (hasShellHttpClient && httpCarriesDestructiveSql(decoded)) {
+    return {
+      destructive: true,
+      category: "sql-destructive",
+      ruleId: "cmd-http-sql",
+      reason: "command sends a destructive SQL statement in an HTTP request (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)"
+    };
+  }
+  if (hasShellHttpClient && NOSQL_HTTP_DESTRUCTIVE.test(decoded)) {
+    return {
+      destructive: true,
+      category: "nosql-destructive",
+      ruleId: "cmd-http-nosql",
+      reason: "command sends a destructive NoSQL/cache operation in an HTTP request"
+    };
+  }
+  const writeIndicated = CURL_WRITE_METHOD.test(command) || CURL_DATA_FLAG.test(command) || httpieMethod === "post" || httpieMethod === "put" || httpieMethod === "patch";
+  if (hasShellHttpClient && writeIndicated) {
+    for (const rawUrl of command.match(URL_IN_COMMAND) ?? []) {
+      if (DESTRUCTIVE_PATH_PATTERN.test(safeDecode2(rawUrl))) {
+        return {
+          destructive: true,
+          category: "http-destructive-path",
+          ruleId: "cmd-http-destructive-path",
+          reason: "command sends a write request to a delete/destroy/purge route"
+        };
+      }
+    }
+  }
+  return NOT_DESTRUCTIVE;
+}
+var DB_CLIENT_PATTERN = /\b(?:psql|mysql|mariadb|mongosh|mongo|sqlite3|sqlcmd|sqlplus|cqlsh|clickhouse-client|redis-cli|sqlmap)\b|\bcockroach\s+sql\b/i;
+function classifyHttpAction(input) {
+  const method = input.method.toUpperCase();
+  const decodedUrl = safeDecode2(input.url);
+  const decodedBody = safeDecode2(typeof input.body === "string" ? input.body : "");
+  const headerText = input.headers ? Object.entries(input.headers).map(([name, value]) => `${name}: ${String(value)}`).join(`
+`) : "";
+  const overrideHaystack = `${decodedUrl}
+${decodedBody}
+${headerText}`;
+  if (method === "DELETE") {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "http-method-delete",
+      reason: "HTTP DELETE removes a resource on the target"
+    };
+  }
+  if (METHOD_OVERRIDE_DELETE_PATTERN.test(overrideHaystack)) {
+    return {
+      destructive: true,
+      category: "http-delete-method",
+      ruleId: "http-method-override-delete",
+      reason: "request overrides the HTTP method to DELETE"
+    };
+  }
+  if (httpCarriesDestructiveSql(`${decodedUrl}
+${decodedBody}`)) {
+    return {
+      destructive: true,
+      category: "sql-destructive",
+      ruleId: "http-body-sql",
+      reason: "request carries a destructive SQL statement (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)"
+    };
+  }
+  if (NOSQL_HTTP_DESTRUCTIVE.test(decodedBody)) {
+    return {
+      destructive: true,
+      category: "nosql-destructive",
+      ruleId: "http-body-nosql",
+      reason: "request carries a destructive NoSQL/cache operation (drop/deleteMany/flush)"
+    };
+  }
+  if (WRITE_METHODS.has(method) && DESTRUCTIVE_PATH_PATTERN.test(decodedUrl)) {
+    return {
+      destructive: true,
+      category: "http-destructive-path",
+      ruleId: "http-destructive-path",
+      reason: "write request targets a delete/destroy/purge route"
+    };
+  }
+  return NOT_DESTRUCTIVE;
+}
+function classifyCommandAction(command) {
+  for (const { id, test } of HOST_DESTRUCTIVE_RULES) {
+    if (test(command)) {
+      return {
+        destructive: true,
+        category: "host-destructive",
+        ruleId: id,
+        reason: `command performs a catastrophic host operation (${id})`
+      };
+    }
+  }
+  const decodedCommand = safeDecode2(command);
+  if (DB_CLIENT_PATTERN.test(command)) {
+    if (SQL_DESTRUCTIVE_STATEMENT.test(decodedCommand)) {
+      return {
+        destructive: true,
+        category: "sql-destructive",
+        ruleId: "cmd-sql",
+        reason: "command runs a destructive SQL statement via a DB client (DROP/TRUNCATE/DELETE FROM/ALTER…DROP)"
+      };
+    }
+    if (NOSQL_CMD_DESTRUCTIVE.test(decodedCommand)) {
+      return {
+        destructive: true,
+        category: "nosql-destructive",
+        ruleId: "cmd-nosql",
+        reason: "command runs a destructive NoSQL/cache operation via a DB client (drop/deleteMany/flush)"
+      };
+    }
+  }
+  return classifyCommandHttp(command);
+}
+
+class DestructiveActionError extends Error {
+  classification;
+  constructor(classification, subject) {
+    super(`Destructive action blocked: ${subject} — ${classification.reason ?? "destructive operation"}. ` + `Destructive testing (DB deletes/drops, API write-deletes, catastrophic host operations) is NOT authorized for this engagement. ` + `Prove the flaw without completing the destructive step (e.g. demonstrate the authorization boundary is crossed with a read or a reversible action), or ask the operator to enable destructive testing.`);
+    this.classification = classification;
+    this.name = "DestructiveActionError";
+  }
+}
+function isDestructiveTestingAllowed(ctx) {
+  return ctx.session?.config?.allowDestructiveActions === true;
+}
+function assertHttpActionAllowed(input, ctx) {
+  if (isDestructiveTestingAllowed(ctx))
+    return;
+  const classification = classifyHttpAction(input);
+  if (classification.destructive) {
+    throw new DestructiveActionError(classification, `${input.method.toUpperCase()} ${input.url}`);
+  }
+}
+function assertCommandActionAllowed(command, ctx) {
+  if (isDestructiveTestingAllowed(ctx))
+    return;
+  const classification = classifyCommandAction(command);
+  if (classification.destructive) {
+    throw new DestructiveActionError(classification, command);
+  }
+}
+
+// src/core/agents/offSecAgent/tools/executeCommand.ts
 var MAX_INLINE = 50000;
 var MS_TIMEOUT_THRESHOLD = 1e4;
 var DEFAULT_PROMPT_INJECTION_FILE_ENV = "APEX_PROMPT_INJECTION_FILE";
@@ -113309,13 +113764,13 @@ function maybeSaveFullOutput(raw, ctx) {
   if (raw.length <= MAX_INLINE) {
     return { text: raw || "(no output)" };
   }
-  const outputDir = join14(ctx.session.logsPath, "cmd-output");
+  const outputDir = join15(agentLogsDir(ctx), "cmd-output");
   if (!existsSync9(outputDir)) {
     mkdirSync8(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `output-${ts}.txt`;
-  const filePath = join14(outputDir, filename);
+  const filePath = join15(outputDir, filename);
   try {
     writeFileSync10(filePath, raw);
   } catch {
@@ -113336,6 +113791,15 @@ function maybeSaveFullOutput(raw, ctx) {
 function shellQuote2(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function redactSecretValues(text, secrets) {
+  if (!secrets?.length)
+    return text;
+  let out = text;
+  for (const s of [...secrets].filter((v) => v && v.length >= 6).sort((a, b) => b.length - a.length)) {
+    out = out.split(s).join("[REDACTED]");
+  }
+  return out;
+}
 function wrapCommandWithEnv(command, envVars) {
   if (!envVars || Object.keys(envVars).length === 0)
     return command;
@@ -113488,6 +113952,20 @@ IMPORTANT: Always analyze results and adjust your approach based on findings.`,
         };
       }
       const commandWithHeaders = inject.status === "injected" ? inject.command : command;
+      try {
+        assertCommandActionAllowed(commandWithHeaders, ctx);
+      } catch (e) {
+        if (e instanceof DestructiveActionError) {
+          return {
+            success: false,
+            error: e.message,
+            stdout: "",
+            stderr: e.message,
+            command
+          };
+        }
+        throw e;
+      }
       let promptInjectionLibrary;
       let promptInjectionEnvVars;
       let promptInjectionPayloadContent;
@@ -113515,7 +113993,10 @@ IMPORTANT: Always analyze results and adjust your approach based on findings.`,
           command
         };
       }
-      const redact = (value) => promptInjectionLibrary ? redactPromptInjectionPayloads(value, promptInjectionLibrary) : value;
+      const redact = (value) => {
+        const stripped = promptInjectionLibrary ? redactPromptInjectionPayloads(value, promptInjectionLibrary) : value;
+        return redactSecretValues(stripped, ctx.secretValues);
+      };
       if (ctx.sandbox) {
         try {
           const ssmOpts = {};
@@ -113908,7 +114389,7 @@ search with flags or a more specific directory if results are truncated.`,
 init_dist();
 init_zod();
 import { existsSync as existsSync10, mkdirSync as mkdirSync9, writeFileSync as writeFileSync11 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 var MAX_INLINE_BODY = 5000;
 var promptInjectionRefSchema = exports_external.object({
   kind: exports_external.literal("prompt_injection_ref"),
@@ -113938,13 +114419,13 @@ function containsPromptInjectionRef(value) {
 function maybeSaveBody(body, ctx) {
   if (body.length <= MAX_INLINE_BODY)
     return { text: body };
-  const outputDir = join15(ctx.session.logsPath, "http-responses");
+  const outputDir = join16(agentLogsDir(ctx), "http-responses");
   if (!existsSync10(outputDir)) {
     mkdirSync9(outputDir, { recursive: true });
   }
   const ts = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `response-${ts}.txt`;
-  const filePath = join15(outputDir, filename);
+  const filePath = join16(outputDir, filename);
   try {
     writeFileSync11(filePath, body);
   } catch {
@@ -114009,6 +114490,7 @@ COMMON TESTING PATTERNS:
       followRedirects,
       timeout
     }) => {
+      let headers = parseHeaders(rawHeaders);
       try {
         assertUrlInScope(url, ctx);
       } catch (e) {
@@ -114027,7 +114509,6 @@ COMMON TESTING PATTERNS:
         }
         throw e;
       }
-      let headers = parseHeaders(rawHeaders);
       let resolvedBody;
       let library = EMPTY_PROMPT_INJECTION_LIBRARY;
       try {
@@ -114038,6 +114519,8 @@ COMMON TESTING PATTERNS:
         }) : EMPTY_PROMPT_INJECTION_LIBRARY;
         headers = resolvePromptInjectionRefs(headers, library);
         resolvedBody = body === undefined ? undefined : String(resolvePromptInjectionRefs(body, library));
+        const effectiveHeaders = resolveEffectiveHeaders(resolverSessionFromCtx(ctx), url, headers);
+        assertHttpActionAllowed({ method, url, body: resolvedBody, headers: effectiveHeaders }, ctx);
       } catch (e) {
         return {
           success: false,
@@ -114137,17 +114620,17 @@ COMMON TESTING PATTERNS:
 }
 async function executeSandboxHttpRequest(ctx, opts, library) {
   const { url, method, headers, body, followRedirects, timeout } = opts;
+  const { sandbox } = ctx;
+  if (!sandbox) {
+    throw new Error("executeSandboxHttpRequest requires a sandbox");
+  }
+  let bodyTempFile = null;
   try {
     let curlCommand = `curl -i -X ${method}`;
     const mergedHeaders = resolveEffectiveHeaders(resolverSessionFromCtx(ctx), url, headers);
     for (const [key, value] of Object.entries(mergedHeaders)) {
       curlCommand += ` -H "${shellQuote(`${key}: ${value}`)}"`;
     }
-    const { sandbox } = ctx;
-    if (!sandbox) {
-      throw new Error("executeSandboxHttpRequest requires a sandbox");
-    }
-    let bodyTempFile = null;
     if (body && ["POST", "PUT", "PATCH"].includes(method)) {
       bodyTempFile = `/tmp/apex_http_body_${Date.now()}_${Math.random().toString(36).slice(2, 11)}.txt`;
       const escapedForPrintf = body.replace(/\\/g, "\\\\").replace(/%/g, "%%");
@@ -114233,6 +114716,10 @@ async function executeSandboxHttpRequest(ctx, opts, library) {
       url,
       redirected: false
     };
+  } finally {
+    if (bodyTempFile) {
+      await sandbox.execute(`rm -f ${bodyTempFile}`, { timeout: 10 }).catch(() => {});
+    }
   }
 }
 
@@ -114240,7 +114727,7 @@ async function executeSandboxHttpRequest(ctx, opts, library) {
 init_dist();
 init_zod();
 import { readdir, stat } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join16, relative as relative2, resolve as resolve3 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join17, relative as relative2, resolve as resolve3 } from "node:path";
 var listFilesInputSchema = exports_external.object({
   directory: exports_external.string().optional().describe("Absolute or relative path to the directory to list (defaults to current working directory)"),
   recursive: exports_external.boolean().optional().describe("If true, list files recursively (default: false)"),
@@ -114260,7 +114747,7 @@ async function listRecursive(dir, maxEntries) {
     }
     for (const entry of entries) {
       total++;
-      const fullPath = join16(current, entry.name);
+      const fullPath = join17(current, entry.name);
       if (entry.isDirectory()) {
         if (results.length < maxEntries)
           results.push(`${fullPath}/`);
@@ -114323,7 +114810,7 @@ Each directory entry is suffixed with "/" for easy identification.`,
         }
         const entries = await readdir(dir, { withFileTypes: true });
         const fullPaths = entries.map((e) => {
-          const name = join16(dir, e.name);
+          const name = join17(dir, e.name);
           return e.isDirectory() ? `${name}/` : name;
         });
         const capped = fullPaths.slice(0, MAX_NON_RECURSIVE);
@@ -114465,9 +114952,9 @@ import {
   unlinkSync as unlinkSync2
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 var MAX_BUFFER = 5000000;
-var APEX_TMP_ROOT = join17(tmpdir(), `apex-shell-${process.pid}`);
+var APEX_TMP_ROOT = join18(tmpdir(), `apex-shell-${process.pid}`);
 try {
   mkdirSync10(APEX_TMP_ROOT, { recursive: true });
 } catch {}
@@ -114739,8 +115226,8 @@ ${commandOutput}`;
         const marker = `__APEX_${nonceHex}__`;
         const exitMarkerPrefix = `${marker}_EXIT_`;
         const cutoverMarker = `${marker}_CUTOVER`;
-        const outPath = join17(APEX_TMP_ROOT, `${nonceHex}.out`);
-        const errPath = join17(APEX_TMP_ROOT, `${nonceHex}.err`);
+        const outPath = join18(APEX_TMP_ROOT, `${nonceHex}.out`);
+        const errPath = join18(APEX_TMP_ROOT, `${nonceHex}.err`);
         const pending = {
           streamedStdout: "",
           authoritativeStdout: "",
@@ -115159,7 +115646,7 @@ Returns discovered endpoints and recommended login approach.`,
 init_dist();
 init_zod();
 import { writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function provideComparisonResults(ctx) {
   return tool({
     description: `Provide the final comparison results with matched, missed, and extra findings.
@@ -115205,7 +115692,7 @@ Results will be saved to: comparison-results.json in the session directory.`,
         recall,
         precision
       };
-      const resultsPath = join18(ctx.session.rootPath, "comparison-results.json");
+      const resultsPath = join19(ctx.session.rootPath, "comparison-results.json");
       writeFileSync12(resultsPath, JSON.stringify(result, null, 2));
       return {
         success: true,
@@ -115363,6 +115850,7 @@ function createResponseTool(responseSchema, onResult) {
 // src/core/agents/offSecAgent/tools/runAttackSurface.ts
 init_dist();
 init_zod();
+init_id();
 init_structured();
 init_lazyLogger();
 var log8 = scopedLogger(() => createLogger("run_attack_surface"));
@@ -115394,15 +115882,17 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
           message: "run_attack_surface requires a model in the tool context."
         };
       }
-      const subagentId = "attack-surface-agent";
+      const subagentName = "Attack Surface";
+      const subagentId = cwd ? newSessionId() : "attack-surface-agent";
       ctx.eventBus?.emit("subagent-spawn", {
         subagentId,
+        name: subagentName,
         input: { target, cwd },
         parentSubagentId: ctx.subagentId
       });
       if (cwd) {
         try {
-          const { WhiteboxAttackSurfaceAgent } = await import("./index-rxskwf3k.js");
+          const { WhiteboxAttackSurfaceAgent } = await import("./index-pxwwcefn.js");
           const localBus = new AgentEventBus;
           AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
           const agent = new WhiteboxAttackSurfaceAgent({
@@ -115413,14 +115903,19 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
             abortSignal: ctx.abortSignal,
             attackSurfaceRegistry: ctx.attackSurfaceRegistry,
             eventBus: localBus,
-            subagentId
+            subagentId,
+            subagentName
           });
           const result = await agent.consume();
-          const targets = result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => ({
-            target: ep.path,
-            objective: ep.pentestObjectives.join("; "),
-            rationale: `${app.framework} ${ep.method} endpoint in ${app.name} (${ep.file}${ep.line ? `:${ep.line}` : ""})`
-          })));
+          const targets = result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => {
+            const grpc = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
+            return {
+              target: grpcAuthorityTarget(grpc, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${target}${ep.path}`),
+              objective: ep.pentestObjectives.join("; "),
+              rationale: `${app.framework} ${ep.method} endpoint in ${app.name} (${ep.file}${ep.line ? `:${ep.line}` : ""})`,
+              grpc
+            };
+          }));
           log8.info(`Whitebox attack surface complete: ${targets.length} targets from ${result.apps.length} apps`);
           ctx.eventBus?.emit("subagent-complete", {
             subagentId,
@@ -115452,7 +115947,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
         }
       }
       try {
-        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-32zwxt6w.js");
+        const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-d0smgqt7.js");
         const localBus = new AgentEventBus;
         AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
         const agent = new BlackboxAttackSurfaceAgent({
@@ -115530,7 +116025,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ target, cwd }) => {
-      const { runPentestWorkflow: workflow } = await import("./pentest-91bygv3h.js");
+      const { runPentestWorkflow: workflow } = await import("./pentest-1cb5t0dt.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -115548,6 +116043,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
           abortSignal: ctx.abortSignal,
           eventBus: ctx.eventBus,
           enableThinking: ctx.enableThinking,
+          thinkingEffort: ctx.thinkingEffort,
           openAIReasoningEffort: ctx.openAIReasoningEffort,
           surfaceIntegrationEnabled: ctx.surfaceIntegrationEnabled
         });
@@ -115636,11 +116132,11 @@ init_id();
 
 // src/core/whitebox/adapters.ts
 import { existsSync as existsSync12 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 
 // src/core/whitebox/artifacts.ts
 import { mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, join as join19 } from "node:path";
+import { basename as basename2, join as join20 } from "node:path";
 
 // src/core/whitebox/paths.ts
 import { existsSync as existsSync11, realpathSync } from "node:fs";
@@ -115701,10 +116197,10 @@ function safeName(value) {
   return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/\.{2,}/g, ".").replace(/^-+|-+$/g, "").slice(0, 80);
 }
 function getWhiteboxLogsDir(session) {
-  return join19(session.logsPath, "whitebox");
+  return join20(session.logsPath, "whitebox");
 }
 function getWhiteboxScratchDir(session) {
-  return join19(session.scratchpadPath, "whitebox");
+  return join20(session.scratchpadPath, "whitebox");
 }
 async function ensureWhiteboxDirs(session) {
   await Promise.all([
@@ -115717,7 +116213,7 @@ async function writeWhiteboxArtifact(input) {
   const baseDir = input.area === "scratchpad" ? getWhiteboxScratchDir(input.session) : getWhiteboxLogsDir(input.session);
   const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
   const filename = `${timestamp}-${safeName(input.name)}${input.extension ?? ".txt"}`;
-  const absolutePath = join19(baseDir, filename);
+  const absolutePath = join20(baseDir, filename);
   await writeFile2(absolutePath, input.content, "utf-8");
   const relativeRoot = input.area === "scratchpad" ? "scratchpad/whitebox" : "logs/whitebox";
   return {
@@ -115959,7 +116455,7 @@ var WHITEBOX_SCAN_ADAPTERS = [
     id: "npm-audit",
     kind: "dependencies",
     tool: "npm",
-    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join20(profile.rootPath, "package-lock.json"))),
+    detect: (profile) => hasTool(profile, "npm") && (profile.packageManagers.includes("npm") || existsSync12(join21(profile.rootPath, "package-lock.json"))),
     buildCommand: () => ["npm", "audit", "--json"],
     parseSummary: (raw) => simpleLineFindings("npm audit", raw)
   },
@@ -116068,7 +116564,7 @@ ${raw.stderr}` : "");
 // src/core/whitebox/candidates.ts
 import { existsSync as existsSync13 } from "node:fs";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join22 } from "node:path";
 var CANDIDATES_FILE = "candidates.json";
 var writeLocks = new Map;
 function withCandidateLock(session, fn) {
@@ -116095,10 +116591,10 @@ var ALLOWED_TRANSITIONS = {
   deferred: ["hypothesis", "investigating"]
 };
 function candidatesDir(session) {
-  return join21(session.scratchpadPath, "whitebox");
+  return join22(session.scratchpadPath, "whitebox");
 }
 function candidatesPath(session) {
-  return join21(candidatesDir(session), CANDIDATES_FILE);
+  return join22(candidatesDir(session), CANDIDATES_FILE);
 }
 function makeId2(title) {
   const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 48);
@@ -116568,7 +117064,7 @@ import {
   readSync as readSync2,
   statSync as statSync4
 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var MAX_JOB_LOG_INLINE = 40000;
 var MAX_JOB_LOG_BYTES = 10 * 1024 * 1024;
 var PRUNE_AFTER_MS = 60000;
@@ -116643,7 +117139,7 @@ function startWhiteboxJob(input) {
   const logsDir = getWhiteboxLogsDir(input.session);
   mkdirSync11(logsDir, { recursive: true });
   const safeName2 = (input.name ?? "job").replace(/[^a-z0-9._-]+/gi, "-").replace(/\.{2,}/g, ".");
-  const logPath = join22(logsDir, `${id}-${safeName2}.log`);
+  const logPath = join23(logsDir, `${id}-${safeName2}.log`);
   const now = new Date().toISOString();
   writeLog(logPath, `$ ${input.command}
 
@@ -116772,7 +117268,7 @@ function readWhiteboxJobLog(id, sessionId) {
 import { execFile as execFile2 } from "node:child_process";
 import { existsSync as existsSync15, realpathSync as realpathSync2 } from "node:fs";
 import { readdir as readdir2, readFile as readFile5, stat as stat2 } from "node:fs/promises";
-import { basename as basename3, extname as extname2, join as join23, relative as relative4, resolve as resolve6 } from "node:path";
+import { basename as basename3, extname as extname2, join as join24, relative as relative4, resolve as resolve6 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile2);
 var MAX_PROFILE_FILES = 5000;
@@ -116881,7 +117377,7 @@ async function walkFiles(rootPath) {
     for (const entry of entries) {
       if (files.length >= MAX_PROFILE_FILES)
         return;
-      const fullPath = join23(current, entry.name);
+      const fullPath = join24(current, entry.name);
       if (entry.isDirectory()) {
         if (shouldSkipDir(entry.name))
           continue;
@@ -116943,7 +117439,7 @@ function detectEntryHints(files) {
   return hints.slice(0, 100);
 }
 async function readPackageScripts(rootPath) {
-  const packageJsonPath = join23(rootPath, "package.json");
+  const packageJsonPath = join24(rootPath, "package.json");
   if (!existsSync15(packageJsonPath)) {
     return { buildCommands: [], testCommands: [], runCommands: [] };
   }
@@ -117107,7 +117603,7 @@ Returns an array of results with the text output from each agent.`,
   });
 }
 async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
-  const { CodeAgent } = await import("./agent-7ab546zf.js");
+  const { CodeAgent } = await import("./agent-3cdfwxcd.js");
   const childSessionId = newSessionId();
   const subagentId = childSessionId;
   ctx.eventBus?.emit("subagent-spawn", {
@@ -117133,7 +117629,9 @@ async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, na
     abortSignal: ctx.abortSignal,
     eventBus: localBus,
     subagentId,
+    subagentName: name,
     enableThinking: ctx.enableThinking,
+    thinkingEffort: ctx.thinkingEffort,
     openAIReasoningEffort: ctx.openAIReasoningEffort
   });
   try {
@@ -117164,7 +117662,7 @@ init_ai();
 init_structured();
 init_lazyLogger();
 import { existsSync as existsSync16, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 var log9 = scopedLogger(() => createLogger("findings:registry"));
 var VULN_CLASS_PATTERNS = [
   [/sql\s*injection/i, "sql-injection"],
@@ -117356,7 +117854,7 @@ class FindingsRegistry {
     log9.debug(`fromDirectory: path=${findingsPath}, jsonFiles=${files.length}`);
     for (const file of files) {
       try {
-        const raw = readFileSync6(join24(findingsPath, file), "utf-8");
+        const raw = readFileSync6(join25(findingsPath, file), "utf-8");
         const finding = JSON.parse(raw);
         if (finding && typeof finding.title === "string" && typeof finding.endpoint === "string") {
           registry.indexFinding(finding);
@@ -117561,13 +118059,13 @@ class FindingsRegistry {
 
 // src/core/plan/index.ts
 import { existsSync as existsSync17, readFileSync as readFileSync7 } from "node:fs";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 var PLAN_FILENAME = "plan.md";
 function planFilePath(sessionRootPath, subagentId) {
   if (subagentId) {
-    return join25(sessionRootPath, "subagents", `${subagentId}-plan.md`);
+    return join26(sessionRootPath, "subagents", `${subagentId}-plan.md`);
   }
-  return join25(sessionRootPath, PLAN_FILENAME);
+  return join26(sessionRootPath, PLAN_FILENAME);
 }
 function readPlan(sessionRootPath, subagentId) {
   const path = planFilePath(sessionRootPath, subagentId);
@@ -117622,7 +118120,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
           message: "spawn_pentest_agent requires a model in the tool context."
         };
       }
-      const { TargetedPentestAgent } = await import("./agent-dsqssedb.js");
+      const { TargetedPentestAgent } = await import("./agent-q5hwjdtb.js");
       const findingsRegistry = ctx.findingsRegistry ?? FindingsRegistry.fromDirectory(ctx.session.findingsPath, {
         model: ctx.model,
         authConfig: ctx.authConfig,
@@ -117652,6 +118150,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
       try {
         agent = new TargetedPentestAgent({
           target,
+          grpc: workerInheritsGrpc(target, ctx.grpc, ctx.target) ? ctx.grpc : undefined,
           objectives,
           context: enrichedContext,
           model: ctx.model,
@@ -117661,8 +118160,11 @@ Returns the worker's summary, objective results, and finding count — but NOT t
           findingsRegistry,
           eventBus: childBus,
           subagentId,
+          subagentName: name,
           sandbox: ctx.sandbox,
+          secretValues: ctx.secretValues,
           enableThinking: ctx.enableThinking,
+          thinkingEffort: ctx.thinkingEffort,
           openAIReasoningEffort: ctx.openAIReasoningEffort,
           role: "worker",
           browserSession: sharedBrowserSession,
@@ -117703,6 +118205,13 @@ Returns the worker's summary, objective results, and finding count — but NOT t
     }
   });
 }
+function workerInheritsGrpc(target, grpc, orchestratorTarget) {
+  if (!grpc)
+    return false;
+  if (orchestratorTarget && target === orchestratorTarget)
+    return true;
+  return target.includes(`${grpc.serviceFqn}/${grpc.method}`);
+}
 function buildSharedBrowserSessionContext(existingContext) {
   const note = `## Shared Browser Session
 You are driving the orchestrator's live Playwright browser (NOT a private copy):
@@ -117739,12 +118248,13 @@ Pass every target you want tested — the swarm handles concurrency automaticall
       targets: exports_external.array(exports_external.object({
         name: exports_external.string().optional().describe("Short human-readable label for this agent shown in the UI (e.g. 'SQLi /api/users', 'IDOR orders')"),
         target: exports_external.string().describe("Full target URL including endpoint to test"),
-        objectives: exports_external.array(exports_external.string()).describe("Testing objectives for this target (e.g., 'Test for SQL injection on /api/users', 'Check IDOR on /api/orders/{id}')")
+        objectives: exports_external.array(exports_external.string()).describe("Testing objectives for this target (e.g., 'Test for SQL injection on /api/users', 'Check IDOR on /api/orders/{id}')"),
+        grpc: GrpcPentestContextSchema.optional().describe("gRPC method context for gRPC/Connect targets — pass through the `grpc` object from run_attack_surface so the agent runs the gRPC test battery instead of HTTP tests.")
       })).describe("Array of targets with their testing objectives"),
       toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ targets }) => {
-      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-91bygv3h.js");
+      const { runPentestSwarm, DEFAULT_CONCURRENCY: DEFAULT_CONCURRENCY2 } = await import("./pentest-1cb5t0dt.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -117768,6 +118278,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
         eventBus: ctx.eventBus,
         concurrency: DEFAULT_CONCURRENCY2,
         enableThinking: ctx.enableThinking,
+        thinkingEffort: ctx.thinkingEffort,
         openAIReasoningEffort: ctx.openAIReasoningEffort,
         display: ctx.display
       });
@@ -119428,6 +119939,30 @@ var ALL_TOOL_NAMES = [
   "submit_plan",
   ASK_USER_QUESTIONS_TOOL_NAME
 ];
+var FAST_STRIKE_EXCLUDED_TOOL_NAMES = [
+  "run_attack_surface",
+  "spawn_pentest_swarm",
+  "spawn_pentest_agent",
+  "spawn_coding_agent",
+  "run_pentest_workflow",
+  "delegate_to_auth_subagent",
+  "run_whitebox_scan",
+  "create_whitebox_candidate",
+  "update_whitebox_candidate",
+  "list_whitebox_candidates",
+  "start_whitebox_job",
+  "poll_whitebox_job",
+  "stop_whitebox_job",
+  "read_whitebox_artifact",
+  "write_plan",
+  "submit_plan",
+  "create_task",
+  "update_task",
+  "list_tasks",
+  "create_attack_surface_report",
+  "provide_comparison_results",
+  ASK_USER_QUESTIONS_TOOL_NAME
+];
 var PLAN_MODE_TOOL_NAMES = [
   "browser_navigate",
   "browser_snapshot",
@@ -119677,7 +120212,7 @@ init_dist();
 init_ai();
 import { existsSync as existsSync18, mkdirSync as mkdirSync14, readFileSync as readFileSync8 } from "node:fs";
 import { writeFile as writeFile6 } from "node:fs/promises";
-import { join as join26 } from "node:path";
+import { join as join27 } from "node:path";
 init_id();
 init_structured();
 init_observability();
@@ -119993,6 +120528,7 @@ class OffensiveSecurityAgent {
   _drainRejection = new Promise(() => {});
   drained = Promise.resolve();
   subagentId;
+  subagentName;
   currentMessageId = null;
   persistentShell;
   browserSession;
@@ -120028,6 +120564,7 @@ class OffensiveSecurityAgent {
   constructor(input) {
     this._session = input.session;
     this.subagentId = input.subagentId;
+    this.subagentName = input.subagentName;
     this.abortSignal = input.abortSignal;
     this.userPrompt = input.prompt;
     this.eventBus = input.eventBus ?? new AgentEventBus;
@@ -120049,23 +120586,33 @@ class OffensiveSecurityAgent {
         extraHttpHeaders: stripBrowserManagedHeaders(sessionHeaders),
         display: input.display
       });
+      if (this.ownsBrowserSession && this.abortSignal) {
+        const onAbort = () => {
+          this.disconnectOwnedBrowser();
+        };
+        if (this.abortSignal.aborted)
+          onAbort();
+        else
+          this.abortSignal.addEventListener("abort", onAbort, { once: true });
+      }
     } else {
       this.ownsBrowserSession = false;
     }
-    const messagesDir = input.messagesDir ?? (input.subagentId ? join26(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
-    const tracePath = input.subagentId ? join26(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join26(messagesDir, "trace.jsonl");
+    const messagesDir = input.messagesDir ?? (input.subagentId ? join27(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
+    const tracePath = input.subagentId ? join27(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join27(messagesDir, "trace.jsonl");
     const traceWriter = new StepTraceWriter({
       tracePath,
       agentId: input.subagentId ?? null,
       eventBus: this.eventBus
     });
     const taskDriven = input.session.config?.taskDriven ?? false;
-    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join26(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join26(input.session.rootPath, "tasks") : undefined);
+    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join27(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join27(input.session.rootPath, "tasks") : undefined);
     const credentialManager = input.credentialManager ?? input.session.credentialManager;
     const builtinTools = createAllTools({
       session: input.session,
       agentCwd,
       target: input.target,
+      grpc: input.grpc,
       abortSignal: input.abortSignal,
       model: input.model,
       authConfig: input.authConfig,
@@ -120074,6 +120621,7 @@ class OffensiveSecurityAgent {
       findingsRegistry: input.findingsRegistry,
       attackSurfaceRegistry: input.attackSurfaceRegistry,
       credentialManager,
+      secretValues: input.secretValues,
       persistentShell: this.persistentShell,
       skillsRegistry: input.skillsRegistry,
       promptInjectionLibrary: input.promptInjectionLibrary,
@@ -120081,6 +120629,7 @@ class OffensiveSecurityAgent {
       traceWriter,
       tasksDir,
       enableThinking: input.enableThinking,
+      thinkingEffort: input.thinkingEffort,
       openAIReasoningEffort: input.openAIReasoningEffort,
       surfaceIntegrationEnabled: input.surfaceIntegrationEnabled,
       projectThreatModel: input.projectThreatModel,
@@ -120157,11 +120706,22 @@ class OffensiveSecurityAgent {
     if (input.mode === "plan") {
       const planSet = new Set(PLAN_MODE_TOOL_NAMES);
       activeTools = activeTools.filter((t) => planSet.has(t));
+    } else if (input.mode === "fast-strike") {
+      const excluded = new Set(FAST_STRIKE_EXCLUDED_TOOL_NAMES);
+      activeTools = Object.keys(tools).filter((t) => {
+        if (excluded.has(t))
+          return false;
+        if (!emailToolSet.has(t))
+          return true;
+        if (t === SEND_EMAIL_TOOL_NAME)
+          return hasSmtp;
+        return hasEmail;
+      });
     }
     if (!existsSync18(messagesDir)) {
       mkdirSync14(messagesDir, { recursive: true });
     }
-    this.messagesPath = join26(messagesDir, "messages.json");
+    this.messagesPath = join27(messagesDir, "messages.json");
     const messagesPath = this.messagesPath;
     const initialMessagesRef = {
       current: input.messages ? [...input.messages] : [
@@ -120212,7 +120772,7 @@ class OffensiveSecurityAgent {
       activeTools,
       stopWhen,
       toolChoice: "auto",
-      sessionPath: input.session.rootPath,
+      sessionPath: messagesDir,
       sessionId: this.busSessionId,
       onStepFinish: async (event) => {
         this.latestMessages = [
@@ -120263,6 +120823,7 @@ class OffensiveSecurityAgent {
         input.onCacheMetrics?.(metrics);
       },
       enableThinking: input.enableThinking,
+      thinkingEffort: input.thinkingEffort,
       openAIReasoningEffort: input.openAIReasoningEffort,
       silent: true
     });
@@ -120287,7 +120848,7 @@ class OffensiveSecurityAgent {
     const runConsume = async () => {
       const toolParts = new Map;
       const ids = {
-        subagentId: this.busSessionId,
+        subagentId: this.subagentId,
         sessionId: this.busSessionId,
         messageId: undefined,
         textPartId: undefined,
@@ -120514,10 +121075,11 @@ class OffensiveSecurityAgent {
       }
       return;
     };
-    const drain = !sid ? runConsume() : getApexTracer().startActiveSpan(`invoke_agent ${sid}`, {
+    const spanLabel = this.subagentName ?? sid;
+    const drain = !sid ? runConsume() : withSubagentSessionBaggage(sid, () => getApexTracer().startActiveSpan(`invoke_agent ${spanLabel}`, {
       attributes: {
         "gen_ai.operation.name": "invoke_agent",
-        "gen_ai.agent.name": sid
+        "gen_ai.agent.name": spanLabel
       }
     }, async (span) => {
       try {
@@ -120528,7 +121090,7 @@ class OffensiveSecurityAgent {
       } finally {
         span.end();
       }
-    });
+    }));
     let rejectDrain;
     this._drainRejection = new Promise((_, reject) => {
       rejectDrain = reject;
@@ -120560,6 +121122,10 @@ class OffensiveSecurityAgent {
     this.browserDisconnected = true;
     await this.browserSession.disconnect().catch(() => {});
   }
+  async abortAndDrain() {
+    await this.disconnectOwnedBrowser();
+    await this.drained.catch(() => {});
+  }
   get response() {
     return this.streamResult.response;
   }
@@ -120698,4 +121264,4 @@ function wrapToolsWithApprovalGate(tools, gate, exemptToolNames) {
   return wrapped;
 }
 
-export { AgentEventBus, INTERNAL_ID_PATTERN, ApprovalGate, OPERATOR_MODES, OPERATOR_MODE_CYCLE, createInitialOperatorState, buildProvidedFilesSection, buildSessionWorkspaceSection, buildBaseSystemPrompt, BASE_SYSTEM_PROMPT, isMemoryEnabled, addMemory2 as addMemory, ASK_USER_QUESTIONS_TOOL_NAME, AskUserQuestionSchema, transformScriptToFunction, parseStorageStateResult, setHeadlessMode, setUserAgent, setViewportSize, PlaywrightMcpSession, createBrowserTools, ScopeViolationError, getAllowedHosts, isHostAllowed, extractHostname2 as extractHostname, assertUrlInScope, extractHostsFromCommand, assertCommandInScope, checkSandboxPlaywright, installSandboxPlaywright, ensureSandboxPlaywright, ensureSandboxBrowser, createSandboxBrowserTools, BROWSER_TOOL_NAMES, createBrowserToolset, checkpointState, completeAuthentication, crawlAuthenticated, createAttackSurfaceReport, createFile, createTask2 as createTask, delegateAuth, detectAuthScheme, documentApp, pLimit, documentEndpoint, CweEntrySchema, ValidatedCweEntrySchema, hasCanonicalName, documentVulnerability, createEmailToolset, EMAIL_TOOL_NAMES, SEND_EMAIL_TOOL_NAME, executeCommand, extractJsEndpoints, getMemory2 as getMemory, getPage, grep, httpRequest, listFiles, listMemories2 as listMemories, listTasksTool, readTempfileCapped, getApexTmpRoot, extractFallbackStdout, PersistentShell, probeAuthEndpoints, provideComparisonResults, readFile2 as readFile, readSkill, REPORT_ERROR_TOOL_NAME, ReportErrorReasonSchema, createReportErrorTool, PentestReportedError, RESPONSE_TOOL_NAME, createResponseTool, runAttackSurface, runPentestWorkflow, runWithBoundedConcurrency, spawnCodingAgent, FindingsRegistry, planFilePath, readPlan, hasPlan, spawnPentestAgent, spawnPentestSwarm, submitPlan, testEndpointVariations, updateFile, updateTask2 as updateTask, validateDiscovery, webSearch, writePlan, createAllTools, ALL_TOOL_NAMES, PLAN_MODE_TOOL_NAMES, SKILL_TOOL_NAMES, StepTraceWriter, OffensiveSecurityAgent };
+export { AgentEventBus, INTERNAL_ID_PATTERN, ApprovalGate, OPERATOR_MODES, OPERATOR_MODE_CYCLE, createInitialOperatorState, buildProvidedFilesSection, buildSessionWorkspaceSection, buildBaseSystemPrompt, BASE_SYSTEM_PROMPT, isMemoryEnabled, addMemory2 as addMemory, ASK_USER_QUESTIONS_TOOL_NAME, AskUserQuestionSchema, transformScriptToFunction, parseStorageStateResult, setHeadlessMode, setUserAgent, setViewportSize, PlaywrightMcpSession, createBrowserTools, ScopeViolationError, getAllowedHosts, isHostAllowed, extractHostname2 as extractHostname, assertUrlInScope, extractHostsFromCommand, assertCommandInScope, checkSandboxPlaywright, installSandboxPlaywright, ensureSandboxPlaywright, ensureSandboxBrowser, createSandboxBrowserTools, BROWSER_TOOL_NAMES, createBrowserToolset, checkpointState, completeAuthentication, crawlAuthenticated, createAttackSurfaceReport, createFile, createTask2 as createTask, delegateAuth, detectAuthScheme, documentApp, EndpointTransportEnum, GrpcEndpointMetadataSchema, toGrpcPentestContext, grpcAuthorityTarget, pLimit, documentEndpoint, CweEntrySchema, ValidatedCweEntrySchema, hasCanonicalName, documentVulnerability, createEmailToolset, EMAIL_TOOL_NAMES, SEND_EMAIL_TOOL_NAME, executeCommand, extractJsEndpoints, getMemory2 as getMemory, getPage, grep, httpRequest, listFiles, listMemories2 as listMemories, listTasksTool, readTempfileCapped, getApexTmpRoot, extractFallbackStdout, PersistentShell, probeAuthEndpoints, provideComparisonResults, readFile2 as readFile, readSkill, REPORT_ERROR_TOOL_NAME, ReportErrorReasonSchema, createReportErrorTool, PentestReportedError, RESPONSE_TOOL_NAME, createResponseTool, runAttackSurface, runPentestWorkflow, runWithBoundedConcurrency, spawnCodingAgent, FindingsRegistry, planFilePath, readPlan, hasPlan, spawnPentestAgent, spawnPentestSwarm, submitPlan, testEndpointVariations, updateFile, updateTask2 as updateTask, validateDiscovery, webSearch, writePlan, createAllTools, ALL_TOOL_NAMES, FAST_STRIKE_EXCLUDED_TOOL_NAMES, PLAN_MODE_TOOL_NAMES, SKILL_TOOL_NAMES, StepTraceWriter, OffensiveSecurityAgent };