@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/build/{cli-d37a42dc.js → cli-9pz9wjt2.js}

@@ -12,24 +12,24 @@ import {
   pLimit,
   PLAN_MODE_TOOL_NAMES,
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-t4q4t4dx.js";
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-k2nwxta0.js";
+} from "./cli-t09zj814.js";
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-xtc2t6me.js";
+} from "./cli-vdd1s3x9.js";
 import {
   buildPentestReport,
   renderJson,
   renderMarkdown,
   REPORT_FILENAME_MD,
   REPORT_FILENAME_JSON
-} from "./cli-n2en7j5b.js";
+} from "./cli-z7ysyrr4.js";
 import {
   CodeAgent2
-} from "./cli-kb21qhvm.js";
+} from "./cli-1pmfnz1a.js";
 import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
@@ -38,7 +38,7 @@ import {
   AppInfoSchema2,
   AppsDiscoveryResultSchema2,
   DiscoverySummarySchema2
-} from "./cli-ngq9dr8n.js";
+} from "./cli-fdrrbb9p.js";
 import {
   createThreatModelPrompt
 } from "./cli-q126f6ef.js";
@@ -50,7 +50,7 @@ import {
   init_session,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 import {
   newSessionId,
   init_id
@@ -262,6 +262,28 @@ function loadSubagentMessages(session, key) {
     return [];
   }
 }
+function loadSubagentReportedFindings(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.reportedFindings) && data.reportedFindings.every((finding) => typeof finding === "string") ? data.reportedFindings : null;
+  } catch {
+    return null;
+  }
+}
+function loadSubagentObjectiveResults(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.objectiveResults) && data.objectiveResults.every((result) => result !== null && typeof result === "object" && typeof result.objective === "string" && typeof result.completed === "boolean" && (result.result === undefined || typeof result.result === "string")) ? data.objectiveResults : null;
+  } catch {
+    return null;
+  }
+}
 function saveSubagentData(session, data) {
   const subagentsDir = join2(session.rootPath, SUBAGENTS_DIR);
   mkdirSync(subagentsDir, { recursive: true });
@@ -287,6 +309,8 @@ function saveSubagentData(session, data) {
     toolCallCount,
     stepCount,
     findingsCount: data.findingsCount ?? 0,
+    reportedFindings: data.reportedFindings,
+    objectiveResults: data.objectiveResults,
     status: data.status,
     error: data.error,
     messages: data.messages,
@@ -780,6 +804,7 @@ async function runEndpointDocumentationAgent(opts) {
       attackSurfaceRegistry
     },
     runtime: {
+      findingPolicy: hooks?.findingPolicy,
       model,
       session,
       authConfig,
@@ -7079,6 +7104,7 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
           attackSurfaceRegistry
         },
         runtime: {
+          findingPolicy: hooksForApp.findingPolicy,
           model,
           session,
           authConfig,
@@ -7937,8 +7963,22 @@ async function runPentestSwarmTarget(target, index, input) {
   const entry = manifestEntries[index];
   const subagentId = entry.id;
   const subagentName = target.name ?? entry.name;
-  if (completedIds.has(subagentId))
-    return null;
+  if (completedIds.has(subagentId)) {
+    if (sharedHooks.findingPolicy !== "external")
+      return null;
+    const reportedFindings = loadSubagentReportedFindings(session, subagentId);
+    const objectiveResults = loadSubagentObjectiveResults(session, subagentId);
+    if (!reportedFindings || !objectiveResults) {
+      throw new Error(`Cannot resume externally graded pentest: findings or objective results for completed agent ${subagentId} are unavailable`);
+    }
+    return {
+      findings: [],
+      reportedFindings,
+      objectiveResults,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath
+    };
+  }
   const itemHooks = resolveItemHooks(sharedHooks, seams, target, index);
   const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
   const previousMessages = loadSubagentMessages(session, subagentId);
@@ -8035,14 +8075,21 @@ async function runPentestSwarmTarget(target, index, input) {
       abortSignal: childSignal
     });
     const result = await agent.consume();
+    if (itemHooks.findingPolicy === "external" && (!Array.isArray(result.reportedFindings) || !Array.isArray(result.objectiveResults))) {
+      throw new Error(`Externally graded pentest worker ${subagentId} ended without structured findings and objective results`);
+    }
     saveSubagentData(session, {
       agentName: subagentId,
       target: target.target,
       objective: objectiveStr,
       status: "completed",
-      findingsCount: result.findings.length,
+      findingsCount: result.reportedFindings?.length ?? result.findings.length,
+      ...itemHooks.findingPolicy === "external" ? {
+        reportedFindings: result.reportedFindings,
+        objectiveResults: result.objectiveResults
+      } : {},
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent.userPrompt
     });
     updateManifestEntryStatus(session, subagentId, "completed");
@@ -8060,7 +8107,7 @@ async function runPentestSwarmTarget(target, index, input) {
       status: "failed",
       error: error instanceof Error ? error.message : String(error),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent?.userPrompt ?? ""
     });
     updateManifestEntryStatus(session, subagentId, "failed");
@@ -8106,7 +8153,8 @@ async function runPentestSwarm2(input) {
     languageModelMiddleware,
     usageRecorder,
     streamIdFactory,
-    ...hooks
+    ...hooks,
+    findingPolicy: hooks?.findingPolicy ?? input.findingPolicy
   };
   const findingsRegistry = withFindingPersistedHook(rawFindingsRegistry, seams.hooks.onFindingPersisted);
   const completedIds = getCompletedAgentIds(session);
@@ -8135,11 +8183,14 @@ async function runPentestSwarm2(input) {
   };
   const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget(target, index, targetInput), { concurrency, abortSignal });
   finalizeManifest(session, manifestEntries, results);
+  if (sharedHooks.findingPolicy === "external" && results.some((result) => result === null)) {
+    throw new Error("Externally graded pentest has an incomplete swarm target; findings cannot be aggregated");
+  }
   return results;
 }
 async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-mcjdvwez.js");
+    const { runFastStrike } = await import("./fastStrike-16jw1s61.js");
     return runFastStrike(input);
   }
   const {
@@ -8159,6 +8210,7 @@ async function runPentestWorkflow2(input) {
     threatModel,
     surfaceIntegrationEnabled
   } = input;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
   const seams = input.seams ?? inProcessSeams({
     fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
     registries: {
@@ -8234,7 +8286,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           },
           seams
         });
@@ -8254,7 +8307,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           }
         });
       }
@@ -8270,6 +8324,16 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
+      if (findingPolicy === "external") {
+        return {
+          findings: [],
+          reportedFindings: [],
+          objectiveResults: [],
+          findingsPath: session.findingsPath,
+          pocsPath: session.pocsPath,
+          reportPath: null
+        };
+      }
       const report = buildPentestReport([], {
         target,
         model,
@@ -8293,9 +8357,12 @@ ${combined}` : combined;
     });
     const findingsRegistry = seams.registries.findings();
     const completedCount = getCompletedAgentIds(session).size;
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm2({
+    let externalReportedFindings = [];
+    let externalObjectiveResults = [];
+    if (findingPolicy === "external" || completedCount < swarmTargets.length) {
+      const swarmResults = await runPentestSwarm2({
         targets: swarmTargets,
+        findingPolicy,
         model,
         session,
         authConfig,
@@ -8314,10 +8381,26 @@ ${combined}` : combined;
         hooks: input.hooks,
         seams
       });
+      externalReportedFindings = swarmResults.flatMap((result) => result?.reportedFindings ?? []);
+      externalObjectiveResults = swarmResults.flatMap((result) => result?.objectiveResults ?? []);
     }
     if (abortSignal?.aborted) {
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
+    if (findingPolicy === "external") {
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "pentesting",
+        summary: { findingsCount: externalReportedFindings.length }
+      });
+      return {
+        findings: [],
+        reportedFindings: externalReportedFindings,
+        objectiveResults: externalObjectiveResults,
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: null
+      };
+    }
     eventBus?.emit("workflow-phase-start", {
       phase: "reporting",
       label: "Report Generation"