@pensar/apex 2.6.1 → 2.7.0-canary.1572d9a4

package/build/cli-pndb7mh9.js

@@ -0,0 +1,1193 @@
+import {
+  createLogger,
+  init_structured,
+  scopedLogger,
+  init_lazyLogger,
+  getModelSettings,
+  generateObjectResponse,
+  init_ai2
+} from "./cli-e9v6zg6h.js";
+import {
+  newSessionId,
+  init_id,
+  runWithNativeRolloutSession
+} from "./cli-se8ae8z3.js";
+import {
+  init_zod
+} from "./cli-3qznjsnr.js";
+import {
+  string,
+  number,
+  boolean,
+  array,
+  object
+} from "./cli-mz5pk30x.js";
+import {
+  require_src6
+} from "./cli-bb02pjt0.js";
+import {
+  __toESM
+} from "./cli-h6y3bt60.js";
+
+// src/core/eventBus.ts
+import { EventEmitter } from "node:events";
+var CHILD_BUS_FORWARD_POLICY = {
+  "text-delta": "forward",
+  "reasoning-delta": "forward",
+  "reasoning-start": "forward",
+  "reasoning-end": "forward",
+  "tool-call-start": "forward",
+  "tool-call-delta": "forward",
+  "tool-call-complete": "forward",
+  "tool-result": "forward",
+  "subagent-spawn": "forward",
+  "subagent-complete": "forward",
+  "step-finish": "forward",
+  "command-output": "forward",
+  error: "forward",
+  "trace-record": "forward",
+  "workflow-phase-start": "parent-only",
+  "workflow-phase-complete": "parent-only",
+  "app-analysis-progress": "parent-only"
+};
+var CHILD_BUS_FORWARDED_EVENTS = Object.keys(CHILD_BUS_FORWARD_POLICY).filter((key) => CHILD_BUS_FORWARD_POLICY[key] === "forward");
+
+class AgentEventBus {
+  emitter = new EventEmitter;
+  constructor() {
+    this.emitter.setMaxListeners(50);
+  }
+  on(event, handler) {
+    this.emitter.on(event, handler);
+    return this;
+  }
+  once(event, handler) {
+    this.emitter.once(event, handler);
+    return this;
+  }
+  off(event, handler) {
+    this.emitter.off(event, handler);
+    return this;
+  }
+  emit(event, payload) {
+    return this.emitter.emit(event, payload);
+  }
+  removeAllListeners(event) {
+    if (event) {
+      this.emitter.removeAllListeners(event);
+    } else {
+      this.emitter.removeAllListeners();
+    }
+    return this;
+  }
+  static attachChild(child, parent, childSessionId) {
+    if (!parent)
+      return;
+    for (const key of CHILD_BUS_FORWARDED_EVENTS) {
+      const forwardKey = key;
+      child.on(forwardKey, (payload) => {
+        const p = payload;
+        const isLifecycle = forwardKey === "subagent-spawn" || forwardKey === "subagent-complete";
+        if (isLifecycle) {
+          const next = { ...p };
+          if (!p.parentSubagentId)
+            next.parentSubagentId = childSessionId;
+          if (!p.parentSessionId)
+            next.parentSessionId = childSessionId;
+          parent.emit(forwardKey, next);
+          return;
+        }
+        const next = { ...p };
+        if (!p.subagentId)
+          next.subagentId = childSessionId;
+        if (!p.sessionId)
+          next.sessionId = childSessionId;
+        parent.emit(forwardKey, next);
+      });
+    }
+  }
+  emitStreamPart(chunk, ids) {
+    const ctx = typeof ids === "string" ? { subagentId: ids } : ids ?? {};
+    const subagentId = ctx.subagentId;
+    const sessionId = ctx.sessionId;
+    const messageId = ctx.messageId;
+    switch (chunk.type) {
+      case "text-delta":
+        this.emit("text-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.textPartId
+        });
+        break;
+      case "reasoning-start":
+        this.emit("reasoning-start", { subagentId, sessionId, messageId });
+        break;
+      case "reasoning-delta":
+        this.emit("reasoning-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId
+        });
+        break;
+      case "reasoning-end":
+        this.emit("reasoning-end", { subagentId, sessionId, messageId });
+        break;
+      case "tool-input-start":
+        this.emit("tool-call-start", {
+          toolCallId: chunk.id,
+          toolName: chunk.toolName,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(chunk.id)
+        });
+        break;
+      case "tool-input-delta":
+        this.emit("tool-call-delta", {
+          toolCallId: chunk.id,
+          argsTextDelta: chunk.delta,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(chunk.id)
+        });
+        break;
+      case "tool-call": {
+        const tc = chunk;
+        this.emit("tool-call-complete", {
+          toolCallId: tc.toolCallId,
+          toolName: tc.toolName,
+          args: tc.args ?? tc.input,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(tc.toolCallId)
+        });
+        break;
+      }
+      case "tool-result": {
+        if (chunk.preliminary)
+          break;
+        const tr = chunk;
+        this.emit("tool-result", {
+          toolCallId: tr.toolCallId,
+          toolName: tr.toolName,
+          result: tr.result ?? tr.output,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(tr.toolCallId)
+        });
+        break;
+      }
+      case "error":
+        this.emit("error", {
+          error: chunk.error,
+          subagentId
+        });
+        break;
+    }
+  }
+}
+
+// src/core/agents/offSecAgent/subagentSpawner.ts
+init_ai2();
+
+// src/core/utils/concurrency.ts
+var import_api = __toESM(require_src6(), 1);
+async function runWithBoundedConcurrency(items, concurrency, fn, abortSignal) {
+  const results = new Array(items.length).fill(null);
+  const parentContext = import_api.context.active();
+  let nextIdx = 0;
+  let completed = 0;
+  await new Promise((resolve) => {
+    if (items.length === 0) {
+      resolve();
+      return;
+    }
+    let active = 0;
+    function canLaunchMore() {
+      return active < concurrency && nextIdx < items.length && !abortSignal?.aborted;
+    }
+    function next() {
+      if (completed >= nextIdx && !canLaunchMore()) {
+        resolve();
+        return;
+      }
+      while (canLaunchMore()) {
+        const idx = nextIdx++;
+        active++;
+        import_api.context.with(parentContext, () => fn(items[idx], idx)).then((r) => {
+          results[idx] = r;
+        }).catch(() => {
+          results[idx] = null;
+        }).finally(() => {
+          active--;
+          completed++;
+          next();
+        });
+      }
+    }
+    next();
+  });
+  return results;
+}
+
+// src/core/findings/attackSurfaceRegistry.ts
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+function normalizeAssetUrl(url) {
+  let u = url.trim().toLowerCase();
+  const hashIdx = u.indexOf("#");
+  if (hashIdx !== -1)
+    u = u.substring(0, hashIdx);
+  const qIdx = u.indexOf("?");
+  if (qIdx !== -1)
+    u = u.substring(0, qIdx);
+  u = u.replace(/^https?:\/\//, "");
+  u = u.replace(/^www\./, "");
+  if (u.length > 1 && u.endsWith("/")) {
+    u = u.replace(/\/+$/, "");
+  }
+  return u;
+}
+function normalizeAssetName(name) {
+  return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function generateAssetFingerprint(asset) {
+  const normalizedName = normalizeAssetName(asset.assetName);
+  const assetType = asset.assetType.toLowerCase();
+  const url = asset.details?.url;
+  const appPrefix = asset.appName ? `${normalizeAssetName(asset.appName)}||` : "";
+  return {
+    urlKey: url ? `${appPrefix}${normalizeAssetUrl(url)}||${assetType}` : null,
+    nameKey: `${appPrefix}${normalizedName}||${assetType}`
+  };
+}
+
+class AttackSurfaceRegistry {
+  urlKeys = new Map;
+  nameKeys = new Map;
+  assets = [];
+  mutex = Promise.resolve();
+  get size() {
+    return this.assets.length;
+  }
+  getAssets() {
+    return [...this.assets];
+  }
+  static fromDirectory(assetsPath) {
+    const registry = new AttackSurfaceRegistry;
+    if (!existsSync(assetsPath))
+      return registry;
+    const files = readdirSync(assetsPath).filter((f) => f.endsWith(".json"));
+    for (const file of files) {
+      try {
+        const raw = readFileSync(join(assetsPath, file), "utf-8");
+        const asset = JSON.parse(raw);
+        if (asset && typeof asset.assetName === "string" && typeof asset.assetType === "string") {
+          registry.indexAsset(asset);
+        }
+      } catch {}
+    }
+    return registry;
+  }
+  static fromAssets(assets) {
+    const registry = new AttackSurfaceRegistry;
+    for (const a of assets) {
+      registry.indexAsset(a);
+    }
+    return registry;
+  }
+  isDuplicate(asset) {
+    const { urlKey, nameKey } = generateAssetFingerprint(asset);
+    if (urlKey) {
+      const urlMatch = this.urlKeys.get(urlKey);
+      if (urlMatch) {
+        return {
+          duplicate: true,
+          matchedAsset: urlMatch,
+          matchType: "exact-url"
+        };
+      }
+    }
+    const nameMatch = this.nameKeys.get(nameKey);
+    if (nameMatch) {
+      return {
+        duplicate: true,
+        matchedAsset: nameMatch,
+        matchType: "exact-name"
+      };
+    }
+    return { duplicate: false };
+  }
+  async register(asset) {
+    return new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        const check = this.isDuplicate(asset);
+        if (check.duplicate) {
+          resolve(check);
+        } else {
+          this.indexAsset(asset);
+          resolve({ duplicate: false });
+        }
+      });
+    });
+  }
+  async unregister(asset) {
+    return new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        this.removeAsset(asset);
+        resolve();
+      });
+    });
+  }
+  removeAsset(asset) {
+    const { urlKey, nameKey } = generateAssetFingerprint(asset);
+    if (urlKey && this.urlKeys.get(urlKey) === asset) {
+      this.urlKeys.delete(urlKey);
+    }
+    if (this.nameKeys.get(nameKey) === asset) {
+      this.nameKeys.delete(nameKey);
+    }
+    const idx = this.assets.indexOf(asset);
+    if (idx !== -1) {
+      this.assets.splice(idx, 1);
+    }
+  }
+  indexAsset(asset) {
+    const { urlKey, nameKey } = generateAssetFingerprint(asset);
+    if (urlKey && !this.urlKeys.has(urlKey)) {
+      this.urlKeys.set(urlKey, asset);
+    }
+    if (!this.nameKeys.has(nameKey)) {
+      this.nameKeys.set(nameKey, asset);
+    }
+    this.assets.push(asset);
+  }
+}
+
+// src/core/findings/registry.ts
+init_zod();
+init_ai2();
+init_structured();
+init_lazyLogger();
+import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+var log = scopedLogger(() => createLogger("findings:registry"));
+var VULN_CLASS_PATTERNS = [
+  [/sql\s*injection/i, "sql-injection"],
+  [/command\s*injection/i, "command-injection"],
+  [/remote\s*code\s*execution|(\b)rce(\b)/i, "rce"],
+  [/server[\s-]*side\s*request\s*forgery|(\b)ssrf(\b)/i, "ssrf"],
+  [/cross[\s-]*site\s*request\s*forgery|(\b)csrf(\b)/i, "csrf"],
+  [
+    /path\s*traversal|directory\s*traversal|local\s*file\s*inclusion|\blfi\b/i,
+    "path-traversal"
+  ],
+  [
+    /\bmissing\s*auth|\bno\s*auth|unauthenticated\s+access/i,
+    "missing-authentication"
+  ],
+  [/\bidor\b|insecure\s*direct\s*object/i, "idor"],
+  [/\bxss\b|cross[\s-]*site\s*scripting/i, "xss"],
+  [/missing\s*content\s*security\s*policy|missing\s*csp\b/i, "missing-csp"],
+  [/\bcors\b|cross[\s-]*origin/i, "cors"],
+  [/authentication\s*bypass|auth\s*bypass/i, "auth-bypass"],
+  [/privilege\s*escalation/i, "privilege-escalation"],
+  [
+    /information\s*disclosure|sensitive\s*data\s*exposure/i,
+    "information-disclosure"
+  ],
+  [/open\s*redirect/i, "open-redirect"],
+  [
+    /missing.*rate[\s-]*limit|rate[\s-]*limit.*missing|no\s*rate[\s-]*limit/i,
+    "missing-rate-limiting"
+  ],
+  [
+    /user[\s-]*enumeration|account[\s-]*enumeration|email[\s-]*enumeration/i,
+    "user-enumeration"
+  ],
+  [
+    /hardcoded[\s-]*credential|hardcoded[\s-]*password|hardcoded[\s-]*key|exposed[\s-]*api[\s-]*key/i,
+    "hardcoded-credentials"
+  ],
+  [/captcha[\s-]*bypass|missing[\s-]*captcha/i, "captcha-bypass"],
+  [/missing.*header|security\s*header/i, "missing-security-header"]
+];
+var URL_PATH_PATTERN = /(?:https?:\/\/[^\s]+|\/[a-z0-9_\-/{}.:]+|\b(?:endpoint|url|path|route)\b)/gi;
+function extractVulnClass(title) {
+  const t = title.trim();
+  for (const [pattern, cls] of VULN_CLASS_PATTERNS) {
+    if (pattern.test(t))
+      return cls;
+  }
+  return t.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").substring(0, 60);
+}
+function classifyFromContent(finding) {
+  const titleClass = extractVulnClass(finding.title);
+  if (titleClass === "idor") {
+    const corpus = `${finding.description ?? ""} ${finding.evidence ?? ""}`;
+    const missingAuthPattern = /no\s+authentication|unauthenticated|without\s+authentication|PR:N|PR=N/i;
+    if (missingAuthPattern.test(corpus)) {
+      return "missing-authentication";
+    }
+  }
+  return titleClass;
+}
+function extractTitleStem(title) {
+  return title.replace(URL_PATH_PATTERN, "").replace(/[^a-zA-Z0-9 ]/g, " ").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function normalizeEndpoint(endpoint) {
+  let e = endpoint.trim().toLowerCase();
+  const hashIdx = e.indexOf("#");
+  if (hashIdx !== -1)
+    e = e.substring(0, hashIdx);
+  const qIdx = e.indexOf("?");
+  if (qIdx !== -1)
+    e = e.substring(0, qIdx);
+  if (e.length > 1 && e.endsWith("/")) {
+    e = e.replace(/\/+$/, "");
+  }
+  return e;
+}
+function generateFingerprint(finding) {
+  const vulnClass = classifyFromContent(finding);
+  const stem = extractTitleStem(finding.title);
+  const endpoint = normalizeEndpoint(finding.endpoint);
+  return {
+    exactKey: `${endpoint}||${vulnClass}`,
+    appWideKey: stem
+  };
+}
+var SemanticDedupResultSchema = object({
+  isDuplicate: boolean().describe("Whether the new finding is a duplicate of an existing one"),
+  matchedIndex: number().optional().describe("1-based index of the matched existing finding, if duplicate"),
+  reasoning: string().describe("Brief explanation of why this is or is not a duplicate")
+});
+var SEMANTIC_DEDUP_SYSTEM = `You are a security finding deduplication specialist. Your task is to determine whether a new vulnerability finding is a duplicate of any existing findings.
+
+Two findings are duplicates if they describe the SAME underlying vulnerability, even if:
+- They use different phrasing or terminology
+- They affect different endpoints but share the same root cause
+- One is more specific/detailed than the other
+
+Two findings are NOT duplicates if they describe genuinely different vulnerabilities, even if:
+- They affect the same endpoint
+- They are the same class of vulnerability but with different root causes (e.g., reflected XSS vs stored XSS)
+
+Be conservative: when in doubt, mark as NOT a duplicate. It is better to allow a borderline finding through than to suppress a genuinely new one.`;
+var MAX_SEMANTIC_DEDUP_FINDINGS = 25;
+function buildSemanticDedupPrompt(newFinding, existingFindings) {
+  const capped = existingFindings.slice(-MAX_SEMANTIC_DEDUP_FINDINGS);
+  const offset = existingFindings.length - capped.length;
+  const existingList = capped.map((f, i) => `${offset + i + 1}. [${f.severity}] "${f.title}" — endpoint: ${f.endpoint}
+   Description: ${f.description.substring(0, 200)}`).join(`
+
+`);
+  return `## New Finding
+Title: "${newFinding.title}"
+Endpoint: ${newFinding.endpoint}
+Severity: ${newFinding.severity}
+Description: ${newFinding.description.substring(0, 300)}
+
+## Existing Findings (${existingFindings.length} total${offset > 0 ? `, showing last ${capped.length}` : ""})
+${existingList}
+
+Is the new finding a duplicate of any existing finding?`;
+}
+var SEVERITY_RANK = {
+  CRITICAL: 4,
+  HIGH: 3,
+  MEDIUM: 2,
+  LOW: 1
+};
+function maxSeverity(severities) {
+  return severities.reduce((acc, s) => SEVERITY_RANK[s] > SEVERITY_RANK[acc] ? s : acc, "LOW");
+}
+var RootCauseGroupResultSchema = object({
+  groups: array(object({
+    groupId: string().describe("Short kebab-case identifier for the group"),
+    findingIndices: array(number()).describe("0-based indices of findings that share this root cause"),
+    rootCause: string().describe("Brief description of the shared underlying misconfiguration or weakness")
+  }))
+});
+var ROOT_CAUSE_GROUPING_SYSTEM = `You are a security finding analyst. Your task is to identify findings that share a common root cause.
+
+These are NOT duplicates — they are distinct findings that stem from the same underlying misconfiguration, weakness, or architectural issue. Examples:
+- "Email Enumeration via Forgot Password" and "Username Enumeration via Cognito Lockout Response" both stem from Cognito leaking user-existence information
+- "Missing Rate Limiting on Email API" and "Unauthenticated Email Sending via SES API" on the same endpoint — the unauthenticated access is the root cause that enables both
+- Multiple IDOR findings on different endpoints that all stem from missing authorization middleware
+
+Group findings when:
+1. One finding enables or is prerequisite to another
+2. Both stem from the same underlying misconfiguration (e.g. same missing middleware, same leaky service)
+3. Fixing the root cause would resolve or mitigate all findings in the group
+
+Do NOT group findings that merely share a vulnerability class (e.g. two unrelated XSS on different endpoints with different root causes).
+
+Return an empty groups array if no findings share a root cause.`;
+function buildRootCauseGroupingPrompt(findings) {
+  const list = findings.map((f, i) => `${i}. [${f.severity}] "${f.title}" — endpoint: ${f.endpoint}
+   Description: ${f.description.substring(0, 200)}`).join(`
+
+`);
+  return `## Findings (${findings.length} total)
+${list}
+
+Which findings share a common root cause? Return groups using 0-based indices.`;
+}
+
+class FindingsRegistry {
+  exactKeys = new Map;
+  appWideKeys = new Map;
+  findings = [];
+  model;
+  reasoning;
+  authConfig;
+  abortSignal;
+  sessionId;
+  languageModelMiddleware;
+  usageRecorder;
+  mutex = Promise.resolve();
+  constructor(opts) {
+    this.model = opts?.model;
+    this.reasoning = opts?.reasoning;
+    this.authConfig = opts?.authConfig;
+    this.abortSignal = opts?.abortSignal;
+    this.sessionId = opts?.sessionId;
+    this.languageModelMiddleware = opts?.languageModelMiddleware;
+    this.usageRecorder = opts?.usageRecorder;
+  }
+  get size() {
+    return this.findings.length;
+  }
+  getFindings() {
+    return [...this.findings];
+  }
+  static fromDirectory(findingsPath, opts) {
+    const registry = new FindingsRegistry(opts);
+    if (!existsSync2(findingsPath))
+      return registry;
+    const files = readdirSync2(findingsPath).filter((f) => f.endsWith(".json"));
+    log.debug(`fromDirectory: path=${findingsPath}, jsonFiles=${files.length}`);
+    for (const file of files) {
+      try {
+        const raw = readFileSync2(join2(findingsPath, file), "utf-8");
+        const finding = JSON.parse(raw);
+        if (finding && typeof finding.title === "string" && typeof finding.endpoint === "string") {
+          registry.indexFinding(finding);
+          log.debug(`fromDirectory: indexed "${finding.title}" endpoint="${finding.endpoint}" (file=${file})`);
+        } else {
+          log.debug(`fromDirectory: skipped (missing title/endpoint) file=${file}`);
+        }
+      } catch {
+        log.debug(`fromDirectory: skipped (malformed) file=${file}`);
+      }
+    }
+    log.debug(`fromDirectory: registry initialized with ${registry.size} findings indexed`);
+    return registry;
+  }
+  static fromFindings(findings, opts) {
+    const registry = new FindingsRegistry(opts);
+    for (const f of findings) {
+      registry.indexFinding(f);
+    }
+    return registry;
+  }
+  isDuplicate(finding) {
+    const { exactKey, appWideKey } = generateFingerprint(finding);
+    const exactMatch = this.exactKeys.get(exactKey);
+    if (exactMatch) {
+      return {
+        duplicate: true,
+        matchedFinding: exactMatch,
+        matchType: "exact"
+      };
+    }
+    const appWideMatch = this.appWideKeys.get(appWideKey);
+    if (appWideMatch) {
+      return {
+        duplicate: true,
+        matchedFinding: appWideMatch,
+        matchType: "application-wide"
+      };
+    }
+    return { duplicate: false };
+  }
+  async register(finding) {
+    log.debug(`register: checking "${finding.title}" endpoint="${finding.endpoint}"`);
+    const fastResult = await new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        const check = this.isDuplicate(finding);
+        if (check.duplicate) {
+          log.debug(`register: DUPLICATE (${check.matchType}) "${finding.title}" matched="${check.matchedFinding?.title}"`);
+          resolve(check);
+        } else if (!this.model || this.findings.length === 0) {
+          this.indexFinding(finding);
+          log.debug(`register: UNIQUE (Tier 1+2, no LLM needed) "${finding.title}" — registry size=${this.size}`);
+          resolve({ duplicate: false });
+        } else {
+          log.debug(`register: Tier 1+2 pass — proceeding to Tier 3 LLM check for "${finding.title}"`);
+          resolve(null);
+        }
+      });
+    });
+    if (fastResult !== null)
+      return fastResult;
+    const snapshot = this.getFindings();
+    let semanticResult = { duplicate: false };
+    try {
+      semanticResult = await this.semanticDedup(finding, snapshot);
+    } catch {
+      log.warn(`register: Tier 3 LLM error for "${finding.title}" — falling back to Tier 1+2 only`);
+    }
+    if (semanticResult.duplicate) {
+      log.debug(`register: DUPLICATE (semantic/Tier 3) "${finding.title}" matched="${semanticResult.matchedFinding?.title}"`);
+      return semanticResult;
+    }
+    return new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        const recheck = this.isDuplicate(finding);
+        if (recheck.duplicate) {
+          log.debug(`register: DUPLICATE (race re-check, ${recheck.matchType}) "${finding.title}" matched="${recheck.matchedFinding?.title}"`);
+          resolve(recheck);
+        } else {
+          this.indexFinding(finding);
+          log.debug(`register: UNIQUE (all tiers passed) "${finding.title}" — registry size=${this.size}`);
+          resolve({ duplicate: false });
+        }
+      });
+    });
+  }
+  async semanticDedup(finding, existingFindings) {
+    if (!this.model || existingFindings.length === 0) {
+      return { duplicate: false };
+    }
+    const prompt = buildSemanticDedupPrompt(finding, existingFindings);
+    const result = await generateObjectResponse({
+      model: this.model,
+      reasoning: this.reasoning,
+      schema: SemanticDedupResultSchema,
+      prompt,
+      system: SEMANTIC_DEDUP_SYSTEM,
+      authConfig: this.authConfig,
+      abortSignal: this.abortSignal,
+      sessionId: this.sessionId,
+      languageModelMiddleware: this.languageModelMiddleware,
+      usageRecorder: this.usageRecorder,
+      operation: "apex.finding.deduplicate"
+    });
+    if (result.isDuplicate && result.matchedIndex != null) {
+      const idx = result.matchedIndex - 1;
+      const matched = existingFindings[idx];
+      if (matched) {
+        return {
+          duplicate: true,
+          matchedFinding: matched,
+          matchType: "semantic"
+        };
+      }
+    }
+    return { duplicate: false };
+  }
+  async unregister(finding) {
+    return new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        this.removeFinding(finding);
+        resolve();
+      });
+    });
+  }
+  async groupByRootCause() {
+    if (!this.model || this.findings.length < 2) {
+      return [];
+    }
+    const snapshot = [...this.findings];
+    const prompt = buildRootCauseGroupingPrompt(snapshot);
+    let result;
+    try {
+      result = await generateObjectResponse({
+        model: this.model,
+        reasoning: this.reasoning,
+        schema: RootCauseGroupResultSchema,
+        prompt,
+        system: ROOT_CAUSE_GROUPING_SYSTEM,
+        authConfig: this.authConfig,
+        abortSignal: this.abortSignal,
+        sessionId: this.sessionId,
+        languageModelMiddleware: this.languageModelMiddleware,
+        usageRecorder: this.usageRecorder,
+        operation: "apex.finding.root-cause"
+      });
+    } catch {
+      log.warn("groupByRootCause: LLM error — skipping root-cause grouping");
+      return [];
+    }
+    const sanitised = [];
+    await new Promise((resolve) => {
+      this.mutex = this.mutex.then(() => {
+        const baseSeverities = snapshot.map((f) => f.severity);
+        for (const group of result.groups) {
+          const validIndices = group.findingIndices.filter((i) => i >= 0 && i < snapshot.length);
+          if (validIndices.length < 2)
+            continue;
+          const normalizedSeverity = maxSeverity(validIndices.map((i) => baseSeverities[i]));
+          const leadFindingIndex = validIndices.reduce((best, i) => {
+            const aRank = SEVERITY_RANK[baseSeverities[i]];
+            const bRank = SEVERITY_RANK[baseSeverities[best]];
+            if (aRank !== bRank) {
+              return aRank > bRank ? i : best;
+            }
+            return (snapshot[i].description?.length ?? 0) > (snapshot[best].description?.length ?? 0) ? i : best;
+          }, validIndices[0]);
+          sanitised.push({
+            groupId: group.groupId,
+            findingIndices: validIndices,
+            rootCause: group.rootCause,
+            normalizedSeverity,
+            leadFindingIndex
+          });
+          for (const idx of validIndices) {
+            const finding = snapshot[idx];
+            finding.rootCauseGroup = group.groupId;
+            finding.severity = normalizedSeverity;
+            finding.rootCauseLead = idx === leadFindingIndex;
+            finding.relatedFindings = validIndices.filter((i) => i !== idx).map((i) => snapshot[i]?.title);
+          }
+        }
+        resolve();
+      });
+    });
+    return sanitised;
+  }
+  removeFinding(finding) {
+    const { exactKey, appWideKey } = generateFingerprint(finding);
+    if (this.exactKeys.get(exactKey) === finding) {
+      this.exactKeys.delete(exactKey);
+    }
+    if (this.appWideKeys.get(appWideKey) === finding) {
+      this.appWideKeys.delete(appWideKey);
+    }
+    const idx = this.findings.indexOf(finding);
+    if (idx !== -1) {
+      this.findings.splice(idx, 1);
+    }
+  }
+  indexFinding(finding) {
+    const { exactKey, appWideKey } = generateFingerprint(finding);
+    if (!this.exactKeys.has(exactKey)) {
+      this.exactKeys.set(exactKey, finding);
+    }
+    if (!this.appWideKeys.has(appWideKey)) {
+      this.appWideKeys.set(appWideKey, finding);
+    }
+    this.findings.push(finding);
+  }
+}
+
+// src/core/workflows/seams.ts
+init_id();
+function inProcessSpawnMany(items, worker, opts) {
+  return runWithBoundedConcurrency(items, opts.concurrency, worker, opts.abortSignal);
+}
+var inProcessConcurrencyRunner = {
+  spawnMany: inProcessSpawnMany
+};
+var inMemoryRegistryProvider = {
+  findings: () => new FindingsRegistry,
+  attackSurface: () => new AttackSurfaceRegistry
+};
+var randomSessionIdFactory = {
+  newSessionId: () => newSessionId()
+};
+var noBrowserSessionProvider = {
+  forChild: () => {
+    return;
+  }
+};
+var noopOrchestrationHooks = {};
+function withFindingPersistedHook(registry, onFindingPersisted) {
+  if (!onFindingPersisted)
+    return registry;
+  return {
+    get size() {
+      return registry.size;
+    },
+    getFindings: () => registry.getFindings(),
+    isDuplicate: (finding) => registry.isDuplicate(finding),
+    groupByRootCause: () => registry.groupByRootCause(),
+    unregister: (finding) => registry.unregister(finding),
+    async register(finding) {
+      const result = await registry.register(finding);
+      if (!result.duplicate)
+        await onFindingPersisted(finding);
+      return result;
+    }
+  };
+}
+var DEFAULT_MAX_DEPTH = 3;
+var DEFAULT_MAX_CONCURRENT_CHILDREN = 10;
+var defaultLimits = {
+  maxDepth: DEFAULT_MAX_DEPTH,
+  maxConcurrentChildren: DEFAULT_MAX_CONCURRENT_CHILDREN
+};
+
+class WorkflowLimitExceededError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "WorkflowLimitExceededError";
+  }
+}
+function assertDepth(depth, limits) {
+  if (depth > limits.maxDepth) {
+    throw new WorkflowLimitExceededError(`workflow depth ${depth} exceeds maxDepth ${limits.maxDepth}`);
+  }
+}
+function withConcurrencyLimit(runner, limits) {
+  return {
+    async spawnMany(items, worker, opts) {
+      if (opts.concurrency > limits.maxConcurrentChildren) {
+        throw new WorkflowLimitExceededError(`concurrency ${opts.concurrency} exceeds maxConcurrentChildren ${limits.maxConcurrentChildren}`);
+      }
+      return runner.spawnMany(items, worker, opts);
+    }
+  };
+}
+function inProcessSeams(overrides) {
+  const limits = overrides?.limits ? { ...defaultLimits, ...overrides.limits } : defaultLimits;
+  return {
+    fanOut: withConcurrencyLimit(overrides?.fanOut ?? inProcessConcurrencyRunner, limits),
+    registries: overrides?.registries ?? inMemoryRegistryProvider,
+    ids: overrides?.ids ?? randomSessionIdFactory,
+    browser: overrides?.browser ?? noBrowserSessionProvider,
+    hooks: overrides?.hooks ?? noopOrchestrationHooks,
+    limits,
+    hooksForItem: overrides?.hooksForItem
+  };
+}
+function resolveItemHooks(hooks, seams, item, index) {
+  const itemHooks = seams.hooksForItem?.(item, index);
+  return {
+    ...hooks,
+    contextRecorder: undefined,
+    inferenceRecorder: undefined,
+    toolExecutionRecorder: undefined,
+    ...itemHooks,
+    ...hooks?.findingPolicy === "external" ? { findingPolicy: "external" } : {}
+  };
+}
+
+// src/core/agents/offSecAgent/subagentSpawner.ts
+async function spawnBatch2(spawner, requests, opts, limiter) {
+  if (spawner.spawnBatch) {
+    if (limiter && !spawner.supportsBatchLimiter) {
+      throw new Error("Batch spawner must support the shared child limiter before scheduling limited batches");
+    }
+    return spawner.spawnBatch(requests, { ...opts, limiter });
+  }
+  const results = await spawner.spawnMany(requests, async (request) => {
+    try {
+      const run = () => spawner.spawn(request);
+      return {
+        status: "fulfilled",
+        value: await (limiter ? limiter(run) : run())
+      };
+    } catch (reason) {
+      return { status: "rejected", reason };
+    }
+  }, opts);
+  return results.map((result) => {
+    if (result === null) {
+      opts.abortSignal?.throwIfAborted();
+      throw new Error("Subagent batch lost a result");
+    }
+    return result;
+  });
+}
+async function runSpawnedPentestWorker(spec, input) {
+  const { TargetedPentestAgent } = await import("./agent-p8cezgbb.js");
+  const hooks = resolveItemHooks(input.hooks, input.seams, spec, 0);
+  const agent = new TargetedPentestAgent({
+    target: spec.target,
+    grpc: spec.grpc,
+    systemScope: spec.systemScope,
+    objectives: spec.objectives,
+    context: spec.context,
+    role: spec.role,
+    findingsRegistry: input.findingsRegistry,
+    browserSession: input.browserSession,
+    ...getModelSettings(input),
+    session: input.session,
+    onStepFinish: input.onStepFinish,
+    onCacheMetrics: input.onCacheMetrics,
+    eventBus: input.eventBus,
+    subagentId: input.subagentId,
+    subagentName: input.subagentName,
+    environmentVariables: input.environmentVariables,
+    secretValues: input.secretValues,
+    display: input.display,
+    ...hooks,
+    abortSignal: input.abortSignal && hooks.abortSignal ? AbortSignal.any([input.abortSignal, hooks.abortSignal]) : input.abortSignal ?? hooks.abortSignal
+  });
+  input.onAgentConstructed?.(agent);
+  return agent.consume();
+}
+var runPentestChild = async (spec, ctx) => {
+  let constructed;
+  const workerSpec = {
+    target: spec.target,
+    grpc: spec.grpc,
+    systemScope: spec.systemScope,
+    objectives: spec.objectives,
+    context: spec.context,
+    role: spec.role
+  };
+  const workerInput = {
+    ...getModelSettings(ctx),
+    session: ctx.session,
+    abortSignal: ctx.abortSignal,
+    onStepFinish: ctx.onStepFinish,
+    onCacheMetrics: ctx.onCacheMetrics,
+    eventBus: ctx.eventBus,
+    subagentId: ctx.subagentId,
+    subagentName: ctx.subagentName,
+    findingsRegistry: spec.findingsRegistry,
+    browserSession: spec.browserSession,
+    environmentVariables: ctx.environmentVariables,
+    secretValues: ctx.secretValues,
+    display: ctx.display,
+    hooks: {
+      findingPolicy: ctx.findingPolicy,
+      backends: ctx.backends,
+      sandbox: ctx.sandbox,
+      languageModelMiddleware: ctx.languageModelMiddleware,
+      usageRecorder: ctx.usageRecorder,
+      toolExecutionContext: ctx.toolExecutionContext,
+      streamIdFactory: ctx.streamIdFactory
+    },
+    seams: inProcessSeams(),
+    onAgentConstructed: (agent) => {
+      constructed = agent;
+    }
+  };
+  return {
+    run: () => runSpawnedPentestWorker(workerSpec, workerInput),
+    drained: () => constructed?.drained ?? Promise.resolve()
+  };
+};
+var runCodeChild = async (spec, ctx) => {
+  const { CodeAgent } = await import("./agent-vvdqga09.js");
+  const agent = new CodeAgent({
+    findingPolicy: ctx.findingPolicy,
+    codebasePath: spec.codebasePath,
+    objective: spec.objective,
+    system: spec.system,
+    responseSchema: spec.responseSchema,
+    stopWhen: spec.stopWhen,
+    excludeTools: spec.excludeTools,
+    projectThreatModel: spec.projectThreatModel,
+    attackSurfaceRegistry: spec.attackSurfaceRegistry,
+    ...getModelSettings(ctx),
+    session: ctx.session,
+    abortSignal: ctx.abortSignal,
+    eventBus: ctx.eventBus,
+    subagentId: ctx.subagentId,
+    subagentName: ctx.subagentName,
+    sandbox: ctx.sandbox,
+    backends: ctx.backends,
+    display: ctx.display,
+    onStepFinish: ctx.onStepFinish,
+    onCacheMetrics: ctx.onCacheMetrics,
+    languageModelMiddleware: ctx.languageModelMiddleware,
+    usageRecorder: ctx.usageRecorder,
+    toolExecutionContext: ctx.toolExecutionContext,
+    streamIdFactory: ctx.streamIdFactory
+  });
+  return { run: () => agent.consume(), drained: () => agent.drained };
+};
+var runWhiteboxChild = async (spec, ctx) => {
+  const { WhiteboxAttackSurfaceAgent } = await import("./index-3t41p258.js");
+  const agent = new WhiteboxAttackSurfaceAgent({
+    findingPolicy: ctx.findingPolicy,
+    codebasePath: spec.codebasePath,
+    attackSurfaceRegistry: spec.attackSurfaceRegistry,
+    ...getModelSettings(ctx),
+    session: ctx.session,
+    abortSignal: ctx.abortSignal,
+    eventBus: ctx.eventBus,
+    subagentId: ctx.subagentId,
+    subagentName: ctx.subagentName,
+    sandbox: ctx.sandbox,
+    backends: ctx.backends,
+    languageModelMiddleware: ctx.languageModelMiddleware,
+    usageRecorder: ctx.usageRecorder,
+    toolExecutionContext: ctx.toolExecutionContext,
+    streamIdFactory: ctx.streamIdFactory
+  });
+  return { run: () => agent.consume(), drained: () => agent.drained };
+};
+var runBlackboxChild = async (spec, ctx) => {
+  const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-ct8bejef.js");
+  const agent = new BlackboxAttackSurfaceAgent({
+    findingPolicy: ctx.findingPolicy,
+    target: spec.target,
+    attackSurfaceRegistry: spec.attackSurfaceRegistry,
+    ...getModelSettings(ctx),
+    session: ctx.session,
+    abortSignal: ctx.abortSignal,
+    eventBus: ctx.eventBus,
+    subagentId: ctx.subagentId,
+    sandbox: ctx.sandbox,
+    backends: ctx.backends,
+    languageModelMiddleware: ctx.languageModelMiddleware,
+    usageRecorder: ctx.usageRecorder,
+    toolExecutionContext: ctx.toolExecutionContext,
+    streamIdFactory: ctx.streamIdFactory
+  });
+  return { run: () => agent.consume(), drained: () => agent.drained };
+};
+var runAuthChild = async (spec, ctx) => {
+  const { runAuthenticationAgent } = await import("./agent-vaq31je6.js");
+  return {
+    run: () => runAuthenticationAgent({
+      findingPolicy: ctx.findingPolicy,
+      target: spec.target,
+      authHints: spec.authHints,
+      session: ctx.session,
+      ...getModelSettings(ctx),
+      abortSignal: ctx.abortSignal,
+      eventBus: ctx.eventBus,
+      subagentId: ctx.subagentId,
+      subagentName: ctx.subagentName,
+      environmentVariables: ctx.environmentVariables,
+      secretValues: ctx.secretValues,
+      backends: ctx.backends,
+      languageModelMiddleware: ctx.languageModelMiddleware,
+      usageRecorder: ctx.usageRecorder,
+      toolExecutionContext: ctx.toolExecutionContext,
+      streamIdFactory: ctx.streamIdFactory
+    })
+  };
+};
+var runJudgeChild = async (spec, ctx) => {
+  const { judgeFinding } = await import("./index-np405b9e.js");
+  return {
+    run: () => judgeFinding(spec.judgeInput, {
+      waitForDrain: spec.waitForDrain,
+      ...getModelSettings(ctx),
+      session: ctx.session,
+      abortSignal: ctx.abortSignal,
+      eventBus: ctx.eventBus,
+      subagentId: ctx.subagentId,
+      subagentName: ctx.subagentName,
+      sandbox: ctx.sandbox,
+      backends: ctx.backends,
+      target: spec.target,
+      languageModelMiddleware: ctx.languageModelMiddleware,
+      usageRecorder: ctx.usageRecorder,
+      toolExecutionContext: ctx.toolExecutionContext,
+      streamIdFactory: ctx.streamIdFactory
+    })
+  };
+};
+var RUNNERS = {
+  pentest: runPentestChild,
+  code: runCodeChild,
+  "whitebox-attack-surface": runWhiteboxChild,
+  "blackbox-attack-surface": runBlackboxChild,
+  authentication: runAuthChild,
+  "finding-judge": runJudgeChild
+};
+function drainBounded(drained, graceMs) {
+  return Promise.race([
+    drained?.catch(() => {}) ?? Promise.resolve(),
+    new Promise((resolve) => {
+      setTimeout(resolve, graceMs).unref?.();
+    })
+  ]);
+}
+
+class InProcessSubagentSpawner {
+  ids;
+  browser;
+  ordinal = 0;
+  constructor(ids = randomSessionIdFactory, browser) {
+    this.ids = ids;
+    this.browser = browser;
+  }
+  mintChildId(name) {
+    return this.ids.newSessionId(name ?? "subagent", this.ordinal++);
+  }
+  async spawn(opts) {
+    const childId = opts.subagentId ?? this.mintChildId(opts.subagentName);
+    opts.onSpawned?.(childId);
+    const parentSessionId = opts.parentSessionId ?? opts.parentSubagentId ?? opts.runtime.session.id;
+    const lifecycleBase = {
+      subagentId: childId,
+      ...opts.stampChildSessionId ? { sessionId: childId } : {},
+      ...opts.parentSubagentId !== undefined ? { parentSubagentId: opts.parentSubagentId } : {},
+      ...parentSessionId !== undefined ? { parentSessionId } : {}
+    };
+    opts.parentBus?.emit("subagent-spawn", {
+      ...lifecycleBase,
+      name: opts.subagentName,
+      input: opts.lifecycleInput
+    });
+    let handle;
+    try {
+      const childBus = new AgentEventBus;
+      AgentEventBus.attachChild(childBus, opts.parentBus, childId);
+      const spec = opts.spec.type === "pentest" && !opts.spec.browserSession && this.browser ? {
+        ...opts.spec,
+        browserSession: this.browser.forChild({
+          subagentId: childId,
+          subagentName: opts.subagentName
+        })
+      } : opts.spec;
+      const runner = RUNNERS[spec.type];
+      handle = await runner(spec, {
+        ...opts.runtime,
+        eventBus: childBus,
+        subagentId: childId,
+        subagentName: opts.subagentName
+      });
+      opts.beforeConsume?.(childBus);
+      const result = await (opts.parentToolCallId && parentSessionId ? runWithNativeRolloutSession({
+        sessionId: childId,
+        parentSessionId,
+        parentToolCallId: opts.parentToolCallId
+      }, handle.run) : handle.run());
+      await opts.onConsumed?.(result);
+      if (opts.drainGraceMs != null) {
+        await drainBounded(handle.drained?.(), opts.drainGraceMs);
+      }
+      opts.parentBus?.emit("subagent-complete", {
+        ...lifecycleBase,
+        status: opts.resolveStatus?.(result) ?? "completed"
+      });
+      return result;
+    } catch (error) {
+      try {
+        await opts.onError?.(error);
+        if (opts.drainGraceMs != null) {
+          await drainBounded(handle?.drained?.(), opts.drainGraceMs);
+        }
+      } finally {
+        opts.parentBus?.emit("subagent-complete", {
+          ...lifecycleBase,
+          status: "failed"
+        });
+      }
+      throw error;
+    }
+  }
+  spawnMany(items, worker, opts) {
+    return runWithBoundedConcurrency(items, opts.concurrency, worker, opts.abortSignal);
+  }
+}
+var inProcessSubagentSpawner2 = new InProcessSubagentSpawner;
+export { AgentEventBus, FindingsRegistry, inMemoryRegistryProvider, withFindingPersistedHook, assertDepth, inProcessSeams, resolveItemHooks, spawnBatch2, inProcessSubagentSpawner2 };