@pensar/apex 2.4.0 → 2.5.0-canary.22f2eb52

package/build/{cli-5k33webc.js → cli-jw1xftqm.js}

@@ -1,59 +1,56 @@
 import {
-  BlackboxAttackSurfaceAgent
-} from "./cli-gq40s5b3.js";
-import {
-  REPORT_FILENAME_JSON,
-  REPORT_FILENAME_MD,
-  buildPentestReport,
-  renderJson,
-  renderMarkdown
-} from "./cli-b1adytsy.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-mavved45.js";
-import {
-  CodeAgent
-} from "./cli-32z0017y.js";
-import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-k8kc47pq.js";
-import {
-  FindingsRegistry,
-  OffensiveSecurityAgent,
-  PLAN_MODE_TOOL_NAMES,
+  toGrpcPentestContext,
   grpcAuthorityTarget,
+  inProcessSubagentSpawner,
   pLimit,
-  runWithBoundedConcurrency,
-  toGrpcPentestContext
-} from "./cli-repbyhkk.js";
-import {
-  createThreatModelPrompt
-} from "./cli-fw5r7pfj.js";
+  FindingsRegistry,
+  PLAN_MODE_TOOL_NAMES,
+  OffensiveSecurityAgent
+} from "./cli-qkb3v2nw.js";
 import {
-  createLogger,
   hasToolCall,
   init_dist,
+  newSessionId,
   init_id,
+  scopedLogger,
   init_lazyLogger,
   init_session,
-  init_structured,
-  newSessionId,
-  scopedLogger
-} from "./cli-tkc598ey.js";
+  createLogger,
+  init_structured
+} from "./cli-j1916nvj.js";
 import {
-  __require
-} from "./cli-bc05qbss.js";
+  BlackboxAttackSurfaceAgent2
+} from "./cli-8kkaeb70.js";
+import {
+  TargetedPentestAgent2,
+  buildPentestSystemPrompt2
+} from "./cli-4z46kyrk.js";
+import {
+  buildPentestReport,
+  renderJson,
+  renderMarkdown,
+  REPORT_FILENAME_MD,
+  REPORT_FILENAME_JSON
+} from "./cli-q45hcq3f.js";
+import {
+  CodeAgent2
+} from "./cli-gq5sk2j3.js";
+import {
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+  EndpointSchema2,
+  AppsDiscoveryResultSchema2,
+  DiscoverySummarySchema2
+} from "./cli-gamfs2yq.js";
+import {
+  createThreatModelPrompt
+} from "./cli-q126f6ef.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
-import { existsSync as existsSync13, readdirSync as readdirSync12, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
-import { join as join18 } from "node:path";
+import { existsSync as existsSync12, readdirSync as readdirSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { join as join17 } from "node:path";
 
 // src/core/agents/specialized/pentest/planPrompt.ts
 var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
@@ -126,9 +123,23 @@ function normalizeTokenUsage(value) {
   return {
     inputTokens,
     outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
     totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
   };
 }
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
 function metricsPath(sessionRootPath) {
   return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
 }
@@ -143,6 +154,7 @@ function readExecutionMetrics(sessionRootPath) {
     const parsed = JSON.parse(readFileSync(path, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
       elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
@@ -167,10 +179,13 @@ function writeExecutionMetrics(input) {
   const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
     inputTokens: 0,
     outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
     totalTokens: 0
   };
   const next = {
     tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
     runtime: input.runtime ?? existing?.runtime,
     elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
     updatedAt: new Date().toISOString()
@@ -467,10 +482,10 @@ function loadSubagents(rootPath) {
   const subagentsPath = join2(rootPath, SUBAGENTS_DIR);
   const manifestNameById = new Map;
   {
-    const manifestPath2 = join2(rootPath, MANIFEST_FILE);
-    if (existsSync2(manifestPath2)) {
+    const manifestPath = join2(rootPath, MANIFEST_FILE);
+    if (existsSync2(manifestPath)) {
       try {
-        const manifest = JSON.parse(readFileSync2(manifestPath2, "utf-8"));
+        const manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
         for (const entry of manifest)
           manifestNameById.set(entry.id, entry.name);
       } catch {}
@@ -620,7 +635,7 @@ init_lazyLogger();
 
 // src/core/workflows/whiteboxAttackSurface.ts
 import {
-  existsSync as existsSync12,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync2,
   readdirSync as readdirSync10,
   readFileSync as readFileSync9,
@@ -740,7 +755,7 @@ async function runEndpointDocumentationAgent(opts) {
     endpoint,
     frameworks
   });
-  const agent = new CodeAgent({
+  const agent = new CodeAgent2({
     codebasePath,
     objective,
     system: WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
@@ -757,7 +772,7 @@ async function runEndpointDocumentationAgent(opts) {
     openAIReasoningEffort,
     enableThinking,
     thinkingEffort,
-    responseSchema: DiscoverySummarySchema,
+    responseSchema: DiscoverySummarySchema2,
     excludeTools: ["document_app", "list_files", "grep"],
     projectThreatModel
   });
@@ -783,12 +798,13 @@ async function runAppEndpointDocumentation(opts) {
   const { endpoints, ...shared } = opts;
   if (endpoints.length === 0)
     return;
+  const spawner = opts.subagentSpawner ?? inProcessSubagentSpawner;
   let anyFailed = false;
-  await runWithBoundedConcurrency(endpoints, ENDPOINT_DOCUMENTATION_CONCURRENCY, async (endpoint) => {
+  await spawner.spawnMany(endpoints, async (endpoint) => {
     const ok = await runEndpointDocumentationAgent({ ...shared, endpoint });
     if (!ok)
       anyFailed = true;
-  });
+  }, { concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY });
   if (anyFailed) {
     throw new Error(`One or more endpoint documentation agents failed for app ${opts.app.name}`);
   }
@@ -1055,12 +1071,12 @@ function compileMap() {
       fallback: []
     }
   }, index, length;
-  function collectType(type2) {
-    if (type2.multi) {
-      result.multi[type2.kind].push(type2);
-      result.multi["fallback"].push(type2);
+  function collectType(type) {
+    if (type.multi) {
+      result.multi[type.kind].push(type);
+      result.multi["fallback"].push(type);
     } else {
-      result[type2.kind][type2.tag] = result["fallback"][type2.tag] = type2;
+      result[type.kind][type.tag] = result["fallback"][type.tag] = type;
     }
   }
   for (index = 0, length = arguments.length;index < length; index += 1) {
@@ -1071,7 +1087,7 @@ function compileMap() {
 function Schema$1(definition) {
   return this.extend(definition);
 }
-Schema$1.prototype.extend = function extend2(definition) {
+Schema$1.prototype.extend = function extend(definition) {
   var implicit = [];
   var explicit = [];
   if (definition instanceof type) {
@@ -1478,9 +1494,9 @@ var BASE64_MAP = `ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
 function resolveYamlBinary(data) {
   if (data === null)
     return false;
-  var code, idx, bitlen = 0, max = data.length, map2 = BASE64_MAP;
+  var code, idx, bitlen = 0, max = data.length, map = BASE64_MAP;
   for (idx = 0;idx < max; idx++) {
-    code = map2.indexOf(data.charAt(idx));
+    code = map.indexOf(data.charAt(idx));
     if (code > 64)
       continue;
     if (code < 0)
@@ -1490,14 +1506,14 @@ function resolveYamlBinary(data) {
   return bitlen % 8 === 0;
 }
 function constructYamlBinary(data) {
-  var idx, tailbits, input = data.replace(/[\r\n=]/g, ""), max = input.length, map2 = BASE64_MAP, bits = 0, result = [];
+  var idx, tailbits, input = data.replace(/[\r\n=]/g, ""), max = input.length, map = BASE64_MAP, bits = 0, result = [];
   for (idx = 0;idx < max; idx++) {
     if (idx % 4 === 0 && idx) {
       result.push(bits >> 16 & 255);
       result.push(bits >> 8 & 255);
       result.push(bits & 255);
     }
-    bits = bits << 6 | map2.indexOf(input.charAt(idx));
+    bits = bits << 6 | map.indexOf(input.charAt(idx));
   }
   tailbits = max % 4 * 6;
   if (tailbits === 0) {
@@ -1513,32 +1529,32 @@ function constructYamlBinary(data) {
   return new Uint8Array(result);
 }
 function representYamlBinary(object) {
-  var result = "", bits = 0, idx, tail, max = object.length, map2 = BASE64_MAP;
+  var result = "", bits = 0, idx, tail, max = object.length, map = BASE64_MAP;
   for (idx = 0;idx < max; idx++) {
     if (idx % 3 === 0 && idx) {
-      result += map2[bits >> 18 & 63];
-      result += map2[bits >> 12 & 63];
-      result += map2[bits >> 6 & 63];
-      result += map2[bits & 63];
+      result += map[bits >> 18 & 63];
+      result += map[bits >> 12 & 63];
+      result += map[bits >> 6 & 63];
+      result += map[bits & 63];
     }
     bits = (bits << 8) + object[idx];
   }
   tail = max % 3;
   if (tail === 0) {
-    result += map2[bits >> 18 & 63];
-    result += map2[bits >> 12 & 63];
-    result += map2[bits >> 6 & 63];
-    result += map2[bits & 63];
+    result += map[bits >> 18 & 63];
+    result += map[bits >> 12 & 63];
+    result += map[bits >> 6 & 63];
+    result += map[bits & 63];
   } else if (tail === 2) {
-    result += map2[bits >> 10 & 63];
-    result += map2[bits >> 4 & 63];
-    result += map2[bits << 2 & 63];
-    result += map2[64];
+    result += map[bits >> 10 & 63];
+    result += map[bits >> 4 & 63];
+    result += map[bits << 2 & 63];
+    result += map[64];
   } else if (tail === 1) {
-    result += map2[bits >> 2 & 63];
-    result += map2[bits << 4 & 63];
-    result += map2[64];
-    result += map2[64];
+    result += map[bits >> 2 & 63];
+    result += map[bits << 4 & 63];
+    result += map[64];
+    result += map[64];
   }
   return result;
 }
@@ -1967,7 +1983,7 @@ function writeFoldedLines(state, count) {
   }
 }
 function readPlainScalar(state, nodeIndent, withinFlowCollection) {
-  var preceding, following, captureStart, captureEnd, hasPendingContent, _line, _lineStart, _lineIndent, _kind = state.kind, _result = state.result, ch;
+  var preceding, following, captureStart, captureEnd, hasPendingContent, _line, _lineStart, _lineIndent, { kind: _kind, result: _result } = state, ch;
   ch = state.input.charCodeAt(state.position);
   if (is_WS_OR_EOL(ch) || is_FLOW_INDICATOR(ch) || ch === 35 || ch === 38 || ch === 42 || ch === 33 || ch === 124 || ch === 62 || ch === 39 || ch === 34 || ch === 37 || ch === 64 || ch === 96) {
     return false;
@@ -2297,7 +2313,7 @@ function readBlockScalar(state, nodeIndent) {
   return true;
 }
 function readBlockSequence(state, nodeIndent) {
-  var _line, _tag = state.tag, _anchor = state.anchor, _result = [], following, detected = false, ch;
+  var _line, { tag: _tag, anchor: _anchor } = state, _result = [], following, detected = false, ch;
   if (state.firstTabInLine !== -1)
     return false;
   if (state.anchor !== null) {
@@ -2346,7 +2362,7 @@ function readBlockSequence(state, nodeIndent) {
   return false;
 }
 function readBlockMapping(state, nodeIndent, flowIndent) {
-  var following, allowCompact, _line, _keyLine, _keyLineStart, _keyPos, _tag = state.tag, _anchor = state.anchor, _result = {}, overridableKeys = Object.create(null), keyTag = null, keyNode = null, valueNode = null, atExplicitKey = false, detected = false, ch;
+  var following, allowCompact, _line, _keyLine, _keyLineStart, _keyPos, { tag: _tag, anchor: _anchor } = state, _result = {}, overridableKeys = Object.create(null), keyTag = null, keyNode = null, valueNode = null, atExplicitKey = false, detected = false, ch;
   if (state.firstTabInLine !== -1)
     return false;
   if (state.anchor !== null) {
@@ -2568,7 +2584,7 @@ function readAlias(state) {
   return true;
 }
 function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact) {
-  var allowBlockStyles, allowBlockScalars, allowBlockCollections, indentStatus = 1, atNewLine = false, hasContent = false, typeIndex, typeQuantity, typeList, type2, flowIndent, blockIndent;
+  var allowBlockStyles, allowBlockScalars, allowBlockCollections, indentStatus = 1, atNewLine = false, hasContent = false, typeIndex, typeQuantity, typeList, type, flowIndent, blockIndent;
   if (state.listener !== null) {
     state.listener("open", state);
   }
@@ -2650,10 +2666,10 @@ function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact
       throwError(state, 'unacceptable node kind for !<?> tag; it should be "scalar", not "' + state.kind + '"');
     }
     for (typeIndex = 0, typeQuantity = state.implicitTypes.length;typeIndex < typeQuantity; typeIndex += 1) {
-      type2 = state.implicitTypes[typeIndex];
-      if (type2.resolve(state.result)) {
-        state.result = type2.construct(state.result);
-        state.tag = type2.tag;
+      type = state.implicitTypes[typeIndex];
+      if (type.resolve(state.result)) {
+        state.result = type.construct(state.result);
+        state.tag = type.tag;
         if (state.anchor !== null) {
           state.anchorMap[state.anchor] = state.result;
         }
@@ -2662,27 +2678,27 @@ function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact
     }
   } else if (state.tag !== "!") {
     if (_hasOwnProperty$1.call(state.typeMap[state.kind || "fallback"], state.tag)) {
-      type2 = state.typeMap[state.kind || "fallback"][state.tag];
+      type = state.typeMap[state.kind || "fallback"][state.tag];
     } else {
-      type2 = null;
+      type = null;
       typeList = state.typeMap.multi[state.kind || "fallback"];
       for (typeIndex = 0, typeQuantity = typeList.length;typeIndex < typeQuantity; typeIndex += 1) {
         if (state.tag.slice(0, typeList[typeIndex].tag.length) === typeList[typeIndex].tag) {
-          type2 = typeList[typeIndex];
+          type = typeList[typeIndex];
           break;
         }
       }
     }
-    if (!type2) {
+    if (!type) {
       throwError(state, "unknown tag !<" + state.tag + ">");
     }
-    if (state.result !== null && type2.kind !== state.kind) {
-      throwError(state, "unacceptable node kind for !<" + state.tag + '> tag; it should be "' + type2.kind + '", not "' + state.kind + '"');
+    if (state.result !== null && type.kind !== state.kind) {
+      throwError(state, "unacceptable node kind for !<" + state.tag + '> tag; it should be "' + type.kind + '", not "' + state.kind + '"');
     }
-    if (!type2.resolve(state.result, state.tag)) {
+    if (!type.resolve(state.result, state.tag)) {
       throwError(state, "cannot resolve a node with !<" + state.tag + "> explicit tag");
     } else {
-      state.result = type2.construct(state.result, state.tag);
+      state.result = type.construct(state.result, state.tag);
       if (state.anchor !== null) {
         state.anchorMap[state.anchor] = state.result;
       }
@@ -2886,21 +2902,21 @@ var DEPRECATED_BOOLEANS_SYNTAX = [
   "OFF"
 ];
 var DEPRECATED_BASE60_SYNTAX = /^[-+]?[0-9_]+(?::[0-9_]+)+(?:\.[0-9_]*)?$/;
-function compileStyleMap(schema2, map2) {
-  var result, keys, index, length, tag, style, type2;
-  if (map2 === null)
+function compileStyleMap(schema, map) {
+  var result, keys, index, length, tag, style, type;
+  if (map === null)
     return {};
   result = {};
-  keys = Object.keys(map2);
+  keys = Object.keys(map);
   for (index = 0, length = keys.length;index < length; index += 1) {
     tag = keys[index];
-    style = String(map2[tag]);
+    style = String(map[tag]);
     if (tag.slice(0, 2) === "!!") {
       tag = "tag:yaml.org,2002:" + tag.slice(2);
     }
-    type2 = schema2.compiledTypeMap["fallback"][tag];
-    if (type2 && _hasOwnProperty.call(type2.styleAliases, style)) {
-      style = type2.styleAliases[style];
+    type = schema.compiledTypeMap["fallback"][tag];
+    if (type && _hasOwnProperty.call(type.styleAliases, style)) {
+      style = type.styleAliases[style];
     }
     result[tag] = style;
   }
@@ -2970,11 +2986,11 @@ function generateNextLine(state, level) {
   return `
 ` + common.repeat(" ", state.indent * level);
 }
-function testImplicitResolving(state, str2) {
-  var index, length, type2;
+function testImplicitResolving(state, str) {
+  var index, length, type;
   for (index = 0, length = state.implicitTypes.length;index < length; index += 1) {
-    type2 = state.implicitTypes[index];
-    if (type2.resolve(str2)) {
+    type = state.implicitTypes[index];
+    if (type.resolve(str)) {
       return true;
     }
   }
@@ -3020,7 +3036,7 @@ var STYLE_LITERAL = 3;
 var STYLE_FOLDED = 4;
 var STYLE_DOUBLE = 5;
 function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, testAmbiguousType, quotingType, forceQuotes, inblock) {
-  var i2;
+  var i;
   var char = 0;
   var prevChar = null;
   var hasLineBreak = false;
@@ -3029,8 +3045,8 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
   var previousLineBreak = -1;
   var plain = isPlainSafeFirst(codePointAt(string, 0)) && isPlainSafeLast(codePointAt(string, string.length - 1));
   if (singleLineOnly || forceQuotes) {
-    for (i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-      char = codePointAt(string, i2);
+    for (i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+      char = codePointAt(string, i);
       if (!isPrintable(char)) {
         return STYLE_DOUBLE;
       }
@@ -3038,13 +3054,13 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       prevChar = char;
     }
   } else {
-    for (i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-      char = codePointAt(string, i2);
+    for (i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+      char = codePointAt(string, i);
       if (char === CHAR_LINE_FEED) {
         hasLineBreak = true;
         if (shouldTrackWidth) {
-          hasFoldableLine = hasFoldableLine || i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ";
-          previousLineBreak = i2;
+          hasFoldableLine = hasFoldableLine || i - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ";
+          previousLineBreak = i;
         }
       } else if (!isPrintable(char)) {
         return STYLE_DOUBLE;
@@ -3052,7 +3068,7 @@ function chooseScalarStyle(string, singleLineOnly, indentPerLevel, lineWidth, te
       plain = plain && isPlainSafe(char, prevChar, inblock);
       prevChar = char;
     }
-    hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i2 - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
+    hasFoldableLine = hasFoldableLine || shouldTrackWidth && (i - previousLineBreak - 1 > lineWidth && string[previousLineBreak + 1] !== " ");
   }
   if (!hasLineBreak && !hasFoldableLine) {
     if (plain && !forceQuotes && !testAmbiguousType(string)) {
@@ -3081,8 +3097,8 @@ function writeScalar(state, string, level, iskey, inblock) {
     var indent = state.indent * Math.max(1, level);
     var lineWidth = state.lineWidth === -1 ? -1 : Math.max(Math.min(state.lineWidth, 40), state.lineWidth - indent);
     var singleLineOnly = iskey || state.flowLevel > -1 && level >= state.flowLevel;
-    function testAmbiguity(string2) {
-      return testImplicitResolving(state, string2);
+    function testAmbiguity(string) {
+      return testImplicitResolving(state, string);
     }
     switch (chooseScalarStyle(string, singleLineOnly, state.indent, lineWidth, testAmbiguity, state.quotingType, state.forceQuotes && !iskey, inblock)) {
       case STYLE_PLAIN:
@@ -3168,13 +3184,13 @@ function escapeString(string) {
   var result = "";
   var char = 0;
   var escapeSeq;
-  for (var i2 = 0;i2 < string.length; char >= 65536 ? i2 += 2 : i2++) {
-    char = codePointAt(string, i2);
+  for (var i = 0;i < string.length; char >= 65536 ? i += 2 : i++) {
+    char = codePointAt(string, i);
     escapeSeq = ESCAPE_SEQUENCES[char];
     if (!escapeSeq && isPrintable(char)) {
-      result += string[i2];
+      result += string[i];
       if (char >= 65536)
-        result += string[i2 + 1];
+        result += string[i + 1];
     } else {
       result += escapeSeq || encodeHex(char);
     }
@@ -3296,28 +3312,28 @@ function writeBlockMapping(state, level, object, compact) {
   state.dump = _result || "{}";
 }
 function detectType(state, object, explicit) {
-  var _result, typeList, index, length, type2, style;
+  var _result, typeList, index, length, type, style;
   typeList = explicit ? state.explicitTypes : state.implicitTypes;
   for (index = 0, length = typeList.length;index < length; index += 1) {
-    type2 = typeList[index];
-    if ((type2.instanceOf || type2.predicate) && (!type2.instanceOf || typeof object === "object" && object instanceof type2.instanceOf) && (!type2.predicate || type2.predicate(object))) {
+    type = typeList[index];
+    if ((type.instanceOf || type.predicate) && (!type.instanceOf || typeof object === "object" && object instanceof type.instanceOf) && (!type.predicate || type.predicate(object))) {
       if (explicit) {
-        if (type2.multi && type2.representName) {
-          state.tag = type2.representName(object);
+        if (type.multi && type.representName) {
+          state.tag = type.representName(object);
         } else {
-          state.tag = type2.tag;
+          state.tag = type.tag;
         }
       } else {
         state.tag = "?";
       }
-      if (type2.represent) {
-        style = state.styleMap[type2.tag] || type2.defaultStyle;
-        if (_toString.call(type2.represent) === "[object Function]") {
-          _result = type2.represent(object, style);
-        } else if (_hasOwnProperty.call(type2.represent, style)) {
-          _result = type2.represent[style](object, style);
+      if (type.represent) {
+        style = state.styleMap[type.tag] || type.defaultStyle;
+        if (_toString.call(type.represent) === "[object Function]") {
+          _result = type.represent(object, style);
+        } else if (_hasOwnProperty.call(type.represent, style)) {
+          _result = type.represent[style](object, style);
         } else {
-          throw new exception("!<" + type2.tag + '> tag resolver accepts not "' + style + '" style');
+          throw new exception("!<" + type.tag + '> tag resolver accepts not "' + style + '" style');
         }
         state.dump = _result;
       }
@@ -3332,13 +3348,13 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
   if (!detectType(state, object, false)) {
     detectType(state, object, true);
   }
-  var type2 = _toString.call(state.dump);
+  var type = _toString.call(state.dump);
   var inblock = block;
   var tagStr;
   if (block) {
     block = state.flowLevel < 0 || state.flowLevel > level;
   }
-  var objectOrArray = type2 === "[object Object]" || type2 === "[object Array]", duplicateIndex, duplicate;
+  var objectOrArray = type === "[object Object]" || type === "[object Array]", duplicateIndex, duplicate;
   if (objectOrArray) {
     duplicateIndex = state.duplicates.indexOf(object);
     duplicate = duplicateIndex !== -1;
@@ -3352,7 +3368,7 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
     if (objectOrArray && duplicate && !state.usedDuplicates[duplicateIndex]) {
       state.usedDuplicates[duplicateIndex] = true;
     }
-    if (type2 === "[object Object]") {
+    if (type === "[object Object]") {
       if (block && Object.keys(state.dump).length !== 0) {
         writeBlockMapping(state, level, state.dump, compact);
         if (duplicate) {
@@ -3364,7 +3380,7 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
           state.dump = "&ref_" + duplicateIndex + " " + state.dump;
         }
       }
-    } else if (type2 === "[object Array]") {
+    } else if (type === "[object Array]") {
       if (block && state.dump.length !== 0) {
         if (state.noArrayIndent && !isblockseq && level > 0) {
           writeBlockSequence(state, level - 1, state.dump, compact);
@@ -3380,16 +3396,16 @@ function writeNode(state, level, object, block, compact, iskey, isblockseq) {
           state.dump = "&ref_" + duplicateIndex + " " + state.dump;
         }
       }
-    } else if (type2 === "[object String]") {
+    } else if (type === "[object String]") {
       if (state.tag !== "?") {
         writeScalar(state, state.dump, level, iskey, inblock);
       }
-    } else if (type2 === "[object Undefined]") {
+    } else if (type === "[object Undefined]") {
       return false;
     } else {
       if (state.skipInvalid)
         return false;
-      throw new exception("unacceptable kind of an object to dump " + type2);
+      throw new exception("unacceptable kind of an object to dump " + type);
     }
     if (state.tag !== null && state.tag !== "?") {
       tagStr = encodeURI(state.tag[0] === "!" ? state.tag.slice(1) : state.tag).replace(/!/g, "%21");
@@ -3820,8 +3836,8 @@ function normalizePath(path) {
 }
 function lineNumber(content, offset) {
   let count = 1;
-  for (let i2 = 0;i2 < offset && i2 < content.length; i2++) {
-    if (content[i2] === `
+  for (let i = 0;i < offset && i < content.length; i++) {
+    if (content[i] === `
 `)
       count++;
   }
@@ -3829,10 +3845,10 @@ function lineNumber(content, offset) {
 }
 function buildLineIndex(content) {
   const offsets = [0];
-  for (let i2 = 0;i2 < content.length; i2++) {
-    if (content[i2] === `
+  for (let i = 0;i < content.length; i++) {
+    if (content[i] === `
 `)
-      offsets.push(i2 + 1);
+      offsets.push(i + 1);
   }
   return {
     lineAt(offset) {
@@ -4047,8 +4063,8 @@ var django = {
     const pyFiles = ctx.iterFiles(PY_EXTS3);
     const dirOf2 = (f) => {
       const norm = f.replace(/\\/g, "/");
-      const i2 = norm.lastIndexOf("/");
-      return i2 < 0 ? "" : norm.slice(0, i2);
+      const i = norm.lastIndexOf("/");
+      return i < 0 ? "" : norm.slice(0, i);
     };
     const classesByDir = /* @__PURE__ */ new Map;
     const funcsByDir = /* @__PURE__ */ new Map;
@@ -4242,67 +4258,67 @@ var PAGE_RENDER_RE = /\bres\s*\.\s*render\s*\(/;
 var PAGE_SENDFILE_RE = /\bres\s*\.\s*sendFile\s*\(/;
 function findMatchingParen(content, start) {
   let depth = 0;
-  let i2 = start;
+  let i = start;
   const len = content.length;
-  while (i2 < len) {
-    const ch = content[i2];
-    if (ch === "/" && content[i2 + 1] === "/") {
+  while (i < len) {
+    const ch = content[i];
+    if (ch === "/" && content[i + 1] === "/") {
       const nl = content.indexOf(`
-`, i2);
+`, i);
       if (nl === -1)
         return -1;
-      i2 = nl + 1;
+      i = nl + 1;
       continue;
     }
-    if (ch === "/" && content[i2 + 1] === "*") {
-      const end = content.indexOf("*/", i2 + 2);
+    if (ch === "/" && content[i + 1] === "*") {
+      const end = content.indexOf("*/", i + 2);
       if (end === -1)
         return -1;
-      i2 = end + 2;
+      i = end + 2;
       continue;
     }
     if (ch === "'" || ch === '"') {
-      i2++;
-      while (i2 < len) {
-        const c = content[i2];
+      i++;
+      while (i < len) {
+        const c = content[i];
         if (c === "\\") {
-          i2 += 2;
+          i += 2;
           continue;
         }
         if (c === ch) {
-          i2++;
+          i++;
           break;
         }
-        i2++;
+        i++;
       }
       continue;
     }
     if (ch === "`") {
-      i2++;
-      while (i2 < len) {
-        const c = content[i2];
+      i++;
+      while (i < len) {
+        const c = content[i];
         if (c === "\\") {
-          i2 += 2;
+          i += 2;
           continue;
         }
         if (c === "`") {
-          i2++;
+          i++;
           break;
         }
-        if (c === "$" && content[i2 + 1] === "{") {
-          i2 += 2;
+        if (c === "$" && content[i + 1] === "{") {
+          i += 2;
           let d = 1;
-          while (i2 < len && d > 0) {
-            const cc = content[i2];
+          while (i < len && d > 0) {
+            const cc = content[i];
             if (cc === "{")
               d++;
             else if (cc === "}")
               d--;
-            i2++;
+            i++;
           }
           continue;
         }
-        i2++;
+        i++;
       }
       continue;
     }
@@ -4311,9 +4327,9 @@ function findMatchingParen(content, start) {
     else if (ch === ")" || ch === "]" || ch === "}") {
       depth--;
       if (depth === 0 && ch === ")")
-        return i2;
+        return i;
     }
-    i2++;
+    i++;
   }
   return -1;
 }
@@ -4474,47 +4490,47 @@ var express = {
 };
 function maskComments(src) {
   let out = "";
-  let i2 = 0;
+  let i = 0;
   const n = src.length;
-  while (i2 < n) {
-    const c = src[i2];
+  while (i < n) {
+    const c = src[i];
     if (c === '"' || c === "'" || c === "`") {
       out += c;
-      i2++;
-      while (i2 < n) {
-        if (src[i2] === "\\" && i2 + 1 < n) {
-          out += src[i2] + src[i2 + 1];
-          i2 += 2;
+      i++;
+      while (i < n) {
+        if (src[i] === "\\" && i + 1 < n) {
+          out += src[i] + src[i + 1];
+          i += 2;
           continue;
         }
-        out += src[i2];
-        const done = src[i2] === c;
-        i2++;
+        out += src[i];
+        const done = src[i] === c;
+        i++;
         if (done)
           break;
       }
-    } else if (c === "/" && src[i2 + 1] === "/") {
-      while (i2 < n && src[i2] !== `
+    } else if (c === "/" && src[i + 1] === "/") {
+      while (i < n && src[i] !== `
 `) {
         out += " ";
-        i2++;
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "*") {
+    } else if (c === "/" && src[i + 1] === "*") {
       out += "  ";
-      i2 += 2;
-      while (i2 < n && !(src[i2] === "*" && src[i2 + 1] === "/")) {
-        out += src[i2] === `
+      i += 2;
+      while (i < n && !(src[i] === "*" && src[i + 1] === "/")) {
+        out += src[i] === `
 ` ? `
 ` : " ";
-        i2++;
+        i++;
       }
-      if (i2 < n) {
+      if (i < n) {
         out += "  ";
-        i2 += 2;
+        i += 2;
       }
     } else {
       out += c;
-      i2++;
+      i++;
     }
   }
   return out;
@@ -4977,8 +4993,8 @@ var GO_EXTS = [".go"];
 var GO_GROUP_RE = /(\w+)\s*[:=]+\s*(\w+)\.Group\s*\(\s*['"]([^'"]+)['"]/g;
 var dirOf = (f) => {
   const norm = f.replace(/\\/g, "/");
-  const i2 = norm.lastIndexOf("/");
-  return i2 < 0 ? "" : norm.slice(0, i2);
+  const i = norm.lastIndexOf("/");
+  return i < 0 ? "" : norm.slice(0, i);
 };
 var GORILLA_WS_IMPORT_RE = /["']github\.com\/gorilla\/websocket["']/;
 var UPGRADE_CALL_RE = /\.\s*Upgrade\s*\(/;
@@ -4992,26 +5008,26 @@ function findWebsocketHandlers(ctx, goFiles) {
     if (!GORILLA_WS_IMPORT_RE.test(content))
       continue;
     const dir = dirOf(f);
-    const set2 = byDir.get(dir) ?? /* @__PURE__ */ new Set;
+    const set = byDir.get(dir) ?? /* @__PURE__ */ new Set;
     for (const m of content.matchAll(funcRe)) {
       const name = m[1];
       const bodyStart = m.index + m[0].length;
       let depth = 1;
-      let i2 = bodyStart;
+      let i = bodyStart;
       const len = content.length;
-      while (i2 < len && depth > 0) {
-        const ch = content[i2];
+      while (i < len && depth > 0) {
+        const ch = content[i];
         if (ch === "{")
           depth++;
         else if (ch === "}")
           depth--;
-        i2++;
+        i++;
       }
-      const body = content.slice(bodyStart, i2 - 1);
+      const body = content.slice(bodyStart, i - 1);
       if (UPGRADE_CALL_RE.test(body))
-        set2.add(name);
+        set.add(name);
     }
-    byDir.set(dir, set2);
+    byDir.set(dir, set);
   }
   return byDir;
 }
@@ -5392,8 +5408,8 @@ var rails = {
     const nsStack = [];
     let depth = 0;
     const prefixAtLine = new Array(sourceLines.length + 1).fill("");
-    for (let i2 = 0;i2 < sourceLines.length; i2++) {
-      const line = sourceLines[i2];
+    for (let i = 0;i < sourceLines.length; i++) {
+      const line = sourceLines[i];
       const code = line.replace(/#.*$/, "");
       const nsM = namespaceLineRe.exec(code);
       if (nsM) {
@@ -5410,7 +5426,7 @@ var rails = {
       if (doMatches)
         depth++;
       const prefix = nsStack.length ? "/" + nsStack.map((n) => n.name).join("/") : "";
-      prefixAtLine[i2 + 1] = prefix;
+      prefixAtLine[i + 1] = prefix;
     }
     const prefixAt = (offset) => {
       const ln = lines.lineAt(offset);
@@ -5678,15 +5694,15 @@ function splitTopLevel(s) {
   const parts = [];
   let depth = 0;
   let start = 0;
-  for (let i2 = 0;i2 < s.length; i2++) {
-    const c = s[i2];
+  for (let i = 0;i < s.length; i++) {
+    const c = s[i];
     if (c === "<" || c === "{" || c === "[" || c === "(")
       depth++;
     else if (c === ">" || c === "}" || c === "]" || c === ")")
       depth--;
     else if (c === "," && depth === 0) {
-      parts.push(s.slice(start, i2));
-      start = i2 + 1;
+      parts.push(s.slice(start, i));
+      start = i + 1;
     }
   }
   parts.push(s.slice(start));
@@ -5694,14 +5710,14 @@ function splitTopLevel(s) {
 }
 function findTopLevelChar(s, targets) {
   let depth = 0;
-  for (let i2 = 0;i2 < s.length; i2++) {
-    const c = s[i2];
+  for (let i = 0;i < s.length; i++) {
+    const c = s[i];
     if (c === "<" || c === "{" || c === "[" || c === "(")
       depth++;
     else if (c === ">" || c === "}" || c === "]" || c === ")")
       depth--;
     else if (depth === 0 && targets.includes(c))
-      return i2;
+      return i;
   }
   return -1;
 }
@@ -5725,14 +5741,14 @@ function parseParams(funcParams) {
     if (trimmed.startsWith("{")) {
       let depth = 0;
       let close = -1;
-      for (let i2 = 0;i2 < trimmed.length; i2++) {
-        const c = trimmed[i2];
+      for (let i = 0;i < trimmed.length; i++) {
+        const c = trimmed[i];
         if (c === "{")
           depth++;
         else if (c === "}") {
           depth--;
           if (depth === 0) {
-            close = i2;
+            close = i;
             break;
           }
         }
@@ -5864,11 +5880,11 @@ var openapi = {
           for (const p of allParams) {
             if (!p || typeof p !== "object")
               continue;
-            const schema2 = p.schema;
+            const schema = p.schema;
             params.push({
               name: p.name ?? "?",
               location: p.in ?? "query",
-              type: schema2?.type,
+              type: schema?.type,
               required: p.required ?? false
             });
           }
@@ -5937,46 +5953,46 @@ function makeConnectResolver(ctx) {
 }
 function stripComments(src) {
   let out = "";
-  for (let i2 = 0;i2 < src.length; ) {
-    const c = src[i2];
+  for (let i = 0;i < src.length; ) {
+    const c = src[i];
     if (c === '"' || c === "'") {
       out += c;
-      i2++;
-      while (i2 < src.length && src[i2] !== c) {
-        if (src[i2] === "\\" && i2 + 1 < src.length) {
-          out += src[i2] + src[i2 + 1];
-          i2 += 2;
+      i++;
+      while (i < src.length && src[i] !== c) {
+        if (src[i] === "\\" && i + 1 < src.length) {
+          out += src[i] + src[i + 1];
+          i += 2;
         } else {
-          out += src[i2];
-          i2++;
+          out += src[i];
+          i++;
         }
       }
-      if (i2 < src.length) {
-        out += src[i2];
-        i2++;
+      if (i < src.length) {
+        out += src[i];
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "/") {
-      while (i2 < src.length && src[i2] !== `
+    } else if (c === "/" && src[i + 1] === "/") {
+      while (i < src.length && src[i] !== `
 `) {
         out += " ";
-        i2++;
+        i++;
       }
-    } else if (c === "/" && src[i2 + 1] === "*") {
+    } else if (c === "/" && src[i + 1] === "*") {
       out += "  ";
-      i2 += 2;
-      while (i2 < src.length && !(src[i2] === "*" && src[i2 + 1] === "/")) {
-        out += src[i2] === `
+      i += 2;
+      while (i < src.length && !(src[i] === "*" && src[i + 1] === "/")) {
+        out += src[i] === `
 ` ? `
 ` : " ";
-        i2++;
+        i++;
       }
-      if (i2 < src.length) {
+      if (i < src.length) {
         out += "  ";
-        i2 += 2;
+        i += 2;
       }
     } else {
       out += c;
-      i2++;
+      i++;
     }
   }
   return out;
@@ -6105,33 +6121,33 @@ function inferServiceType(absDir) {
   try {
     const content = readFileSync42(join10(absDir, "package.json"), "utf-8");
     const lower = content.toLowerCase();
-    for (const [dep, type2] of PKG_DEP_TO_TYPE) {
+    for (const [dep, type] of PKG_DEP_TO_TYPE) {
       if (lower.includes(`"${dep}"`))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "go.mod"), "utf-8");
-    for (const [dep, type2] of GO_DEP_TO_TYPE) {
+    for (const [dep, type] of GO_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "Cargo.toml"), "utf-8");
-    for (const [dep, type2] of CARGO_DEP_TO_TYPE) {
+    for (const [dep, type] of CARGO_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
   try {
     const content = readFileSync42(join10(absDir, "requirements.txt"), "utf-8");
-    for (const [dep, type2] of PY_DEP_TO_TYPE) {
+    for (const [dep, type] of PY_DEP_TO_TYPE) {
       if (content.includes(dep))
-        return type2;
+        return type;
     }
     return "generic";
   } catch {}
@@ -6947,10 +6963,10 @@ function mapAppWithSurface(appPath, repoRoot, options) {
   }
   const narrow = map2(absApp, { includeInternal: false });
   if (narrow.frameworks.length > 0 && narrow.endpoints.all.length > 0) {
-    const rebased2 = rebaseFileToRepoRoot(narrow.endpoints.all, absApp, absRoot);
+    const rebased = rebaseFileToRepoRoot(narrow.endpoints.all, absApp, absRoot);
     return {
       mode: "surface",
-      endpoints: consolidateBySameRoute(rebased2),
+      endpoints: consolidateBySameRoute(rebased),
       frameworks: narrow.frameworks
     };
   }
@@ -7018,15 +7034,17 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     projectThreatModel,
     environments,
     surfaceIntegrationEnabled = true,
-    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS,
+    subagentSpawner
   } = input;
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
   const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
   const agentLimiter = (fn) => agentSlots(fn);
   const WORKFLOW_UMBRELLA_ID = newSessionId();
-  const appsAgent = new CodeAgent({
+  const appsAgent = new CodeAgent2({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
-    system: WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+    system: WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
     model,
     session,
     authConfig,
@@ -7040,7 +7058,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     openAIReasoningEffort,
     enableThinking,
     thinkingEffort,
-    responseSchema: AppsDiscoveryResultSchema,
+    responseSchema: AppsDiscoveryResultSchema2,
     projectThreatModel,
     excludeTools: ["document_endpoint"]
   });
@@ -7104,20 +7122,20 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       parentSubagentId: WORKFLOW_UMBRELLA_ID
     });
   }
-  const spawnDiscoveryAgent = async (app, type2, objective) => {
+  const spawnDiscoveryAgent = async (app, type, objective) => {
     const subagentId = newSessionId();
     const appNodeId = appNodeIdFor(app.name);
-    log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type2}, appType=${app.type})`);
+    log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type}, appType=${app.type})`);
     eventBus?.emit("subagent-spawn", {
       subagentId,
-      name: TASK_TYPE_LABELS[type2],
-      input: { app: app.name, type: type2 },
+      name: TASK_TYPE_LABELS[type],
+      input: { app: app.name, type },
       parentSubagentId: appNodeId
     });
-    const agent = new CodeAgent({
+    const agent = new CodeAgent2({
       codebasePath,
       objective,
-      system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+      system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
       model,
       session,
       authConfig,
@@ -7125,13 +7143,13 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       attackSurfaceRegistry,
       eventBus,
       subagentId,
-      subagentName: TASK_TYPE_LABELS[type2],
+      subagentName: TASK_TYPE_LABELS[type],
       onStepFinish: (event) => onStepFinish?.(event),
       onCacheMetrics,
       openAIReasoningEffort,
       enableThinking,
       thinkingEffort,
-      responseSchema: DiscoverySummarySchema,
+      responseSchema: DiscoverySummarySchema2,
       excludeTools: ["document_app"],
       projectThreatModel
     });
@@ -7156,7 +7174,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
   const spawnPagesAgent = (app) => spawnDiscoveryAgent(app, "pages", buildPagesDiscoveryObjective(codebasePath, app));
   const spawnApiEndpointsAgent = (app) => spawnDiscoveryAgent(app, "apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app));
   const spawnCloudResourceAgent = (app) => spawnDiscoveryAgent(app, "cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments));
-  await runWithBoundedConcurrency(appsResult.apps, DEFAULT_CONCURRENCY, async (app) => {
+  await spawner.spawnMany(appsResult.apps, async (app) => {
     const appNodeId = appNodeIdFor(app.name);
     try {
       if (NON_SERVICE_TYPES.includes(app.type)) {
@@ -7189,7 +7207,8 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             thinkingEffort,
             projectThreatModel,
             parentSubagentId: appNodeId,
-            agentLimiter
+            agentLimiter,
+            subagentSpawner
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
@@ -7215,7 +7234,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
         appName: app.name
       });
     }
-  });
+  }, { concurrency: DEFAULT_CONCURRENCY });
   eventBus?.emit("subagent-complete", {
     subagentId: WORKFLOW_UMBRELLA_ID,
     status: "completed"
@@ -7248,7 +7267,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
 function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
   const repoType = appsDiscovery?.repoType ?? "unknown";
   const packageManager = appsDiscovery?.packageManager ?? "unknown";
-  if (!existsSync12(assetsPath)) {
+  if (!existsSync11(assetsPath)) {
     log4.debug(`readAssets: assets directory does not exist: ${assetsPath}`);
     return { apps: [], repoType, packageManager };
   }
@@ -7263,7 +7282,7 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
     }
     const appJsonPath = join16(entryPath, "app.json");
     let metadata;
-    if (existsSync12(appJsonPath)) {
+    if (existsSync11(appJsonPath)) {
       try {
         metadata = JSON.parse(readFileSync9(appJsonPath, "utf-8"));
       } catch {
@@ -7283,16 +7302,16 @@ function readAppsFromAssetsDirectory(assetsPath, appsDiscovery) {
       try {
         const raw = readFileSync9(join16(entryPath, file), "utf-8");
         const data = JSON.parse(raw);
-        const endpoint2 = assetRecordToEndpoint(data);
-        if (!endpoint2) {
+        const endpoint = assetRecordToEndpoint(data);
+        if (!endpoint) {
           log4.debug(`readAssets: ${file}: failed schema validation (assetRecordToEndpoint returned null)`);
           parseFailed++;
           continue;
         }
         if (isPageEndpoint(data)) {
-          pages.push(endpoint2);
+          pages.push(endpoint);
         } else {
-          apiEndpoints.push(endpoint2);
+          apiEndpoints.push(endpoint);
         }
       } catch {
         log4.warn(`readAssets: skipping unreadable asset file: ${entry}/${file}`);
@@ -7317,7 +7336,7 @@ function assetRecordToEndpoint(record) {
   const method = Array.isArray(rawMethod) ? rawMethod.join(", ") : rawMethod ?? "UNKNOWN";
   const path = record.routePath;
   const file = record.file ?? "";
-  const parsed = EndpointSchema.safeParse({
+  const parsed = EndpointSchema2.safeParse({
     method,
     path,
     handler: record.handler,
@@ -7639,17 +7658,7 @@ When finished, call \`response\` with a summary of how many entry points you doc
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
-async function runPentestSwarm(input) {
+async function runPentestSwarm2(input) {
   const {
     targets,
     model,
@@ -7661,17 +7670,23 @@ async function runPentestSwarm(input) {
     onError,
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
-    display
+    display,
+    subagentSpawner,
+    languageModelMiddleware,
+    usageRecorder,
+    streamIdFactory
   } = input;
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
   const completedIds = getCompletedAgentIds(session);
   const existingManifest = readAgentManifest(session);
   const freshEntries = buildManifestEntries(targets);
   const manifestEntries = reconcileManifestOnResume(existingManifest, freshEntries);
   writeAgentManifest(session, manifestEntries);
-  const results = await runWithBoundedConcurrency(targets, concurrency, async (target, index) => {
+  const results = await spawner.spawnMany(targets, async (target, index) => {
     const entry = manifestEntries[index];
     const subagentId = entry.id;
     const subagentName = target.name ?? entry.name;
@@ -7698,7 +7713,7 @@ async function runPentestSwarm(input) {
           input: { target: target.target, objectives: target.objectives },
           parentSubagentId: subagentId
         });
-        const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
+        const executionTasksDir = join17(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
           prompt: buildPlanPrompt(target.target, target.objectives, target.grpc),
@@ -7717,10 +7732,16 @@ async function runPentestSwarm(input) {
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
+          onStepFinish,
+          onCacheMetrics,
           enableThinking,
           thinkingEffort,
           openAIReasoningEffort,
-          display
+          display,
+          subagentSpawner: spawner,
+          languageModelMiddleware,
+          usageRecorder,
+          streamIdFactory
         });
         await planAgent.consume();
         eventBus?.emit("subagent-complete", {
@@ -7740,7 +7761,7 @@ async function runPentestSwarm(input) {
     const objectiveStr = target.objectives.join("; ");
     let agent;
     try {
-      agent = new TargetedPentestAgent({
+      agent = new TargetedPentestAgent2({
         target: target.target,
         grpc: target.grpc,
         objectives: target.objectives,
@@ -7750,6 +7771,8 @@ async function runPentestSwarm(input) {
         abortSignal,
         findingsRegistry,
         onStepFinish: handleStepFinish,
+        onCacheMetrics,
+        forwardUsageCallbacksToSpawnedAgents: true,
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
@@ -7757,7 +7780,11 @@ async function runPentestSwarm(input) {
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort,
-        display
+        display,
+        subagentSpawner: spawner,
+        languageModelMiddleware,
+        usageRecorder,
+        streamIdFactory
       });
       const result = await agent.consume();
       saveSubagentData(session, {
@@ -7767,7 +7794,7 @@ async function runPentestSwarm(input) {
         status: "completed",
         findingsCount: result.findings.length,
         messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
+        systemPrompt: buildPentestSystemPrompt2(session),
         userPrompt: agent.userPrompt
       });
       updateManifestEntryStatus(session, subagentId, "completed");
@@ -7784,7 +7811,7 @@ async function runPentestSwarm(input) {
         status: "failed",
         error: error instanceof Error ? error.message : String(error),
         messages: [...previousMessages, ...lastMessages],
-        systemPrompt: buildPentestSystemPrompt(session),
+        systemPrompt: buildPentestSystemPrompt2(session),
         userPrompt: agent?.userPrompt ?? ""
       });
       updateManifestEntryStatus(session, subagentId, "failed");
@@ -7796,13 +7823,13 @@ async function runPentestSwarm(input) {
       onError?.(error);
       throw error;
     }
-  }, abortSignal);
+  }, { concurrency, abortSignal });
   finalizeManifest(session, manifestEntries, results);
   return results;
 }
-async function runPentestWorkflow(input) {
+async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-8zka43xs.js");
+    const { runFastStrike } = await import("./fastStrike-b8t8f916.js");
     return runFastStrike(input);
   }
   const {
@@ -7839,17 +7866,6 @@ async function runPentestWorkflow(input) {
 ${combined}` : combined;
   }
   const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
   try {
     const mode = cwd ? "whitebox" : "blackbox";
     let swarmTargets;
@@ -7886,10 +7902,11 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
-          surfaceIntegrationEnabled
+          surfaceIntegrationEnabled,
+          subagentSpawner: input.subagentSpawner
         });
       } else {
         swarmTargets = await runBlackboxPhase({
@@ -7899,7 +7916,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort
         });
@@ -7916,21 +7933,21 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
-      const report2 = buildPentestReport([], {
+      const report = buildPentestReport([], {
         target,
         model,
         sessionId: session.id,
         mode
       });
-      const mdPath2 = join18(session.rootPath, REPORT_FILENAME_MD);
-      const jsonPath2 = join18(session.rootPath, REPORT_FILENAME_JSON);
-      writeFileSync4(mdPath2, renderMarkdown(report2));
-      writeFileSync4(jsonPath2, renderJson(report2));
+      const mdPath = join17(session.rootPath, REPORT_FILENAME_MD);
+      const jsonPath = join17(session.rootPath, REPORT_FILENAME_JSON);
+      writeFileSync4(mdPath, renderMarkdown(report));
+      writeFileSync4(jsonPath, renderJson(report));
       return {
         findings: [],
         findingsPath: session.findingsPath,
         pocsPath: session.pocsPath,
-        reportPath: mdPath2
+        reportPath: mdPath
       };
     }
     eventBus?.emit("workflow-phase-start", {
@@ -7940,11 +7957,12 @@ ${combined}` : combined;
     const findingsRegistry = FindingsRegistry.fromDirectory(session.findingsPath, {
       model,
       authConfig,
-      abortSignal
+      abortSignal,
+      sessionId: session.id
     });
     const completedCount = getCompletedAgentIds(session).size;
     if (completedCount < swarmTargets.length) {
-      await runPentestSwarm({
+      await runPentestSwarm2({
         targets: swarmTargets,
         model,
         session,
@@ -7952,10 +7970,15 @@ ${combined}` : combined;
         abortSignal,
         findingsRegistry,
         eventBus,
-        onStepFinish: wrappedOnStepFinish,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
-        openAIReasoningEffort
+        openAIReasoningEffort,
+        subagentSpawner: input.subagentSpawner,
+        languageModelMiddleware: input.languageModelMiddleware,
+        usageRecorder: input.usageRecorder,
+        streamIdFactory: input.streamIdFactory
       });
     }
     if (abortSignal?.aborted) {
@@ -7973,8 +7996,8 @@ ${combined}` : combined;
       sessionId: session.id,
       mode
     });
-    const mdPath = join18(session.rootPath, REPORT_FILENAME_MD);
-    const jsonPath = join18(session.rootPath, REPORT_FILENAME_JSON);
+    const mdPath = join17(session.rootPath, REPORT_FILENAME_MD);
+    const jsonPath = join17(session.rootPath, REPORT_FILENAME_JSON);
     writeFileSync4(mdPath, renderMarkdown(report));
     writeFileSync4(jsonPath, renderJson(report));
     const severityCounts = {};
@@ -8000,7 +8023,6 @@ ${combined}` : combined;
     const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
     writeExecutionMetrics({
       sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
       runtime
     });
   }
@@ -8016,15 +8038,16 @@ async function runWhiteboxPhase(opts) {
     onStepFinish: opts.onStepFinish,
     onCacheMetrics: opts.onCacheMetrics,
     openAIReasoningEffort: opts.openAIReasoningEffort,
-    surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled
+    surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled,
+    subagentSpawner: opts.subagentSpawner
   };
   const result = await runWhiteboxAttackSurfaceWorkflow(workflowInput);
   return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => {
-    const grpc2 = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
+    const grpc = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
     return {
-      target: grpcAuthorityTarget(grpc2, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
+      target: grpcAuthorityTarget(grpc, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
       objectives: ep.pentestObjectives,
-      grpc: grpc2
+      grpc
     };
   }));
 }
@@ -8047,7 +8070,7 @@ async function runBlackboxPhase(opts) {
     onCacheMetrics: opts.onCacheMetrics,
     openAIReasoningEffort: opts.openAIReasoningEffort
   };
-  const agent = new BlackboxAttackSurfaceAgent(agentInput);
+  const agent = new BlackboxAttackSurfaceAgent2(agentInput);
   opts.eventBus?.emit("subagent-spawn", {
     subagentId: "attack-surface-agent",
     name: "Attack Surface Discovery",
@@ -8084,4 +8107,4 @@ async function runBlackboxPhase(opts) {
     throw e;
   }
 }
-export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };
+export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2, runPentestSwarm2, runPentestWorkflow2 };