@pensar/apex 2.5.0 → 2.6.1-canary.0cc77dcc

package/build/lib/chunk-4ydrmwd9.js

@@ -0,0 +1,980 @@
+import {
+  createLogger,
+  scopedLogger
+} from "./chunk-3502z798.js";
+import {
+  OffensiveSecurityAgent2
+} from "./chunk-g8d2x00m.js";
+import {
+  inMemoryRegistryProvider2,
+  withFindingPersistedHook2,
+  assertDepth2,
+  inProcessSeams2,
+  resolveItemHooks2
+} from "./chunk-517rf135.js";
+import {
+  FindingsRegistry2
+} from "./chunk-02awpt3c.js";
+import {
+  inProcessSubagentSpawner2
+} from "./chunk-f04pr76h.js";
+import {
+  PLAN_MODE_TOOL_NAMES2
+} from "./chunk-wr6ke041.js";
+import {
+  toGrpcPentestContext,
+  grpcAuthorityTarget
+} from "./chunk-vx228eeq.js";
+import {
+  AttackPathSchema,
+  CweEntrySchema,
+  ValidatedCweEntrySchema,
+  hasCanonicalName
+} from "./chunk-bx94rwt5.js";
+import {
+  EvidenceFileEntrySchema
+} from "./chunk-q5e23acz.js";
+import {
+  BlackboxAttackSurfaceAgent2
+} from "./chunk-mp1czx2y.js";
+import {
+  TargetedPentestAgent2,
+  buildPentestSystemPrompt2
+} from "./chunk-2j49k090.js";
+import {
+  loadSubagentMessages2,
+  saveSubagentData2,
+  writeAgentManifest2,
+  readAgentManifest2,
+  buildManifestEntries2,
+  reconcileManifestOnResume2,
+  finalizeManifest2,
+  updateManifestEntryStatus2,
+  getCompletedAgentIds2
+} from "./chunk-48zms2q1.js";
+import {
+  runWhiteboxAttackSurfaceWorkflow2
+} from "./chunk-2t65f749.js";
+
+// src/core/session/execution-metrics.ts
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+var EXECUTION_METRICS_FILENAME = "execution-metrics.json";
+function toNonNegativeInteger(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 0;
+}
+function normalizeTokenUsage(value) {
+  const inputTokens = toNonNegativeInteger(value?.inputTokens);
+  const outputTokens = toNonNegativeInteger(value?.outputTokens);
+  const derivedTotal = inputTokens + outputTokens;
+  const explicitTotal = toNonNegativeInteger(value?.totalTokens);
+  return {
+    inputTokens,
+    outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
+    totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
+  };
+}
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
+function metricsPath(sessionRootPath) {
+  return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
+}
+function sessionJsonPath(sessionRootPath) {
+  return join(sessionRootPath, "session.json");
+}
+function readExecutionMetrics(sessionRootPath) {
+  const path = metricsPath(sessionRootPath);
+  if (!existsSync(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    return {
+      tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
+      runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
+      elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
+      updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
+    };
+  } catch {
+    return null;
+  }
+}
+function writeSessionJsonTokenTotals(sessionRootPath, tokenUsage) {
+  const path = sessionJsonPath(sessionRootPath);
+  if (!existsSync(path))
+    return;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf-8"));
+    parsed.tokensIn = tokenUsage.inputTokens;
+    parsed.tokensOut = tokenUsage.outputTokens;
+    writeFileSync(path, JSON.stringify(parsed, null, 2));
+  } catch {}
+}
+function writeExecutionMetrics(input) {
+  const existing = readExecutionMetrics(input.sessionRootPath);
+  const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
+    totalTokens: 0
+  };
+  const next = {
+    tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
+    runtime: input.runtime ?? existing?.runtime,
+    elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
+    updatedAt: new Date().toISOString()
+  };
+  writeFileSync(metricsPath(input.sessionRootPath), JSON.stringify(next, null, 2), "utf-8");
+  writeSessionJsonTokenTotals(input.sessionRootPath, next.tokenUsage);
+  return next;
+}
+function formatDurationHmsFromMs(durationMs) {
+  const totalSeconds = Math.max(0, Math.floor(durationMs / 1000));
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = totalSeconds % 60;
+  return `${hours}h${minutes}m${seconds}s`;
+}
+
+// src/core/workflows/pentest.ts
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join3 } from "node:path";
+import { hasToolCall } from "ai";
+
+// src/core/agents/specialized/pentest/planPrompt.ts
+var PLAN_PHASE_SYSTEM_PROMPT = `You are an expert penetration tester performing reconnaissance and planning.
+
+Your job is to analyze the target, understand its attack surface, and create a comprehensive testing plan. You have READ-ONLY tools available — you can probe the target but NOT exploit it.
+
+Methodology:
+1. RECALL — Call list_memories to check for relevant knowledge from previous engagements.
+2. PROBE — Use http_request and browser tools to understand the target's behavior, technology stack, and input vectors.
+3. ANALYZE — Identify technologies, endpoints, authentication mechanisms, input parameters, and potential vulnerability classes.
+4. PLAN — Write a structured pentest plan via write_plan with the following sections:
+   - **Objective** — engagement goals
+   - **Scope** — in-scope targets, exclusions
+   - **Reconnaissance Findings** — technology stack, endpoints, authentication mechanisms discovered
+   - **Attack Surface Map** — entry points ranked by exposure
+   - **Prioritized Attack Vectors** — ordered by impact, with endpoint, vulnerability class, rationale, and test approach per vector
+   - **Testing Methodology** — concrete techniques and payloads per vector (OWASP categories)
+   - **Estimated Action Tiers** — anticipated T1–T5 action counts for operator awareness
+5. DECOMPOSE — Call create_task for each attack vector in the plan. One task per technique × endpoint combination.
+6. SUBMIT — Call submit_plan when the plan is complete and all tasks are created.
+
+Guidelines:
+- Be thorough in reconnaissance — probe different endpoints, check response headers, test authentication flows
+- Rank attack vectors by likelihood of success and potential impact
+- Each task should be atomic and testable independently
+- Include authentication bypass, injection, access control, and business logic testing as appropriate`;
+function buildPlanPrompt(target, objectives, grpc) {
+  const objectiveList = objectives.map((o, i) => `${i + 1}. ${o}`).join(`
+`);
+  const grpcSection = grpc ? `
+## gRPC Target
+This target is a **gRPC method**, not a plain HTTP endpoint — plan gRPC-specific attack vectors (reflection/schema recovery, per-method missing-auth, BOLA on request-message IDs, metadata trust, \`:path\` authz bypass, protobuf fuzzing, streaming abuse) rather than HTTP-centric ones.
+- **Transport:** ${grpc.transport}
+- **Service:** ${grpc.serviceFqn}
+- **Method:** ${grpc.method}${grpc.streamingType ? `
+- **Streaming:** ${grpc.streamingType}` : ""}${grpc.host ? `
+- **Authority (host):** ${grpc.host}` : ""}
+` : "";
+  return `# Planning Assignment
+
+## Target
+- **URL:** ${target}
+${grpcSection}
+## Objectives
+${objectiveList}
+
+## Instructions
+1. Probe the target to understand its behavior and attack surface
+2. Write a comprehensive pentest plan via write_plan
+3. Create tasks for each attack vector via create_task
+4. Submit the plan via submit_plan when complete`;
+}
+
+// src/core/report/schemas.ts
+import { z } from "zod";
+var PentestReportFindingSchema = z.object({
+  title: z.string(),
+  severity: z.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: z.string(),
+  impact: z.string(),
+  evidence: z.string(),
+  endpoint: z.string(),
+  pocPath: z.string(),
+  remediation: z.string(),
+  references: z.string().optional(),
+  cwes: z.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: z.string().optional(),
+  relatedFindings: z.array(z.string()).optional(),
+  rootCauseLead: z.boolean().optional(),
+  evidenceFiles: z.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
+});
+var PentestReportSchema = z.object({
+  version: z.string().regex(/^1\.\d+$/),
+  metadata: z.object({
+    target: z.string(),
+    model: z.string(),
+    timestamp: z.string(),
+    sessionId: z.string(),
+    mode: z.enum(["blackbox", "whitebox", "targeted"])
+  }),
+  summary: z.object({
+    totalFindings: z.number(),
+    bySeverity: z.object({
+      CRITICAL: z.number(),
+      HIGH: z.number(),
+      MEDIUM: z.number(),
+      LOW: z.number()
+    })
+  }),
+  findings: z.array(PentestReportFindingSchema)
+});
+var REPORT_VERSION = "1.0";
+
+// src/core/report/builder.ts
+var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function buildPentestReport(findings, context) {
+  const sorted = [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+  const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
+  for (const f of findings) {
+    bySeverity[f.severity]++;
+  }
+  return {
+    version: REPORT_VERSION,
+    metadata: {
+      target: context.target,
+      model: context.model,
+      timestamp: new Date().toISOString(),
+      sessionId: context.sessionId,
+      mode: context.mode
+    },
+    summary: {
+      totalFindings: findings.length,
+      bySeverity
+    },
+    findings: sorted.map((f) => ({
+      title: f.title,
+      severity: f.severity,
+      description: f.description,
+      impact: f.impact,
+      evidence: f.evidence,
+      endpoint: f.endpoint,
+      pocPath: f.pocPath,
+      remediation: f.remediation,
+      references: f.references,
+      cwes: f.cwes,
+      rootCauseGroup: f.rootCauseGroup,
+      relatedFindings: f.relatedFindings,
+      rootCauseLead: f.rootCauseLead,
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
+    }))
+  };
+}
+// src/core/report/renderers/json.ts
+function renderJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+// src/core/report/renderers/markdown.ts
+function renderMarkdown(report) {
+  const { metadata, findings, summary } = report;
+  const header = [
+    `# Pentest Report — ${metadata.target}`,
+    "",
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}  `,
+    `**Model:** ${metadata.model}  `,
+    `**Mode:** ${metadata.mode}`,
+    "",
+    `**Findings:** ${summary.totalFindings}`,
+    ""
+  ];
+  if (findings.length === 0) {
+    return [
+      ...header,
+      "No findings were identified during this assessment.",
+      ""
+    ].join(`
+`);
+  }
+  const body = findings.map((finding) => renderFinding(finding, metadata)).join(`
+`);
+  return [...header, body].join(`
+`);
+}
+function renderFinding(finding, metadata) {
+  const lines = [
+    `# ${finding.title}`,
+    "",
+    `**Severity:** ${finding.severity}  `,
+    `**Target:** ${metadata.target}  `,
+    `**Endpoint:** ${finding.endpoint}  `,
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}`,
+    "",
+    "## Description",
+    "",
+    finding.description,
+    "",
+    "## Impact",
+    "",
+    finding.impact,
+    "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
+    "## Evidence",
+    "",
+    "```",
+    finding.evidence,
+    "```",
+    "",
+    ...finding.evidenceFiles?.length ? [
+      "## Evidence Files",
+      "",
+      ...finding.evidenceFiles.map((ef) => `- **[${ef.type}]** \`${ef.path}\` — ${ef.description}`),
+      ""
+    ] : [],
+    ...finding.cwes?.length ? [
+      "## CWE Classification",
+      "",
+      ...finding.cwes.map((cwe) => `- **${cwe.id}**${hasCanonicalName(cwe) ? `: ${cwe.name}` : ""} — ${cwe.reasoning}`),
+      ""
+    ] : [],
+    ...finding.rootCauseGroup ? [
+      "## Root Cause Group",
+      "",
+      `**Group:** \`${finding.rootCauseGroup}\``,
+      ...finding.relatedFindings?.length ? [
+        "",
+        "**Related Findings:**",
+        ...finding.relatedFindings.map((rf) => `- ${rf}`)
+      ] : [],
+      ""
+    ] : [],
+    "## POC",
+    "",
+    `Path: \`${finding.pocPath}\``,
+    "",
+    "## Remediation",
+    "",
+    finding.remediation,
+    ...finding.references ? ["", `## References`, "", finding.references] : [],
+    "",
+    "---",
+    "",
+    "*This finding was automatically documented by the Pensar penetration testing agent.*",
+    ""
+  ];
+  return lines.join(`
+`);
+}
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
+
+// src/core/report/index.ts
+var REPORT_FILENAME_MD = "pentest-report.md";
+var REPORT_FILENAME_JSON = "pentest-report.json";
+
+// src/core/session/loader.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+var log = scopedLogger(() => createLogger("session:loader"));
+function loadAttackSurfaceResults(rootPath) {
+  const resultsPath = join2(rootPath, "attack-surface-results.json");
+  if (!existsSync2(resultsPath)) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync2(resultsPath, "utf-8"));
+  } catch (e) {
+    log.error("Failed to load attack surface results", e instanceof Error ? e : undefined, { error: String(e) });
+    return null;
+  }
+}
+
+// src/core/utils/prompt.ts
+function createThreatModelPrompt(content) {
+  return `## Threat Model
+
+The following threat model was generated for this application. Use it to guide your pentest:
+
+1. **Prioritize attack paths by severity** — start with Critical and High severity paths.
+2. **Use the pentest guidance** — each attack path includes specific objectives, techniques, and example payloads. Follow these when testing.
+3. **Check existing controls** — the threat model documents existing security controls. Verify they work as documented and look for bypasses.
+4. **Verify control gaps** — each attack path lists control gaps. These are your highest-value targets.
+5. **Reference attacker profiles** — understand who would attack this application and what they control. This shapes your testing perspective.
+6. **Don't limit yourself** — the threat model is guidance, not an exhaustive list. If you discover attack vectors not covered by the model, pursue them.
+
+<threat-model>
+${content}
+</threat-model>`;
+}
+
+// src/core/workflows/pentest.ts
+var log2 = scopedLogger(() => createLogger("pentest-swarm"));
+var DEFAULT_CONCURRENCY2 = 10;
+async function runPentestSwarmTarget2(target, index, input) {
+  const {
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    findingsRegistry,
+    eventBus,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    display,
+    onError,
+    hooks: sharedHooks,
+    seams,
+    manifestEntries,
+    completedIds
+  } = input;
+  const entry = manifestEntries[index];
+  const subagentId = entry.id;
+  const subagentName = target.name ?? entry.name;
+  if (completedIds.has(subagentId))
+    return null;
+  const itemHooks = resolveItemHooks2(sharedHooks, seams, target, index);
+  const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
+  const previousMessages = loadSubagentMessages2(session, subagentId);
+  let lastMessages = [];
+  const handleStepFinish = (e) => {
+    if (e.response.messages) {
+      lastMessages = e.response.messages;
+    }
+    onStepFinish?.(e);
+  };
+  await seams.hooks.onEndpointStart?.({
+    subagentId,
+    subagentName,
+    target: target.target
+  });
+  eventBus?.emit("subagent-spawn", {
+    subagentId,
+    name: subagentName,
+    input: { target: target.target, objectives: target.objectives }
+  });
+  if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
+    try {
+      eventBus?.emit("subagent-spawn", {
+        subagentId: `${subagentId}-plan`,
+        name: `${subagentName} (plan)`,
+        input: { target: target.target, objectives: target.objectives },
+        parentSubagentId: subagentId
+      });
+      const executionTasksDir = join3(session.rootPath, "subagents", `${subagentId}-tasks`);
+      const planAgent = new OffensiveSecurityAgent2({
+        system: PLAN_PHASE_SYSTEM_PROMPT,
+        prompt: buildPlanPrompt(target.target, target.objectives, target.grpc),
+        model,
+        session,
+        target: target.target,
+        grpc: target.grpc,
+        mode: "plan",
+        activeTools: [...PLAN_MODE_TOOL_NAMES2],
+        stopWhen: hasToolCall("submit_plan"),
+        authConfig,
+        findingsRegistry,
+        subagentId: `${subagentId}-plan`,
+        subagentName: `${subagentName} (plan)`,
+        tasksDir: executionTasksDir,
+        planSubagentId: subagentId,
+        eventBus,
+        onStepFinish,
+        onCacheMetrics,
+        enableThinking,
+        thinkingEffort,
+        openAIReasoningEffort,
+        display,
+        ...itemHooks,
+        abortSignal: childSignal
+      });
+      await planAgent.consume();
+      eventBus?.emit("subagent-complete", {
+        subagentId: `${subagentId}-plan`,
+        status: "completed",
+        parentSubagentId: subagentId
+      });
+    } catch (planErr) {
+      eventBus?.emit("subagent-complete", {
+        subagentId: `${subagentId}-plan`,
+        status: "failed",
+        parentSubagentId: subagentId
+      });
+      log2.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
+    }
+  }
+  const objectiveStr = target.objectives.join("; ");
+  let agent;
+  try {
+    agent = new TargetedPentestAgent2({
+      target: target.target,
+      grpc: target.grpc,
+      objectives: target.objectives,
+      model,
+      session,
+      authConfig,
+      findingsRegistry,
+      onStepFinish: handleStepFinish,
+      onCacheMetrics,
+      forwardUsageCallbacksToSpawnedAgents: true,
+      messages: previousMessages.length > 0 ? previousMessages : undefined,
+      eventBus,
+      subagentId,
+      subagentName,
+      enableThinking,
+      thinkingEffort,
+      openAIReasoningEffort,
+      display,
+      ...itemHooks,
+      abortSignal: childSignal
+    });
+    const result = await agent.consume();
+    saveSubagentData2(session, {
+      agentName: subagentId,
+      target: target.target,
+      objective: objectiveStr,
+      status: "completed",
+      findingsCount: result.findings.length,
+      messages: [...previousMessages, ...lastMessages],
+      systemPrompt: buildPentestSystemPrompt2(session),
+      userPrompt: agent.userPrompt
+    });
+    updateManifestEntryStatus2(session, subagentId, "completed");
+    eventBus?.emit("subagent-complete", {
+      subagentId,
+      status: "completed"
+    });
+    await seams.hooks.onEndpointDone?.({ subagentId, subagentName, target: target.target }, result);
+    return result;
+  } catch (error) {
+    saveSubagentData2(session, {
+      agentName: subagentId,
+      target: target.target,
+      objective: objectiveStr,
+      status: "failed",
+      error: error instanceof Error ? error.message : String(error),
+      messages: [...previousMessages, ...lastMessages],
+      systemPrompt: buildPentestSystemPrompt2(session),
+      userPrompt: agent?.userPrompt ?? ""
+    });
+    updateManifestEntryStatus2(session, subagentId, "failed");
+    eventBus?.emit("subagent-complete", {
+      subagentId,
+      status: "failed"
+    });
+    eventBus?.emit("error", { error, subagentId });
+    await seams.hooks.onEndpointFailed?.({ subagentId, subagentName, target: target.target }, error);
+    onError?.(error);
+    throw error;
+  }
+}
+async function runPentestSwarm2(input) {
+  const {
+    targets,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    findingsRegistry: rawFindingsRegistry,
+    eventBus,
+    onError,
+    concurrency = DEFAULT_CONCURRENCY2,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    display,
+    subagentSpawner,
+    languageModelMiddleware,
+    usageRecorder,
+    streamIdFactory,
+    hooks,
+    seams: inputSeams
+  } = input;
+  const seams = inputSeams ?? inProcessSeams2({ fanOut: hooks?.subagentSpawner ?? subagentSpawner });
+  assertDepth2(1, seams.limits);
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner2;
+  const sharedHooks = {
+    subagentSpawner: spawner,
+    languageModelMiddleware,
+    usageRecorder,
+    streamIdFactory,
+    ...hooks
+  };
+  const findingsRegistry = withFindingPersistedHook2(rawFindingsRegistry, seams.hooks.onFindingPersisted);
+  const completedIds = getCompletedAgentIds2(session);
+  const existingManifest = readAgentManifest2(session);
+  const freshEntries = buildManifestEntries2(targets, (name, ordinal) => seams.ids.newSessionId(name, ordinal));
+  const manifestEntries = reconcileManifestOnResume2(existingManifest, freshEntries);
+  writeAgentManifest2(session, manifestEntries);
+  const targetInput = {
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    findingsRegistry,
+    eventBus,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    display,
+    onError,
+    hooks: sharedHooks,
+    seams,
+    manifestEntries,
+    completedIds
+  };
+  const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget2(target, index, targetInput), { concurrency, abortSignal });
+  finalizeManifest2(session, manifestEntries, results);
+  return results;
+}
+async function runPentestWorkflow2(input) {
+  if (input.fastStrike) {
+    const { runFastStrike } = await import("./chunk-sk8xnywf.js");
+    return runFastStrike(input);
+  }
+  const {
+    target,
+    cwd,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    eventBus,
+    onStepFinish,
+    onCacheMetrics,
+    enableThinking,
+    thinkingEffort,
+    openAIReasoningEffort,
+    prompt,
+    threatModel,
+    surfaceIntegrationEnabled
+  } = input;
+  const seams = input.seams ?? inProcessSeams2({
+    fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
+    registries: {
+      findings: () => FindingsRegistry2.fromDirectory(session.findingsPath, {
+        model,
+        authConfig,
+        abortSignal,
+        sessionId: session.id
+      }),
+      attackSurface: inMemoryRegistryProvider2.attackSurface
+    }
+  });
+  if (prompt || threatModel) {
+    const parts = [];
+    if (threatModel)
+      parts.push(createThreatModelPrompt(threatModel));
+    if (prompt)
+      parts.push(prompt);
+    const combined = parts.join(`
+
+`);
+    if (!session.config) {
+      session.config = {};
+    }
+    session.config.prompt = session.config?.prompt ? `${session.config?.prompt}
+
+${combined}` : combined;
+  }
+  const startedAt = Date.now();
+  try {
+    const mode = cwd ? "whitebox" : "blackbox";
+    let swarmTargets;
+    const existingResults = loadAttackSurfaceResults(session.rootPath);
+    if (existingResults?.targets && existingResults.targets.length > 0) {
+      swarmTargets = existingResults.targets.map((t) => ({
+        target: t.target,
+        objectives: [t.objective]
+      }));
+      eventBus?.emit("workflow-phase-start", {
+        phase: "discovery",
+        label: "Attack Surface Discovery (cached)"
+      });
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "discovery",
+        summary: {
+          targets: swarmTargets,
+          targetCount: swarmTargets.length,
+          cached: true
+        }
+      });
+    } else {
+      eventBus?.emit("workflow-phase-start", {
+        phase: "discovery",
+        label: `Attack Surface Discovery (${mode})`,
+        metadata: { mode, target }
+      });
+      if (mode === "whitebox") {
+        swarmTargets = await runWhiteboxPhase({
+          codebasePath: cwd,
+          baseTarget: target,
+          model,
+          session,
+          authConfig,
+          abortSignal,
+          eventBus,
+          onStepFinish,
+          onCacheMetrics,
+          openAIReasoningEffort,
+          surfaceIntegrationEnabled,
+          subagentSpawner: input.subagentSpawner,
+          hooks: {
+            subagentSpawner: input.subagentSpawner,
+            languageModelMiddleware: input.languageModelMiddleware,
+            usageRecorder: input.usageRecorder,
+            streamIdFactory: input.streamIdFactory,
+            ...input.hooks
+          },
+          seams
+        });
+      } else {
+        swarmTargets = await runBlackboxPhase({
+          target,
+          model,
+          session,
+          authConfig,
+          abortSignal,
+          eventBus,
+          onStepFinish,
+          onCacheMetrics,
+          openAIReasoningEffort,
+          hooks: {
+            subagentSpawner: input.subagentSpawner,
+            languageModelMiddleware: input.languageModelMiddleware,
+            usageRecorder: input.usageRecorder,
+            streamIdFactory: input.streamIdFactory,
+            ...input.hooks
+          }
+        });
+      }
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "discovery",
+        summary: {
+          targets: swarmTargets,
+          targetCount: swarmTargets.length
+        }
+      });
+    }
+    if (abortSignal?.aborted) {
+      throw new DOMException("Pentest aborted by user", "AbortError");
+    }
+    if (swarmTargets.length === 0) {
+      const report = buildPentestReport([], {
+        target,
+        model,
+        sessionId: session.id,
+        mode
+      });
+      const mdPath = join3(session.rootPath, REPORT_FILENAME_MD);
+      const jsonPath = join3(session.rootPath, REPORT_FILENAME_JSON);
+      writeFileSync2(mdPath, renderMarkdown(report));
+      writeFileSync2(jsonPath, renderJson(report));
+      return {
+        findings: [],
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: mdPath
+      };
+    }
+    eventBus?.emit("workflow-phase-start", {
+      phase: "pentesting",
+      label: `Pentest Swarm (${swarmTargets.length} targets)`
+    });
+    const findingsRegistry = seams.registries.findings();
+    const completedCount = getCompletedAgentIds2(session).size;
+    if (completedCount < swarmTargets.length) {
+      await runPentestSwarm2({
+        targets: swarmTargets,
+        model,
+        session,
+        authConfig,
+        abortSignal,
+        findingsRegistry,
+        eventBus,
+        onStepFinish,
+        onCacheMetrics,
+        enableThinking,
+        thinkingEffort,
+        openAIReasoningEffort,
+        subagentSpawner: input.subagentSpawner,
+        languageModelMiddleware: input.languageModelMiddleware,
+        usageRecorder: input.usageRecorder,
+        streamIdFactory: input.streamIdFactory,
+        hooks: input.hooks,
+        seams
+      });
+    }
+    if (abortSignal?.aborted) {
+      throw new DOMException("Pentest aborted by user", "AbortError");
+    }
+    eventBus?.emit("workflow-phase-start", {
+      phase: "reporting",
+      label: "Report Generation"
+    });
+    await findingsRegistry.groupByRootCause();
+    const findings = [...findingsRegistry.getFindings()];
+    const report = buildPentestReport(findings, {
+      target,
+      model,
+      sessionId: session.id,
+      mode
+    });
+    const mdPath = join3(session.rootPath, REPORT_FILENAME_MD);
+    const jsonPath = join3(session.rootPath, REPORT_FILENAME_JSON);
+    writeFileSync2(mdPath, renderMarkdown(report));
+    writeFileSync2(jsonPath, renderJson(report));
+    const severityCounts = {};
+    for (const f of findings) {
+      const sev = (f.severity ?? "unknown").toLowerCase();
+      severityCounts[sev] = (severityCounts[sev] ?? 0) + 1;
+    }
+    eventBus?.emit("workflow-phase-complete", {
+      phase: "reporting",
+      summary: {
+        reportPath: mdPath,
+        findingsCount: findings.length,
+        findingsBySeverity: severityCounts
+      }
+    });
+    return {
+      findings,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+      reportPath: mdPath
+    };
+  } finally {
+    const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
+    writeExecutionMetrics({
+      sessionRootPath: session.rootPath,
+      runtime
+    });
+  }
+}
+async function runWhiteboxPhase(opts) {
+  const workflowInput = {
+    codebasePath: opts.codebasePath,
+    model: opts.model,
+    session: opts.session,
+    authConfig: opts.authConfig,
+    abortSignal: opts.abortSignal,
+    eventBus: opts.eventBus,
+    onStepFinish: opts.onStepFinish,
+    onCacheMetrics: opts.onCacheMetrics,
+    openAIReasoningEffort: opts.openAIReasoningEffort,
+    surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled,
+    subagentSpawner: opts.subagentSpawner,
+    hooks: opts.hooks,
+    seams: opts.seams
+  };
+  const result = await runWhiteboxAttackSurfaceWorkflow2(workflowInput);
+  return result.apps.flatMap((app) => [...app.pages, ...app.apiEndpoints].map((ep) => {
+    const grpc = toGrpcPentestContext(ep.transport, ep.grpc, ep.path);
+    return {
+      target: grpcAuthorityTarget(grpc, ep.path) ?? (ep.path.startsWith("http") ? ep.path : `${opts.baseTarget}${ep.path}`),
+      objectives: ep.pentestObjectives,
+      grpc
+    };
+  }));
+}
+async function runBlackboxPhase(opts) {
+  let lastMessages = [];
+  const agentInput = {
+    ...opts.hooks,
+    target: opts.target,
+    model: opts.model,
+    session: opts.session,
+    authConfig: opts.authConfig,
+    abortSignal: opts.abortSignal && opts.hooks?.abortSignal ? AbortSignal.any([opts.abortSignal, opts.hooks.abortSignal]) : opts.abortSignal ?? opts.hooks?.abortSignal,
+    eventBus: opts.eventBus,
+    subagentId: "attack-surface-agent",
+    onStepFinish: (e) => {
+      if (e.response.messages) {
+        lastMessages = e.response.messages;
+      }
+      opts.onStepFinish?.(e);
+    },
+    onCacheMetrics: opts.onCacheMetrics,
+    openAIReasoningEffort: opts.openAIReasoningEffort
+  };
+  const agent = new BlackboxAttackSurfaceAgent2(agentInput);
+  opts.eventBus?.emit("subagent-spawn", {
+    subagentId: "attack-surface-agent",
+    name: "Attack Surface Discovery",
+    input: { target: opts.target }
+  });
+  try {
+    const result = await agent.consume();
+    saveSubagentData2(opts.session, {
+      agentName: "attack-surface-agent",
+      target: opts.target,
+      status: "completed",
+      messages: lastMessages
+    });
+    opts.eventBus?.emit("subagent-complete", {
+      subagentId: "attack-surface-agent",
+      status: "completed"
+    });
+    return result.targets.map((t) => ({
+      target: t.target,
+      objectives: [t.objective]
+    }));
+  } catch (e) {
+    saveSubagentData2(opts.session, {
+      agentName: "attack-surface-agent",
+      target: opts.target,
+      status: "failed",
+      error: e instanceof Error ? e.message : String(e),
+      messages: lastMessages
+    });
+    opts.eventBus?.emit("subagent-complete", {
+      subagentId: "attack-surface-agent",
+      status: "failed"
+    });
+    throw e;
+  }
+}
+export { buildPentestReport, renderJson, renderMarkdown, REPORT_FILENAME_MD, REPORT_FILENAME_JSON, readExecutionMetrics, writeExecutionMetrics, createThreatModelPrompt, DEFAULT_CONCURRENCY2, runPentestSwarmTarget2, runPentestSwarm2, runPentestWorkflow2 };