@pensar/apex 2.5.0 → 2.6.1-canary.025b1ecf

package/build/lib/chunk-cx7yrzh1.js

@@ -0,0 +1,2429 @@
+import {
+  AgentEventBus2
+} from "./chunk-7gjdygcx.js";
+import {
+  newMessageId2,
+  newPartId2
+} from "./chunk-jdjagvgr.js";
+import {
+  registerActiveRootSpan2,
+  unregisterActiveRootSpan2,
+  getApexTracer2,
+  shouldRecordAiPayloads2,
+  withSubagentSessionBaggage2,
+  getActiveTraceCorrelation2
+} from "./chunk-2njv7wz3.js";
+import {
+  create2,
+  createLogger,
+  scopedLogger,
+  normalizeStepUsage2,
+  streamResponse2
+} from "./chunk-sgd2126b.js";
+import {
+  PerCommandShell2,
+  resolveBrowserHeaderPolicy2,
+  transformScriptToFunction2,
+  parseStorageStateResult2,
+  setHeadlessMode2,
+  setUserAgent2,
+  setViewportSize2,
+  PlaywrightMcpSession2,
+  createBrowserTools2,
+  ScopeViolationError2,
+  getAllowedHosts2,
+  isHostAllowed2,
+  extractHostname2,
+  assertUrlInScope2,
+  extractHostsFromCommand2,
+  assertCommandInScope2,
+  checkSandboxPlaywright2,
+  installSandboxPlaywright2,
+  ensureSandboxPlaywright2,
+  ensureSandboxBrowser2,
+  SandboxBrowserBackend2,
+  createSandboxBrowserTools2,
+  resolveBackends2
+} from "./chunk-fy3bbbqy.js";
+import {
+  inProcessSubagentSpawner2
+} from "./chunk-ve7m90fb.js";
+import {
+  addMemory2,
+  ASK_USER_QUESTIONS_TOOL_NAME2,
+  AskUserQuestionSchema2,
+  BROWSER_TOOL_NAMES2,
+  createBrowserToolset2,
+  CallbackListenerRegistry2,
+  checkpointState2,
+  completeAuthentication2,
+  crawlAuthenticated2,
+  createAttackSurfaceReport2,
+  createFile2,
+  createTask2,
+  delegateAuth2,
+  detectAuthScheme2,
+  documentApp2,
+  documentEndpoint2,
+  documentVulnerability2,
+  createEmailToolset2,
+  EMAIL_TOOL_NAMES2,
+  SEND_EMAIL_TOOL_NAME2,
+  executeCommand2,
+  extractJsEndpoints2,
+  getMemory2,
+  getPage2,
+  grep2,
+  httpRequest2,
+  listFiles2,
+  listMemories2,
+  listTasksTool2,
+  probeAuthEndpoints2,
+  provideComparisonResults2,
+  readFile2,
+  readSkill2,
+  REPORT_ERROR_TOOL_NAME2,
+  ReportErrorReasonSchema2,
+  createReportErrorTool2,
+  PentestReportedError2,
+  RESPONSE_TOOL_NAME2,
+  createResponseTool2,
+  runAttackSurface2,
+  runPentestWorkflow3,
+  SMS_LIST_MESSAGES_TOOL_NAME2,
+  SMS_TOOL_NAMES2,
+  sessionHasSmsPasswordless2,
+  spawnCodingAgent2,
+  spawnPentestAgent2,
+  spawnPentestSwarm2,
+  submitPlan2,
+  testEndpointVariations2,
+  updateFile2,
+  updateTask2,
+  validateDiscovery2,
+  webSearch2,
+  listWorkspaceApps2,
+  createWorkspaceApp2,
+  updateWorkspaceApp2,
+  listWorkspaceEndpoints2,
+  createWorkspaceEndpoint2,
+  updateWorkspaceEndpoint2,
+  listWorkspaceDomains2,
+  createWorkspaceDomain2,
+  writePlan2,
+  listToolRegistryNames2,
+  createAllTools2,
+  createToolsForNames2,
+  WORKSPACE_TOOL_NAMES2,
+  WORKSPACE_WRITE_TOOL_NAMES2,
+  ALL_TOOL_NAMES2,
+  FAST_STRIKE_EXCLUDED_TOOL_NAMES2,
+  PLAN_MODE_TOOL_NAMES2,
+  SKILL_TOOL_NAMES2
+} from "./chunk-gdrv2h1p.js";
+import {
+  ApexFindingObject2
+} from "./chunk-q5e23acz.js";
+import {
+  __export
+} from "./chunk-n0ba7khr.js";
+
+// src/core/agents/offSecAgent/index.ts
+var exports_offSecAgent = {};
+__export(exports_offSecAgent, {
+  ALL_TOOL_NAMES: () => ALL_TOOL_NAMES2,
+  ASK_USER_QUESTIONS_TOOL_NAME: () => ASK_USER_QUESTIONS_TOOL_NAME2,
+  AgentEventBus: () => AgentEventBus2,
+  ApexFindingObject: () => ApexFindingObject2,
+  AskUserQuestionSchema: () => AskUserQuestionSchema2,
+  BASE_SYSTEM_PROMPT: () => BASE_SYSTEM_PROMPT2,
+  BROWSER_TOOL_NAMES: () => BROWSER_TOOL_NAMES2,
+  EMAIL_TOOL_NAMES: () => EMAIL_TOOL_NAMES2,
+  EMAIL_TOOL_NAMES_ACTIVE: () => EMAIL_TOOL_NAMES2,
+  FAST_STRIKE_EXCLUDED_TOOL_NAMES: () => FAST_STRIKE_EXCLUDED_TOOL_NAMES2,
+  OffensiveSecurityAgent: () => OffensiveSecurityAgent2,
+  PLAN_MODE_TOOL_NAMES: () => PLAN_MODE_TOOL_NAMES2,
+  PentestReportedError: () => PentestReportedError2,
+  PerCommandShell: () => PerCommandShell2,
+  PlaywrightMcpSession: () => PlaywrightMcpSession2,
+  REPORT_ERROR_TOOL_NAME: () => REPORT_ERROR_TOOL_NAME2,
+  RESPONSE_TOOL_NAME: () => RESPONSE_TOOL_NAME2,
+  ReportErrorReasonSchema: () => ReportErrorReasonSchema2,
+  SEND_EMAIL_TOOL_NAME: () => SEND_EMAIL_TOOL_NAME2,
+  SKILL_TOOL_NAMES: () => SKILL_TOOL_NAMES2,
+  SMS_LIST_MESSAGES_TOOL_NAME: () => SMS_LIST_MESSAGES_TOOL_NAME2,
+  SMS_TOOL_NAMES: () => SMS_TOOL_NAMES2,
+  SMS_TOOL_NAMES_ACTIVE: () => SMS_TOOL_NAMES2,
+  SandboxBrowserBackend: () => SandboxBrowserBackend2,
+  ScopeViolationError: () => ScopeViolationError2,
+  StepTraceWriter: () => StepTraceWriter2,
+  addMemory: () => addMemory2,
+  assertCommandInScope: () => assertCommandInScope2,
+  assertUrlInScope: () => assertUrlInScope2,
+  buildBaseSystemPrompt: () => buildBaseSystemPrompt2,
+  buildProvidedFilesSection: () => buildProvidedFilesSection2,
+  buildSessionWorkspaceSection: () => buildSessionWorkspaceSection2,
+  checkSandboxPlaywright: () => checkSandboxPlaywright2,
+  checkpointState: () => checkpointState2,
+  completeAuthentication: () => completeAuthentication2,
+  crawlAuthenticated: () => crawlAuthenticated2,
+  createAllTools: () => createAllTools2,
+  createAttackSurfaceReport: () => createAttackSurfaceReport2,
+  createBrowserTools: () => createBrowserTools2,
+  createBrowserToolset: () => createBrowserToolset2,
+  createEmailToolset: () => createEmailToolset2,
+  createFile: () => createFile2,
+  createReportErrorTool: () => createReportErrorTool2,
+  createResponseTool: () => createResponseTool2,
+  createSandboxBrowserTools: () => createSandboxBrowserTools2,
+  createTask: () => createTask2,
+  createToolsForNames: () => createToolsForNames2,
+  createWorkspaceApp: () => createWorkspaceApp2,
+  createWorkspaceDomain: () => createWorkspaceDomain2,
+  createWorkspaceEndpoint: () => createWorkspaceEndpoint2,
+  delegateAuth: () => delegateAuth2,
+  detectAuthScheme: () => detectAuthScheme2,
+  documentApp: () => documentApp2,
+  documentEndpoint: () => documentEndpoint2,
+  documentVulnerability: () => documentVulnerability2,
+  ensureSandboxBrowser: () => ensureSandboxBrowser2,
+  ensureSandboxPlaywright: () => ensureSandboxPlaywright2,
+  executeCommand: () => executeCommand2,
+  extractHostname: () => extractHostname2,
+  extractHostsFromCommand: () => extractHostsFromCommand2,
+  extractJsEndpoints: () => extractJsEndpoints2,
+  getAllowedHosts: () => getAllowedHosts2,
+  getMemory: () => getMemory2,
+  getPage: () => getPage2,
+  grep: () => grep2,
+  httpRequest: () => httpRequest2,
+  installSandboxPlaywright: () => installSandboxPlaywright2,
+  isHostAllowed: () => isHostAllowed2,
+  listFiles: () => listFiles2,
+  listMemories: () => listMemories2,
+  listTasksTool: () => listTasksTool2,
+  listToolRegistryNames: () => listToolRegistryNames2,
+  listWorkspaceApps: () => listWorkspaceApps2,
+  listWorkspaceDomains: () => listWorkspaceDomains2,
+  listWorkspaceEndpoints: () => listWorkspaceEndpoints2,
+  parseStorageStateResult: () => parseStorageStateResult2,
+  probeAuthEndpoints: () => probeAuthEndpoints2,
+  provideComparisonResults: () => provideComparisonResults2,
+  readFile: () => readFile2,
+  readSkill: () => readSkill2,
+  runAttackSurface: () => runAttackSurface2,
+  runPentestWorkflow: () => runPentestWorkflow3,
+  sessionHasSmsPasswordless: () => sessionHasSmsPasswordless2,
+  setHeadlessMode: () => setHeadlessMode2,
+  setUserAgent: () => setUserAgent2,
+  setViewportSize: () => setViewportSize2,
+  spawnCodingAgent: () => spawnCodingAgent2,
+  spawnPentestAgent: () => spawnPentestAgent2,
+  spawnPentestSwarm: () => spawnPentestSwarm2,
+  submitPlan: () => submitPlan2,
+  testEndpointVariations: () => testEndpointVariations2,
+  transformScriptToFunction: () => transformScriptToFunction2,
+  updateFile: () => updateFile2,
+  updateTask: () => updateTask2,
+  updateWorkspaceApp: () => updateWorkspaceApp2,
+  updateWorkspaceEndpoint: () => updateWorkspaceEndpoint2,
+  validateDiscovery: () => validateDiscovery2,
+  webSearch: () => webSearch2,
+  writePlan: () => writePlan2
+});
+// src/core/agents/offSecAgent/offensiveSecurityAgent.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { SpanStatusCode } from "@opentelemetry/api";
+import { hasToolCall } from "ai";
+
+// src/core/operator/approvalGate.ts
+var DEFAULT_DECISION_TIMEOUT_MS = 15 * 60 * 1000;
+class ApprovalDeniedError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ApprovalDeniedError";
+  }
+}
+// src/core/operator/types.ts
+import { z } from "zod";
+var OperatorSettingsObject = z.object({
+  initialMode: z.enum(["plan", "manual", "auto"]).default("manual"),
+  requireApproval: z.boolean().default(true)
+});
+// src/core/agents/offSecAgent/interruptedStepFinalization.ts
+import { existsSync, readFileSync } from "node:fs";
+
+// src/core/agents/offSecAgent/interruptedStepMessages.ts
+function buildSyntheticToolResults(input) {
+  const output = {
+    type: "error-text",
+    value: `Tool execution aborted: ${input.reason}`
+  };
+  const parts = [];
+  for (const [toolCallId, toolName] of input.inFlightTools) {
+    const result = toolName === input.responseToolName && input.responseSubmitted ? { type: "text", value: "Response submitted." } : output;
+    parts.push({
+      type: "tool-result",
+      toolCallId,
+      toolName,
+      output: result
+    });
+  }
+  return parts;
+}
+function baseContainsToolCalls(msg, toolCallIds) {
+  if (!Array.isArray(msg.content))
+    return false;
+  const contentToolIds = new Set(msg.content.filter((p) => p.type === "tool-call" && p.toolCallId).map((p) => p.toolCallId));
+  return [...toolCallIds].every((id) => contentToolIds.has(id));
+}
+function buildInterruptedStepMessages(input) {
+  const { base, inFlightTools, completedResults, syntheticParts } = input;
+  const allToolCallIds = new Set([
+    ...inFlightTools.keys(),
+    ...completedResults.map((r) => r.toolCallId)
+  ]);
+  const lastMsg = base[base.length - 1];
+  const needsStepReconstruction = !lastMsg || lastMsg.role !== "assistant" || !baseContainsToolCalls(lastMsg, allToolCallIds);
+  const appended = [];
+  if (needsStepReconstruction) {
+    const stepTools = [
+      ...inFlightTools,
+      ...completedResults.map((r) => [
+        r.toolCallId,
+        r.toolName
+      ])
+    ];
+    const reconstructInput = (toolCallId) => {
+      const raw = input.streamedArgText?.get(toolCallId);
+      if (!raw)
+        return {};
+      try {
+        return JSON.parse(raw);
+      } catch {
+        return { _partial: raw };
+      }
+    };
+    appended.push({
+      role: "assistant",
+      content: stepTools.map(([toolCallId, toolName]) => ({
+        type: "tool-call",
+        toolCallId,
+        toolName,
+        input: reconstructInput(toolCallId)
+      }))
+    });
+  }
+  appended.push({
+    role: "tool",
+    content: [...completedResults, ...syntheticParts]
+  });
+  return { appended, needsStepReconstruction };
+}
+
+// src/core/agents/offSecAgent/interruptedStepFinalization.ts
+function createInterruptedStepFinalizer(deps) {
+  const debug = deps.debugLog;
+  const readBaseFromDisk = deps.readBaseFromDisk ?? (() => {
+    const path = deps.writer.messagesPath;
+    if (!path || !existsSync(path))
+      return null;
+    try {
+      return JSON.parse(readFileSync(path, "utf-8"));
+    } catch {
+      return null;
+    }
+  });
+  return async (input) => {
+    const { snapshot, reason } = input;
+    const { inFlightTools, completedResults, streamedArgText } = snapshot;
+    const syntheticParts = buildSyntheticToolResults({
+      inFlightTools,
+      reason,
+      responseToolName: deps.responseToolName,
+      responseSubmitted: deps.responseToolFired()
+    });
+    let emissionError;
+    let hasEmissionError = false;
+    if (debug) {
+      const responseInFlight = [...inFlightTools.entries()].filter(([, n]) => n === deps.responseToolName);
+      if (responseInFlight.length > 0) {
+        debug(`[response-debug] emitSyntheticToolResults closing ${responseInFlight.length} response call(s) ` + `ids=${responseInFlight.map(([id]) => id).join(",")} reason="${reason}" ` + `responseToolFired=${deps.responseToolFired()}`);
+      }
+    }
+    for (const part of syntheticParts) {
+      try {
+        deps.eventBus.emit("tool-result", {
+          toolCallId: part.toolCallId,
+          toolName: part.toolName,
+          result: part.output,
+          sessionId: deps.sessionId,
+          subagentId: deps.subagentId,
+          partId: input.partIdFor?.(part.toolCallId),
+          messageId: input.messageId
+        });
+      } catch (error) {
+        if (!hasEmissionError) {
+          emissionError = error;
+          hasEmissionError = true;
+        }
+      }
+    }
+    if (!deps.writer.messagesPath) {
+      if (hasEmissionError)
+        throw emissionError;
+      return;
+    }
+    deps.writer.cancelTimer();
+    await deps.writer.waitForPendingWrites();
+    let base = deps.writer.latest ?? [];
+    if (base.length === 0) {
+      base = readBaseFromDisk() ?? [];
+    }
+    const { appended, needsStepReconstruction } = buildInterruptedStepMessages({
+      base,
+      inFlightTools,
+      completedResults,
+      syntheticParts,
+      streamedArgText
+    });
+    if (needsStepReconstruction && debug) {
+      const responseReconstructed = [
+        ...inFlightTools,
+        ...completedResults.map((r) => [r.toolCallId, r.toolName])
+      ].filter(([, n]) => n === deps.responseToolName).map(([id]) => id);
+      if (responseReconstructed.length > 0) {
+        debug(`[response-debug] step-reconstruction for response call(s) ` + `ids=${responseReconstructed.join(",")} ` + `preservedArgChars=${responseReconstructed.map((id) => streamedArgText?.get(id)?.length ?? 0).join(",")}`);
+      }
+    }
+    const next = [...base, ...appended];
+    deps.writer.setLatest(next);
+    try {
+      await deps.writer.enqueueWrite(next);
+      deps.writer.markSyntheticsPersisted();
+    } catch {}
+    if (hasEmissionError)
+      throw emissionError;
+  };
+}
+
+// src/core/agents/offSecAgent/messagePersistence.ts
+import { writeFile } from "node:fs/promises";
+var PERSIST_INTERVAL_MS = 15000;
+
+class AgentMessageWriter {
+  intervalMs;
+  writeImpl;
+  path;
+  pending = null;
+  tail = Promise.resolve();
+  persistTimer = null;
+  syntheticsWritten = false;
+  constructor(options) {
+    this.path = options.messagesPath;
+    this.intervalMs = options.intervalMs ?? PERSIST_INTERVAL_MS;
+    this.writeImpl = options.writeImpl ?? ((p, contents) => writeFile(p, contents));
+  }
+  get messagesPath() {
+    return this.path;
+  }
+  get latest() {
+    return this.pending;
+  }
+  setLatest(messages) {
+    this.pending = messages;
+  }
+  get syntheticsPersisted() {
+    return this.syntheticsWritten;
+  }
+  markSyntheticsPersisted() {
+    this.syntheticsWritten = true;
+  }
+  schedulePersist() {
+    if (this.persistTimer)
+      return;
+    this.persistTimer = setTimeout(() => {
+      this.persistTimer = null;
+      const toWrite = this.pending;
+      if (!toWrite)
+        return;
+      this.enqueueWrite(toWrite).then(() => {
+        if (this.pending === toWrite)
+          this.pending = null;
+      }).catch(() => {});
+    }, this.intervalMs);
+  }
+  cancelTimer() {
+    if (this.persistTimer) {
+      clearTimeout(this.persistTimer);
+      this.persistTimer = null;
+    }
+  }
+  async enqueueWrite(messages) {
+    const path = this.path;
+    if (!path)
+      return;
+    const contents = JSON.stringify(messages);
+    const write = this.tail.then(() => this.writeImpl(path, contents));
+    this.tail = write.catch(() => {});
+    await write;
+  }
+  async waitForPendingWrites() {
+    let pending;
+    do {
+      pending = this.tail;
+      await pending;
+    } while (pending !== this.tail);
+  }
+}
+
+// src/core/agents/offSecAgent/prompt.ts
+import { existsSync as existsSync2, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+function buildProvidedFilesSection2(sessionRootPath, fileWorkspaceRoot) {
+  const providedDir = join(sessionRootPath, "provided_files");
+  if (!existsSync2(providedDir))
+    return "";
+  let entries;
+  try {
+    entries = readdirSync(providedDir);
+  } catch {
+    return "";
+  }
+  const fileEntries = entries.filter((name) => name !== "README.md").map((name) => {
+    try {
+      const stat = statSync(join(providedDir, name));
+      if (!stat.isFile())
+        return null;
+      return { name, size: stat.size };
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+  if (fileEntries.length === 0)
+    return "";
+  const lines = fileEntries.map((f) => `- \`provided_files/${f.name}\` (${f.size} bytes)`);
+  const readGuidance = fileWorkspaceRoot ? "Use `execute_command` with the absolute directory above to inspect these files, or copy inputs into the file workspace before using `read_file` / `list_files`." : "Read these with `read_file` and list directory contents with `list_files provided_files/` as needed.";
+  return `
+
+# Provided Files
+
+The user has uploaded the following files for this session. They are available at \`${providedDir}\` (relative path: \`provided_files/\`) and may include sample payloads, reference documentation, test data, or other context the agent should consult when planning and executing its work.
+
+${lines.join(`
+`)}
+
+${readGuidance} A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
+}
+function buildSessionWorkspaceSection2(session, agentCwd, activeTools, fileWorkspaceRoot) {
+  const sandboxMode = agentCwd === session.rootPath;
+  const providedFilesSection = buildProvidedFilesSection2(session.rootPath, fileWorkspaceRoot);
+  const sourceAssessmentSection = buildSourceAssessmentSection(session, agentCwd, { sandboxMode, activeTools, fileWorkspaceRoot });
+  if (fileWorkspaceRoot) {
+    return `
+
+# Working Directory and File Workspace
+
+Your shell starts in ${agentCwd}. Native file tools are confined to ${fileWorkspaceRoot}; their relative paths resolve inside that directory, independently of the shell's working directory.
+
+Create and edit helper scripts inside the file workspace. Use absolute helper paths with \`execute_command\` to check and run them. Do not prefix native file-tool paths with \`scratchpad/\` or \`provided_files/\` to reach session directories outside the file workspace.
+
+Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence. Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+  if (sandboxMode) {
+    return `
+
+# Session Workspace
+
+Your shell is already set to the session directory. **Do not \`cd\` into it** — you are already there. Just run commands directly (e.g. \`npx create-next-app my-app\`, \`mkdir test\`, \`curl ...\`). Use relative paths for everything.
+
+The session directory (${session.rootPath}) contains these subdirectories:
+- **findings/** — vulnerability findings (written by \`document_vulnerability\`)
+- **pocs/** — proof-of-concept scripts (written by \`document_vulnerability\`)
+- **scratchpad/** — your scratch space for working notes, intermediate data, wordlists, temporary scripts. **Do NOT write reports, executive summaries, or finding compilations here** — reports are generated automatically from findings/.
+- **logs/** — execution logs
+- **evidence/** — screenshots and evidence (written by browser tools)
+- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
+
+Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+  return `
+
+# Working Directory
+
+Your shell starts in the user's project directory: ${agentCwd}
+Use relative paths to reference project files.
+
+Session artifacts are stored separately at ${session.rootPath}:
+- **findings/** — written by \`document_vulnerability\`
+- **pocs/** — written by \`document_vulnerability\`
+- **scratchpad/** — your scratch space
+- **logs/** — execution logs
+- **evidence/** — screenshots and evidence
+- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
+
+Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically.${providedFilesSection}${sourceAssessmentSection}`;
+}
+var SOURCE_ASSESSMENT_TOOL_NAMES = [
+  "profile_codebase",
+  "query_whitebox_catalog",
+  "run_code_query",
+  "run_whitebox_scan"
+];
+var REPO_MUTATION_TOOL_NAMES = [
+  "update_file",
+  "apply_patch",
+  "create_file",
+  "delete_file"
+];
+function buildSourceAssessmentSection(session, agentCwd, {
+  sandboxMode,
+  activeTools,
+  fileWorkspaceRoot
+}) {
+  const codebasePath = session.config?.codebasePath;
+  const hasSourceAccess = Boolean(codebasePath) || !sandboxMode && !fileWorkspaceRoot;
+  if (!hasSourceAccess)
+    return "";
+  if (activeTools && !SOURCE_ASSESSMENT_TOOL_NAMES.some((name) => activeTools.includes(name))) {
+    return "";
+  }
+  const sourceRoot = codebasePath ?? agentCwd;
+  const alignmentNote = codebasePath && codebasePath !== agentCwd ? `
+The configured codebase path is ${codebasePath}, while your shell starts in ${agentCwd}. Use the configured codebase path for source analysis unless the user says otherwise.` : "";
+  const mayEditRepo = !fileWorkspaceRoot && (activeTools?.some((name) => REPO_MUTATION_TOOL_NAMES.includes(name)) ?? false);
+  const repoEditBullet = fileWorkspaceRoot ? `
+- Source access is read-only. Keep harnesses, generated inputs, and scratch scripts inside ${fileWorkspaceRoot}. Helper-file tools do not authorize target repository changes. Do not use shell commands to edit target source or bypass the helper workspace.` : mayEditRepo ? `
+- Keep harnesses, generated inputs, and scratch scripts at ${session.scratchpadPath} (an absolute session path, not a repo-relative path). Limit repo edits to the change you were dispatched to make.` : `
+- Do not modify the target repo by default. Put harnesses, generated inputs, and scratch scripts at ${session.scratchpadPath} unless the operator approves repo edits.`;
+  const hasTool = (name) => !activeTools || activeTools.includes(name);
+  const toolGuidance = [
+    hasTool("profile_codebase") && "- Start with `profile_codebase` when the repo is unfamiliar.",
+    hasTool("query_whitebox_catalog") && "- Query only relevant playbook slices with `query_whitebox_catalog`; do not carry the whole methodology in context.",
+    hasTool("run_code_query") && "- Use `run_code_query` for batched source searches.",
+    hasTool("run_whitebox_scan") && "- Use `run_whitebox_scan` for installed scanners.",
+    hasTool("spawn_coding_agent") && "- Use `spawn_coding_agent` for independent deep dives.",
+    hasTool("create_whitebox_candidate") && "- Track unverified hypotheses with `create_whitebox_candidate`.",
+    hasTool("document_vulnerability") && "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
+    hasTool("start_whitebox_job") && hasTool("poll_whitebox_job") && "- Run builds, local servers, sanitizer runs, and microfuzzers through bounded whitebox jobs so logs and crashes are preserved as artifacts."
+  ].filter(Boolean).join(`
+`);
+  return `
+
+# Source Code Assessment
+
+Source code is in scope at ${sourceRoot}.${alignmentNote}
+
+Use source access as a force multiplier, not as a rigid workflow:
+- Prefer sink-first analysis: find dangerous operations, then trace backward to attacker-controlled entry points and trust boundaries.
+${toolGuidance}${repoEditBullet}`;
+}
+function buildBaseSystemPrompt2(options) {
+  const sandboxMode = options?.sandboxMode ?? true;
+  const stayInSessionParagraph = sandboxMode ? `
+
+**Stay in the session folder.** Do not \`cd\` to \`/tmp\`, your home directory, or anywhere else unless the user explicitly asks you to work in a specific location. Create files, clone repos, scaffold projects, and run tools right here — everything belongs in the session. Use relative paths (e.g. \`scratchpad/notes.txt\`, \`test-app/\`) rather than absolute paths to external directories.` : "";
+  return `You are an expert offensive security engineer. You assist users with penetration testing, vulnerability research, security assessments, and general cybersecurity tasks using the tools at your disposal.
+
+You work interactively with the user. Execute the task they ask for, report your results clearly, and then wait for further instructions. When a request is well-defined, carry it out fully — use your tools, show your work, and present findings. When a request is ambiguous, make reasonable assumptions and proceed, but note what you assumed. The user can steer you between turns.
+
+# Core Capabilities
+
+You can perform the full lifecycle of a penetration test and support a wide range of cybersecurity tasks:
+- **Reconnaissance & attack surface mapping** — subdomain enumeration, endpoint discovery, JS analysis, authenticated crawling
+- **Vulnerability testing** — injection flaws, auth bypasses, access control issues, misconfigurations, business logic flaws
+- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them
+- **Source code analysis** — read and search codebases for security-relevant patterns, misconfigurations, and vulnerabilities
+- **Reporting** — document confirmed findings with evidence, impact, and remediation
+
+# Tool Reference
+
+## Shell & HTTP
+- **execute_command** — Run shell commands (curl, nmap, nikto, ffuf, gobuster, dig, etc.). Use for anything that needs a CLI tool.
+- **http_request** — Make HTTP requests with full control over method, headers, body, and redirect behavior. Redirects are NOT followed by default so you can inspect Location headers and Set-Cookie values.
+
+**Wordlist tools (operator-mode addition).** Tier selection is governed by the \`[BUNDLED ASSETS]\` env block. Operator-only rule: before escalating to \`LARGE_WORDLIST\`, confirm with the user via the \`response\` tool with a one-sentence rationale, unless the user pre-directed (e.g. "deep scan", "use the larger wordlist", "quick smoke check").
+
+## Browser Automation
+- **browser_navigate** — Navigate the browser to a URL (renders JS).
+- **browser_snapshot** — Get the accessibility tree with element refs. Always call this before clicking or filling.
+- **browser_screenshot** — Capture a screenshot as evidence.
+- **browser_click** — Click an element by description or ref.
+- **browser_fill** — Clear and fill a form field.
+- **browser_evaluate** — Execute JavaScript in the page context.
+- **browser_console** — Retrieve browser console messages.
+- **browser_get_cookies** — Extract all cookies (including httpOnly) from the browser context.
+
+## Filesystem & Search
+- **read_file** — Read file contents (whole file or line range).
+- **list_files** — List directory contents (optionally recursive).
+- **grep** — Search file contents by pattern with full grep flag support.
+
+## Authentication
+- **delegate_to_auth_subagent** — Hand off authentication (form/JSON/Basic logins as well as complex flows like OAuth, SAML, CSRF-protected forms, and SPA logins) to a specialized auth sub-agent.
+- **detect_auth_scheme** — Analyze an endpoint to identify its authentication mechanism and detect barriers like CAPTCHA or rate limiting.
+- **probe_auth_endpoints** — Probe common auth paths (/login, /token, /api/auth, etc.) to discover where and how to authenticate.
+
+## Reconnaissance & Asset Discovery
+- **document_app** — Record a discovered application in this session's reconnaissance artifacts. This does not update the authenticated Pensar workspace.
+- **document_endpoint** — Record a discovered endpoint in this session and enrich it through endpoint threat modeling. This does not update the authenticated Pensar workspace. Must specify the parent app name.
+- **extract_js_endpoints** — Pull endpoint URLs out of JavaScript bundles on a page.
+- **crawl_authenticated_area** — Recursively crawl an authenticated area, extracting forms and JS endpoints on each page.
+- **test_endpoint_variations** — Probe multiple endpoint URLs for accessibility and status codes.
+- **validate_discovery_completeness** — Evaluate your recon coverage and identify gaps.
+- **create_attack_surface_report** — Produce the final structured attack surface report with targets and pentest objectives.
+
+## Authenticated Pensar Workspace
+- **list_workspace_domains** — List domains in the connected Console workspace and resolve domain IDs.
+- **create_workspace_domain** — Add or resolve a canonical domain without verifying it or starting recon.
+- **list_workspace_apps** — List or search applications in the connected Console workspace.
+- **create_workspace_app** — Add one application to the connected Console workspace.
+- **update_workspace_app** — Change an existing application, including linking or unlinking its domain.
+- **list_workspace_endpoints** — List or search endpoints under a workspace application.
+- **create_workspace_endpoint** — Add one endpoint under a workspace application, with optional HTTP/gRPC/gRPC-Web/Connect transport.
+- **update_workspace_endpoint** — Change or repair an existing endpoint, including its wire transport.
+
+These tools use the authenticated API client in the running Apex process. Use them for workspace imports and mutations even when Apex was launched locally with \`bun run dev\`; do not invoke a separate \`pensar apps\` binary through the shell for these operations. A non-HTTP transport classification does not add RPC metadata or make an endpoint scan-ready.
+
+## Findings & PoCs
+- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.
+
+## Orchestration
+- **run_attack_surface** — Launch a full attack surface discovery workflow. Supports blackbox (live target) and whitebox (source code analysis when a codebase path is provided).
+- **spawn_pentest_swarm** — Fan out targeted pentest agents in parallel across multiple endpoints/objectives.
+- **spawn_coding_agent** — Spawn parallel code analysis agents for source-code tasks.
+
+## Pensar CLI (other Console operations)
+
+You run inside Pensar Apex, and the \`pensar\` CLI may also be available on this machine. Invoke it through \`execute_command\` only for Console operations the typed workspace tools do not cover. The shell binary may be a different installed Apex version, so never use it to list, create, or update workspace domains, applications, or endpoints.
+
+- **Issues & fixes** — \`pensar issues [--status --severity --scan --branch]\`, \`issues get <id>\`, \`issues update <id>\`, \`issues retest <id>\`; \`pensar fixes <issueId>\`, \`fixes get <fixId>\`.
+- **Scans** — \`pensar pentests\`, \`pentests get <id>\`, \`pentests dispatch [--branch --level]\`.
+- **Agent logs** — \`pensar logs <issueId>\`, \`logs search <issueId> <query>\`.
+
+**Destination rule:** When the user explicitly asks to manage domains, applications, or endpoints in their connected/authenticated/Console workspace, use the typed workspace tools above. Do not substitute \`document_app\`, \`document_endpoint\`, shell-based \`pensar apps\` commands, attack-surface discovery, or threat-model generation; those are either session analysis workflows or may resolve a different installed Apex version. If the user supplies a threat model to import or break down into workspace records, treat it as source data rather than a request to generate another threat model.
+
+An explicit request for a specific workspace mutation is confirmation for that mutation; do not ask for a second conversational confirmation. The configured approval gate still applies. Ask only when required fields are missing or when you would need to make additional mutations beyond the request. Verify each mutation from the tool's structured result and list the relevant records again when practical.
+
+Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI is the source of truth. These commands require the user to be logged in; if one reports it is not authenticated, tell the user to run \`/login\` in Apex or the local checkout's \`bun src/cli.ts login\` rather than attempting the device flow yourself. Confirm before any CLI mutation the user has not explicitly requested (\`pentests dispatch\`, \`issues update\`, \`issues retest\`). Do NOT launch nested engagements from here (\`pensar pentest\`, \`pensar targeted-pentest\`, \`pensar operator\`, or \`pensar -p\`) — use your own tools for testing.
+
+# How to Work
+
+1. **Execute what the user asks.** If they say "scan this target", scan it. If they say "test this endpoint for SQLi", test it. Carry out the requested task using your tools and present the results.
+2. **Show your work.** Explain what you're doing and why as you go. Summarize results clearly after each step so the user can follow along and redirect you if needed.
+3. **Be thorough within the ask.** When given a task, see it through completely. Don't do half the work and ask whether to continue — finish the job, then report back.
+4. **Use the right level of automation.** For large tasks (e.g., "pentest this entire application"), use orchestration tools like \`run_attack_surface\` and \`spawn_pentest_swarm\` to parallelize the work. For focused tasks (e.g., "check if this parameter is vulnerable to XSS"), work directly with \`http_request\`, \`execute_command\`, or the browser tools.
+5. **Authenticate when needed.** If the user provides credentials or auth instructions, use them. Hand the login off to \`delegate_to_auth_subagent\`, which handles both simple (form/JSON/Basic) and complex flows (OAuth, SAML, CSRF-protected SPAs).
+6. **Document security work as you go.** During reconnaissance or pentesting, call \`document_app\` for discovered applications and \`document_endpoint\` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call \`document_vulnerability\` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.
+7. **Consult memories first.** When you begin testing a specific application, framework, or path, call \`list_memories\` to check for saved knowledge from previous sessions — past findings, useful payloads, endpoint patterns, or target-specific notes. Use relevant memories to inform your approach before starting from scratch.
+
+# Command Execution
+
+Each \`execute_command\` call runs in a **fresh shell** that starts in your session directory — \`cd\`, \`export\`, aliases, and background jobs do NOT persist between calls. Chain related steps in one command (\`cd dir && ./run\`) or use absolute paths. Environment activation (virtualenv, exports) must happen in the same command that uses it, or come from the session's configured environment.${stayInSessionParagraph}
+
+For long-running services (servers, listeners, watchers), background them with **redirected stdio** so the call returns immediately and the service keeps running as a plain process:
+- \`nohup python server.py > scratchpad/server.log 2>&1 & echo $! > scratchpad/server.pid\`
+- Check later with \`cat scratchpad/server.log\`; stop with \`kill $(cat scratchpad/server.pid)\`.
+- There is no shell job table across calls — recorded PIDs/files plus explicit lifecycle are how you manage services. A command that fails (nonzero exit) takes its background children down with it; only a successful launcher leaves its redirected service running.
+
+# Rules
+
+1. **Evidence over assumptions.** Every claim must be backed by actual tool output. Never hallucinate findings or fabricate evidence.
+2. **Stay in scope.** Only test targets and systems explicitly provided by the user or discovered within the authorized scope. Respect any scope constraints in the session config.
+3. **Handle failures gracefully.** If a tool call fails or a technique doesn't work, try alternative approaches. If your PoC approach fails repeatedly, pivot to a different technique.
+4. **Summarize results.** After completing a task, give the user a clear summary of what you found, what you tried, and what the next steps could be.
+5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the \`response\` tool or inline text, not standalone report files.`;
+}
+var BASE_SYSTEM_PROMPT2 = buildBaseSystemPrompt2();
+
+// src/core/agents/offSecAgent/recordedTools.ts
+import {
+  toolModelMessageSchema
+} from "ai";
+var STREAMING_OUTPUT_REJECTED = "Streaming tool output is not supported in recorded runs; the journal settles one final result per call";
+function defaultModelOutput(output) {
+  if (typeof output === "string")
+    return { type: "text", value: output };
+  const value = output === undefined ? null : output;
+  return { type: "json", value };
+}
+function isAsyncIterable(value) {
+  return typeof value === "object" && value !== null && Symbol.asyncIterator in value;
+}
+function transportShape(toolCallId, toolName, output) {
+  const validated = toolModelMessageSchema.safeParse({
+    role: "tool",
+    content: [{ type: "tool-result", toolCallId, toolName, output }]
+  });
+  if (!validated.success) {
+    throw new Error(`Tool result for ${toolCallId} is not a valid model-visible output`);
+  }
+  return JSON.parse(JSON.stringify(output));
+}
+function reuseRaw(output) {
+  return output.type === "text" || output.type === "json" ? output.value : output;
+}
+function wrapRecordedTools(tools, recorder) {
+  const conversions = new Map;
+  const wrapped = {};
+  for (const [name, entry] of Object.entries(tools)) {
+    const tool = entry;
+    if (typeof tool?.execute !== "function") {
+      wrapped[name] = entry;
+      continue;
+    }
+    const originalExecute = tool.execute.bind(tool);
+    const originalToModelOutput = tool.toModelOutput?.bind(tool);
+    wrapped[name] = {
+      ...tool,
+      execute: async (input, options) => {
+        const committedInput = structuredClone(input);
+        const gate = await recorder.beforeExecute({
+          toolCallId: options.toolCallId,
+          toolName: name,
+          input: committedInput
+        });
+        if (gate.kind === "reuse") {
+          const settled = structuredClone(gate.output);
+          conversions.set(options.toolCallId, settled);
+          return reuseRaw(structuredClone(settled));
+        }
+        try {
+          options.abortSignal?.throwIfAborted();
+          const raw = await originalExecute(committedInput, options);
+          if (isAsyncIterable(raw)) {
+            throw new Error(STREAMING_OUTPUT_REJECTED);
+          }
+          const modelOutput = originalToModelOutput ? await originalToModelOutput({
+            toolCallId: options.toolCallId,
+            input: committedInput,
+            output: raw
+          }) : defaultModelOutput(raw);
+          const settled = transportShape(options.toolCallId, name, modelOutput);
+          await recorder.settle(options.toolCallId, settled);
+          conversions.set(options.toolCallId, settled);
+          return raw;
+        } catch (error) {
+          await recorder.unknown(options.toolCallId).catch(() => {});
+          throw error;
+        }
+      },
+      toModelOutput: async (call) => {
+        const cached = conversions.get(call.toolCallId);
+        if (cached)
+          return structuredClone(cached);
+        if (originalToModelOutput)
+          return await originalToModelOutput(call);
+        return defaultModelOutput(call.output);
+      }
+    };
+  }
+  return wrapped;
+}
+
+// src/core/agents/offSecAgent/runtimeContext.ts
+import { createHash } from "node:crypto";
+
+// src/core/assets/wordlists.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { dirname, join as join2, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+var RELATIVE = {
+  tiny: "assets/wordlists/tiny.txt",
+  common: "assets/wordlists/common.txt",
+  large: "assets/wordlists/large.txt"
+};
+var cached;
+function findPackageRoot(start) {
+  let dir = start;
+  while (true) {
+    const pkgPath = join2(dir, "package.json");
+    if (existsSync3(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync2(pkgPath, "utf8"));
+        if (pkg.name === "@pensar/apex" && existsSync3(join2(dir, "assets", "wordlists"))) {
+          return dir;
+        }
+      } catch {}
+    }
+    const parent = dirname(dir);
+    if (parent === dir)
+      return null;
+    dir = parent;
+  }
+}
+function getBundledWordlists() {
+  if (cached !== undefined)
+    return cached;
+  const here = dirname(fileURLToPath(import.meta.url));
+  const root = findPackageRoot(here);
+  if (root === null) {
+    cached = null;
+    return cached;
+  }
+  const paths = {
+    tiny: resolve(root, RELATIVE.tiny),
+    common: resolve(root, RELATIVE.common),
+    large: resolve(root, RELATIVE.large)
+  };
+  for (const p of Object.values(paths)) {
+    if (!existsSync3(p) || statSync2(p).size === 0) {
+      cached = null;
+      return cached;
+    }
+  }
+  cached = paths;
+  return cached;
+}
+
+// src/core/agents/offSecAgent/runtimeContext.ts
+var UNKNOWN_FACTS = {
+  probed: false,
+  available: [],
+  missing: []
+};
+var PROBE_TOOL_NAMES = [
+  "bash",
+  "sh",
+  "python3",
+  "python",
+  "node",
+  "ffuf",
+  "nmap",
+  "gobuster",
+  "sqlmap",
+  "nikto",
+  "hydra",
+  "john",
+  "hashcat",
+  "tcpdump",
+  "tshark",
+  "nc",
+  "socat",
+  "curl",
+  "wget",
+  "git"
+];
+var PROBE_TIMEOUT_SECONDS = 10;
+var MAX_PROBE_OUTPUT_BYTES = 16 * 1024;
+function posixProbeCommand() {
+  const checks = PROBE_TOOL_NAMES.map((t) => `if command -v ${t} >/dev/null 2>&1; then echo "AVAIL ${t}"; else echo "MISSING ${t}"; fi`).join("; ");
+  return `${checks}; echo "OS: $(uname -sr 2>/dev/null)"`;
+}
+function windowsProbeCommand() {
+  const checks = PROBE_TOOL_NAMES.map((t) => `where ${t} >nul 2>&1 && echo AVAIL ${t} || echo MISSING ${t}`).join(" & ");
+  return `${checks} & echo OS: & ver`;
+}
+function parseProbeOutput(output) {
+  const available = [];
+  const missing = [];
+  let os;
+  let osPending = false;
+  for (const rawLine of output.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line)
+      continue;
+    if (osPending) {
+      os = line;
+      osPending = false;
+      continue;
+    }
+    if (line === "OS:") {
+      osPending = true;
+      continue;
+    }
+    const avail = /^AVAIL (\S+)$/.exec(line);
+    if (avail) {
+      available.push(avail[1]);
+      continue;
+    }
+    const miss = /^MISSING (\S+)$/.exec(line);
+    if (miss) {
+      missing.push(miss[1]);
+      continue;
+    }
+    const osMatch = /^OS: (.+)$/.exec(line);
+    if (osMatch?.[1])
+      os = osMatch[1];
+  }
+  const seen = new Set([...available, ...missing]);
+  if (seen.size < PROBE_TOOL_NAMES.length)
+    return UNKNOWN_FACTS;
+  return {
+    probed: true,
+    ...os ? { os } : {},
+    available: available.sort(),
+    missing: missing.sort()
+  };
+}
+async function runProbe(ctx) {
+  try {
+    const backend = resolveBackends2({
+      ...ctx,
+      abortSignal: undefined,
+      commandShell: undefined
+    });
+    const platform = backend.command.platform ?? "posix";
+    const cmd = platform === "windows" ? windowsProbeCommand() : posixProbeCommand();
+    const opts = {
+      timeoutSeconds: PROBE_TIMEOUT_SECONDS,
+      abortSignal: AbortSignal.timeout(PROBE_TIMEOUT_SECONDS * 1000),
+      envVars: ctx.environmentVariables
+    };
+    let output = "";
+    let outputTruncated = false;
+    let exitCode = null;
+    let timedOut = false;
+    for await (const event of backend.command.run(cmd, opts)) {
+      const e = event;
+      if (e.type === "stdout" || e.type === "stderr") {
+        if (output.length >= MAX_PROBE_OUTPUT_BYTES) {
+          outputTruncated = true;
+        } else {
+          const room = MAX_PROBE_OUTPUT_BYTES - output.length;
+          output += e.bytes.slice(0, room);
+          if (e.bytes.length > room)
+            outputTruncated = true;
+        }
+      } else if (e.type === "end") {
+        exitCode = e.exitCode;
+        timedOut = e.timedOut;
+        if (e.stdoutTruncated || e.stderrTruncated)
+          outputTruncated = true;
+      }
+    }
+    if (exitCode === null || exitCode !== 0 || timedOut || outputTruncated) {
+      return UNKNOWN_FACTS;
+    }
+    return parseProbeOutput(output);
+  } catch {
+    return UNKNOWN_FACTS;
+  }
+}
+var objectId = new WeakMap;
+var nextObjectId = 0;
+function idFor(obj) {
+  let id = objectId.get(obj);
+  if (id === undefined) {
+    id = ++nextObjectId;
+    objectId.set(obj, id);
+  }
+  return id;
+}
+function envTag(env) {
+  if (!env || Object.keys(env).length === 0)
+    return "";
+  const sorted = JSON.stringify(Object.keys(env).sort().map((k) => [k, env[k]]));
+  return createHash("sha256").update(sorted).digest("hex").slice(0, 16);
+}
+function cacheKey(ctx) {
+  return [
+    ctx.session.id,
+    ctx.backends ? `b${idFor(ctx.backends)}` : "local",
+    ctx.sandbox ? `s${idFor(ctx.sandbox)}` : "nosh",
+    ctx.agentCwd,
+    envTag(ctx.environmentVariables)
+  ].join("|");
+}
+var MAX_CACHE_ENTRIES = 32;
+var factsByKey = new Map;
+var settledFactsByKey = new Map;
+function waitForProbe(pending, signal) {
+  if (!signal)
+    return pending;
+  if (signal.aborted)
+    return Promise.resolve(UNKNOWN_FACTS);
+  return new Promise((resolve) => {
+    const finish = (facts) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(facts);
+    };
+    const onAbort = () => finish(UNKNOWN_FACTS);
+    signal.addEventListener("abort", onAbort, { once: true });
+    pending.then(finish, () => finish(UNKNOWN_FACTS));
+  });
+}
+function probeRuntimeFacts(ctx) {
+  if (ctx.abortSignal?.aborted)
+    return Promise.resolve(UNKNOWN_FACTS);
+  const key = cacheKey(ctx);
+  const cached = factsByKey.get(key);
+  if (cached)
+    return waitForProbe(cached, ctx.abortSignal);
+  const pending = runProbe(ctx).then((facts) => {
+    if (factsByKey.get(key) !== pending)
+      return facts;
+    if (facts.probed) {
+      settledFactsByKey.set(key, facts);
+    } else {
+      factsByKey.delete(key);
+      settledFactsByKey.delete(key);
+    }
+    return facts;
+  });
+  pending.catch(() => {
+    if (factsByKey.get(key) !== pending)
+      return;
+    factsByKey.delete(key);
+    settledFactsByKey.delete(key);
+  });
+  if (factsByKey.size >= MAX_CACHE_ENTRIES) {
+    factsByKey.clear();
+    settledFactsByKey.clear();
+  }
+  factsByKey.set(key, pending);
+  return waitForProbe(pending, ctx.abortSignal);
+}
+function peekSettledRuntimeFacts(ctx) {
+  return settledFactsByKey.get(cacheKey(ctx)) ?? null;
+}
+function resolveCommandPlatform(ctx) {
+  return resolveBackends2(ctx).command.platform ?? "posix";
+}
+function hasTool(facts, tool) {
+  return facts.available.includes(tool);
+}
+function toolFact(facts, tool) {
+  if (!facts.probed)
+    return "unknown";
+  if (hasTool(facts, tool))
+    return "available";
+  return facts.missing.includes(tool) ? "missing" : "unknown";
+}
+function shellFact(facts) {
+  if (!facts.probed)
+    return "unknown";
+  if (hasTool(facts, "bash"))
+    return "bash";
+  if (hasTool(facts, "sh"))
+    return "sh (no bash)";
+  return "missing";
+}
+function pythonFact(facts) {
+  if (!facts.probed)
+    return "unknown";
+  if (hasTool(facts, "python3"))
+    return "available (python3)";
+  if (hasTool(facts, "python"))
+    return "available (python)";
+  return "missing";
+}
+function inventoryLine(facts) {
+  if (!facts.probed) {
+    return "Command-tool inventory: unknown (not established — no probe has settled for this runtime). Verify each tool before first use.";
+  }
+  const lines = [];
+  if (facts.available.length > 0) {
+    lines.push(`Command tools present: ${facts.available.join(", ")}`);
+  }
+  if (facts.missing.length > 0) {
+    lines.push(`Command tools absent: ${facts.missing.join(", ")}`);
+  }
+  return lines.join(`
+`);
+}
+function buildRuntimeContextSection(facts, opts) {
+  const verify = opts.platform === "windows" ? "where <tool>" : "command -v <tool>";
+  const lines = [
+    "[RUNTIME CONTEXT]",
+    `OS: ${facts.probed ? facts.os ?? "unknown" : "unknown"} | Shell: ${shellFact(facts)} | Python: ${pythonFact(facts)} | Node: ${toolFact(facts, "node")} | ffuf: ${toolFact(facts, "ffuf")}`,
+    inventoryLine(facts),
+    `Treat this inventory as facts, not as a checklist: pick techniques from evidence. When a tool is absent, build the equivalent with the available interpreters (shell/Python/Node) instead of assuming the tool exists. For tools listed unknown, verify with \`${verify}\` before first use.`,
+    "Syntax-check or compile new or changed helper scripts with the runtime's available tools before execution; inspect the exit status and output, repair failures, and rerun. A successful file write alone does not establish that a helper works.",
+    "[/RUNTIME CONTEXT]"
+  ];
+  return lines.filter(Boolean).join(`
+`);
+}
+function buildBundledAssetsSection() {
+  const wordlists = getBundledWordlists();
+  if (wordlists === null)
+    return null;
+  return `[BUNDLED ASSETS]
+This block is your authoritative inventory of wordlist assets shipped with the CLI. When the user asks what wordlists / assets / capabilities you have, answer directly from the entries below — do NOT probe the filesystem (\`ls /usr/share/wordlists\`, \`which gobuster\`, \`find / -name wordlists\`, etc.). Those paths are not where these live; the inventory is here.
+
+TINY_WORDLIST=${wordlists.tiny} (~200 entries — smoke checks / time-pressured runs)
+DEFAULT_WORDLIST=${wordlists.common} (~4.7k entries — normal recon, the default)
+LARGE_WORDLIST=${wordlists.large} (~30k entries — escalation only)
+
+These paths can be passed as \`-w\` arguments to gobuster/ffuf/dirb/wfuzz/dirsearch, OR iterated line-by-line in shell loops and \`http_request\` scripts. Their presence is NOT a reason to run a wordlist-based tool; choose techniques based on the task.
+
+If you do invoke a wordlist-based tool: default to DEFAULT_WORDLIST. Use TINY only under explicit time pressure or for a first-pass smoke probe. Use LARGE only after DEFAULT finishes and the target still looks under-mapped, or when the user explicitly asked for a deeper scan. Do NOT chain tiers automatically. Do NOT assume /usr/share/wordlists/* exists — it is missing on macOS, Alpine, most Docker images, and CI.
+[/BUNDLED ASSETS]`;
+}
+
+// src/core/agents/offSecAgent/streamDiagnostics.ts
+var STREAM_STALL_DEBUG = process.env.STREAM_STALL_DEBUG === "1" || process.env.STREAM_STALL_DEBUG === "true";
+var STREAM_STALL_TICK_MS = 15000;
+var STREAM_STALL_WARN_MS = 20000;
+var STREAM_GAP_RECOVERED_MS = 1e4;
+var RESPONSE_DEBUG = process.env.RESPONSE_DEBUG === "1" || process.env.RESPONSE_DEBUG === "true";
+var rlog = scopedLogger(() => createLogger("response-debug"));
+function responseArgBytes(input) {
+  if (input == null)
+    return 0;
+  if (typeof input === "string")
+    return input.length;
+  try {
+    return JSON.stringify(input).length;
+  } catch {
+    return -1;
+  }
+}
+
+class StreamDiagnostics {
+  opts;
+  stallEnabled;
+  responseDebugEnabled;
+  warn;
+  responseArgChars = new Map;
+  responseSawTerminal = new Map;
+  lastChunkAt = Date.now();
+  lastChunkType = "none";
+  stallStepIndex = -1;
+  stallTimer;
+  constructor(options) {
+    this.opts = options;
+    this.stallEnabled = options.stallEnabled ?? STREAM_STALL_DEBUG;
+    this.responseDebugEnabled = options.responseDebugEnabled ?? RESPONSE_DEBUG;
+    this.warn = options.warn ?? ((message) => rlog.warn(message));
+  }
+  start() {
+    if (!this.stallEnabled || this.stallTimer)
+      return;
+    const label = this.opts.sessionId;
+    const sid = this.opts.subagentId;
+    this.stallTimer = setInterval(() => {
+      const gap = Date.now() - this.lastChunkAt;
+      if (gap > STREAM_STALL_WARN_MS) {
+        this.warn(`[stream-stall] no chunk for ${Math.round(gap / 1000)}s ` + `session=${label} subagent=${sid ?? "-"} step=${this.stallStepIndex} ` + `lastChunkType=${this.lastChunkType} ` + `inFlightTools=${[...this.opts.inFlightTools().values()].join(",")} ` + `responseToolFired=${this.opts.responseToolFired()}`);
+      }
+    }, STREAM_STALL_TICK_MS);
+  }
+  observeChunk(chunk) {
+    if (this.stallEnabled) {
+      const now = Date.now();
+      const gap = now - this.lastChunkAt;
+      this.lastChunkAt = now;
+      this.lastChunkType = chunk.type;
+      if (chunk.type === "start-step")
+        this.stallStepIndex++;
+      if (gap > STREAM_GAP_RECOVERED_MS) {
+        this.warn(`[stream-gap] recovered after ${Math.round(gap / 1000)}s ` + `session=${this.opts.sessionId} chunkType=${chunk.type}`);
+      }
+    }
+    if (this.responseDebugEnabled) {
+      this.traceResponseTool(chunk);
+    }
+  }
+  logSurfacedToolError(info) {
+    if (!this.responseDebugEnabled)
+      return;
+    if (info.toolName !== this.opts.responseToolName)
+      return;
+    this.warn(`[response-debug] tool-error SURFACED id=${info.toolCallId} ` + `streamedArgChars=${info.streamedArgChars} ` + `finishReason=${info.finishReason ?? "unknown"} ` + `outputTokenTruncated=${info.truncated} error=${info.message.slice(0, 300)}`);
+  }
+  logClosingInFlightTool(info) {
+    if (!this.responseDebugEnabled)
+      return;
+    if (info.toolName !== this.opts.responseToolName)
+      return;
+    this.warn(`[response-debug] CLOSING response as "did not complete" id=${info.toolCallId} ` + `streamedArgChars=${this.responseArgChars.get(info.toolCallId) ?? 0} ` + `sawTerminalChunk=${this.responseSawTerminal.get(info.toolCallId) ?? "none"} ` + `finishReason=${info.finishReason ?? "unknown"} outputTokenTruncated=${info.truncated} ` + `responseToolFired=${this.opts.responseToolFired()}`);
+  }
+  stop() {
+    if (this.stallTimer)
+      clearInterval(this.stallTimer);
+    this.stallTimer = undefined;
+  }
+  traceResponseTool(chunk) {
+    const idForChunk = chunk.toolCallId ?? chunk.id;
+    const nameForChunk = chunk.toolName ?? (idForChunk ? this.opts.inFlightTools().get(idForChunk) : undefined);
+    if (nameForChunk !== this.opts.responseToolName || !idForChunk) {
+      if (chunk.type === "finish-step") {
+        const responseInFlight = [...this.opts.inFlightTools().entries()].filter(([, n]) => n === this.opts.responseToolName).map(([id]) => id).join(",");
+        if (responseInFlight) {
+          this.warn(`[response-debug] finish-step finishReason=${chunk.finishReason} ` + `responseInFlight=${responseInFlight} ` + `responseToolFired=${this.opts.responseToolFired()}`);
+        }
+      }
+      return;
+    }
+    switch (chunk.type) {
+      case "tool-input-start":
+        this.responseArgChars.set(idForChunk, 0);
+        this.warn(`[response-debug] tool-input-start id=${idForChunk} session=${this.opts.subagentId ?? this.opts.sessionId}`);
+        break;
+      case "tool-input-delta":
+        this.responseArgChars.set(idForChunk, (this.responseArgChars.get(idForChunk) ?? 0) + (chunk.delta?.length ?? 0));
+        break;
+      case "tool-input-end":
+        this.warn(`[response-debug] tool-input-end id=${idForChunk} argChars=${this.responseArgChars.get(idForChunk) ?? 0}`);
+        break;
+      case "tool-call": {
+        this.responseSawTerminal.set(idForChunk, "tool-call");
+        const inputBytes = responseArgBytes(chunk.input ?? chunk.args);
+        this.warn(`[response-debug] tool-call id=${idForChunk} streamedArgChars=${this.responseArgChars.get(idForChunk) ?? 0} parsedInputBytes=${inputBytes} invalid=${chunk.invalid === true}`);
+        break;
+      }
+      case "tool-error": {
+        this.responseSawTerminal.set(idForChunk, "tool-error");
+        const errMsg = chunk.error instanceof Error ? chunk.error.message : typeof chunk.error === "string" ? chunk.error : JSON.stringify(chunk.error)?.slice(0, 300);
+        this.warn(`[response-debug] tool-error id=${idForChunk} streamedArgChars=${this.responseArgChars.get(idForChunk) ?? 0} stillInFlight=${this.opts.inFlightTools().has(idForChunk)} error=${errMsg}`);
+        break;
+      }
+      case "tool-result":
+        this.responseSawTerminal.set(idForChunk, "tool-result");
+        this.warn(`[response-debug] tool-result id=${idForChunk} streamedArgChars=${this.responseArgChars.get(idForChunk) ?? 0}`);
+        break;
+    }
+  }
+}
+
+// src/core/agents/offSecAgent/toolLifecycle.ts
+class ToolLifecycleTracker {
+  inFlight = new Map;
+  completed = [];
+  streamedArgs = new Map;
+  errors = new Map;
+  observePart(chunk) {
+    switch (chunk.type) {
+      case "tool-input-start":
+        this.inFlight.set(chunk.id, chunk.toolName);
+        this.streamedArgs.set(chunk.id, "");
+        break;
+      case "tool-input-delta":
+        this.streamedArgs.set(chunk.id, (this.streamedArgs.get(chunk.id) ?? "") + (chunk.delta ?? ""));
+        break;
+      case "tool-call":
+        this.inFlight.set(chunk.toolCallId, chunk.toolName);
+        break;
+      case "tool-error": {
+        const toolCallId = chunk.toolCallId;
+        this.inFlight.delete(toolCallId);
+        const errMsg = chunk.error instanceof Error ? chunk.error.message : typeof chunk.error === "string" ? chunk.error : (() => {
+          try {
+            return JSON.stringify(chunk.error);
+          } catch {
+            return String(chunk.error);
+          }
+        })();
+        const partialArgs = chunk.input !== undefined && chunk.input !== null && responseArgBytes(chunk.input) > 2 ? chunk.input : this.streamedArgs.get(toolCallId) ?? "";
+        this.errors.set(toolCallId, {
+          message: errMsg,
+          input: partialArgs,
+          toolName: chunk.toolName
+        });
+        break;
+      }
+      case "tool-result":
+        this.inFlight.delete(chunk.toolCallId);
+        this.completed.push({
+          type: "tool-result",
+          toolCallId: chunk.toolCallId,
+          toolName: chunk.toolName,
+          output: chunk.result ?? chunk.output
+        });
+        break;
+    }
+  }
+  onStepPersisted() {
+    this.completed.length = 0;
+  }
+  flushToolErrorsToResults() {
+    const flushed = [];
+    for (const [toolCallId, info] of this.errors) {
+      this.completed.push({
+        type: "tool-result",
+        toolCallId,
+        toolName: info.toolName,
+        output: {
+          type: "error-text",
+          value: `Tool call failed: ${info.message}`
+        }
+      });
+      flushed.push([toolCallId, info]);
+    }
+    this.errors.clear();
+    return flushed;
+  }
+  clearToolErrors() {
+    this.errors.clear();
+  }
+  clearInFlight() {
+    this.inFlight.clear();
+  }
+  hasUnpersistedState() {
+    return this.inFlight.size > 0 || this.completed.length > 0;
+  }
+  get inFlightTools() {
+    return this.inFlight;
+  }
+  get toolErrors() {
+    return this.errors;
+  }
+  get completedResults() {
+    return this.completed;
+  }
+  get streamedArgText() {
+    return this.streamedArgs;
+  }
+  snapshot() {
+    return {
+      inFlightTools: new Map(this.inFlight),
+      completedResults: this.completed.map((r) => ({ ...r })),
+      streamedArgText: new Map(this.streamedArgs),
+      toolErrors: new Map(this.errors)
+    };
+  }
+}
+
+// src/core/agents/offSecAgent/trace.ts
+import { createHash as createHash2 } from "node:crypto";
+import { appendFileSync, mkdirSync } from "node:fs";
+import { dirname as dirname2 } from "node:path";
+var OUTPUT_PREVIEW_LIMIT = 2000;
+var INPUT_PREVIEW_LIMIT = 1000;
+var SYSTEM_PROMPT_HASH_PREFIX_LENGTH = 12;
+function stringifyOutput(output) {
+  if (output == null)
+    return { text: "", type: "text" };
+  if (typeof output === "object" && "type" in output) {
+    const typed = output;
+    switch (typed.type) {
+      case "text":
+      case "error-text":
+        return {
+          text: String(typed.value ?? ""),
+          type: typed.type
+        };
+      case "json":
+      case "error-json":
+        return {
+          text: JSON.stringify(typed.value ?? null),
+          type: typed.type
+        };
+      case "execution-denied":
+        return {
+          text: typed.reason ?? "execution denied",
+          type: typed.type
+        };
+      case "content":
+        return { text: JSON.stringify(typed.value ?? []), type: typed.type };
+      default:
+        return { text: JSON.stringify(output), type: "text" };
+    }
+  }
+  if (typeof output === "string")
+    return { text: output, type: "text" };
+  return { text: JSON.stringify(output), type: "json" };
+}
+function preview(str, maxLen) {
+  return str.length <= maxLen ? str : str.slice(0, maxLen);
+}
+
+class StepTraceWriter2 {
+  tracePath;
+  agentId;
+  eventBus;
+  stepIndex = 0;
+  cumulativeUsage = {
+    inputTokens: 0,
+    outputTokens: 0
+  };
+  lastStepTime;
+  agentStartTime;
+  summarized = false;
+  previousMessageCount = 0;
+  constructor(opts) {
+    this.tracePath = opts.tracePath;
+    this.agentId = opts.agentId;
+    this.eventBus = opts.eventBus;
+    const now = Date.now();
+    this.agentStartTime = now;
+    this.lastStepTime = now;
+    mkdirSync(dirname2(this.tracePath), { recursive: true });
+  }
+  writeInit(data) {
+    const { systemPrompt, ...rest } = data;
+    const record = {
+      type: "init",
+      timestamp: new Date().toISOString(),
+      agentId: this.agentId,
+      systemPromptHash: createHash2("sha256").update(systemPrompt).digest("hex").slice(0, SYSTEM_PROMPT_HASH_PREFIX_LENGTH),
+      systemPrompt,
+      ...rest
+    };
+    this.appendRecord(record);
+  }
+  markSummarized() {
+    this.summarized = true;
+    this.previousMessageCount = 0;
+  }
+  recordStep(responseMessages, usage, options) {
+    const now = Date.now();
+    const usageOnly = options?.usageOnly ?? false;
+    const newMessages = usageOnly ? [] : responseMessages.slice(this.previousMessageCount);
+    if (!usageOnly) {
+      this.previousMessageCount = responseMessages.length;
+    }
+    const observations = [];
+    const reasoningParts = [];
+    const textParts = [];
+    const actions = [];
+    for (const msg of newMessages) {
+      if (!Array.isArray(msg.content)) {
+        if (typeof msg.content === "string" && msg.role === "assistant") {
+          textParts.push(msg.content);
+        }
+        continue;
+      }
+      for (const part of msg.content) {
+        switch (part.type) {
+          case "tool-result": {
+            const { text, type } = stringifyOutput(part.output);
+            observations.push({
+              toolCallId: part.toolCallId,
+              toolName: part.toolName,
+              outputType: type,
+              outputPreview: preview(text, OUTPUT_PREVIEW_LIMIT),
+              outputLength: Buffer.byteLength(text, "utf-8")
+            });
+            break;
+          }
+          case "reasoning": {
+            reasoningParts.push(part.text);
+            break;
+          }
+          case "text": {
+            textParts.push(part.text);
+            break;
+          }
+          case "tool-call": {
+            const serialized = JSON.stringify(part.input);
+            actions.push({
+              toolCallId: part.toolCallId,
+              toolName: part.toolName,
+              inputPreview: preview(serialized, INPUT_PREVIEW_LIMIT),
+              inputLength: Buffer.byteLength(serialized, "utf-8")
+            });
+            break;
+          }
+        }
+      }
+    }
+    const inputTokens = usage.inputTokens ?? 0;
+    const outputTokens = usage.outputTokens ?? 0;
+    const cacheReadTokens = usage.cacheReadTokens;
+    const cacheWriteTokens = usage.cacheWriteTokens;
+    this.cumulativeUsage.inputTokens += inputTokens;
+    this.cumulativeUsage.outputTokens += outputTokens;
+    if (cacheReadTokens != null) {
+      this.cumulativeUsage.cacheReadTokens = (this.cumulativeUsage.cacheReadTokens ?? 0) + cacheReadTokens;
+    }
+    if (cacheWriteTokens != null) {
+      this.cumulativeUsage.cacheWriteTokens = (this.cumulativeUsage.cacheWriteTokens ?? 0) + cacheWriteTokens;
+    }
+    const record = {
+      type: "step",
+      stepIndex: this.stepIndex,
+      timestamp: new Date(now).toISOString(),
+      agentId: this.agentId,
+      observations: this.stepIndex === 0 ? null : observations.length > 0 ? observations : null,
+      reasoning: reasoningParts.length > 0 ? reasoningParts.join("") : null,
+      text: textParts.length > 0 ? textParts.join("") : null,
+      actions,
+      usage: { inputTokens, outputTokens, cacheReadTokens, cacheWriteTokens },
+      cumulativeUsage: { ...this.cumulativeUsage },
+      stepDurationMs: now - this.lastStepTime,
+      elapsedMs: now - this.agentStartTime,
+      summarized: usageOnly ? false : this.summarized
+    };
+    this.appendRecord(record);
+    this.stepIndex++;
+    this.lastStepTime = now;
+    if (!usageOnly)
+      this.summarized = false;
+  }
+  get currentStepIndex() {
+    return this.stepIndex;
+  }
+  appendCheckpoint(data) {
+    const record = {
+      type: "checkpoint",
+      stepIndex: this.stepIndex,
+      timestamp: new Date().toISOString(),
+      agentId: this.agentId,
+      ...data
+    };
+    this.appendRecord(record);
+  }
+  appendTaskRecord(data) {
+    const record = {
+      type: "task",
+      timestamp: new Date().toISOString(),
+      agentId: this.agentId,
+      stepIndex: this.stepIndex,
+      ...data
+    };
+    this.appendRecord(record);
+  }
+  appendRecord(record) {
+    const correlation = getActiveTraceCorrelation2();
+    const enriched = correlation ? { ...record, correlation } : record;
+    try {
+      appendFileSync(this.tracePath, `${JSON.stringify(enriched)}
+`);
+    } catch {}
+    try {
+      this.eventBus?.emit("trace-record", {
+        record: enriched,
+        subagentId: this.agentId ?? undefined
+      });
+    } catch {}
+  }
+}
+
+// src/core/agents/offSecAgent/offensiveSecurityAgent.ts
+function isGenericAbortError(error) {
+  return error instanceof Error && error.name === "AbortError" && error.cause === undefined && /^(?:Aborted|Agent aborted by user|(?:This|The) operation was aborted|The user aborted a request)\.?$/.test(error.message);
+}
+function agentAbortReason(signal) {
+  const reason = signal.reason;
+  return reason === undefined || isGenericAbortError(reason) ? new DOMException("Agent aborted by user", "AbortError") : reason;
+}
+var log = scopedLogger(() => createLogger("approval-gate"));
+var RESPONSE_DEBUG2 = process.env.RESPONSE_DEBUG === "1" || process.env.RESPONSE_DEBUG === "true";
+var rlog2 = scopedLogger(() => createLogger("response-debug"));
+var WORKSPACE_TOOL_NAME_SET = new Set(WORKSPACE_TOOL_NAMES2);
+var WORKSPACE_WRITE_TOOL_NAME_SET = new Set(WORKSPACE_WRITE_TOOL_NAMES2);
+var RUNTIME_CAPABLE_TOOL_NAMES = new Set([
+  "execute_command",
+  "read_file",
+  "list_files",
+  "glob",
+  "grep",
+  "create_file",
+  "update_file",
+  "delete_file",
+  "apply_patch",
+  "document_vulnerability"
+]);
+var WORKSPACE_TARGET_RE = /\b(?:console|workspace)\b/i;
+var WORKSPACE_NOUN_RE = /\b(?:domains?|apps?|applications?|endpoints?|threat\s+models?|attack\s+surfaces?)\b/i;
+var WORKSPACE_READ_REQUEST_RE = /(?:\b(?:list|show|find|search|get)\s+(?:(?:me|a|an|the|my|our|all|any|list|of|for|in|within|registered|existing|available|console|workspace|which)\s+){0,8}(?:domains?|apps?|applications?|endpoints?)\b|\b(?:what|which)\s+(?:(?:of|a|an|the|my|our|all|any|are|is|do|does|we|i|have|has|there|registered|existing|available|console|workspace)\s+){0,8}(?:domains?|apps?|applications?|endpoints?)\b)/i;
+var WORKSPACE_WRITE_ACTION = String.raw`(?:add|create|register|import|update|edit|change|set|correct|repair|link|unlink|rename|break\s+down)`;
+var WORKSPACE_EXPLICIT_WRITE_REQUEST_RE = new RegExp(String.raw`(?:^\s*|[.?!;\n]\s*|\b(?:please|kindly)\s+|\b(?:can|could|would|will)\s+you\s+|\b(?:i|we)\s+(?:want|need)\s+(?:you\s+)?to\s+|\bi(?:['’]d| would)\s+like\s+(?:you\s+)?to\s+|\blet['’]s\s+|\bgo\s+ahead\s+and\s+)${WORKSPACE_WRITE_ACTION}\b`, "i");
+var WORKSPACE_NEGATED_WRITE_REQUEST_RE = new RegExp(String.raw`\b(?:do\s+not|don't|never|avoid)\b[^.?!;\n]{0,40}\b${WORKSPACE_WRITE_ACTION}\b`, "i");
+var WORKSPACE_CLAUSE_BOUNDARY_RE = new RegExp(String.raw`(?:[.!?;]+(?=\s|$)\s*|\n+|\s+(?:but|however)\s+|\s+and\s+(?=(?:(?:do\s+not|don't|never|avoid)\s+)?${WORKSPACE_WRITE_ACTION}\b))`, "i");
+var WORKSPACE_SENTENCE_BOUNDARY_RE = /(?:[.!?;]+(?=\s|$)\s*|\n+)/;
+var WORKSPACE_CAPABILITY_QUESTION_RE = /^\s*(?:(?:so|and|also|then|ok|okay|well|hey|hi|actually|but)[,\s]+)*(?:is\s+it\s+possible\b|what\s+if\b|how\s+(?:do|can|could|should|would|shall|might)\s+(?:i|we)\b|(?:can|could|should|would|may|will|do|does|did|am|are|is|shall|have|has)\s+(?:i|we)\b)/i;
+var WORKSPACE_CREATE_REQUEST_RE = /\b(?:add|create|register|import)\s+(?:(?:the|this|that|a|an|my|our|existing|new|current|connected|authenticated|console|workspace|attached|provided)\s+){0,4}(?:domains?|apps?|applications?|endpoints?|threat\s+models?|attack\s+surfaces?)\b/i;
+var WORKSPACE_DOMAIN_HOST_WRITE_RE = /\b(?:add|create|register|import|link)\s+(?:https?:\/\/)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}(?::\d+)?(?:\/\S*)?\s+(?:to|in|under)\s+(?:(?:the|my|our|connected|authenticated)\s+)?(?:console|workspace)\b/i;
+var WORKSPACE_APP_FIELD_UPDATE_RE = /\b(?:update|edit|change|set|correct|repair)\s+(?:(?:the|this|that|my|our|existing|current|connected|authenticated|console|workspace)\s+){0,4}(?:apps?|applications?)(?:['’]s)?\s+(?:name|description|type|framework|domain|disallowed\s+actions?)\s+(?:(?:to|as|with|from)\b|[:=])/i;
+var WORKSPACE_ENDPOINT_FIELD_UPDATE_RE = /\b(?:update|edit|change|set|correct|repair)\s+(?:(?:the|this|that|my|our|existing|current|connected|authenticated|console|workspace)\s+){0,4}endpoints?(?:['’]s)?\s+(?:path|route|url|description|type|transport|location|source(?:\s+location)?|start\s+line|end\s+line|line\s+numbers?|objectives?|authentication(?:\s+requirements?)?|business\s+logic|threat\s+model|parent\s+application)\s+(?:(?:to|as|with|from)\b|[:=])/i;
+var WORKSPACE_LINK_CLAUSE_GAP = String.raw`[^.?!;\n]{0,80}`;
+var WORKSPACE_APP_RESOURCE = String.raw`\b(?:apps?|applications?)\b`;
+var WORKSPACE_DOMAIN_RESOURCE = String.raw`\b(?:domains?|(?:https?:\/\/)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,})\b`;
+var WORKSPACE_APP_DOMAIN_LINK_RE = new RegExp(String.raw`(?:\blink\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_APP_RESOURCE}${WORKSPACE_LINK_CLAUSE_GAP}\bto\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_DOMAIN_RESOURCE}|\blink\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_DOMAIN_RESOURCE}${WORKSPACE_LINK_CLAUSE_GAP}\bto\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_APP_RESOURCE}|\bunlink\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_APP_RESOURCE}${WORKSPACE_LINK_CLAUSE_GAP}\bfrom\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_DOMAIN_RESOURCE}|\bunlink\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_DOMAIN_RESOURCE}${WORKSPACE_LINK_CLAUSE_GAP}\bfrom\b${WORKSPACE_LINK_CLAUSE_GAP}${WORKSPACE_APP_RESOURCE})`, "i");
+var WORKSPACE_APP_RENAME_RE = /\brename\s+(?:(?:the|this|that|my|our|existing|current|connected|authenticated|console|workspace)\s+){0,4}(?:apps?|applications?)\b[^.?!;\n]{0,60}\b(?:to|as)\b/i;
+var WORKSPACE_BREAK_DOWN_IMPORT_RE = /\bbreak\s+down\b[^.?!;\n]{0,100}\b(?:threat\s+models?|attack\s+surfaces?)\b[^.?!;\n]{0,100}\b(?:into|as)\b[^.?!;\n]{0,40}\b(?:apps?|applications?|endpoints?)\b/i;
+function hasExplicitWorkspaceWriteRequest(prompt, targetsWorkspace) {
+  return prompt.split(WORKSPACE_SENTENCE_BOUNDARY_RE).some((sentence) => {
+    if (WORKSPACE_CAPABILITY_QUESTION_RE.test(sentence))
+      return false;
+    return sentence.split(WORKSPACE_CLAUSE_BOUNDARY_RE).some((clause) => {
+      if (!WORKSPACE_EXPLICIT_WRITE_REQUEST_RE.test(clause) || WORKSPACE_NEGATED_WRITE_REQUEST_RE.test(clause)) {
+        return false;
+      }
+      return WORKSPACE_DOMAIN_HOST_WRITE_RE.test(clause) || targetsWorkspace && (WORKSPACE_CREATE_REQUEST_RE.test(clause) || WORKSPACE_APP_FIELD_UPDATE_RE.test(clause) || WORKSPACE_ENDPOINT_FIELD_UPDATE_RE.test(clause) || WORKSPACE_APP_DOMAIN_LINK_RE.test(clause) || WORKSPACE_APP_RENAME_RE.test(clause) || WORKSPACE_BREAK_DOWN_IMPORT_RE.test(clause));
+    });
+  });
+}
+function filterWorkspaceToolsForRun(activeTools, prompt, hasInteractiveApprovalGate) {
+  const gated = hasInteractiveApprovalGate && !prompt.trimStart().startsWith("<skill ");
+  if (!gated) {
+    return activeTools.filter((name) => !WORKSPACE_TOOL_NAME_SET.has(name));
+  }
+  const targetsWorkspace = WORKSPACE_TARGET_RE.test(prompt) && WORKSPACE_NOUN_RE.test(prompt);
+  const writeRequested = WORKSPACE_WRITE_TOOL_NAMES2.some((name) => prompt.includes(name)) || hasExplicitWorkspaceWriteRequest(prompt, targetsWorkspace);
+  const readRequested = writeRequested || WORKSPACE_TOOL_NAMES2.some((name) => prompt.includes(name)) || targetsWorkspace && WORKSPACE_READ_REQUEST_RE.test(prompt);
+  return activeTools.filter((name) => {
+    if (WORKSPACE_WRITE_TOOL_NAME_SET.has(name))
+      return writeRequested;
+    if (WORKSPACE_TOOL_NAME_SET.has(name))
+      return readRequested;
+    return true;
+  });
+}
+
+class OffensiveSecurityAgent2 {
+  _streamResult = null;
+  createStream;
+  initializeStreamOnce;
+  streamInit = null;
+  probesRuntime;
+  toolCtx;
+  eventBus;
+  resolveResult;
+  _capturedResponse = null;
+  _responseToolFired = false;
+  _responseToolResult;
+  _resolveResponseCaptured;
+  _rejectResponseCaptured;
+  responseCaptured = new Promise((resolve, reject) => {
+    this._resolveResponseCaptured = resolve;
+    this._rejectResponseCaptured = reject;
+  });
+  _drainRejection = new Promise(() => {});
+  drained = Promise.resolve();
+  subagentId;
+  subagentName;
+  agentMode;
+  currentMessageId = null;
+  streamStepIndex = -1;
+  streamTextPartIndex = 0;
+  commandShell;
+  browserSession;
+  ownsBrowserSession;
+  browserDisconnected = false;
+  shellDisposed = false;
+  callbackListeners = new CallbackListenerRegistry2;
+  shellDisposeBarrier = null;
+  abortSignal;
+  streamIdFactory;
+  contextRecorder;
+  userPrompt;
+  _session;
+  writer;
+  finalizeInterruptedStep;
+  messagesPath = null;
+  static async create(input) {
+    let session = input.session;
+    if (!session) {
+      session = await create2({
+        targets: input.target ? [input.target] : [],
+        config: input.sessionConfig,
+        model: input.model,
+        authConfig: input.authConfig,
+        userMessage: input.prompt,
+        onNameGenerated: input.onNameGenerated
+      });
+    }
+    return new OffensiveSecurityAgent2({ ...input, session });
+  }
+  get session() {
+    return this._session;
+  }
+  get busSessionId() {
+    return this.subagentId ?? this._session.id;
+  }
+  constructor(input) {
+    this._session = input.session;
+    this.subagentId = input.subagentId;
+    this.subagentName = input.subagentName;
+    this.agentMode = input.mode ?? "default";
+    this.abortSignal = input.abortSignal;
+    this.streamIdFactory = input.streamIdFactory;
+    this.contextRecorder = input.contextRecorder;
+    this.userPrompt = input.prompt;
+    this.eventBus = input.eventBus ?? new AgentEventBus2;
+    const agentCwd = input.agentCwd ?? input.session.config?.agentCwd ?? input.session.rootPath;
+    const fileWorkspaceRoot = input.fileWorkspaceRoot ?? input.session.config?.remoteFileWorkspaceRoot;
+    if (!input.sandbox) {
+      this.commandShell = new PerCommandShell2({
+        cwd: agentCwd,
+        env: input.environmentVariables
+      });
+      if (input.commandCancelHandle) {
+        const shell = this.commandShell;
+        input.commandCancelHandle.cancel = () => shell.cancelCurrentCommand();
+      }
+    }
+    if (!input.sandbox) {
+      this.ownsBrowserSession = !input.browserSession;
+      this.browserSession = input.browserSession ?? new PlaywrightMcpSession2({
+        headerPolicy: resolveBrowserHeaderPolicy2(input.session, input.target),
+        display: input.display,
+        engine: input.browserEngine
+      });
+      if (this.ownsBrowserSession && this.abortSignal) {
+        const onAbort = () => {
+          this.disconnectOwnedBrowser();
+        };
+        if (this.abortSignal.aborted)
+          onAbort();
+        else
+          this.abortSignal.addEventListener("abort", onAbort, { once: true });
+      }
+    } else {
+      this.ownsBrowserSession = false;
+    }
+    const messagesDir = input.messagesDir ?? (input.subagentId ? join3(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
+    const tracePath = input.subagentId ? join3(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join3(messagesDir, "trace.jsonl");
+    const traceWriter = new StepTraceWriter2({
+      tracePath,
+      agentId: input.subagentId ?? null,
+      eventBus: this.eventBus
+    });
+    const taskDriven = input.session.config?.taskDriven ?? false;
+    const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join3(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join3(input.session.rootPath, "tasks") : undefined);
+    const credentialManager = input.credentialManager ?? input.session.credentialManager;
+    const toolCtx = {
+      ...input.attackSurfaceArtifactsPath ? { attackSurfaceArtifactsPath: input.attackSurfaceArtifactsPath } : {},
+      session: input.session,
+      agentCwd,
+      fileWorkspaceRoot,
+      target: input.target,
+      grpc: input.grpc,
+      systemScope: input.systemScope,
+      abortSignal: input.abortSignal,
+      model: input.model,
+      authConfig: input.authConfig,
+      eventBus: this.eventBus,
+      onStepFinish: input.forwardUsageCallbacksToSpawnedAgents ? input.onStepFinish : undefined,
+      onCacheMetrics: input.forwardUsageCallbacksToSpawnedAgents ? input.onCacheMetrics : undefined,
+      sandbox: input.sandbox,
+      backends: input.backends,
+      findingsRegistry: input.findingsRegistry,
+      attackSurfaceRegistry: input.attackSurfaceRegistry,
+      credentialManager,
+      secretValues: input.secretValues,
+      environmentVariables: input.environmentVariables,
+      commandShell: this.commandShell,
+      skillsRegistry: input.skillsRegistry,
+      promptInjectionLibrary: input.promptInjectionLibrary,
+      promptInjectionLibrarySource: input.promptInjectionLibrarySource ?? input.session.config?.promptInjectionLibrarySource,
+      traceWriter,
+      tasksDir,
+      enableThinking: input.enableThinking,
+      thinkingEffort: input.thinkingEffort,
+      openAIReasoningEffort: input.openAIReasoningEffort,
+      surfaceIntegrationEnabled: input.surfaceIntegrationEnabled,
+      projectThreatModel: input.projectThreatModel,
+      planSubagentId: input.planSubagentId,
+      subagentId: input.subagentId,
+      browserSession: this.browserSession,
+      display: input.display,
+      subagentSpawner: input.subagentSpawner ?? inProcessSubagentSpawner2,
+      callbackListeners: this.callbackListeners,
+      smsInbox: input.smsInbox,
+      emailAdapterFor: input.emailAdapterFor,
+      languageModelMiddleware: input.languageModelMiddleware,
+      usageRecorder: input.usageRecorder,
+      streamIdFactory: input.streamIdFactory
+    };
+    const hasEmail = (input.session.config?.emailIntegration?.inboxes?.length ?? 0) > 0;
+    const hasSmtp = !!input.session.config?.smtpConfig;
+    const emailToolSet = new Set(EMAIL_TOOL_NAMES2);
+    const smsToolSet = new Set(SMS_TOOL_NAMES2);
+    const hasSms = sessionHasSmsPasswordless2(input.session);
+    const passesEmailSmsGates = (t) => {
+      if (smsToolSet.has(t))
+        return hasSms;
+      if (!emailToolSet.has(t))
+        return true;
+      if (t === SEND_EMAIL_TOOL_NAME2)
+        return hasSmtp;
+      return hasEmail;
+    };
+    let activeTools = input.activeTools.filter(passesEmailSmsGates);
+    if (input.mode === "plan") {
+      const planSet = new Set(PLAN_MODE_TOOL_NAMES2);
+      activeTools = activeTools.filter((t) => planSet.has(t));
+    } else if (input.mode === "fast-strike") {
+      const excluded = new Set(FAST_STRIKE_EXCLUDED_TOOL_NAMES2);
+      const mergedNames = input.extraTools ? Object.keys({
+        ...Object.fromEntries(listToolRegistryNames2(toolCtx).map((n) => [n, null])),
+        ...input.extraTools
+      }) : listToolRegistryNames2(toolCtx);
+      activeTools = mergedNames.filter((t) => {
+        if (excluded.has(t))
+          return false;
+        return passesEmailSmsGates(t);
+      });
+      if (input.responseSchema && !activeTools.includes(RESPONSE_TOOL_NAME2)) {
+        activeTools = [...activeTools, RESPONSE_TOOL_NAME2];
+      }
+    }
+    activeTools = filterWorkspaceToolsForRun(activeTools, input.prompt, input.approvalGate !== undefined);
+    const builtinTools = createToolsForNames2(toolCtx, activeTools);
+    let tools = input.extraTools ? { ...builtinTools, ...input.extraTools } : { ...builtinTools };
+    if (input.toolExecutionRecorder) {
+      tools = wrapRecordedTools(tools, input.toolExecutionRecorder);
+    }
+    if (input.approvalGate) {
+      tools = wrapToolsWithApprovalGate(tools, input.approvalGate, AGENT_PAUSE_TOOLS);
+    }
+    if (input.responseSchema) {
+      tools = {
+        ...tools,
+        [RESPONSE_TOOL_NAME2]: createResponseTool2(input.responseSchema, (result) => {
+          this._responseToolFired = true;
+          this._responseToolResult = result;
+          if (RESPONSE_DEBUG2) {
+            rlog2.warn(`[response-debug] response tool EXECUTED (captured) session=${this.busSessionId} ` + `resultBytes=${responseArgBytes(result)} — happy path`);
+          }
+          const customResolve = input.resolveResult;
+          if (customResolve) {
+            Promise.resolve().then(() => {
+              const sr = this.streamResult;
+              const guarded = Object.create(sr, {
+                response: {
+                  get: () => Promise.race([sr.response, this._drainRejection])
+                }
+              });
+              return customResolve(guarded);
+            }).then((resolved) => {
+              this._capturedResponse = resolved;
+              this._resolveResponseCaptured(resolved);
+            }).catch((err) => {
+              this._rejectResponseCaptured(err);
+            });
+            return;
+          }
+          this._capturedResponse = result;
+          this._resolveResponseCaptured(result);
+        })
+      };
+    }
+    if (input.resolveResult) {
+      this.resolveResult = input.resolveResult;
+    } else if (input.responseSchema) {
+      this.resolveResult = () => {
+        if (this._capturedResponse !== null)
+          return this._capturedResponse;
+        return;
+      };
+    }
+    let stopWhen = input.stopWhen;
+    if (input.responseSchema) {
+      const responseStop = hasToolCall(RESPONSE_TOOL_NAME2);
+      if (!stopWhen) {
+        stopWhen = responseStop;
+      } else if (Array.isArray(stopWhen)) {
+        stopWhen = [...stopWhen, responseStop];
+      } else {
+        stopWhen = [stopWhen, responseStop];
+      }
+    }
+    if (!existsSync4(messagesDir)) {
+      mkdirSync2(messagesDir, { recursive: true });
+    }
+    this.messagesPath = join3(messagesDir, "messages.json");
+    const initialMessagesRef = {
+      current: input.messages ? [...input.messages] : [
+        {
+          role: "user",
+          content: [{ type: "text", text: input.prompt }]
+        }
+      ]
+    };
+    this.writer = new AgentMessageWriter({ messagesPath: this.messagesPath });
+    this.finalizeInterruptedStep = createInterruptedStepFinalizer({
+      eventBus: this.eventBus,
+      sessionId: this.busSessionId,
+      subagentId: this.subagentId,
+      writer: this.writer,
+      responseToolName: RESPONSE_TOOL_NAME2,
+      responseToolFired: () => this._responseToolFired,
+      ...RESPONSE_DEBUG2 ? { debugLog: (message) => rlog2.warn(message) } : {}
+    });
+    const schedulePersist = () => this.writer.schedulePersist();
+    const baseSystemPrompt = input.system ?? buildBaseSystemPrompt2({
+      sandboxMode: agentCwd === input.session.rootPath
+    });
+    const commandPlatform = resolveCommandPlatform(toolCtx);
+    const workspaceSection = buildSessionWorkspaceSection2(input.session, agentCwd, activeTools, fileWorkspaceRoot);
+    const bundledAssets = input.backends || input.sandbox ? null : buildBundledAssetsSection();
+    const assembleBaseSystemPrompt = (facts) => {
+      const sections = [baseSystemPrompt];
+      if (facts) {
+        sections.push(buildRuntimeContextSection(facts, { platform: commandPlatform }));
+      }
+      if (bundledAssets)
+        sections.push(bundledAssets);
+      return sections.join(`
+
+`);
+    };
+    this.toolCtx = toolCtx;
+    this.probesRuntime = activeTools.some((name) => RUNTIME_CAPABLE_TOOL_NAMES.has(name));
+    this.createStream = (facts) => {
+      const baseWithFacts = assembleBaseSystemPrompt(facts);
+      traceWriter.writeInit({
+        model: input.model,
+        systemPrompt: baseWithFacts,
+        activeTools,
+        sessionId: input.session.id,
+        target: input.target
+      });
+      return streamResponse2({
+        prompt: input.prompt,
+        system: baseWithFacts + workspaceSection,
+        model: input.model,
+        messages: input.messages,
+        tools,
+        activeTools,
+        stopWhen,
+        toolChoice: "auto",
+        languageModelMiddleware: input.languageModelMiddleware,
+        usageRecorder: input.usageRecorder,
+        contextRecorder: input.contextRecorder,
+        inferenceRecorder: input.inferenceRecorder,
+        sessionPath: messagesDir,
+        sessionId: this.busSessionId,
+        onStepFinish: async (event) => {
+          const auxiliaryModelEvent = event.response.id === "summarization" || event.response.id === "tool-repair";
+          const stepUsage = normalizeStepUsage2(event);
+          if (auxiliaryModelEvent) {
+            traceWriter.recordStep([], stepUsage, { usageOnly: true });
+            await input.onStepFinish?.(event);
+            return;
+          }
+          const canonical = input.contextRecorder?.latest() ?? [
+            ...initialMessagesRef.current,
+            ...event.response.messages
+          ];
+          this.writer.setLatest(canonical);
+          schedulePersist();
+          traceWriter.recordStep(event.response.messages, stepUsage);
+          this.eventBus.emit("step-finish", {
+            messages: event.response.messages,
+            subagentId: this.subagentId,
+            sessionId: this.busSessionId,
+            messageId: this.currentMessageId ?? undefined
+          });
+          this.currentMessageId = null;
+          await input.onStepFinish?.(event);
+        },
+        onSummarized: () => {
+          initialMessagesRef.current = [];
+          traceWriter.markSummarized();
+        },
+        onFinish: async (event) => {
+          this.writer.cancelTimer();
+          if (!this.writer.syntheticsPersisted) {
+            const finalMessages = input.contextRecorder?.latest() ?? this.writer.latest ?? [
+              ...initialMessagesRef.current,
+              ...event.response.messages
+            ];
+            this.writer.setLatest(finalMessages);
+            await this.writer.enqueueWrite(finalMessages).catch(() => {});
+          }
+          await input.onFinish?.(event);
+        },
+        abortSignal: input.abortSignal,
+        authConfig: input.authConfig,
+        onCacheMetrics: input.onCacheMetrics,
+        enableThinking: input.enableThinking,
+        thinkingEffort: input.thinkingEffort,
+        openAIReasoningEffort: input.openAIReasoningEffort,
+        silent: true
+      });
+    };
+    this.initializeStreamOnce = async () => {
+      if (this._streamResult !== null)
+        return;
+      const facts = this.probesRuntime && !this.abortSignal?.aborted ? await probeRuntimeFacts(toolCtx).catch(() => UNKNOWN_FACTS) : null;
+      if (this._streamResult !== null)
+        return;
+      this._streamResult = this.createStream(facts);
+    };
+  }
+  streamReady() {
+    this.streamInit ??= this.initializeStreamOnce();
+    return this.streamInit;
+  }
+  get streamResult() {
+    if (this._streamResult === null) {
+      const facts = this.probesRuntime ? peekSettledRuntimeFacts(this.toolCtx) ?? UNKNOWN_FACTS : null;
+      this._streamResult = this.createStream(facts);
+    }
+    return this._streamResult;
+  }
+  get fullStream() {
+    if (this._streamResult !== null) {
+      return this._streamResult.fullStream;
+    }
+    const self = this;
+    return async function* () {
+      await self.streamReady();
+      const stream = self._streamResult;
+      if (stream === null) {
+        throw new Error("Stream initialization did not produce a stream");
+      }
+      yield* stream.fullStream;
+    }();
+  }
+  async* [Symbol.asyncIterator]() {
+    await this.streamReady();
+    for await (const chunk of this.streamResult.fullStream) {
+      yield chunk;
+    }
+  }
+  async consume() {
+    const sid = this.subagentId;
+    const bus = this.eventBus;
+    const runConsume = async () => {
+      this.streamStepIndex = -1;
+      this.streamTextPartIndex = 0;
+      const toolParts = new Map;
+      const ids = {
+        subagentId: this.subagentId,
+        sessionId: this.busSessionId,
+        messageId: undefined,
+        textPartId: undefined,
+        toolPartId: (toolCallId) => {
+          let p = toolParts.get(toolCallId);
+          if (!p) {
+            p = this.streamIdFactory?.({ kind: "tool-part", toolCallId }) ?? newPartId2();
+            toolParts.set(toolCallId, p);
+          }
+          return p;
+        }
+      };
+      const tracker = new ToolLifecycleTracker;
+      let streamError;
+      let hasStreamError = false;
+      const diagnostics = new StreamDiagnostics({
+        sessionId: this._session.id,
+        subagentId: sid,
+        inFlightTools: () => tracker.inFlightTools,
+        responseToolFired: () => this._responseToolFired,
+        responseToolName: RESPONSE_TOOL_NAME2
+      });
+      diagnostics.start();
+      try {
+        await this.streamReady();
+        for await (const chunk of this.streamResult.fullStream) {
+          diagnostics.observeChunk(chunk);
+          this.applyStreamPart(chunk, { ids, tracker, diagnostics });
+          bus.emitStreamPart(chunk, ids);
+        }
+      } catch (err) {
+        streamError = this.abortSignal?.aborted && isGenericAbortError(err) ? agentAbortReason(this.abortSignal) : err;
+        hasStreamError = true;
+      } finally {
+        if (!hasStreamError && this.abortSignal?.aborted) {
+          streamError = agentAbortReason(this.abortSignal);
+          hasStreamError = true;
+        }
+        const finalizeError = await this.finalizeRun({
+          tracker,
+          diagnostics,
+          ids,
+          streamError
+        });
+        if (!hasStreamError && finalizeError !== null) {
+          streamError = finalizeError;
+          hasStreamError = true;
+        }
+      }
+      if (hasStreamError) {
+        throw streamError;
+      }
+      if (this.abortSignal?.aborted) {
+        throw agentAbortReason(this.abortSignal);
+      }
+      if (this.resolveResult) {
+        if (this._responseToolFired) {
+          return;
+        }
+        return this.resolveResult(this.streamResult);
+      }
+      return;
+    };
+    const isSubagent = Boolean(sid);
+    const spanLabel = isSubagent ? this.subagentName ?? sid ?? "subagent" : this.agentMode;
+    const rootSessionId = this._session.id;
+    const agentSessionId = this.busSessionId;
+    const runSpanAttributes = {
+      "gen_ai.operation.name": "invoke_agent",
+      "gen_ai.agent.id": agentSessionId,
+      "gen_ai.agent.name": spanLabel,
+      "gen_ai.conversation.id": rootSessionId,
+      "session.id": rootSessionId,
+      "pensar.session.id": agentSessionId,
+      "pensar.root_session.id": rootSessionId,
+      ...!isSubagent ? { "pensar.agent.mode": this.agentMode } : {}
+    };
+    const runInSpan = () => getApexTracer2().startActiveSpan(`invoke_agent ${spanLabel}`, { attributes: runSpanAttributes }, async (span) => {
+      if (!isSubagent)
+        registerActiveRootSpan2(span);
+      const recordRootIO = (!isSubagent || this.agentMode === "fast-strike") && shouldRecordAiPayloads2();
+      if (recordRootIO && this.userPrompt) {
+        span.setAttribute("gen_ai.prompt", this.userPrompt);
+      }
+      try {
+        const result = await runConsume();
+        const completedResult = result === undefined && this._responseToolFired ? this._responseToolResult : result;
+        if (recordRootIO && completedResult !== undefined && completedResult !== null) {
+          span.setAttribute("gen_ai.completion", safePreview(completedResult));
+        }
+        return result;
+      } catch (err) {
+        span.recordException(err);
+        span.setStatus({ code: SpanStatusCode.ERROR });
+        span.setAttribute("error.type", err instanceof Error ? err.name : "Error");
+        if (recordRootIO) {
+          span.setAttribute("gen_ai.completion", this._responseToolFired ? safePreview(this._responseToolResult) : `Failure: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        throw err;
+      } finally {
+        unregisterActiveRootSpan2(span);
+        if (span.isRecording())
+          span.end();
+      }
+    });
+    const drain = !isSubagent ? runInSpan() : withSubagentSessionBaggage2(sid, runInSpan);
+    let rejectDrain;
+    this._drainRejection = new Promise((_, reject) => {
+      rejectDrain = reject;
+    });
+    this._drainRejection.catch(() => {});
+    this.drained = drain.then(() => {}, () => {});
+    const guardedDrain = drain.then((result) => {
+      if (this._responseToolFired) {
+        rejectDrain?.(new Error("drain resolved"));
+        return this.responseCaptured;
+      }
+      return result;
+    }).catch((err) => {
+      rejectDrain?.(err);
+      if (!this._responseToolFired)
+        throw err;
+      return this.responseCaptured;
+    });
+    guardedDrain.catch(() => {});
+    const result = await Promise.race([guardedDrain, this.responseCaptured]);
+    await this.disconnectOwnedBrowser();
+    return result;
+  }
+  applyStreamPart(chunk, ctx) {
+    const { ids, tracker, diagnostics } = ctx;
+    const sid = this.subagentId;
+    const bus = this.eventBus;
+    switch (chunk.type) {
+      case "start-step":
+        this.streamStepIndex++;
+        this.streamTextPartIndex = 0;
+        ids.messageId = this.streamIdFactory?.({
+          kind: "message",
+          stepIndex: this.streamStepIndex
+        }) ?? newMessageId2();
+        this.currentMessageId = ids.messageId;
+        ids.textPartId = undefined;
+        break;
+      case "text-start":
+        ids.textPartId = this.streamIdFactory?.({
+          kind: "text-part",
+          stepIndex: this.streamStepIndex,
+          textPartIndex: this.streamTextPartIndex
+        }) ?? newPartId2();
+        this.streamTextPartIndex++;
+        break;
+      case "text-end":
+        ids.textPartId = undefined;
+        break;
+      case "finish-step": {
+        tracker.onStepPersisted();
+        const finishReason = chunk.finishReason;
+        const truncated = finishReason === "length";
+        for (const [toolCallId, info] of tracker.toolErrors) {
+          diagnostics.logSurfacedToolError({
+            toolCallId,
+            toolName: info.toolName,
+            message: info.message,
+            streamedArgChars: (tracker.streamedArgText.get(toolCallId) ?? "").length,
+            finishReason,
+            truncated
+          });
+          bus.emit("tool-result", {
+            toolCallId,
+            toolName: info.toolName,
+            result: {
+              type: "error-text",
+              value: truncated ? `Tool call failed: the model's output was truncated at its max output tokens before the "${info.toolName}" arguments were complete. ${info.message}` : `Tool call failed: ${info.message}`
+            },
+            sessionId: this.busSessionId,
+            subagentId: sid,
+            partId: ids.toolPartId?.(toolCallId),
+            messageId: ids.messageId
+          });
+        }
+        tracker.clearToolErrors();
+        for (const [toolCallId, toolName] of tracker.inFlightTools) {
+          diagnostics.logClosingInFlightTool({
+            toolCallId,
+            toolName,
+            finishReason,
+            truncated
+          });
+          const result = toolName === RESPONSE_TOOL_NAME2 && this._responseToolFired ? { type: "text", value: "Response submitted." } : {
+            type: "error-text",
+            value: truncated ? "Tool call did not complete: the model's output was truncated at its max output tokens before the arguments were finalized." : "Tool call did not complete"
+          };
+          bus.emit("tool-result", {
+            toolCallId,
+            toolName,
+            result,
+            sessionId: this.busSessionId,
+            subagentId: sid,
+            partId: ids.toolPartId?.(toolCallId),
+            messageId: ids.messageId
+          });
+        }
+        tracker.clearInFlight();
+        break;
+      }
+      default:
+        tracker.observePart(chunk);
+    }
+  }
+  async finalizeRun(input) {
+    const { tracker, diagnostics, ids, streamError } = input;
+    const sid = this.subagentId;
+    const bus = this.eventBus;
+    diagnostics.stop();
+    let finalizationError;
+    let hasFinalizationError = false;
+    const recordFinalizationError = (error) => {
+      if (hasFinalizationError)
+        return;
+      finalizationError = error;
+      hasFinalizationError = true;
+    };
+    try {
+      try {
+        await this.disposeOwnedShell();
+      } catch (error) {
+        recordFinalizationError(error);
+      }
+      try {
+        const outcomes = await this.callbackListeners.stopAll();
+        const failed = outcomes.find((o) => o.error);
+        if (failed) {
+          recordFinalizationError(new Error(`callback listener cleanup failed for ${failed.jobId}: ${failed.error}`));
+        }
+      } catch (error) {
+        recordFinalizationError(error);
+      }
+      if (this.contextRecorder) {
+        try {
+          await this.contextRecorder.flush();
+        } catch (error) {
+          recordFinalizationError(error);
+        }
+      }
+      for (const [toolCallId, info] of tracker.flushToolErrorsToResults()) {
+        const result = {
+          type: "error-text",
+          value: `Tool call failed: ${info.message}`
+        };
+        try {
+          bus.emit("tool-result", {
+            toolCallId,
+            toolName: info.toolName,
+            result,
+            sessionId: this.busSessionId,
+            subagentId: sid,
+            partId: ids.toolPartId?.(toolCallId),
+            messageId: ids.messageId
+          });
+        } catch (error) {
+          recordFinalizationError(error);
+        }
+      }
+      if (tracker.hasUnpersistedState()) {
+        const failure = streamError ?? (this.abortSignal?.aborted ? agentAbortReason(this.abortSignal) : undefined);
+        const reason = failure instanceof Error && failure.message ? failure.message : failure !== undefined ? String(failure) : "Stream terminated unexpectedly";
+        try {
+          await this.finalizeInterruptedStep({
+            snapshot: tracker.snapshot(),
+            reason,
+            partIdFor: ids.toolPartId,
+            messageId: ids.messageId
+          });
+        } catch (error) {
+          recordFinalizationError(error);
+        }
+      }
+    } catch (error) {
+      recordFinalizationError(error);
+    } finally {
+      await this.disconnectOwnedBrowser();
+    }
+    return hasFinalizationError ? finalizationError : null;
+  }
+  disposeOwnedShell() {
+    if (this.shellDisposed) {
+      return this.shellDisposeBarrier ?? Promise.resolve();
+    }
+    this.shellDisposed = true;
+    this.shellDisposeBarrier = this.commandShell?.dispose() ?? Promise.resolve();
+    return this.shellDisposeBarrier;
+  }
+  async disconnectOwnedBrowser() {
+    if (this.browserDisconnected)
+      return;
+    if (!this.ownsBrowserSession || !this.browserSession)
+      return;
+    this.browserDisconnected = true;
+    await this.browserSession.disconnect().catch(() => {});
+  }
+  async abortAndDrain() {
+    await this.disconnectOwnedBrowser();
+    await this.disposeOwnedShell().catch(() => {});
+    await this.callbackListeners.stopAll().catch(() => {});
+    await this.drained.catch(() => {});
+  }
+  get response() {
+    return this.streamReady().then(() => this.streamResult.response);
+  }
+}
+var AGENT_PAUSE_TOOLS = new Set([ASK_USER_QUESTIONS_TOOL_NAME2]);
+function wrapToolsWithApprovalGate(tools, gate, exemptToolNames) {
+  const wrapped = {};
+  for (const [name, coreTool] of Object.entries(tools)) {
+    if (exemptToolNames?.has(name)) {
+      wrapped[name] = coreTool;
+      continue;
+    }
+    const t = coreTool;
+    if (!t.execute) {
+      wrapped[name] = coreTool;
+      continue;
+    }
+    const originalExecute = t.execute;
+    wrapped[name] = {
+      ...t,
+      execute: async (args, options) => {
+        const toolCallId = args.toolCallId ?? `tc_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+        log.debug(`${name} (${toolCallId}): checking`);
+        try {
+          await gate.check(name, String(toolCallId), args);
+        } catch (err) {
+          if (err instanceof ApprovalDeniedError) {
+            log.debug(`${name} (${toolCallId}): denied`);
+            return { blocked: true, reason: "Denied by operator" };
+          }
+          throw err;
+        }
+        log.debug(`${name} (${toolCallId}): approved, executing`);
+        const result = await originalExecute(args, options);
+        log.debug(`${name} (${toolCallId}): execute finished`);
+        return result;
+      }
+    };
+  }
+  return wrapped;
+}
+function safePreview(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === undefined ? String(value) : text.slice(0, 2000);
+  } catch {
+    return "[unserializable result]";
+  }
+}
+export { buildProvidedFilesSection2, buildSessionWorkspaceSection2, buildBaseSystemPrompt2, BASE_SYSTEM_PROMPT2, StepTraceWriter2, OffensiveSecurityAgent2, exports_offSecAgent };