@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/build/cli.js

@@ -1,51 +1,60 @@
 #!/usr/bin/env bun
 // @bun
+import"./cli-pckpvwbd.js";
+import"./cli-nmg32cfd.js";
 import {
+  require_src,
+  require_src2,
+  require_src3,
+  require_src4,
   require_index_node_http,
+  require_src5,
   require_index_shim,
-  require_src as require_src2,
-  require_src1 as require_src3,
-  require_src2 as require_src4,
-  require_src3 as require_src5,
-  require_src4 as require_src6
-} from "./cli-68260ckj.js";
-import"./cli-dm0fc0bm.js";
+  ActiveSpanProcessor
+} from "./cli-91gs9whc.js";
 import {
   createThreatModelPrompt
-} from "./cli-fw5r7pfj.js";
-import"./cli-c8131c4q.js";
+} from "./cli-q126f6ef.js";
 import {
-  buildAuthConfig,
   endAllActiveRootSpans,
   init_active_root_spans,
-  init_ai1 as init_ai,
   init_model_history,
   init_models,
+  buildAuthConfig,
+  init_utils,
   init_session,
+  createLogger,
+  logger,
   init_structured,
-  init_toolset,
-  init_utils,
-  logger
-} from "./cli-p4r7q012.js";
-import"./cli-kff2bbq7.js";
-import"./cli-avmhkjtv.js";
-import"./cli-j54qa6tm.js";
-import"./cli-7s062hr6.js";
-import"./cli-ww7hbazg.js";
+  init_ai2
+} from "./cli-c0ha5wh1.js";
+import {
+  init_inference_attempt,
+  init_native_rollout_evidence
+} from "./cli-se8ae8z3.js";
+import"./cli-c2k4xxaw.js";
+import {
+  parseCustomModelId,
+  resolveCustomModel,
+  resolveCustomApiKey,
+  init_customProviders,
+  resolveHoonifyModel,
+  init_hoonify
+} from "./cli-5ppxe6qz.js";
 import {
-  init_installation,
   init_package,
+  version,
   package_default,
-  version
-} from "./cli-g3czc3jz.js";
+  init_installation
+} from "./cli-v9rrvh12.js";
 import {
-  require_src
-} from "./cli-knd276ed.js";
+  require_src6
+} from "./cli-bb02pjt0.js";
 import {
+  __toESM,
   __commonJS,
-  __require,
-  __toESM
-} from "./cli-bc05qbss.js";
+  __require
+} from "./cli-h6y3bt60.js";
 
 // node_modules/dotenv/lib/main.js
 var require_main = __commonJS(function(exports, module) {
@@ -244,13 +253,13 @@ var require_main = __commonJS(function(exports, module) {
     }
     let lastError;
     const parsedAll = {};
-    for (const path2 of optionPaths) {
+    for (const path of optionPaths) {
       try {
-        const parsed = DotenvModule.parse(fs.readFileSync(path2, { encoding }));
+        const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }));
         DotenvModule.populate(parsedAll, parsed, options);
       } catch (e) {
         if (debug) {
-          _debug(`failed to load ${path2} ${e.message}`);
+          _debug(`failed to load ${path} ${e.message}`);
         }
         lastError = e;
       }
@@ -263,8 +272,8 @@ var require_main = __commonJS(function(exports, module) {
       const shortPaths = [];
       for (const filePath of optionPaths) {
         try {
-          const relative = path.relative(process.cwd(), filePath);
-          shortPaths.push(relative);
+          const relative2 = path.relative(process.cwd(), filePath);
+          shortPaths.push(relative2);
         } catch (e) {
           if (debug) {
             _debug(`failed to load ${filePath} ${e.message}`);
@@ -368,6 +377,7 @@ var require_main = __commonJS(function(exports, module) {
 
 // src/cli.ts
 var import_dotenv = __toESM(require_main(), 1);
+import { resolve as resolve2 } from "path";
 // package.json
 var package_default2 = {
   author: "Pensar",
@@ -375,13 +385,15 @@ var package_default2 = {
     pensar: "./bin/pensar.js"
   },
   dependencies: {
-    "@ai-sdk/amazon-bedrock": "^4.0.119",
+    "@ai-sdk/amazon-bedrock": "4.0.119",
     "@ai-sdk/anthropic": "^3.0.85",
     "@ai-sdk/google": "^3.0.83",
     "@ai-sdk/openai": "3.0.46",
     "@ai-sdk/openai-compatible": "^2.0.51",
     "@ai-sdk/provider": "^3.0.10",
-    "@daytonaio/sdk": "^0.112.3",
+    "@aws-sdk/client-s3": "3.1146.0",
+    "@aws-sdk/lib-storage": "3.1146.0",
+    "@daytona/sdk": "0.222.0",
     "@googleapis/gmail": "^16.1.2",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -393,7 +405,7 @@ var package_default2 = {
     "@opentelemetry/resources": "^2.10.0",
     "@opentui/core": "^0.1.107",
     "@opentui/react": "^0.1.107",
-    "@pensar/surface": "0.3.0",
+    "@pensar/surface": "0.3.1",
     "@playwright/mcp": "^0.0.54",
     ai: "^6.0.208",
     "camoufox-js": "^0.11.1",
@@ -408,6 +420,7 @@ var package_default2 = {
     react: "^19.2.7",
     sharp: "^0.34.5",
     tldts: "^7.4.3",
+    undici: "^6",
     yaml: "^2.9.0",
     zod: "^4.4.3"
   },
@@ -430,8 +443,226 @@ var package_default2 = {
     bun: ">=1.0.0",
     node: ">=18.0.0"
   },
+  exports: {
+    ".": {
+      default: "./build/lib/index.js",
+      import: "./build/lib/index.js",
+      types: "./build/lib/index.d.ts"
+    },
+    "./agents/offSecAgent": {
+      default: "./build/lib/core/agents/offSecAgent/index.js",
+      import: "./build/lib/core/agents/offSecAgent/index.js",
+      types: "./build/lib/core/agents/offSecAgent/index.d.ts"
+    },
+    "./agents/offSecAgent/tools": {
+      default: "./build/lib/core/agents/offSecAgent/tools/index.js",
+      import: "./build/lib/core/agents/offSecAgent/tools/index.js",
+      types: "./build/lib/core/agents/offSecAgent/tools/index.d.ts"
+    },
+    "./agents/offSecAgent/tools/email/adapters": {
+      default: "./build/lib/core/agents/offSecAgent/tools/email/adapters.js",
+      import: "./build/lib/core/agents/offSecAgent/tools/email/adapters.js",
+      types: "./build/lib/core/agents/offSecAgent/tools/email/adapters.d.ts"
+    },
+    "./agents/offSecAgent/tools/email/types": {
+      default: "./build/lib/core/agents/offSecAgent/tools/email/types.js",
+      import: "./build/lib/core/agents/offSecAgent/tools/email/types.js",
+      types: "./build/lib/core/agents/offSecAgent/tools/email/types.d.ts"
+    },
+    "./agents/offSecAgent/tools/smsInbox": {
+      default: "./build/lib/core/agents/offSecAgent/tools/smsInbox.js",
+      import: "./build/lib/core/agents/offSecAgent/tools/smsInbox.js",
+      types: "./build/lib/core/agents/offSecAgent/tools/smsInbox.d.ts"
+    },
+    "./agents/offSecAgent/types": {
+      default: "./build/lib/core/agents/offSecAgent/types.js",
+      import: "./build/lib/core/agents/offSecAgent/types.js",
+      types: "./build/lib/core/agents/offSecAgent/types.d.ts"
+    },
+    "./agents/specialized/attackSurface/blackboxAgent": {
+      default: "./build/lib/core/agents/specialized/attackSurface/blackboxAgent.js",
+      import: "./build/lib/core/agents/specialized/attackSurface/blackboxAgent.js",
+      types: "./build/lib/core/agents/specialized/attackSurface/blackboxAgent.d.ts"
+    },
+    "./agents/specialized/attackSurface/schemas": {
+      default: "./build/lib/core/agents/specialized/attackSurface/schemas.js",
+      import: "./build/lib/core/agents/specialized/attackSurface/schemas.js",
+      types: "./build/lib/core/agents/specialized/attackSurface/schemas.d.ts"
+    },
+    "./agents/specialized/authenticationAgent": {
+      default: "./build/lib/core/agents/specialized/authenticationAgent/index.js",
+      import: "./build/lib/core/agents/specialized/authenticationAgent/index.js",
+      types: "./build/lib/core/agents/specialized/authenticationAgent/index.d.ts"
+    },
+    "./agents/specialized/codeAgent/agent": {
+      default: "./build/lib/core/agents/specialized/codeAgent/agent.js",
+      import: "./build/lib/core/agents/specialized/codeAgent/agent.js",
+      types: "./build/lib/core/agents/specialized/codeAgent/agent.d.ts"
+    },
+    "./agents/specialized/codeAgent/schemas": {
+      default: "./build/lib/core/agents/specialized/codeAgent/schemas.js",
+      import: "./build/lib/core/agents/specialized/codeAgent/schemas.js",
+      types: "./build/lib/core/agents/specialized/codeAgent/schemas.d.ts"
+    },
+    "./agents/specialized/findingJudge": {
+      default: "./build/lib/core/agents/specialized/findingJudge/index.js",
+      import: "./build/lib/core/agents/specialized/findingJudge/index.js",
+      types: "./build/lib/core/agents/specialized/findingJudge/index.d.ts"
+    },
+    "./agents/specialized/findingJudge/agent": {
+      default: "./build/lib/core/agents/specialized/findingJudge/agent.js",
+      import: "./build/lib/core/agents/specialized/findingJudge/agent.js",
+      types: "./build/lib/core/agents/specialized/findingJudge/agent.d.ts"
+    },
+    "./agents/specialized/patching": {
+      default: "./build/lib/core/agents/specialized/patching/index.js",
+      import: "./build/lib/core/agents/specialized/patching/index.js",
+      types: "./build/lib/core/agents/specialized/patching/index.d.ts"
+    },
+    "./agents/specialized/pentest/agent": {
+      default: "./build/lib/core/agents/specialized/pentest/agent.js",
+      import: "./build/lib/core/agents/specialized/pentest/agent.js",
+      types: "./build/lib/core/agents/specialized/pentest/agent.d.ts"
+    },
+    "./agents/specialized/whiteboxAttackSurface": {
+      default: "./build/lib/core/agents/specialized/whiteboxAttackSurface/index.js",
+      import: "./build/lib/core/agents/specialized/whiteboxAttackSurface/index.js",
+      types: "./build/lib/core/agents/specialized/whiteboxAttackSurface/index.d.ts"
+    },
+    "./agents/specialized/whiteboxAttackSurface/types": {
+      default: "./build/lib/core/agents/specialized/whiteboxAttackSurface/types.js",
+      import: "./build/lib/core/agents/specialized/whiteboxAttackSurface/types.js",
+      types: "./build/lib/core/agents/specialized/whiteboxAttackSurface/types.d.ts"
+    },
+    "./api/targetedPentest": {
+      default: "./build/lib/core/api/targetedPentest.js",
+      import: "./build/lib/core/api/targetedPentest.js",
+      types: "./build/lib/core/api/targetedPentest.d.ts"
+    },
+    "./core/ai": {
+      default: "./build/lib/core/ai/index.js",
+      import: "./build/lib/core/ai/index.js",
+      types: "./build/lib/core/ai/index.d.ts"
+    },
+    "./core/ai/ai": {
+      default: "./build/lib/core/ai/ai.js",
+      import: "./build/lib/core/ai/ai.js",
+      types: "./build/lib/core/ai/ai.d.ts"
+    },
+    "./core/ai/utils": {
+      default: "./build/lib/core/ai/utils.js",
+      import: "./build/lib/core/ai/utils.js",
+      types: "./build/lib/core/ai/utils.d.ts"
+    },
+    "./core/api": {
+      default: "./build/lib/core/api/index.js",
+      import: "./build/lib/core/api/index.js",
+      types: "./build/lib/core/api/index.d.ts"
+    },
+    "./core/config": {
+      default: "./build/lib/core/config/index.js",
+      import: "./build/lib/core/config/index.js",
+      types: "./build/lib/core/config/index.d.ts"
+    },
+    "./core/eventBus": {
+      default: "./build/lib/core/eventBus.js",
+      import: "./build/lib/core/eventBus.js",
+      types: "./build/lib/core/eventBus.d.ts"
+    },
+    "./core/id": {
+      default: "./build/lib/core/id/id.js",
+      import: "./build/lib/core/id/id.js",
+      types: "./build/lib/core/id/id.d.ts"
+    },
+    "./core/memory": {
+      default: "./build/lib/core/memory/index.js",
+      import: "./build/lib/core/memory/index.js",
+      types: "./build/lib/core/memory/index.d.ts"
+    },
+    "./core/observability": {
+      default: "./build/lib/core/observability/index.js",
+      import: "./build/lib/core/observability/index.js",
+      types: "./build/lib/core/observability/index.d.ts"
+    },
+    "./core/prompt-injections": {
+      default: "./build/lib/core/prompt-injections/index.js",
+      import: "./build/lib/core/prompt-injections/index.js",
+      types: "./build/lib/core/prompt-injections/index.d.ts"
+    },
+    "./core/session": {
+      default: "./build/lib/core/session/index.js",
+      import: "./build/lib/core/session/index.js",
+      types: "./build/lib/core/session/index.d.ts"
+    },
+    "./core/session/persistence": {
+      default: "./build/lib/core/session/persistence.js",
+      import: "./build/lib/core/session/persistence.js",
+      types: "./build/lib/core/session/persistence.d.ts"
+    },
+    "./findings/attackSurfaceRegistry": {
+      default: "./build/lib/core/findings/attackSurfaceRegistry.js",
+      import: "./build/lib/core/findings/attackSurfaceRegistry.js",
+      types: "./build/lib/core/findings/attackSurfaceRegistry.d.ts"
+    },
+    "./findings/registry": {
+      default: "./build/lib/core/findings/registry.js",
+      import: "./build/lib/core/findings/registry.js",
+      types: "./build/lib/core/findings/registry.d.ts"
+    },
+    "./lib/cvss": {
+      default: "./build/lib/lib/cvss/index.js",
+      import: "./build/lib/lib/cvss/index.js",
+      types: "./build/lib/lib/cvss/index.d.ts"
+    },
+    "./lib/cvss/types": {
+      default: "./build/lib/lib/cvss/types.js",
+      import: "./build/lib/lib/cvss/types.js",
+      types: "./build/lib/lib/cvss/types.d.ts"
+    },
+    "./package.json": "./package.json",
+    "./src/*": "./src/*.ts",
+    "./src/core/agents/offSecAgent": "./src/core/agents/offSecAgent/index.ts",
+    "./src/core/agents/offSecAgent/tools": "./src/core/agents/offSecAgent/tools/index.ts",
+    "./src/core/agents/specialized/authenticationAgent": "./src/core/agents/specialized/authenticationAgent/index.ts",
+    "./src/core/agents/specialized/findingJudge": "./src/core/agents/specialized/findingJudge/index.ts",
+    "./src/core/agents/specialized/patching": "./src/core/agents/specialized/patching/index.ts",
+    "./src/core/agents/specialized/whiteboxAttackSurface": "./src/core/agents/specialized/whiteboxAttackSurface/index.ts",
+    "./src/core/ai": "./src/core/ai/index.ts",
+    "./src/core/api": "./src/core/api/index.ts",
+    "./src/core/memory": "./src/core/memory/index.ts",
+    "./src/core/observability": "./src/core/observability/index.ts",
+    "./src/core/prompt-injections": "./src/core/prompt-injections/index.ts",
+    "./src/core/session": "./src/core/session/index.ts",
+    "./src/lib/cvss": "./src/lib/cvss/index.ts",
+    "./subagentSpawner": {
+      default: "./build/lib/core/agents/offSecAgent/subagentSpawner.js",
+      import: "./build/lib/core/agents/offSecAgent/subagentSpawner.js",
+      types: "./build/lib/core/agents/offSecAgent/subagentSpawner.d.ts"
+    },
+    "./tools/backends": {
+      default: "./build/lib/core/tools/backends/index.js",
+      import: "./build/lib/core/tools/backends/index.js",
+      types: "./build/lib/core/tools/backends/index.d.ts"
+    },
+    "./workflows/pentest": {
+      default: "./build/lib/core/workflows/pentest.js",
+      import: "./build/lib/core/workflows/pentest.js",
+      types: "./build/lib/core/workflows/pentest.d.ts"
+    },
+    "./workflows/seams": {
+      default: "./build/lib/core/workflows/seams.js",
+      import: "./build/lib/core/workflows/seams.js",
+      types: "./build/lib/core/workflows/seams.d.ts"
+    },
+    "./workflows/whiteboxAttackSurface": {
+      default: "./build/lib/core/workflows/whiteboxAttackSurface.js",
+      import: "./build/lib/core/workflows/whiteboxAttackSurface.js",
+      types: "./build/lib/core/workflows/whiteboxAttackSurface.d.ts"
+    }
+  },
   files: [
     "build",
+    "src",
     "bin",
     "assets",
     "pensar.svg",
@@ -469,6 +700,7 @@ var package_default2 = {
     "build:binary:linux-x64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
     "build:binary:macos-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
     "build:binary:macos-x64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
+    "build:lib": "bun run scripts/build-lib.ts",
     check: "biome check --write",
     "check:ci": "biome check",
     "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
@@ -483,20 +715,25 @@ var package_default2 = {
     "lint:fix": "biome lint --write src/",
     "local-benchmark": "bun run scripts/local-benchmark.ts",
     pensar: "node bin/pensar.js",
-    prepublishOnly: "npm run build",
+    "perf:tui": "bun --no-env-file scripts/tui-performance.ts",
+    prepublishOnly: "npm run build && npm run build:lib",
     start: "bun run src/tui/index.tsx",
     test: "vitest run",
+    "test:lib-exports": "bun run scripts/verify-lib-exports.ts",
+    "test:tui": "bun --no-env-file test scripts/tui-performance/",
     "test:watch": "vitest",
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.5.0"
+  version: "2.6.1-canary.0cc77dcc"
 };
 
 // src/core/ai/index.ts
-init_ai();
+init_ai2();
+init_inference_attempt();
 init_model_history();
 init_models();
+init_native_rollout_evidence();
 init_utils();
 
 // src/core/api/clientIdentity.ts
@@ -552,6 +789,28 @@ function resolveCliLogLevel(argv) {
   return { level: logLevelValue ?? shorthandLevel, invalid };
 }
 
+// src/core/cli/model.ts
+init_customProviders();
+init_hoonify();
+function resolveExplicitCliModel(options) {
+  const { model, provider, customProviders } = options;
+  if (provider && !model)
+    throw new Error("--model-provider requires --model.");
+  if (!model)
+    return;
+  const id = provider === "hoonify" ? `hoonify:${model}` : provider ? `custom:${provider}:${model}` : model;
+  if (id.startsWith("hoonify:")) {
+    if (options.hoonifyCatalogError)
+      throw new Error(options.hoonifyCatalogError);
+    resolveHoonifyModel(id, options.hoonifyModels);
+  }
+  if (parseCustomModelId(id)) {
+    const resolved = resolveCustomModel(id, customProviders);
+    resolveCustomApiKey(resolved.provider);
+  }
+  return id;
+}
+
 // src/core/cli/pentestMode.ts
 var SUPPORTED_PENTEST_MODES = ["exfil"];
 function resolvePentestMode(mode) {
@@ -567,6 +826,26 @@ function resolvePentestMode(mode) {
   };
 }
 
+// src/core/cli/tuiArgs.ts
+function parseTuiArgs(args) {
+  if (args.length === 0)
+    return {};
+  if (args[0] !== "--resume") {
+    throw new Error("Use pensar --resume <session-id> [--model <model>].");
+  }
+  const sessionId = args[1];
+  if (!sessionId || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(sessionId)) {
+    throw new Error("--resume requires a saved session ID.");
+  }
+  if (args.length === 2)
+    return { sessionId };
+  const modelId = args[3];
+  if (args.length !== 4 || args[2] !== "--model" || !modelId?.trim() || modelId.startsWith("-")) {
+    throw new Error("Use pensar --resume <session-id> [--model <model>].");
+  }
+  return { sessionId, modelId };
+}
+
 // src/core/eventBus.ts
 import { EventEmitter } from "node:events";
 var CHILD_BUS_FORWARD_POLICY = {
@@ -627,12 +906,12 @@ class AgentEventBus {
         const p = payload;
         const isLifecycle = forwardKey === "subagent-spawn" || forwardKey === "subagent-complete";
         if (isLifecycle) {
-          const next2 = { ...p };
+          const next = { ...p };
           if (!p.parentSubagentId)
-            next2.parentSubagentId = childSessionId;
+            next.parentSubagentId = childSessionId;
           if (!p.parentSessionId)
-            next2.parentSessionId = childSessionId;
-          parent.emit(forwardKey, next2);
+            next.parentSessionId = childSessionId;
+          parent.emit(forwardKey, next);
           return;
         }
         const next = { ...p };
@@ -732,7 +1011,7 @@ class AgentEventBus {
 // src/core/installation/index.ts
 init_package();
 import { spawnSync } from "node:child_process";
-function getCurrentVersion2() {
+function getCurrentVersion() {
   return package_default.version;
 }
 function isNewerVersion(current, latest) {
@@ -797,7 +1076,7 @@ function getUpgradeCommandString(method) {
   return `${cmd} ${args.join(" ")}`;
 }
 function runUpgrade(method, options) {
-  const currentVersion = getCurrentVersion2();
+  const currentVersion = getCurrentVersion();
   const { cmd, args } = getUpgradeCommand(method);
   const interactive = options?.interactive ?? false;
   const result = spawnSync(cmd, args, {
@@ -822,7 +1101,7 @@ function runUpgrade(method, options) {
   };
 }
 async function upgrade(options) {
-  const currentVersion = getCurrentVersion2();
+  const currentVersion = getCurrentVersion();
   let latestVersion;
   try {
     latestVersion = await getLatestVersion();
@@ -861,6 +1140,147 @@ You can upgrade manually by running:
   };
 }
 
+// src/core/integrations/herdr.ts
+import { spawn } from "node:child_process";
+var SOURCE = "pensar-apex";
+var AGENT = "apex";
+var REPORT_TIMEOUT_MS = 1000;
+var INVALID_RESUME_CHARACTER = /['\p{Cc}]/u;
+var sequence = 0;
+function nextSequence() {
+  sequence = Math.max(sequence + 1, Date.now() * 1000);
+  return String(sequence);
+}
+function validResumeArgv(argv) {
+  return argv.length > 0 && argv.length <= 64 && /^[a-zA-Z0-9_.][a-zA-Z0-9_.-]*$/.test(argv[0]) && argv.every((arg) => !INVALID_RESUME_CHARACTER.test(arg)) && argv.reduce((bytes, arg) => bytes + Buffer.byteLength(arg), 0) <= 8192;
+}
+function createHerdrReporter(env = process.env) {
+  const binary = env.HERDR_BIN_PATH;
+  const pane = env.HERDR_PANE_ID;
+  if (env.HERDR_ENV !== "1" || !binary || !pane || !env.HERDR_SOCKET_PATH) {
+    return { report(_report) {}, async release() {} };
+  }
+  const childEnv = { ...env };
+  let pending;
+  let active;
+  let releasePromise;
+  let lastSentKey;
+  let reportStarted = false;
+  let closing = false;
+  let supportsResume = true;
+  function run(args) {
+    return new Promise((resolve) => {
+      try {
+        const child = spawn(binary, args, {
+          env: childEnv,
+          stdio: "ignore",
+          windowsHide: true
+        });
+        let settled = false;
+        const finish = (code) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          resolve(code);
+        };
+        const timer = setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {}
+          child.unref();
+          finish(null);
+        }, REPORT_TIMEOUT_MS);
+        child.once("spawn", () => {
+          reportStarted = true;
+        });
+        child.once("error", () => finish(null));
+        child.once("close", (code) => finish(code));
+      } catch {
+        resolve(null);
+      }
+    });
+  }
+  function argsFor(command) {
+    return [
+      "pane",
+      command,
+      pane,
+      "--source",
+      SOURCE,
+      "--agent",
+      AGENT,
+      "--seq",
+      nextSequence()
+    ];
+  }
+  async function send(report) {
+    const args = argsFor("report-agent");
+    args.push("--state", report.state);
+    if (report.message && !report.message.includes("\x00")) {
+      args.push("--message", report.message);
+    }
+    const session = report.session;
+    if (session?.id && !INVALID_RESUME_CHARACTER.test(session.id)) {
+      args.push("--agent-session-id", session.id);
+    }
+    const withResume = supportsResume && session && validResumeArgv(session.resumeArgv);
+    const code = await run(withResume ? [...args, "--", ...session.resumeArgv] : args);
+    if (code !== 2 || !withResume)
+      return code;
+    supportsResume = false;
+    if (closing || pending)
+      return code;
+    return send(report);
+  }
+  function drain() {
+    if (active || closing)
+      return;
+    active = (async () => {
+      while (pending && !closing) {
+        const report = pending;
+        pending = undefined;
+        const key = JSON.stringify(report);
+        if (key === lastSentKey)
+          continue;
+        if (await send(report) === 0)
+          lastSentKey = key;
+      }
+    })().finally(() => {
+      active = undefined;
+      if (pending && !closing)
+        drain();
+    });
+  }
+  return {
+    report(report) {
+      if (closing)
+        return;
+      pending = {
+        state: report.state,
+        message: report.message,
+        session: report.session ? {
+          id: report.session.id,
+          resumeArgv: [...report.session.resumeArgv]
+        } : undefined
+      };
+      drain();
+    },
+    release() {
+      if (releasePromise)
+        return releasePromise;
+      closing = true;
+      pending = undefined;
+      releasePromise = (async () => {
+        await active;
+        if (reportStarted)
+          await run(argsFor("release-agent"));
+      })();
+      return releasePromise;
+    }
+  };
+}
+
 // src/core/logger/index.ts
 init_session();
 init_structured();
@@ -871,14 +1291,15 @@ var ERROR_LOG_PATH = path.join(os.homedir(), ".pensar", "error.log");
 
 // src/core/observability/runtime.ts
 init_package();
+init_structured();
 init_active_root_spans();
-var import_api = __toESM(require_src(), 1);
-var import_context_async_hooks = __toESM(require_src2(), 1);
-var import_exporter_trace_otlp_http = __toESM(require_src6(), 1);
-var import_otlp_exporter_base = __toESM(require_src3(), 1);
+var import_api = __toESM(require_src6(), 1);
+var import_context_async_hooks = __toESM(require_src(), 1);
+var import_exporter_trace_otlp_http = __toESM(require_src5(), 1);
+var import_otlp_exporter_base = __toESM(require_src2(), 1);
 var import_node_http = __toESM(require_index_node_http(), 1);
-var import_otlp_transformer = __toESM(require_src5(), 1);
-var import_resources = __toESM(require_src4(), 1);
+var import_otlp_transformer = __toESM(require_src4(), 1);
+var import_resources = __toESM(require_src3(), 1);
 var import_sdk_trace_base = __toESM(require_index_shim(), 1);
 import { randomUUID } from "node:crypto";
 var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5000;
@@ -896,6 +1317,7 @@ function withTimeout(promise, timeoutMs) {
     promise.then(() => settle("completed"), () => settle("completed"));
   });
 }
+var log = createLogger("observability");
 var NOOP_RUNTIME = {
   async forceFlush() {},
   async shutdown() {
@@ -961,14 +1383,27 @@ function startObservabilityRuntime(env = process.env, opts) {
     return NOOP_RUNTIME;
   const shutdownTimeoutMs = opts?.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
   const exporter = createTraceExporter(resolveTracesProtocol(env));
+  const activeSpans = new ActiveSpanProcessor;
   const provider = new import_sdk_trace_base.BasicTracerProvider({
     resource: buildResource(env),
-    spanProcessors: opts?.spanProcessors ?? [new import_sdk_trace_base.BatchSpanProcessor(exporter)]
+    spanProcessors: [
+      activeSpans,
+      ...opts?.spanProcessors ?? [new import_sdk_trace_base.BatchSpanProcessor(exporter)]
+    ]
   });
   const contextManager = new import_context_async_hooks.AsyncLocalStorageContextManager;
   contextManager.enable();
-  import_api.trace.setGlobalTracerProvider(provider);
-  import_api.context.setGlobalContextManager(contextManager);
+  const ownsTracerGlobal = import_api.trace.setGlobalTracerProvider(provider);
+  if (!ownsTracerGlobal) {
+    log.warn("OTel tracer provider already registered by the host — Apex stays embedded and will not register its own");
+    contextManager.disable();
+    provider.shutdown().catch((error) => log.warn("Orphaned provider shutdown failed", { error: String(error) }));
+    return NOOP_RUNTIME;
+  }
+  const ownsContextGlobal = import_api.context.setGlobalContextManager(contextManager);
+  if (!ownsContextGlobal) {
+    log.warn("OTel context manager already registered by the host — Apex reuses it and will not disable it");
+  }
   let shutdownPromise = null;
   const runtime = {
     async forceFlush() {
@@ -976,18 +1411,24 @@ function startObservabilityRuntime(env = process.env, opts) {
     },
     shutdown() {
       if (!shutdownPromise) {
-        const shutdownWork = (async () => {
+        const shutdownWork = async () => {
+          activeSpans.endAll();
           endAllActiveRootSpans();
           try {
             await provider.forceFlush();
           } finally {
-            await provider.shutdown();
+            activeSpans.endAll();
+            await provider.shutdown().catch((error) => {
+              log.warn("OTLP export/shutdown failed", { error: String(error) });
+            });
           }
-        })();
-        shutdownPromise = withTimeout(shutdownWork, shutdownTimeoutMs).then((result) => {
+        };
+        shutdownPromise = withTimeout(shutdownWork(), shutdownTimeoutMs).then((result) => {
           contextManager.disable();
+          if (ownsContextGlobal) {
+            import_api.context.disable();
+          }
           import_api.trace.disable();
-          import_api.context.disable();
           return result;
         }).finally(() => {
           activeRuntime = null;
@@ -1045,7 +1486,6 @@ function installObservabilityExitHandlers(runtime, opts) {
 // src/tui/utils/command-flags.ts
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-init_toolset();
 function combinePromptParts(threatModel, prompt) {
   const parts = [];
   if (threatModel)
@@ -1072,7 +1512,6 @@ function resolveThreatModelPrompt(value) {
 // src/cli.ts
 var args = process.argv.slice(2);
 var version2 = package_default2.version;
-import_dotenv.config();
 var OBFUSCATE_FLAGS = new Set(["--obfuscate", "--redact", "-O"]);
 var obfuscateRequested = args.some((a) => OBFUSCATE_FLAGS.has(a));
 if (obfuscateRequested) {
@@ -1093,6 +1532,7 @@ if (obfuscateRequested) {
   }
 }
 var command = args[0];
+import_dotenv.config({ quiet: true });
 function getArg(flag, argv = args) {
   const idx = argv.indexOf(flag);
   return idx !== -1 ? argv[idx + 1] : undefined;
@@ -1117,6 +1557,11 @@ function getAllArgs(flag, argv = args) {
   }
   return values;
 }
+function nativeRolloutEvidenceOutput() {
+  if (!hasFlag("--native-rollout-evidence"))
+    return;
+  return resolve2(getArgRequired("--native-rollout-evidence"));
+}
 function attachCliAgentStreamListeners(bus) {
   bus.on("text-delta", (d) => process.stdout.write(d.text));
   bus.on("tool-call-complete", (d) => console.log(`
@@ -1124,16 +1569,31 @@ function attachCliAgentStreamListeners(bus) {
   bus.on("tool-result", (d) => console.log(`\u2713 ${d.toolName} completed`));
   bus.on("error", (d) => console.error("Error:", d.error));
 }
-async function createInstrumentedBus(session) {
+async function createInstrumentedBus(session, model) {
+  headlessHerdrSession = {
+    id: session.id,
+    resumeArgv: [
+      "pensar",
+      "--resume",
+      session.id,
+      "--model",
+      model,
+      ...process.env.PENSAR_OBFUSCATE === "1" ? ["--obfuscate"] : []
+    ]
+  };
+  reportHerdrState("working");
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-9qj1kpt9.js");
+  const { attachWandbToEventBus } = await import("./upload-vkkj6h54.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
   });
   return { bus, cleanup: async () => wandbCleanup?.() };
 }
+function reportHerdrState(state) {
+  headlessHerdr?.report({ state, session: headlessHerdrSession });
+}
 async function resolveCliHeaders() {
   const headerArgs = getAllArgs("--header");
   const headersFromArg = getArg("--headers-from");
@@ -1141,10 +1601,10 @@ async function resolveCliHeaders() {
   if (headerArgs.length === 0 && !headersFromArg && !noGlobal) {
     return;
   }
-  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-rtccymzn.js");
+  const { parseHeaderLine, parseHeadersFromFile, formatParseError } = await import("./parse-cqecqrc5.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-18vyy6mj.js");
+    const { config: appConfig } = await import("./index-cfbd4zej.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -1155,7 +1615,7 @@ async function resolveCliHeaders() {
     if (!parsed.ok) {
       for (const err of parsed.error) {
         console.error(`--headers-from error:
-${formatParseError2(err)}`);
+${formatParseError(err)}`);
       }
       process.exit(1);
     }
@@ -1164,10 +1624,10 @@ ${formatParseError2(err)}`);
     }
   }
   for (const arg of headerArgs) {
-    const parsed = parseHeaderLine2(arg);
+    const parsed = parseHeaderLine(arg);
     if (!parsed.ok) {
       console.error(`--header "${arg}" rejected:
-${formatParseError2(parsed.error)}`);
+${formatParseError(parsed.error)}`);
       process.exit(1);
     }
     merged[parsed.value.name] = parsed.value.value;
@@ -1175,24 +1635,40 @@ ${formatParseError2(parsed.error)}`);
   return merged;
 }
 async function resolveCliModel() {
-  const explicit = getArg("--model");
+  const { config: appConfig } = await import("./index-cfbd4zej.js");
+  const { getDefaultModelForConfig } = await import("./utils-b1kae4f3.js");
+  const pensarConfig = await appConfig.get();
+  const explicit = resolveExplicitCliModel({
+    model: getArg("--model"),
+    provider: getArg("--model-provider"),
+    customProviders: pensarConfig.customProviders,
+    hoonifyModels: pensarConfig.hoonifyModels,
+    hoonifyCatalogError: pensarConfig.hoonifyCatalogError
+  });
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-18vyy6mj.js");
-  const { getDefaultModelForConfig } = await import("./utils-t7gc2903.js");
-  const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
+    if (pensarConfig.hoonifyCatalogError)
+      throw new Error(pensarConfig.hoonifyCatalogError);
     console.error(`Error: No AI provider configured. Set one of:
 ` + `  PENSAR_API_KEY     \u2014 Pensar Console (recommended)
 ` + `  ANTHROPIC_API_KEY  \u2014 Anthropic direct
 ` + `  OPENAI_API_KEY     \u2014 OpenAI
 ` + `  OPENROUTER_API_KEY \u2014 OpenRouter
 ` + `  CONCENTRATE_API_KEY \u2014 Concentrate
+` + `  HOONIFY_API_KEY    \u2014 Hoonify
+` + `  APEX_CUSTOM_PROVIDERS \u2014 Custom OpenAI-compatible providers (JSON)
 ` + `
 Or run 'pensar login' to connect to Pensar Console.`);
     process.exit(1);
   }
+  resolveExplicitCliModel({
+    model: defaultModel.id,
+    customProviders: pensarConfig.customProviders,
+    hoonifyModels: pensarConfig.hoonifyModels,
+    hoonifyCatalogError: pensarConfig.hoonifyCatalogError
+  });
   return defaultModel.id;
 }
 function showHelp() {
@@ -1200,6 +1676,7 @@ function showHelp() {
 
 Usage:
   pensar                             Launch the TUI
+  pensar --resume <session-id>        Reopen a saved session in the TUI
   pensar -p <prompt>                 Start an operator session with a prompt
   pensar pentest [options]            Run a full pentest orchestration
   pensar targeted-pentest [options]   Run a targeted pentest on a single target
@@ -1208,16 +1685,22 @@ Usage:
   pensar uninstall                    Uninstall Pensar (keeps sessions, memories, skills)
   pensar apps                         Manage the attack surface (apps & endpoints)
   pensar pentests                     List and manage pentests
+  pensar agent-runs                   Record and inspect local agent runs
   pensar targets                      List pentest targets and view their agent logs
   pensar issues                       List and manage security issues
   pensar fixes                        View security fixes
+  pensar knowledge                    Read and edit the workspace knowledge base
   pensar logs                         View agent execution logs
   pensar config headers               Manage global default HTTP headers
+  pensar export-trajectory            Convert saved rollout evidence to ATIF
   pensar upgrade                      Update pensar to the latest version
   pensar doctor                       Check dependencies and install missing tools
   pensar help                         Show this help message
   pensar version                      Show version number
 
+resume options:
+  --model <model>            Restore the session with this model
+
 operator options (-p):
   -p, --prompt <text|@file>  (required) Prompt for the operator agent
   -s, --system <text|@file>  Override the default system prompt
@@ -1226,6 +1709,8 @@ operator options (-p):
   --header "Name: Value"     Custom HTTP header (repeatable)
   --headers-from <file>      Load headers from a JSON object or Name:Value file
   --no-global-headers        Skip the global defaultHeaders snapshot
+  --native-rollout-evidence <directory>
+                             Capture this invocation's model-boundary evidence
 
 pentest options:
   --target <url>           (required) Target URL / domain / IP
@@ -1241,6 +1726,8 @@ pentest options:
   --header "Name: Value"   Custom HTTP header (repeatable)
   --headers-from <file>    Load headers from a JSON object or Name:Value file
   --no-global-headers      Skip the global defaultHeaders snapshot
+  --native-rollout-evidence <directory>
+                           Capture this invocation's model-boundary evidence
 
 targeted-pentest options:
   --target <url>          (required) Target URL / domain / IP
@@ -1249,12 +1736,19 @@ targeted-pentest options:
   --header "Name: Value"  Custom HTTP header (repeatable)
   --headers-from <file>   Load headers from a JSON object or Name:Value file
   --no-global-headers     Skip the global defaultHeaders snapshot
+  --native-rollout-evidence <directory>
+                          Capture this invocation's model-boundary evidence
 
 threat-model options:
   --output, -o <path>  Output file path (default: ./threat-model.md)
   --model <model>      AI model (default: auto-selected from configured provider)
 
+export-trajectory options:
+  --input <path>   Version 1 export request with saved evidence paths and digests
+  --output <path>  Fresh output directory; existing paths are never overwritten
+
 Global options:
+  --model-provider <id>  Hoonify or custom provider for --model (headless commands)
   -h, --help         Show this help message
   -v, --version      Show version number
   --log-level <lvl>  Diagnostic log level: debug|info|warn|error|silent
@@ -1263,12 +1757,21 @@ Global options:
   --obfuscate        Run the TUI in obfuscation mode \u2014 redacts hostnames,
                      IPs, UUIDs, emails, paths, tokens, and apparent
                      company names so screenshots are safe to share.
+
+Hoonify inference:
+  Set HOONIFY_API_KEY, then use --model-provider hoonify --model <catalog-model-id>
+  or --model hoonify:<catalog-model-id>. Models are discovered from Hoonify.
+
+Custom inference:
+  Configure customProviders in ~/.pensar/config.json or set APEX_CUSTOM_PROVIDERS
+  to the equivalent JSON object. API keys are read from each provider's apiKeyEnv.
+  Use --model-provider <id> --model <model>, or --model custom:<id>:<model>.
 `);
 }
 async function runPentest() {
-  const { runPentestAgent } = await import("./blackboxPentest-w5nwzpvk.js");
-  const { sessions: sessions2 } = await import("./index-kyd1jm89.js");
-  const { config: appConfig } = await import("./index-18vyy6mj.js");
+  const { runPentestAgent } = await import("./blackboxPentest-aw69ect4.js");
+  const { sessions } = await import("./index-nfhetcq8.js");
+  const { config: appConfig } = await import("./index-cfbd4zej.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -1277,6 +1780,7 @@ async function runPentest() {
   const enableThinking = hasFlag("--extended-thinking");
   const taskDriven = hasFlag("--task-driven");
   const fastStrike = hasFlag("--fast-strike");
+  const evidenceOutput = nativeRolloutEvidenceOutput();
   const resolvedTm = threatModelRaw ? resolveThreatModelPrompt(threatModelRaw) : undefined;
   const resolvedPrompt = promptRaw ? resolveFlagValue(promptRaw) : undefined;
   const prompt = combinePromptParts(resolvedTm, resolvedPrompt);
@@ -1303,7 +1807,7 @@ Task-driven: enabled` : ""}${fastStrike ? `
 Fast strike: enabled` : ""}${headers ? `
 Headers: ${Object.keys(headers).length} configured` : ""}
 `);
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
     targets: [target],
     config: {
@@ -1311,24 +1815,30 @@ Headers: ${Object.keys(headers).length} configured` : ""}
       ...exfilMode ? { exfilMode: true } : {},
       ...prompt ? { prompt } : {},
       ...taskDriven ? { taskDriven: true } : {},
+      ...evidenceOutput ? { nativeRolloutEvidence: { outputDirectory: evidenceOutput } } : {},
       ...headers !== undefined ? { headers } : {}
     }
   });
   console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
-  const { bus: pentestBus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
-  try {
-    const { findings, findingsPath, pocsPath, reportPath } = await runPentestAgent({
-      target,
-      ...cwd ? { cwd } : {},
-      session,
-      model,
-      enableThinking,
-      ...fastStrike ? { fastStrike: true } : {},
-      surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
-      authConfig: buildAuthConfig(pensarConfig),
-      eventBus: pentestBus
-    });
-    console.log(`
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-y0vdtjje.js");
+  const evidence = await runWithCliNativeRolloutEvidence({
+    session,
+    outputDirectory: evidenceOutput,
+    run: async () => {
+      const { bus: pentestBus, cleanup: wandbCleanup } = await createInstrumentedBus(session, model);
+      try {
+        const { findings, findingsPath, pocsPath, reportPath } = await runPentestAgent({
+          target,
+          ...cwd ? { cwd } : {},
+          session,
+          model,
+          enableThinking,
+          ...fastStrike ? { fastStrike: true } : {},
+          surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
+          authConfig: buildAuthConfig(pensarConfig),
+          eventBus: pentestBus
+        });
+        console.log(`
 ${sep}
 RESULTS
 ${sep}
@@ -1336,16 +1846,22 @@ Findings:  ${findings.length}
 Path:      ${findingsPath}
 POCs:      ${pocsPath}${reportPath ? `
 Report:    ${reportPath}` : ""}`);
-  } finally {
-    await wandbCleanup();
+      } finally {
+        await wandbCleanup();
+      }
+    }
+  });
+  if (evidence.manifestPath) {
+    console.log(`Native evidence: ${evidence.manifestPath}`);
   }
 }
 async function runTargetedPentest() {
-  const { runTargetedPentestAgent } = await import("./targetedPentest-tdwtgmxm.js");
-  const { sessions: sessions2 } = await import("./index-kyd1jm89.js");
-  const { config: appConfig } = await import("./index-18vyy6mj.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-rgffxsgd.js");
+  const { sessions } = await import("./index-nfhetcq8.js");
+  const { config: appConfig } = await import("./index-cfbd4zej.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
+  const evidenceOutput = nativeRolloutEvidenceOutput();
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
   if (objectives.length === 0) {
@@ -1364,41 +1880,56 @@ Objectives:
 ${objectivesList}
 `);
   const headers = await resolveCliHeaders();
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: "Targeted Pentest",
     targets: [target],
-    ...headers !== undefined ? { config: { headers } } : {}
+    ...headers !== undefined || evidenceOutput ? {
+      config: {
+        ...headers !== undefined ? { headers } : {},
+        ...evidenceOutput ? { nativeRolloutEvidence: { outputDirectory: evidenceOutput } } : {}
+      }
+    } : {}
   });
   console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
-  const { bus: targetedBus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
-  try {
-    const { findings, findingsPath, pocsPath } = await runTargetedPentestAgent({
-      target,
-      objectives,
-      session,
-      model,
-      authConfig: buildAuthConfig(pensarConfig),
-      eventBus: targetedBus
-    });
-    console.log(`
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-y0vdtjje.js");
+  const evidence = await runWithCliNativeRolloutEvidence({
+    session,
+    outputDirectory: evidenceOutput,
+    run: async () => {
+      const { bus: targetedBus, cleanup: wandbCleanup } = await createInstrumentedBus(session, model);
+      try {
+        const { findings, findingsPath, pocsPath } = await runTargetedPentestAgent({
+          target,
+          objectives,
+          session,
+          model,
+          authConfig: buildAuthConfig(pensarConfig),
+          eventBus: targetedBus
+        });
+        console.log(`
 ${sep}
 RESULTS
 ${sep}
 Findings:  ${findings.length}
 Path:      ${findingsPath}
 POCs:      ${pocsPath}`);
-  } finally {
-    await wandbCleanup();
+      } finally {
+        await wandbCleanup();
+      }
+    }
+  });
+  if (evidence.manifestPath) {
+    console.log(`Native evidence: ${evidence.manifestPath}`);
   }
 }
 async function runThreatModel() {
-  const { runThreatModelWorkflow } = await import("./threatModel-81d4rcbk.js");
-  const { config: appConfig } = await import("./index-18vyy6mj.js");
-  const path2 = await import("path");
+  const { runThreatModelWorkflow } = await import("./threatModel-6efzjpbv.js");
+  const { config: appConfig } = await import("./index-cfbd4zej.js");
+  const path = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
   const outputArg = getArg("--output") ?? getArg("-o") ?? "threat-model.md";
-  const resolvedPath = path2.isAbsolute(outputArg) ? outputArg : path2.resolve(process.cwd(), outputArg);
+  const resolvedPath = path.isAbsolute(outputArg) ? outputArg : path.resolve(process.cwd(), outputArg);
   const sep = "=".repeat(60);
   console.log(`${sep}
 THREAT MODEL GENERATION
@@ -1413,6 +1944,7 @@ Model:    ${model}
   \u2192 ${d.toolName}`));
   threatBus.on("tool-result", (d) => console.log(`  \u2713 ${d.toolName}`));
   threatBus.on("error", (d) => console.error("Error:", d.error));
+  reportHerdrState("working");
   await runThreatModelWorkflow({
     codebasePath: process.cwd(),
     outputPath: resolvedPath,
@@ -1427,14 +1959,14 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-c97pqzcn.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-kyd1jm89.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-hnwhswqj.js");
-  const { config: appConfig } = await import("./index-18vyy6mj.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-dfj42jkj.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-nfhetcq8.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-0ef0j7yp.js");
+  const { config: appConfig } = await import("./index-cfbd4zej.js");
   const { createInterface } = await import("readline");
-  const { readFileSync: readFileSync2, existsSync } = await import("fs");
-  const path2 = await import("path");
-  const { stepCountIs } = await import("./index-5wh7gq37.js");
+  const { readFileSync, existsSync } = await import("fs");
+  const path = await import("path");
+  const { stepCountIs } = await import("./index-qnyevb6q.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -1444,6 +1976,7 @@ async function runOperator() {
   const systemRaw = getArg("-s") ?? getArg("--system");
   const systemPrompt = systemRaw ? resolveFlagValue(systemRaw) : undefined;
   const target = getArg("--target");
+  const evidenceOutput = nativeRolloutEvidenceOutput();
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
   const sep = "\u2500".repeat(60);
@@ -1455,7 +1988,7 @@ Target:  ${target}` : ""}
 ${sep}
 `);
   const headers = await resolveCliHeaders();
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: "Operator Session",
     targets: target ? [target] : [],
     config: {
@@ -1466,84 +1999,124 @@ ${sep}
         requireApproval: false,
         enableSuggestions: false
       },
-      ...headers !== undefined ? { headers } : {}
+      ...headers !== undefined ? { headers } : {},
+      ...evidenceOutput ? { nativeRolloutEvidence: { outputDirectory: evidenceOutput } } : {}
     }
   });
-  const { bus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
-  let currentPrompt = prompt;
-  let messages;
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  const askFollowUp = () => new Promise((resolve2) => {
-    process.stdout.write(`
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-y0vdtjje.js");
+  const evidence = await runWithCliNativeRolloutEvidence({
+    session,
+    outputDirectory: evidenceOutput,
+    run: async () => {
+      const { bus, cleanup: wandbCleanup } = await createInstrumentedBus(session, model);
+      let currentPrompt = prompt;
+      let messages;
+      const rl = createInterface({
+        input: process.stdin,
+        output: process.stdout
+      });
+      const askFollowUp = () => new Promise((resolve) => {
+        reportHerdrState("idle");
+        process.stdout.write(`
 ${sep}
 `);
-    rl.question("follow-up (empty to exit): ", (answer) => {
-      const trimmed = answer.trim();
-      resolve2(trimmed || null);
-    });
-  });
-  try {
-    for (;; ) {
-      await runOffensiveSecurityAgent({
-        prompt: currentPrompt,
-        ...systemPrompt ? { system: systemPrompt } : {},
-        model,
-        target,
-        activeTools: [...ALL_TOOL_NAMES, ...SKILL_TOOL_NAMES],
-        stopWhen: stepCountIs(1e4),
-        authConfig: buildAuthConfig(pensarConfig),
-        eventBus: bus,
-        session,
-        messages
+        rl.question("follow-up (empty to exit): ", (answer) => {
+          const trimmed = answer.trim();
+          resolve(trimmed || null);
+        });
       });
-      const messagesPath = path2.join(session.rootPath, "messages.json");
-      if (existsSync(messagesPath)) {
-        const raw = JSON.parse(readFileSync2(messagesPath, "utf-8"));
-        const allMessages = Array.isArray(raw) ? raw : [];
-        messages = normalizeMessages(getResumeMessages(allMessages));
+      try {
+        for (;; ) {
+          reportHerdrState("working");
+          await runOffensiveSecurityAgent({
+            prompt: currentPrompt,
+            ...systemPrompt ? { system: systemPrompt } : {},
+            model,
+            target,
+            activeTools: [...ALL_TOOL_NAMES, ...SKILL_TOOL_NAMES],
+            stopWhen: stepCountIs(1e4),
+            authConfig: buildAuthConfig(pensarConfig),
+            eventBus: bus,
+            session,
+            messages
+          });
+          const messagesPath = path.join(session.rootPath, "messages.json");
+          if (existsSync(messagesPath)) {
+            const raw = JSON.parse(readFileSync(messagesPath, "utf-8"));
+            const allMessages = Array.isArray(raw) ? raw : [];
+            messages = normalizeMessages(getResumeMessages(allMessages));
+          }
+          const followUp = await askFollowUp();
+          if (!followUp)
+            break;
+          currentPrompt = followUp;
+          messages = normalizeMessages([
+            ...messages ?? [],
+            { role: "user", content: followUp }
+          ]);
+        }
+      } finally {
+        rl.close();
+        await wandbCleanup();
       }
-      const followUp = await askFollowUp();
-      if (!followUp)
-        break;
-      currentPrompt = followUp;
-      messages = normalizeMessages([
-        ...messages ?? [],
-        { role: "user", content: followUp }
-      ]);
+      console.log(`
+Session: ${session.rootPath}`);
     }
-  } finally {
-    rl.close();
-    await wandbCleanup();
+  });
+  if (evidence.manifestPath) {
+    console.log(`Native evidence: ${evidence.manifestPath}`);
   }
-  console.log(`
-Session: ${session.rootPath}`);
 }
 async function runUpgrade2() {
-  const currentVersion = getCurrentVersion2();
+  const currentVersion = getCurrentVersion();
   console.log(`Current version: v${currentVersion}
 Checking for updates...`);
   const result = await upgrade({ interactive: true });
   console.log(`
 ${result.message}`);
-  process.exit(result.success ? 0 : 1);
+  process.exitCode = result.success ? 0 : 1;
 }
-var observabilityRuntime = startObservabilityRuntime();
-var exitAfterObservabilityShutdown = args.length !== 0 ? installObservabilityExitHandlers(observabilityRuntime, {
+var tuiRequested = args.length === 0 || command === "--resume";
+var headlessHerdr = !tuiRequested && process.stdin.isTTY && process.stdout.isTTY && (hasFlag("-p") || command === "--prompt" || command === "pentest" || command === "targeted-pentest" || command === "threat-model") ? createHerdrReporter() : null;
+var headlessHerdrSession;
+var observabilityRuntime = command === "export-trajectory" ? null : startObservabilityRuntime();
+var standaloneRuntime = observabilityRuntime && {
+  ...observabilityRuntime,
+  shutdown: async () => {
+    const [result] = await Promise.all([
+      observabilityRuntime.shutdown().catch(() => "completed"),
+      headlessHerdr?.release()
+    ]);
+    return result;
+  }
+};
+var exitAfterObservabilityShutdown = standaloneRuntime !== null && !tuiRequested ? installObservabilityExitHandlers(standaloneRuntime, {
   onError: (error) => {
     console.error("Uncaught exception:", error);
   }
 }) : null;
 setCurrentCommand(command);
 try {
-  if (hasFlag("-p") || command === "--prompt") {
+  if (tuiRequested) {
+    const options = parseTuiArgs(args);
+    if (process.env.PENSAR_NO_TUI === "1") {
+      console.error("TUI mode requires Bun. Install Bun (https://bun.sh) or use a standalone binary release for interactive mode.");
+      console.error("All other commands work with Node \u2014 run 'pensar --help'.");
+      await standaloneRuntime?.shutdown();
+      process.exitCode = 1;
+    } else {
+      const { startTui } = await import("./index-wyn4g2c1.js");
+      await startTui(options);
+    }
+  } else if (hasFlag("-p") || command === "--prompt") {
     await runOperator();
   } else if (command === "version" || command === "--version" || command === "-v") {
     console.log(`v${version2}`);
   } else if (command === "help" || command === "--help" || command === "-h") {
     showHelp();
+  } else if (command === "export-trajectory") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./export-trajectory-rt4tf07k.js");
   } else if (command === "upgrade" || command === "update") {
     await runUpgrade2();
   } else if (command === "pentest") {
@@ -1552,57 +2125,58 @@ try {
     await runTargetedPentest();
   } else if (command === "login" || command === "auth") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./auth-7ay8qgxm.js");
+    await import("./auth-396rc66q.js");
   } else if (command === "uninstall") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./uninstall-d33159cz.js");
+    await import("./uninstall-cmv057jn.js");
   } else if (command === "apps") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./apps-x4ef2gpc.js");
+    await import("./apps-d50kkp3g.js");
   } else if (command === "pentests") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./pentests-v98eg8n3.js");
+    await import("./pentests-jh9az51h.js");
+  } else if (command === "agent-runs") {
+    const { runAgentRunsCommand } = await import("./agent-runs-awgj4sat.js");
+    await runAgentRunsCommand(args.slice(1));
   } else if (command === "targets") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./targets-763n91t7.js");
+    await import("./targets-wn0gmdhe.js");
   } else if (command === "issues") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./issues-019678t0.js");
+    await import("./issues-9zdszfq8.js");
+  } else if (command === "knowledge") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./knowledge-r6rmer3d.js");
   } else if (command === "fixes") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./fixes-fv66yn1z.js");
+    await import("./fixes-9qtsvwxx.js");
   } else if (command === "logs") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./logs-wzr5176k.js");
+    await import("./logs-1r7nkzhg.js");
   } else if (command === "config") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./config-4kzh88xz.js");
+    await import("./config-hddxxr27.js");
   } else if (command === "threat-model") {
     await runThreatModel();
   } else if (command === "doctor") {
-    const { runDoctor } = await import("./doctor-rz7sx6ev.js");
+    const { runDoctor } = await import("./doctor-z94afr10.js");
     await runDoctor();
-  } else if (args.length === 0) {
-    if (process.env.PENSAR_NO_TUI === "1") {
-      console.error("TUI mode requires Bun. Install Bun (https://bun.sh) or use a standalone binary release for interactive mode.");
-      console.error("All other commands work with Node \u2014 run 'pensar --help'.");
-      process.exit(1);
-    }
-    await import("./index-fpwr10qm.js");
   } else {
     console.error(`Error: Unknown command '${command}'`);
     console.error();
     console.error("Run 'pensar --help' for usage information");
-    process.exit(1);
+    process.exitCode = 1;
   }
 } catch (error) {
-  if (exitAfterObservabilityShutdown !== null) {
+  if (exitAfterObservabilityShutdown !== null && observabilityRuntime !== null) {
     await exitAfterObservabilityShutdown(1, error, "uncaughtException");
+  } else {
+    await standaloneRuntime?.shutdown();
   }
   throw error;
 } finally {
-  if (exitAfterObservabilityShutdown !== null) {
-    const shutdownResult = await observabilityRuntime.shutdown().catch(() => "completed");
+  if (exitAfterObservabilityShutdown !== null && standaloneRuntime !== null) {
+    const shutdownResult = await standaloneRuntime.shutdown();
     if (shutdownResult === "timed-out" || command === "pentest" || command === "targeted-pentest") {
       await exitAfterObservabilityShutdown(typeof process.exitCode === "number" ? process.exitCode : 0);
     }