@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/build/lib/{chunk-v3dk9j7k.js → chunk-aq9eyxas.js}

@@ -1,26 +1,26 @@
 import {
   createLogger,
   scopedLogger
-} from "./chunk-ba41jh41.js";
+} from "./chunk-kcw4cpr3.js";
 import {
   OffensiveSecurityAgent2
-} from "./chunk-r4j8ybn9.js";
+} from "./chunk-hys7nemr.js";
 import {
   inMemoryRegistryProvider2,
   withFindingPersistedHook2,
   assertDepth2,
   inProcessSeams2,
   resolveItemHooks2
-} from "./chunk-yrnrbjes.js";
+} from "./chunk-7tft4b8b.js";
 import {
   FindingsRegistry2
-} from "./chunk-1azdancq.js";
+} from "./chunk-0dnx79b1.js";
 import {
   inProcessSubagentSpawner2
-} from "./chunk-3c00n0cy.js";
+} from "./chunk-77se1d35.js";
 import {
   PLAN_MODE_TOOL_NAMES2
-} from "./chunk-2qsq76xq.js";
+} from "./chunk-qkz5sm0d.js";
 import {
   toGrpcPentestContext,
   grpcAuthorityTarget
@@ -36,13 +36,15 @@ import {
 } from "./chunk-q5e23acz.js";
 import {
   BlackboxAttackSurfaceAgent2
-} from "./chunk-1fy8azee.js";
+} from "./chunk-fasqtjq1.js";
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./chunk-1jvwqnem.js";
+} from "./chunk-gm3b9j4y.js";
 import {
   loadSubagentMessages2,
+  loadSubagentReportedFindings2,
+  loadSubagentObjectiveResults2,
   saveSubagentData2,
   writeAgentManifest2,
   readAgentManifest2,
@@ -51,10 +53,10 @@ import {
   finalizeManifest2,
   updateManifestEntryStatus2,
   getCompletedAgentIds2
-} from "./chunk-e8yy2k73.js";
+} from "./chunk-f3sq4896.js";
 import {
   runWhiteboxAttackSurfaceWorkflow2
-} from "./chunk-z137x08b.js";
+} from "./chunk-1rqbhx4b.js";
 
 // src/core/session/execution-metrics.ts
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
@@ -470,8 +472,22 @@ async function runPentestSwarmTarget2(target, index, input) {
   const entry = manifestEntries[index];
   const subagentId = entry.id;
   const subagentName = target.name ?? entry.name;
-  if (completedIds.has(subagentId))
-    return null;
+  if (completedIds.has(subagentId)) {
+    if (sharedHooks.findingPolicy !== "external")
+      return null;
+    const reportedFindings = loadSubagentReportedFindings2(session, subagentId);
+    const objectiveResults = loadSubagentObjectiveResults2(session, subagentId);
+    if (!reportedFindings || !objectiveResults) {
+      throw new Error(`Cannot resume externally graded pentest: findings or objective results for completed agent ${subagentId} are unavailable`);
+    }
+    return {
+      findings: [],
+      reportedFindings,
+      objectiveResults,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath
+    };
+  }
   const itemHooks = resolveItemHooks2(sharedHooks, seams, target, index);
   const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
   const previousMessages = loadSubagentMessages2(session, subagentId);
@@ -568,14 +584,21 @@ async function runPentestSwarmTarget2(target, index, input) {
       abortSignal: childSignal
     });
     const result = await agent.consume();
+    if (itemHooks.findingPolicy === "external" && (!Array.isArray(result.reportedFindings) || !Array.isArray(result.objectiveResults))) {
+      throw new Error(`Externally graded pentest worker ${subagentId} ended without structured findings and objective results`);
+    }
     saveSubagentData2(session, {
       agentName: subagentId,
       target: target.target,
       objective: objectiveStr,
       status: "completed",
-      findingsCount: result.findings.length,
+      findingsCount: result.reportedFindings?.length ?? result.findings.length,
+      ...itemHooks.findingPolicy === "external" ? {
+        reportedFindings: result.reportedFindings,
+        objectiveResults: result.objectiveResults
+      } : {},
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent.userPrompt
     });
     updateManifestEntryStatus2(session, subagentId, "completed");
@@ -593,7 +616,7 @@ async function runPentestSwarmTarget2(target, index, input) {
       status: "failed",
       error: error instanceof Error ? error.message : String(error),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent?.userPrompt ?? ""
     });
     updateManifestEntryStatus2(session, subagentId, "failed");
@@ -639,7 +662,8 @@ async function runPentestSwarm2(input) {
     languageModelMiddleware,
     usageRecorder,
     streamIdFactory,
-    ...hooks
+    ...hooks,
+    findingPolicy: hooks?.findingPolicy ?? input.findingPolicy
   };
   const findingsRegistry = withFindingPersistedHook2(rawFindingsRegistry, seams.hooks.onFindingPersisted);
   const completedIds = getCompletedAgentIds2(session);
@@ -668,11 +692,14 @@ async function runPentestSwarm2(input) {
   };
   const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget2(target, index, targetInput), { concurrency, abortSignal });
   finalizeManifest2(session, manifestEntries, results);
+  if (sharedHooks.findingPolicy === "external" && results.some((result) => result === null)) {
+    throw new Error("Externally graded pentest has an incomplete swarm target; findings cannot be aggregated");
+  }
   return results;
 }
 async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./chunk-bb0ekhkw.js");
+    const { runFastStrike } = await import("./chunk-z8kej0sp.js");
     return runFastStrike(input);
   }
   const {
@@ -692,6 +719,7 @@ async function runPentestWorkflow2(input) {
     threatModel,
     surfaceIntegrationEnabled
   } = input;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
   const seams = input.seams ?? inProcessSeams2({
     fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
     registries: {
@@ -767,7 +795,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           },
           seams
         });
@@ -787,7 +816,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           }
         });
       }
@@ -803,6 +833,16 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
+      if (findingPolicy === "external") {
+        return {
+          findings: [],
+          reportedFindings: [],
+          objectiveResults: [],
+          findingsPath: session.findingsPath,
+          pocsPath: session.pocsPath,
+          reportPath: null
+        };
+      }
       const report = buildPentestReport([], {
         target,
         model,
@@ -826,9 +866,12 @@ ${combined}` : combined;
     });
     const findingsRegistry = seams.registries.findings();
     const completedCount = getCompletedAgentIds2(session).size;
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm2({
+    let externalReportedFindings = [];
+    let externalObjectiveResults = [];
+    if (findingPolicy === "external" || completedCount < swarmTargets.length) {
+      const swarmResults = await runPentestSwarm2({
         targets: swarmTargets,
+        findingPolicy,
         model,
         session,
         authConfig,
@@ -847,10 +890,26 @@ ${combined}` : combined;
         hooks: input.hooks,
         seams
       });
+      externalReportedFindings = swarmResults.flatMap((result) => result?.reportedFindings ?? []);
+      externalObjectiveResults = swarmResults.flatMap((result) => result?.objectiveResults ?? []);
     }
     if (abortSignal?.aborted) {
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
+    if (findingPolicy === "external") {
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "pentesting",
+        summary: { findingsCount: externalReportedFindings.length }
+      });
+      return {
+        findings: [],
+        reportedFindings: externalReportedFindings,
+        objectiveResults: externalObjectiveResults,
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: null
+      };
+    }
     eventBus?.emit("workflow-phase-start", {
       phase: "reporting",
       label: "Report Generation"

package/build/lib/{chunk-9tt2021m.js → chunk-d05cvnv8.js}

@@ -1,26 +1,26 @@
 import {
   AuthenticationAgent2,
   runAuthenticationAgent3
-} from "./chunk-xhdpgpkm.js";
-import"./chunk-acgbyf5h.js";
-import"./chunk-r4j8ybn9.js";
-import"./chunk-3c00n0cy.js";
-import"./chunk-yrnrbjes.js";
+} from "./chunk-mbsde9d0.js";
+import"./chunk-ydxhkgjw.js";
+import"./chunk-hys7nemr.js";
+import"./chunk-77se1d35.js";
+import"./chunk-7tft4b8b.js";
 import"./chunk-7gjdygcx.js";
 import"./chunk-b8eq85d2.js";
-import"./chunk-2qsq76xq.js";
+import"./chunk-qkz5sm0d.js";
 import"./chunk-ja7j565c.js";
 import"./chunk-3q89v4xv.js";
 import"./chunk-fy3bbbqy.js";
-import"./chunk-1azdancq.js";
+import"./chunk-0dnx79b1.js";
 import"./chunk-t5bt5vn1.js";
 import"./chunk-eb4h4k1f.js";
 import"./chunk-vx228eeq.js";
-import"./chunk-ba41jh41.js";
+import"./chunk-kcw4cpr3.js";
 import"./chunk-8vhr65w3.js";
 import"./chunk-2njv7wz3.js";
 import"./chunk-jdjagvgr.js";
-import"./chunk-w66ce82a.js";
+import"./chunk-8njjwwcw.js";
 import"./chunk-zrbqn62x.js";
 import"./chunk-mv74mq5n.js";
 import"./chunk-q5e23acz.js";

package/build/lib/{chunk-e8yy2k73.js → chunk-f3sq4896.js}

@@ -6,7 +6,7 @@ import {
   normalizeMessages2,
   createLogger,
   scopedLogger
-} from "./chunk-ba41jh41.js";
+} from "./chunk-kcw4cpr3.js";
 import {
   __export
 } from "./chunk-n0ba7khr.js";
@@ -19,6 +19,8 @@ __export(exports_persistence, {
   finalizeManifest: () => finalizeManifest2,
   getCompletedAgentIds: () => getCompletedAgentIds2,
   loadSubagentMessages: () => loadSubagentMessages2,
+  loadSubagentObjectiveResults: () => loadSubagentObjectiveResults2,
+  loadSubagentReportedFindings: () => loadSubagentReportedFindings2,
   loadSubagents: () => loadSubagents2,
   readAgentManifest: () => readAgentManifest2,
   reconcileManifestOnResume: () => reconcileManifestOnResume2,
@@ -58,6 +60,28 @@ function loadSubagentMessages2(session, key) {
     return [];
   }
 }
+function loadSubagentReportedFindings2(session, key) {
+  const snapshotPath = join(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.reportedFindings) && data.reportedFindings.every((finding) => typeof finding === "string") ? data.reportedFindings : null;
+  } catch {
+    return null;
+  }
+}
+function loadSubagentObjectiveResults2(session, key) {
+  const snapshotPath = join(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.objectiveResults) && data.objectiveResults.every((result) => result !== null && typeof result === "object" && typeof result.objective === "string" && typeof result.completed === "boolean" && (result.result === undefined || typeof result.result === "string")) ? data.objectiveResults : null;
+  } catch {
+    return null;
+  }
+}
 function saveSubagentData2(session, data) {
   const subagentsDir = join(session.rootPath, SUBAGENTS_DIR);
   mkdirSync(subagentsDir, { recursive: true });
@@ -83,6 +107,8 @@ function saveSubagentData2(session, data) {
     toolCallCount,
     stepCount,
     findingsCount: data.findingsCount ?? 0,
+    reportedFindings: data.reportedFindings,
+    objectiveResults: data.objectiveResults,
     status: data.status,
     error: data.error,
     messages: data.messages,
@@ -569,4 +595,4 @@ function rehydrateFromConsoleTree2(sessionId, tree) {
   return { rootPath, messages: rootMessages, subagentMessages };
 }
 
-export { loadSubagentMessages2, saveSubagentData2, writeAgentManifest2, readAgentManifest2, buildManifestEntries2, reconcileManifestOnResume2, finalizeManifest2, updateManifestEntryStatus2, getCompletedAgentIds2, convertModelMessagesToUI2, loadSubagents2, repairOrphanToolCalls2, rehydrateFromConsoleTree2, exports_persistence };
+export { loadSubagentMessages2, loadSubagentReportedFindings2, loadSubagentObjectiveResults2, saveSubagentData2, writeAgentManifest2, readAgentManifest2, buildManifestEntries2, reconcileManifestOnResume2, finalizeManifest2, updateManifestEntryStatus2, getCompletedAgentIds2, convertModelMessagesToUI2, loadSubagents2, repairOrphanToolCalls2, rehydrateFromConsoleTree2, exports_persistence };

package/build/lib/{chunk-1fy8azee.js → chunk-fasqtjq1.js}

@@ -4,7 +4,7 @@ import {
 import {
   AgentRuntime,
   defineAgent
-} from "./chunk-acgbyf5h.js";
+} from "./chunk-ydxhkgjw.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";

package/build/lib/{chunk-1jvwqnem.js → chunk-gm3b9j4y.js}

@@ -1,7 +1,7 @@
 import {
   createLogger,
   scopedLogger
-} from "./chunk-ba41jh41.js";
+} from "./chunk-kcw4cpr3.js";
 import {
   isMemoryEnabled2
 } from "./chunk-t5bt5vn1.js";
@@ -15,7 +15,7 @@ import {
   REPORT_ERROR_TOOL_NAME2,
   createReportErrorTool2,
   PentestReportedError2
-} from "./chunk-2qsq76xq.js";
+} from "./chunk-qkz5sm0d.js";
 import {
   GOOGLE_SIGNIN_PROMPT_GUIDANCE,
   browserEngineForGoogleSignIn
@@ -26,7 +26,7 @@ import {
 import {
   AgentRuntime,
   defineAgent
-} from "./chunk-acgbyf5h.js";
+} from "./chunk-ydxhkgjw.js";
 
 // src/core/agents/specialized/pentest/agent.ts
 import { existsSync, readdirSync, readFileSync } from "node:fs";
@@ -66,6 +66,13 @@ var PentestResponseSchema2 = z.object({
   newObjectives: z.array(z.string()).optional().describe("Objectives for the NEXT run of this endpoint. Populate this directly from everything you observed: worker outcomes, what was confirmed or conclusively ruled out, recon anomalies nobody investigated, and the technology you fingerprinted. Each entry must be a focused, self-contained objective the next run can act on directly — name a concrete attack class against a concrete parameter, header, or flow. Do NOT restate anything tested this run or already marked completed in your assignment context; find the coverage gaps. Emit a small, high-signal set (typically 2-6), preferring breadth across distinct untested attack classes over payload variants. Empty/omitted when the endpoint is genuinely exhausted."),
   noFindingsReason: z.string().optional().describe("If no findings were documented, explain why (e.g., target not vulnerable, endpoint unreachable)")
 });
+var PentestExternalResponseSchema2 = PentestResponseSchema2.omit({
+  findingsDocumented: true
+}).extend({
+  objectiveResults: z.array(ObjectiveResultSchema).describe("Status of each assigned objective, including findings or limitations."),
+  reportedFindings: z.array(z.string()).describe("One concise evidence-backed finding per vulnerability, including the affected target and security impact. An empty array is valid."),
+  noFindingsReason: z.string().optional().describe("If no findings are reported, explain why.")
+});
 function resolvePentestBrowserEngine2(hasGoogleSignIn) {
   return browserEngineForGoogleSignIn(hasGoogleSignIn);
 }
@@ -83,55 +90,67 @@ var targetedPentestWorker2 = defineAgent({
       helperWorkspaceRoot: effectiveRole === "worker" ? pentestHelperWorkspaceRoot(opts.session, opts.subagentId, opts.sandbox?.type) : undefined
     };
   },
-  system: (opts, state) => buildPentestSystemPrompt2(opts.session, state.effectiveRole, state.mode, opts.systemScope, state.helperWorkspaceRoot),
+  system: (opts, state) => buildPentestSystemPrompt2(opts.session, state.effectiveRole, state.mode, opts.systemScope, state.helperWorkspaceRoot, opts.findingPolicy),
   fileWorkspaceRoot: (_opts, state) => state.helperWorkspaceRoot,
   grpc: (opts) => opts.grpc,
   browserEngine: (opts) => resolvePentestBrowserEngine2(opts.session.credentialManager?.hasGoogleSignIn() === true),
   target: (opts) => opts.target,
   systemScope: (opts) => opts.systemScope,
   mode: (_opts, state) => state.mode,
-  activeTools: (opts, state) => buildPentestActiveTools2(state.effectiveRole, opts.session),
-  responseSchema: () => PentestResponseSchema2,
-  prompt: (opts, state) => buildPentestPrompt2(opts.target, opts.objectives, opts.session, opts.findingsRegistry, opts.context, opts.environmentVariables ? Object.keys(opts.environmentVariables) : undefined, opts.subagentId, state.effectiveRole, opts.session.credentialManager?.formatForPrompt(), opts.grpc, state.mode),
-  extraTools: (_opts, state) => ({
+  activeTools: (opts, state) => buildPentestActiveTools2(state.effectiveRole, opts.session, opts.findingPolicy),
+  responseSchema: (opts) => opts.findingPolicy === "external" ? PentestExternalResponseSchema2 : PentestResponseSchema2,
+  prompt: (opts, state) => buildPentestPrompt2(opts.target, opts.objectives, opts.session, opts.findingsRegistry, opts.context, opts.environmentVariables ? Object.keys(opts.environmentVariables) : undefined, opts.subagentId, state.effectiveRole, opts.session.credentialManager?.formatForPrompt(), opts.grpc, state.mode, opts.findingPolicy),
+  extraTools: (opts, state) => ({
     [REPORT_ERROR_TOOL_NAME2]: createReportErrorTool2((err) => {
       state.reportedError = err;
-    })
+    }, opts.findingPolicy)
   }),
   stopWhen: () => hasToolCall(REPORT_ERROR_TOOL_NAME2),
-  resolveResult: async (opts, state, streamResult) => {
+  resolveResult: async (opts, state, streamResult, validatedResponse) => {
     if (state.reportedError) {
       throw new PentestReportedError2(state.reportedError);
     }
     let objectiveResults;
     let newObjectives;
-    try {
-      const response = await streamResult.response;
-      for (const msg of response.messages ?? []) {
-        if (msg.role !== "assistant" || !Array.isArray(msg.content))
-          continue;
-        for (const part of msg.content) {
-          if (part.type === "tool-call" && part.toolName === "response" && part.input) {
-            const input = part.input;
-            if (input.result?.objectiveResults) {
-              objectiveResults = input.result.objectiveResults;
-            }
-            if (input.result?.newObjectives) {
-              newObjectives = input.result.newObjectives;
+    let reportedFindings;
+    if (opts.findingPolicy === "external") {
+      const parsed = PentestExternalResponseSchema2.safeParse(validatedResponse);
+      if (!parsed.success) {
+        throw new Error("Externally graded pentest ended without a structured findings response");
+      }
+      objectiveResults = parsed.data.objectiveResults;
+      newObjectives = parsed.data.newObjectives;
+      reportedFindings = parsed.data.reportedFindings;
+    } else {
+      try {
+        const response = await streamResult.response;
+        for (const msg of response.messages ?? []) {
+          if (msg.role !== "assistant" || !Array.isArray(msg.content))
+            continue;
+          for (const part of msg.content) {
+            if (part.type === "tool-call" && part.toolName === "response" && part.input) {
+              const input = part.input;
+              if (input.result?.objectiveResults) {
+                objectiveResults = input.result.objectiveResults;
+              }
+              if (input.result?.newObjectives) {
+                newObjectives = input.result.newObjectives;
+              }
             }
           }
         }
-      }
-    } catch {}
+      } catch {}
+    }
     const sandboxed = opts.backends?.sandboxed === true;
     const findingsPath = sandboxed ? `${SANDBOX_ARTIFACTS_ROOT}/findings` : opts.session.findingsPath;
-    const findings = sandboxed && opts.backends ? await loadSandboxFindings(opts.backends, findingsPath, opts.abortSignal) : loadFindings(findingsPath);
+    const findings = opts.findingPolicy === "external" ? [] : sandboxed && opts.backends ? await loadSandboxFindings(opts.backends, findingsPath, opts.abortSignal) : loadFindings(findingsPath);
     return {
       findings,
       findingsPath,
       pocsPath: sandboxed ? `${SANDBOX_ARTIFACTS_ROOT}/pocs` : opts.session.pocsPath,
       objectiveResults,
-      newObjectives
+      newObjectives,
+      reportedFindings
     };
   }
 });
@@ -499,14 +518,16 @@ ${SECTION_SECURITY_HEADERS_CORS}
 ${SECTION_FINDING_QUALITY}
 
 ${SECTION_STATE_CHECKPOINTING}`;
-function destructiveSection(allow) {
-  return allow ? SECTION_DESTRUCTIVE_ALLOWED : SECTION_DESTRUCTIVE_BLOCKED;
+function destructiveSection(allow, findingPolicy = "native") {
+  if (allow)
+    return SECTION_DESTRUCTIVE_ALLOWED;
+  return findingPolicy === "external" ? SECTION_DESTRUCTIVE_BLOCKED.replace(" and document_vulnerability", "") : SECTION_DESTRUCTIVE_BLOCKED;
 }
 function rateLimitTestingSection(allow) {
   return allow ? SECTION_RATE_LIMITING_TESTING_ALLOWED : SECTION_RATE_LIMITING_TESTING_BLOCKED;
 }
-function buildPentestSystemPrompt2(session, role = "orchestrator", mode = "default", systemScope, helperWorkspaceRoot) {
-  const destructive = destructiveSection(session.config?.allowDestructiveActions);
+function buildPentestSystemPrompt2(session, role = "orchestrator", mode = "default", systemScope, helperWorkspaceRoot, findingPolicy = "native") {
+  const destructive = destructiveSection(session.config?.allowDestructiveActions, findingPolicy);
   const rateLimitTesting = rateLimitTestingSection(session.config?.allowRateLimitTesting);
   const guardrails = `${destructive}
 
@@ -515,11 +536,42 @@ ${rateLimitTesting}
 ${SECTION_SIDE_EFFECT_SAFETY}`;
   const systemSection = systemScope && systemScope.memberHosts.length > 0 ? `
 
-${SECTION_SYSTEM_SCOPE(systemScope.memberHosts)}` : "";
+${SECTION_SYSTEM_SCOPE(systemScope.memberHosts, findingPolicy)}` : "";
   const sourceRoot = mode === "fast-strike" ? session.config?.codebasePath : undefined;
   const helperToolsSection = role === "orchestrator" && mode !== "fast-strike" ? "" : `
 
 ${SECTION_HELPER_FILE_WORKSPACE(helperWorkspaceRoot ?? session.scratchpadPath, Boolean(sourceRoot))}`;
+  if (findingPolicy === "external") {
+    const sourcePolicy = sourceRoot ? `Read-only Source Access:
+- The configured repository at ${sourceRoot} is in scope for read-only analysis. Use source-assessment tools or execute_command to inspect it. Keep generated helpers in the file workspace; do not modify target source.` : SECTION_SOURCE_CODE_PROHIBITION;
+    const roleMethod = mode === "fast-strike" ? `Run a focused Strike assessment against the supplied target. Work alone: observe, form the strongest hypothesis, test it with the available HTTP, browser, source, and command tools, then move to the next lead only when evidence rules the first out. Use editable scripts for stateful or multi-stage work. Do not spawn agents or create task lists.` : role === "orchestrator" ? `Lead a focused assessment. State a short plan, perform light reconnaissance and any needed authentication, then call spawn_pentest_agent for each assigned objective that needs testing. Investigate chains or untested leads with another worker when the objective calls for it. For detection-only work, stop when the requested evidence is sufficient. Combine the workers' findings and objective results in your response; workers do not write to a shared finding registry in this run.` : session.config?.taskDriven ? `Test each assigned objective. Decompose techniques with create_task, update each task as you test, adapt when a lead fails, and use list_tasks to check coverage before finishing.` : `Test each assigned objective with the strongest available techniques. Verify reachability and authentication, inspect source when explicitly in scope, probe plausible weaknesses, and distinguish genuine security impact from benign behavior.`;
+    const authentication = SECTION_AUTHENTICATION.replace("Build verifiable POCs, but bound the blast radius.", "When the assigned objective requires a live proof, bound the blast radius.");
+    const exfilGoal = session.config?.exfilMode ? `
+
+Exfiltration goal: Locate and extract a flag in the format FLAG{...} or the assigned sensitive data. Pivot through a confirmed vulnerability when needed to reach it. Do not stop at discovery; demonstrate extraction before calling response.` : "";
+    return `You are an expert offensive security agent. ${roleMethod}
+${exfilGoal}
+
+${sourcePolicy}
+
+Finding boundary: The caller evaluates findings after this run. Put every credible vulnerability in the response tool's reportedFindings array with its affected target, observed evidence, and likely impact. For detection-only objectives, do not build a separate proof-of-concept script, seek a second in-run review, or continue exploiting once the requested evidence is sufficient. If the objective requires exploitation or extraction, pursue that objective fully.
+
+Use the browser for interactive or authenticated flows, HTTP tools for direct probes, and the shell for scripts or source analysis. Stay within the supplied scope and report uncertainty honestly. Complete every assigned objective before calling response.
+
+${guardrails}${systemSection}${helperToolsSection}
+
+${authentication}
+
+${SECTION_MATERIALITY_GUIDANCE}
+
+${SECTION_CREDENTIAL_DISCOVERY}
+
+${SECTION_SECURITY_HEADERS_CORS}
+
+${SECTION_STATE_CHECKPOINTING}${session.config?.promptInjectionLibrarySource ? `
+
+${SECTION_PROMPT_INJECTION}` : ""}`;
+  }
   if (mode === "fast-strike") {
     const sourcePolicy = sourceRoot ? `Read-only Source Access:
 - The configured repository at ${sourceRoot} is in scope for read-only analysis. Use available source-assessment tools or execute_command to inspect it.
@@ -547,12 +599,12 @@ ${guardrails}${systemSection}${helperToolsSection}`;
 
 ${SECTION_PROMPT_INJECTION}` : withGuardrails;
 }
-var SECTION_SYSTEM_SCOPE = (memberHosts) => `System Scope (structured):
+var SECTION_SYSTEM_SCOPE = (memberHosts, findingPolicy = "native") => `System Scope (structured):
 - This engagement covers a multi-application System. Member hosts already present in session targets: ${memberHosts.join(", ")}.
 - Declared relationships in the application context prioritize investigation order; undeclared paths between members remain in scope when discovered.
 - For cross-service follow-ups, an orchestrator MAY set a worker \`target\` to a full URL on another member host listed above. Workers receive this same System Scope. Do not invent hosts outside that set.
 - Authentication state is origin-specific. Before dispatching an authenticated cross-service follow-up, the orchestrator must establish and verify a session on that member origin. The worker must verify access on its assigned origin and follow the Authentication rules below if access is denied.
-- When a confirmed finding spans multiple members, populate the \`attackPath\` argument of \`document_vulnerability\` with the ordered member-to-member hop chain. Do not leave the chain only in the narrative.`;
+${findingPolicy === "external" ? "- When a finding spans multiple members, describe the ordered member-to-member path in your reported finding." : "- When a confirmed finding spans multiple members, populate the `attackPath` argument of `document_vulnerability` with the ordered member-to-member hop chain. Do not leave the chain only in the narrative."}`;
 var SECTION_ORCHESTRATOR_DELEGATION = `Sub-Agent Delegation Rules:
 - You DO NOT call document_vulnerability directly. Findings are documented by the workers you spawn.
 - You DO NOT execute deep exploitation attempts yourself. Your tools (execute_command, http_request, browser_*) are for INITIAL RECON only — fingerprinting, sanity-checking the target, observing baseline behavior.
@@ -599,7 +651,7 @@ ${SECTION_MATERIALITY_GUIDANCE}
 ${SECTION_BROWSER_INTERACTION}
 
 ${SECTION_STATE_CHECKPOINTING}`;
-function buildPentestPrompt2(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext, grpc, mode = "default") {
+function buildPentestPrompt2(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext, grpc, mode = "default", findingPolicy = "native") {
   const sessionRootPath = session.rootPath;
   const exfilMode = session.config?.exfilMode ?? false;
   const taskDriven = mode === "fast-strike" || role === "orchestrator" ? false : session.config?.taskDriven ?? false;
@@ -638,7 +690,7 @@ For \`http_request\`, pass these as the \`headers\` parameter.`, `For \`execute_
     } catch {}
   }
   let knownFindingsSection = "";
-  if (findingsRegistry && findingsRegistry.size > 0) {
+  if (findingPolicy !== "external" && findingsRegistry && findingsRegistry.size > 0) {
     const existing = findingsRegistry.getFindings().map((f) => `- [${f.severity}] ${f.title} (endpoint: ${f.endpoint})`).join(`
 `);
     knownFindingsSection = `
@@ -731,7 +783,19 @@ Do NOT discover or enumerate other endpoints or services. Focus exclusively on t
 If your assignment lists ZERO open objectives (everything is already completed), skip steps 4-5, do light recon only, then finish — still populating newObjectives so the run is productive rather than re-testing completed objectives.
 
 Do NOT call document_vulnerability — that is the workers' job. Do NOT discover or enumerate other endpoints or services beyond the assigned target except for cross-service follow-ups explicitly authorized by the structured System Scope.`;
-  const instructions = role === "orchestrator" ? orchestratorInstructions : taskDriven ? taskDrivenInstructions : exfilMode ? `## Goal
+  const externalInstructions = role === "orchestrator" ? `## Instructions
+1. State a short plan, perform light reconnaissance and authenticate if needed.
+2. Delegate each assigned objective with spawn_pentest_agent. Follow a concrete chain or anomaly only when the assignment calls for it or the detection objective remains unmet.
+3. Include every credible vulnerability from the workers in reportedFindings. Summarize objective coverage and any remaining leads in objectiveResults and newObjectives. The caller evaluates findings after this run.` : taskDriven ? `## Instructions
+1. Create tasks for the supplied objectives and test them with the available tools.
+2. Update task results as evidence develops; inspect list_tasks before finishing.
+3. Put each credible vulnerability in reportedFindings with the affected target, evidence, and likely impact. Follow the assigned objective's discovery or exploitation boundary. The caller evaluates findings after this run.` : `## Instructions
+1. Test the supplied objectives using the available tools and follow the strongest evidence first.
+2. Put each credible vulnerability in reportedFindings with the affected target, evidence, and likely impact. For detection-only objectives, stop when the requested evidence is sufficient; exploit or pivot only if the objective requires it.
+3. Finish with objectiveResults for each objective and any high-signal newObjectives. The caller evaluates findings after this run.`;
+  const instructions = findingPolicy === "external" ? `${externalInstructions}${exfilMode ? `
+
+This is an exfiltration run: locate and extract FLAG{...} or the assigned sensitive data before finishing. Pivot through a confirmed weakness when necessary; report the result in objectiveResults without invoking a finding judge.` : ""}` : role === "orchestrator" ? orchestratorInstructions : taskDriven ? taskDrivenInstructions : exfilMode ? `## Goal
 Your target is a flag with the format FLAG{...}. Locate and extract it.
 
 ## Instructions
@@ -858,10 +922,10 @@ var SHARED_PENTEST_TOOLS = [
   "checkpoint_state"
 ];
 var MEMORY_TOOL_NAMES = ["add_memory", "list_memories", "get_memory"];
-function buildPentestActiveTools2(role, session) {
+function buildPentestActiveTools2(role, session, findingPolicy = "native") {
   const tools = role === "orchestrator" ? [...WORKER_RECON_TOOLS, ...SHARED_PENTEST_TOOLS, "spawn_pentest_agent"] : [
     ...WORKER_RECON_TOOLS,
-    "document_vulnerability",
+    ...findingPolicy === "external" ? [] : ["document_vulnerability"],
     ...WORKER_HELPER_FILE_TOOLS,
     ...SHARED_PENTEST_TOOLS,
     ...session.config?.taskDriven ? ["create_task", "update_task", "list_tasks"] : [],
@@ -919,4 +983,4 @@ function loadFindings(findingsPath) {
     }
   }).filter((f) => f !== null);
 }
-export { resolvePentestAgentRole2, PentestResponseSchema2, resolvePentestBrowserEngine2, targetedPentestWorker2, TargetedPentestAgent2, buildPentestSystemPrompt2, buildPentestPrompt2, buildPentestActiveTools2 };
+export { resolvePentestAgentRole2, PentestResponseSchema2, PentestExternalResponseSchema2, resolvePentestBrowserEngine2, targetedPentestWorker2, TargetedPentestAgent2, buildPentestSystemPrompt2, buildPentestPrompt2, buildPentestActiveTools2 };