@pensar/apex 2.6.1 → 2.7.0-canary.1572d9a4

package/build/{cli-d37a42dc.js → cli-2jz2jz06.js}

@@ -1,35 +1,38 @@
 import {
-  collectCommand,
   FindingsRegistry,
   inMemoryRegistryProvider,
   withFindingPersistedHook,
   assertDepth,
   inProcessSeams,
   resolveItemHooks,
+  spawnBatch2,
+  inProcessSubagentSpawner2
+} from "./cli-pndb7mh9.js";
+import {
+  collectCommand,
   toGrpcPentestContext,
   grpcAuthorityTarget,
-  inProcessSubagentSpawner,
   pLimit,
   PLAN_MODE_TOOL_NAMES,
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-58781vcf.js";
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-k2nwxta0.js";
+} from "./cli-8b25dhky.js";
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-xtc2t6me.js";
+} from "./cli-qs4msn6x.js";
 import {
   buildPentestReport,
   renderJson,
   renderMarkdown,
   REPORT_FILENAME_MD,
   REPORT_FILENAME_JSON
-} from "./cli-n2en7j5b.js";
+} from "./cli-n8mmw4c4.js";
 import {
   CodeAgent2
-} from "./cli-kb21qhvm.js";
+} from "./cli-rvybdhgn.js";
 import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
@@ -38,19 +41,19 @@ import {
   AppInfoSchema2,
   AppsDiscoveryResultSchema2,
   DiscoverySummarySchema2
-} from "./cli-ngq9dr8n.js";
+} from "./cli-wm8ech0x.js";
 import {
   createThreatModelPrompt
 } from "./cli-q126f6ef.js";
 import {
   hasToolCall,
   init_dist,
-  scopedLogger,
-  init_lazyLogger,
   init_session,
   createLogger,
-  init_structured
-} from "./cli-dpsw2fe6.js";
+  init_structured,
+  scopedLogger,
+  init_lazyLogger
+} from "./cli-e9v6zg6h.js";
 import {
   newSessionId,
   init_id
@@ -262,6 +265,28 @@ function loadSubagentMessages(session, key) {
     return [];
   }
 }
+function loadSubagentReportedFindings(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.reportedFindings) && data.reportedFindings.every((finding) => typeof finding === "string") ? data.reportedFindings : null;
+  } catch {
+    return null;
+  }
+}
+function loadSubagentObjectiveResults(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.objectiveResults) && data.objectiveResults.every((result) => result !== null && typeof result === "object" && typeof result.objective === "string" && typeof result.completed === "boolean" && (result.result === undefined || typeof result.result === "string")) ? data.objectiveResults : null;
+  } catch {
+    return null;
+  }
+}
 function saveSubagentData(session, data) {
   const subagentsDir = join2(session.rootPath, SUBAGENTS_DIR);
   mkdirSync(subagentsDir, { recursive: true });
@@ -287,6 +312,8 @@ function saveSubagentData(session, data) {
     toolCallCount,
     stepCount,
     findingsCount: data.findingsCount ?? 0,
+    reportedFindings: data.reportedFindings,
+    objectiveResults: data.objectiveResults,
     status: data.status,
     error: data.error,
     messages: data.messages,
@@ -734,7 +761,7 @@ This agent is responsible for **exactly one** endpoint. Do not document other en
 4. Call \`response\` with \`{ endpointsDocumented: 1, summary: "<one-line summary>" }\`.
 `;
 }
-async function runEndpointDocumentationAgent(opts) {
+function endpointDocumentationSpawnOptions(opts) {
   const {
     codebasePath,
     app,
@@ -749,12 +776,11 @@ async function runEndpointDocumentationAgent(opts) {
     onStepFinish,
     onCacheMetrics,
     openAIReasoningEffort,
+    reasoning,
     enableThinking,
     thinkingEffort,
     projectThreatModel,
     parentSubagentId,
-    agentLimiter,
-    subagentSpawner,
     hooks,
     mintChildId
   } = opts;
@@ -767,8 +793,7 @@ async function runEndpointDocumentationAgent(opts) {
     endpoint,
     frameworks
   });
-  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
-  const spawnChild = () => spawner.spawn({
+  return {
     spec: {
       type: "code",
       codebasePath,
@@ -780,6 +805,7 @@ async function runEndpointDocumentationAgent(opts) {
       attackSurfaceRegistry
     },
     runtime: {
+      findingPolicy: hooks?.findingPolicy,
       model,
       session,
       authConfig,
@@ -787,12 +813,14 @@ async function runEndpointDocumentationAgent(opts) {
       enableThinking,
       thinkingEffort,
       openAIReasoningEffort,
+      reasoning,
       onStepFinish,
       onCacheMetrics,
       backends: hooks?.backends,
       sandbox: hooks?.sandbox,
       languageModelMiddleware: hooks?.languageModelMiddleware,
       usageRecorder: hooks?.usageRecorder,
+      toolExecutionContext: hooks?.toolExecutionContext,
       streamIdFactory: hooks?.streamIdFactory
     },
     subagentId,
@@ -805,26 +833,25 @@ async function runEndpointDocumentationAgent(opts) {
       method: displayMethod,
       path: endpoint.path
     }
-  });
-  try {
-    await (agentLimiter ? agentLimiter(spawnChild) : spawnChild());
-    return true;
-  } catch (error) {
-    log3.error(`"${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-    return false;
-  }
+  };
 }
 async function runAppEndpointDocumentation(opts) {
   const { endpoints, ...shared } = opts;
   if (endpoints.length === 0)
     return;
-  const spawner = opts.subagentSpawner ?? inProcessSubagentSpawner;
+  const spawner = opts.subagentSpawner ?? inProcessSubagentSpawner2;
+  const requests = endpoints.map((endpoint) => endpointDocumentationSpawnOptions({ ...shared, endpoint }));
+  const results = await spawnBatch2(spawner, requests, {
+    concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY,
+    abortSignal: opts.abortSignal
+  }, opts.agentLimiter);
   let anyFailed = false;
-  await spawner.spawnMany(endpoints, async (endpoint) => {
-    const ok = await runEndpointDocumentationAgent({ ...shared, endpoint });
-    if (!ok)
+  for (const [index, result] of results.entries()) {
+    if (result.status === "rejected") {
       anyFailed = true;
-  }, { concurrency: ENDPOINT_DOCUMENTATION_CONCURRENCY });
+      log3.error(`"${requests[index].subagentId}" FAILED`, result.reason instanceof Error ? result.reason : undefined, { error: String(result.reason) });
+    }
+  }
   if (anyFailed) {
     throw new Error(`One or more endpoint documentation agents failed for app ${opts.app.name}`);
   }
@@ -7046,6 +7073,7 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
     onStepFinish,
     onCacheMetrics,
     openAIReasoningEffort,
+    reasoning,
     enableThinking,
     thinkingEffort,
     projectThreatModel,
@@ -7062,59 +7090,73 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
   const appNodeId = `app:${sanitizeName(app.name)}`;
   const hooksForApp = resolveItemHooks(sharedHooks, seams, app, appIndex);
   let failed = false;
-  const spawnDiscoveryAgent = async (type, objective) => {
+  const discoveryRequest = (type, objective) => {
     const subagentId = mintChildId(TASK_TYPE_LABELS[type]);
     log4.debug(`Phase 2: spawning agent id="${subagentId}" parent="${appNodeId}" (app="${app.name}", type=${type}, appType=${app.type})`);
-    const spawner = subagentSpawner ?? inProcessSubagentSpawner;
-    try {
-      await agentLimiter(() => spawner.spawn({
-        spec: {
-          type: "code",
-          codebasePath,
-          objective,
-          system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
-          excludeTools: ["document_app"],
-          responseSchema: DiscoverySummarySchema2,
-          projectThreatModel,
-          attackSurfaceRegistry
-        },
-        runtime: {
-          model,
-          session,
-          authConfig,
-          abortSignal,
-          enableThinking,
-          thinkingEffort,
-          openAIReasoningEffort,
-          onStepFinish,
-          onCacheMetrics,
-          backends: hooksForApp.backends,
-          sandbox: hooksForApp.sandbox,
-          languageModelMiddleware: hooksForApp.languageModelMiddleware,
-          usageRecorder: hooksForApp.usageRecorder,
-          streamIdFactory: hooksForApp.streamIdFactory
-        },
-        subagentId,
-        subagentName: TASK_TYPE_LABELS[type],
-        parentBus: eventBus,
-        parentSubagentId: appNodeId,
-        lifecycleInput: { app: app.name, type }
-      }));
-      log4.debug(`Phase 2: agent "${subagentId}" completed`);
-    } catch (error) {
-      log4.error(`Phase 2: agent "${subagentId}" FAILED`, error instanceof Error ? error : undefined, { error: String(error) });
-      failed = true;
+    return {
+      spec: {
+        type: "code",
+        codebasePath,
+        objective,
+        system: WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+        excludeTools: ["document_app"],
+        responseSchema: DiscoverySummarySchema2,
+        projectThreatModel,
+        attackSurfaceRegistry
+      },
+      runtime: {
+        findingPolicy: hooksForApp.findingPolicy,
+        model,
+        session,
+        authConfig,
+        abortSignal,
+        enableThinking,
+        thinkingEffort,
+        openAIReasoningEffort,
+        reasoning,
+        onStepFinish,
+        onCacheMetrics,
+        backends: hooksForApp.backends,
+        sandbox: hooksForApp.sandbox,
+        languageModelMiddleware: hooksForApp.languageModelMiddleware,
+        usageRecorder: hooksForApp.usageRecorder,
+        toolExecutionContext: hooksForApp.toolExecutionContext,
+        streamIdFactory: hooksForApp.streamIdFactory
+      },
+      subagentId,
+      subagentName: TASK_TYPE_LABELS[type],
+      parentBus: eventBus,
+      parentSubagentId: appNodeId,
+      lifecycleInput: { app: app.name, type }
+    };
+  };
+  const spawnDiscoveryAgents = async (requests) => {
+    const results = await spawnBatch2(subagentSpawner ?? inProcessSubagentSpawner2, requests, {
+      concurrency: requests.length,
+      abortSignal
+    }, agentLimiter);
+    for (const [index, result] of results.entries()) {
+      const subagentId = requests[index].subagentId;
+      if (result.status === "rejected") {
+        failed = true;
+        log4.error(`Phase 2: agent "${subagentId}" FAILED`, result.reason instanceof Error ? result.reason : undefined, { error: String(result.reason) });
+      } else {
+        log4.debug(`Phase 2: agent "${subagentId}" completed`);
+      }
     }
   };
-  const spawnPagesAgent = () => spawnDiscoveryAgent("pages", buildPagesDiscoveryObjective(codebasePath, app));
-  const spawnApiEndpointsAgent = () => spawnDiscoveryAgent("apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app));
-  const spawnCloudResourceAgent = () => spawnDiscoveryAgent("cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments));
+  const discoverPagesAndApi = () => spawnDiscoveryAgents([
+    discoveryRequest("pages", buildPagesDiscoveryObjective(codebasePath, app)),
+    discoveryRequest("apiEndpoints", buildApiEndpointsDiscoveryObjective(codebasePath, app))
+  ]);
   try {
     if (NON_SERVICE_TYPES.includes(app.type)) {
-      await spawnCloudResourceAgent();
+      await spawnDiscoveryAgents([
+        discoveryRequest("cloudResourceEndpoints", buildCloudResourceEndpointsObjective(codebasePath, app, environments))
+      ]);
     } else if (!surfaceIntegrationEnabled) {
       log4.debug(`${app.name}: legacy (surfaceIntegrationEnabled=false)`);
-      await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+      await discoverPagesAndApi();
     } else {
       const surfaceResult = mapAppWithSurface(join16(codebasePath, app.location), codebasePath, { isSingleAppRepo });
       if (surfaceResult.mode === "surface") {
@@ -7133,6 +7175,7 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
           onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
+          reasoning,
           enableThinking,
           thinkingEffort,
           projectThreatModel,
@@ -7144,11 +7187,12 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
         });
       } else {
         log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
-        await Promise.all([spawnPagesAgent(), spawnApiEndpointsAgent()]);
+        await discoverPagesAndApi();
       }
     }
-  } catch {
+  } catch (error) {
     failed = true;
+    log4.error(`Phase 2: app "${app.name}" FAILED`, error instanceof Error ? error : undefined, { error: String(error), app: app.name });
   }
   eventBus?.emit("subagent-complete", {
     subagentId: appNodeId,
@@ -7169,6 +7213,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onStepFinish,
     onCacheMetrics,
     openAIReasoningEffort,
+    reasoning,
     enableThinking,
     thinkingEffort,
     domains,
@@ -7204,6 +7249,7 @@ Trace changed shared libraries, deleted files, and root/build/deployment configu
     onStepFinish: (event) => onStepFinish?.(event),
     onCacheMetrics,
     openAIReasoningEffort,
+    reasoning,
     enableThinking,
     thinkingEffort,
     responseSchema: input.incremental ? IncrementalReconResultSchema : AppsDiscoveryResultSchema2,
@@ -7289,6 +7335,7 @@ Trace changed shared libraries, deleted files, and root/build/deployment configu
     onStepFinish,
     onCacheMetrics,
     openAIReasoningEffort,
+    reasoning,
     enableThinking,
     thinkingEffort,
     projectThreatModel,
@@ -7927,6 +7974,7 @@ async function runPentestSwarmTarget(target, index, input) {
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
+    reasoning,
     display,
     onError,
     hooks: sharedHooks,
@@ -7937,8 +7985,22 @@ async function runPentestSwarmTarget(target, index, input) {
   const entry = manifestEntries[index];
   const subagentId = entry.id;
   const subagentName = target.name ?? entry.name;
-  if (completedIds.has(subagentId))
-    return null;
+  if (completedIds.has(subagentId)) {
+    if (sharedHooks.findingPolicy !== "external")
+      return null;
+    const reportedFindings = loadSubagentReportedFindings(session, subagentId);
+    const objectiveResults = loadSubagentObjectiveResults(session, subagentId);
+    if (!reportedFindings || !objectiveResults) {
+      throw new Error(`Cannot resume externally graded pentest: findings or objective results for completed agent ${subagentId} are unavailable`);
+    }
+    return {
+      findings: [],
+      reportedFindings,
+      objectiveResults,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath
+    };
+  }
   const itemHooks = resolveItemHooks(sharedHooks, seams, target, index);
   const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
   const previousMessages = loadSubagentMessages(session, subagentId);
@@ -7990,6 +8052,7 @@ async function runPentestSwarmTarget(target, index, input) {
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort,
+        reasoning,
         display,
         ...itemHooks,
         abortSignal: childSignal
@@ -8030,19 +8093,27 @@ async function runPentestSwarmTarget(target, index, input) {
       enableThinking,
       thinkingEffort,
       openAIReasoningEffort,
+      reasoning,
       display,
       ...itemHooks,
       abortSignal: childSignal
     });
     const result = await agent.consume();
+    if (itemHooks.findingPolicy === "external" && (!Array.isArray(result.reportedFindings) || !Array.isArray(result.objectiveResults))) {
+      throw new Error(`Externally graded pentest worker ${subagentId} ended without structured findings and objective results`);
+    }
     saveSubagentData(session, {
       agentName: subagentId,
       target: target.target,
       objective: objectiveStr,
       status: "completed",
-      findingsCount: result.findings.length,
+      findingsCount: result.reportedFindings?.length ?? result.findings.length,
+      ...itemHooks.findingPolicy === "external" ? {
+        reportedFindings: result.reportedFindings,
+        objectiveResults: result.objectiveResults
+      } : {},
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent.userPrompt
     });
     updateManifestEntryStatus(session, subagentId, "completed");
@@ -8060,7 +8131,7 @@ async function runPentestSwarmTarget(target, index, input) {
       status: "failed",
       error: error instanceof Error ? error.message : String(error),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent?.userPrompt ?? ""
     });
     updateManifestEntryStatus(session, subagentId, "failed");
@@ -8090,6 +8161,7 @@ async function runPentestSwarm2(input) {
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
+    reasoning,
     display,
     subagentSpawner,
     languageModelMiddleware,
@@ -8100,13 +8172,14 @@ async function runPentestSwarm2(input) {
   } = input;
   const seams = inputSeams ?? inProcessSeams({ fanOut: hooks?.subagentSpawner ?? subagentSpawner });
   assertDepth(1, seams.limits);
-  const spawner = subagentSpawner ?? inProcessSubagentSpawner;
+  const spawner = subagentSpawner ?? inProcessSubagentSpawner2;
   const sharedHooks = {
     subagentSpawner: spawner,
     languageModelMiddleware,
     usageRecorder,
     streamIdFactory,
-    ...hooks
+    ...hooks,
+    findingPolicy: hooks?.findingPolicy ?? input.findingPolicy
   };
   const findingsRegistry = withFindingPersistedHook(rawFindingsRegistry, seams.hooks.onFindingPersisted);
   const completedIds = getCompletedAgentIds(session);
@@ -8126,6 +8199,7 @@ async function runPentestSwarm2(input) {
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
+    reasoning,
     display,
     onError,
     hooks: sharedHooks,
@@ -8135,11 +8209,14 @@ async function runPentestSwarm2(input) {
   };
   const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget(target, index, targetInput), { concurrency, abortSignal });
   finalizeManifest(session, manifestEntries, results);
+  if (sharedHooks.findingPolicy === "external" && results.some((result) => result === null)) {
+    throw new Error("Externally graded pentest has an incomplete swarm target; findings cannot be aggregated");
+  }
   return results;
 }
 async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-mcjdvwez.js");
+    const { runFastStrike } = await import("./fastStrike-efp0rjs3.js");
     return runFastStrike(input);
   }
   const {
@@ -8155,15 +8232,18 @@ async function runPentestWorkflow2(input) {
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
+    reasoning,
     prompt,
     threatModel,
     surfaceIntegrationEnabled
   } = input;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
   const seams = input.seams ?? inProcessSeams({
     fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
     registries: {
       findings: () => FindingsRegistry.fromDirectory(session.findingsPath, {
         model,
+        reasoning,
         authConfig,
         abortSignal,
         sessionId: session.id
@@ -8227,6 +8307,7 @@ ${combined}` : combined;
           onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
+          reasoning,
           surfaceIntegrationEnabled,
           subagentSpawner: input.subagentSpawner,
           hooks: {
@@ -8234,7 +8315,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           },
           seams
         });
@@ -8249,12 +8331,14 @@ ${combined}` : combined;
           onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
+          reasoning,
           hooks: {
             subagentSpawner: input.subagentSpawner,
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           }
         });
       }
@@ -8270,6 +8354,16 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
+      if (findingPolicy === "external") {
+        return {
+          findings: [],
+          reportedFindings: [],
+          objectiveResults: [],
+          findingsPath: session.findingsPath,
+          pocsPath: session.pocsPath,
+          reportPath: null
+        };
+      }
       const report = buildPentestReport([], {
         target,
         model,
@@ -8293,9 +8387,12 @@ ${combined}` : combined;
     });
     const findingsRegistry = seams.registries.findings();
     const completedCount = getCompletedAgentIds(session).size;
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm2({
+    let externalReportedFindings = [];
+    let externalObjectiveResults = [];
+    if (findingPolicy === "external" || completedCount < swarmTargets.length) {
+      const swarmResults = await runPentestSwarm2({
         targets: swarmTargets,
+        findingPolicy,
         model,
         session,
         authConfig,
@@ -8307,6 +8404,7 @@ ${combined}` : combined;
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort,
+        reasoning,
         subagentSpawner: input.subagentSpawner,
         languageModelMiddleware: input.languageModelMiddleware,
         usageRecorder: input.usageRecorder,
@@ -8314,10 +8412,26 @@ ${combined}` : combined;
         hooks: input.hooks,
         seams
       });
+      externalReportedFindings = swarmResults.flatMap((result) => result?.reportedFindings ?? []);
+      externalObjectiveResults = swarmResults.flatMap((result) => result?.objectiveResults ?? []);
     }
     if (abortSignal?.aborted) {
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
+    if (findingPolicy === "external") {
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "pentesting",
+        summary: { findingsCount: externalReportedFindings.length }
+      });
+      return {
+        findings: [],
+        reportedFindings: externalReportedFindings,
+        objectiveResults: externalObjectiveResults,
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: null
+      };
+    }
     eventBus?.emit("workflow-phase-start", {
       phase: "reporting",
       label: "Report Generation"
@@ -8372,6 +8486,7 @@ async function runWhiteboxPhase(opts) {
     onStepFinish: opts.onStepFinish,
     onCacheMetrics: opts.onCacheMetrics,
     openAIReasoningEffort: opts.openAIReasoningEffort,
+    reasoning: opts.reasoning,
     surfaceIntegrationEnabled: opts.surfaceIntegrationEnabled,
     subagentSpawner: opts.subagentSpawner,
     hooks: opts.hooks,
@@ -8405,7 +8520,8 @@ async function runBlackboxPhase(opts) {
       opts.onStepFinish?.(e);
     },
     onCacheMetrics: opts.onCacheMetrics,
-    openAIReasoningEffort: opts.openAIReasoningEffort
+    openAIReasoningEffort: opts.openAIReasoningEffort,
+    reasoning: opts.reasoning
   };
   const agent = new BlackboxAttackSurfaceAgent2(agentInput);
   opts.eventBus?.emit("subagent-spawn", {

package/build/{cli-az3xq70v.js → cli-4a8dsz2k.js}

@@ -1,9 +1,9 @@
 import {
-  scopedLogger,
-  init_lazyLogger,
   createLogger,
-  init_structured
-} from "./cli-dpsw2fe6.js";
+  init_structured,
+  scopedLogger,
+  init_lazyLogger
+} from "./cli-e9v6zg6h.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();