@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/src/core/observability/telemetry.test.ts

@@ -684,10 +684,9 @@ describe("auxiliary model lifecycle", () => {
 
     const synthetic = events.find((e) => e.response.id === "summarization");
     expect(synthetic).toBeDefined();
-    // Handler-safe: handlers spread response.messages; cache and provider
-    // metadata survive the synthetic event.
+    // Handler-safe: callbacks can spread response.messages without replaying history.
     expect(Array.isArray(synthetic?.response.messages)).toBe(true);
-    expect(synthetic?.response.messages).toEqual(history);
+    expect(synthetic?.response.messages).toEqual([]);
     expect(synthetic?.usage.inputTokenDetails?.cacheReadTokens).toBe(400);
     expect(synthetic?.usage.inputTokenDetails?.cacheWriteTokens).toBe(7);
     expect(synthetic?.providerMetadata).toEqual({

package/src/core/session/index.ts

@@ -96,6 +96,7 @@ const OperatorSettingsObject = z.object({
   enableSuggestions: z.boolean().default(true),
   /** Run the top-level operator as a focused solo researcher without orchestration tools. */
   strikeMode: z.boolean().optional(),
+  findingPolicy: z.enum(["native", "external"]).optional(),
 });
 
 export type OperatorSettings = z.infer<typeof OperatorSettingsObject>;
@@ -989,6 +990,7 @@ export async function updateOperatorSettings(
         requireApproval: true,
         enableSuggestions: true,
         strikeMode: false,
+        findingPolicy: "native",
       };
     }
 
@@ -1007,6 +1009,9 @@ export async function updateOperatorSettings(
     if (settings.strikeMode !== undefined) {
       session.config.operatorSettings.strikeMode = settings.strikeMode;
     }
+    if (settings.findingPolicy !== undefined) {
+      session.config.operatorSettings.findingPolicy = settings.findingPolicy;
+    }
   });
 }
 

package/src/core/session/persistence.test.ts

@@ -18,6 +18,7 @@ import {
   convertModelMessagesToUI,
   finalizeManifest,
   getCompletedAgentIds,
+  loadSubagentObjectiveResults,
   loadSubagents,
   readAgentManifest,
   reconcileManifestOnResume,
@@ -239,6 +240,67 @@ describe("saveSubagentData + loadSubagents roundtrip", () => {
   });
 });
 
+describe("loadSubagentObjectiveResults", () => {
+  it("roundtrips completed objective coverage, including an empty result", () => {
+    const session = makeSession();
+    const objectiveResults = [
+      { objective: "Test authorization", completed: true, result: "No bypass" },
+      { objective: "Test injection", completed: false },
+    ];
+    saveSubagentData(session, {
+      agentName: "pentest-agent-1",
+      target: "http://localhost:8080",
+      status: "completed",
+      reportedFindings: [],
+      objectiveResults,
+      messages: [],
+    });
+
+    expect(loadSubagentObjectiveResults(session, "pentest-agent-1")).toEqual(
+      objectiveResults,
+    );
+
+    saveSubagentData(session, {
+      agentName: "pentest-agent-1",
+      target: "http://localhost:8080",
+      status: "completed",
+      reportedFindings: [],
+      objectiveResults: [],
+      messages: [],
+    });
+    expect(loadSubagentObjectiveResults(session, "pentest-agent-1")).toEqual(
+      [],
+    );
+  });
+
+  it("rejects missing, failed, and malformed objective coverage", () => {
+    const session = makeSession();
+    const key = "pentest-agent-1";
+    const snapshotPath = join(tmpDir, "subagents", `${key}.json`);
+    expect(loadSubagentObjectiveResults(session, key)).toBeNull();
+    mkdirSync(join(tmpDir, "subagents"));
+
+    const invalidSnapshots = [
+      { status: "failed", objectiveResults: [] },
+      { status: "completed" },
+      { status: "completed", objectiveResults: null },
+      { status: "completed", objectiveResults: [{ objective: "Test" }] },
+      {
+        status: "completed",
+        objectiveResults: [{ objective: "Test", completed: "true" }],
+      },
+      {
+        status: "completed",
+        objectiveResults: [{ objective: "Test", completed: true, result: 42 }],
+      },
+    ];
+    for (const snapshot of invalidSnapshots) {
+      writeFileSync(snapshotPath, JSON.stringify(snapshot));
+      expect(loadSubagentObjectiveResults(session, key)).toBeNull();
+    }
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Manifest roundtrip
 // ---------------------------------------------------------------------------

package/src/core/session/persistence.ts

@@ -28,6 +28,7 @@ export type { SessionInfo };
 
 import type { ModelMessage } from "ai";
 import type { GrpcPentestContext } from "../agents/specialized/attackSurface/grpcSchema";
+import type { ObjectiveResult } from "../agents/specialized/pentest/agent";
 import { newSessionId, type SessionID } from "../id/id";
 import type { AuthenticationInfo } from "./types";
 
@@ -56,6 +57,8 @@ interface SavedSubagentData {
   toolCallCount?: number;
   stepCount?: number;
   findingsCount?: number;
+  reportedFindings?: string[];
+  objectiveResults?: ObjectiveResult[];
   status?: string;
   error?: string;
   messages?: ModelMessage[];
@@ -115,6 +118,8 @@ export interface SubagentSaveInput {
   status: string;
   error?: string;
   findingsCount?: number;
+  reportedFindings?: string[];
+  objectiveResults?: ObjectiveResult[];
   /** Raw AI SDK messages from onStepFinish (e.response.messages) */
   messages: ModelMessage[];
   /** System prompt used for this agent (for training data export) */
@@ -150,6 +155,55 @@ export function loadSubagentMessages(
   }
 }
 
+/** Read external findings from a completed swarm target on resume. */
+export function loadSubagentReportedFindings(
+  session: SessionInfo,
+  key: string,
+): string[] | null {
+  const snapshotPath = join(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync(snapshotPath)) return null;
+  try {
+    const data = JSON.parse(
+      readFileSync(snapshotPath, "utf-8"),
+    ) as SavedSubagentData;
+    return data.status === "completed" &&
+      Array.isArray(data.reportedFindings) &&
+      data.reportedFindings.every((finding) => typeof finding === "string")
+      ? data.reportedFindings
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Read completed objective coverage from a swarm target on resume. */
+export function loadSubagentObjectiveResults(
+  session: SessionInfo,
+  key: string,
+): ObjectiveResult[] | null {
+  const snapshotPath = join(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync(snapshotPath)) return null;
+  try {
+    const data = JSON.parse(
+      readFileSync(snapshotPath, "utf-8"),
+    ) as SavedSubagentData;
+    return data.status === "completed" &&
+      Array.isArray(data.objectiveResults) &&
+      data.objectiveResults.every(
+        (result) =>
+          result !== null &&
+          typeof result === "object" &&
+          typeof result.objective === "string" &&
+          typeof result.completed === "boolean" &&
+          (result.result === undefined || typeof result.result === "string"),
+      )
+      ? data.objectiveResults
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 /** Writes to `{session.rootPath}/{SUBAGENTS_DIR}/{name}.json`. */
 export function saveSubagentData(
   session: SessionInfo,
@@ -181,6 +235,8 @@ export function saveSubagentData(
     toolCallCount,
     stepCount,
     findingsCount: data.findingsCount ?? 0,
+    reportedFindings: data.reportedFindings,
+    objectiveResults: data.objectiveResults,
     status: data.status,
     error: data.error,
     messages: data.messages,

package/src/core/workflows/fastStrike.seams.test.ts

@@ -61,6 +61,7 @@ let rootPath: string;
 let session: SessionInfo;
 
 beforeEach(() => {
+  mocks.registry.groupByRootCause.mockClear();
   rootPath = mkdtempSync(join(tmpdir(), "faststrike-seams-"));
   session = {
     id: "ses_faststrike_seams",
@@ -215,3 +216,151 @@ it("forwards canonical hooks and legacy fields to the fast-strike operator", asy
   });
   expect(mocks.fastStrikeInputs[0]).toMatchObject({ ...hooks, usageRecorder });
 });
+
+describe("external Fast Strike", () => {
+  it("keeps exfiltration mode explicit and returns the extracted result", async () => {
+    session.config = { exfilMode: true };
+    mocks.consumeImpl = async () => ({
+      solved: true,
+      summary: "Extracted FLAG{example}",
+      reportedFindings: ["Confirmed scoped weakness"],
+      submissionJson: "",
+    });
+
+    const result = await runFastStrike({
+      target: "https://example.com",
+      model: {} as PentestWorkflowInput["model"],
+      session,
+      findingPolicy: "external",
+    });
+
+    expect(String(mocks.fastStrikeInputs.at(-1)?.prompt)).toContain(
+      "Exfiltration goal: locate and extract FLAG{...}",
+    );
+    expect(result).toMatchObject({
+      solved: true,
+      summary: "Extracted FLAG{example}",
+    });
+  });
+
+  it("returns exact submission JSON and skips native finding aggregation", async () => {
+    const submissionJson = JSON.stringify({
+      schema_version: "penbench-finding/v1",
+      status: "finding",
+      surfaces: ["GET /private"],
+      root_cause: "Tenant scope is not enforced",
+      impact: "Cross-tenant read",
+    });
+    mocks.consumeImpl = async () => ({
+      solved: true,
+      summary: "Cross-tenant read found",
+      reportedFindings: ["GET /private reads another tenant's data"],
+      submissionJson,
+    });
+
+    const result = await runFastStrike({
+      target: "https://example.com",
+      model: {} as PentestWorkflowInput["model"],
+      session,
+      findingPolicy: "external",
+      enableThinking: true,
+      thinkingEffort: "high",
+    });
+
+    expect(result).toMatchObject({
+      findings: [],
+      reportedFindings: ["GET /private reads another tenant's data"],
+      submissionJson,
+      solved: true,
+      summary: "Cross-tenant read found",
+      reportPath: null,
+    });
+    expect(mocks.registry.groupByRootCause).not.toHaveBeenCalled();
+    const input = mocks.fastStrikeInputs.at(-1);
+    expect(input).toMatchObject({
+      findingPolicy: "external",
+      enableThinking: true,
+      thinkingEffort: "high",
+    });
+    expect(String(input?.system)).not.toContain("document_vulnerability");
+    const responseSchema = input?.responseSchema as {
+      safeParse: (value: unknown) => { success: boolean };
+    };
+    expect(
+      responseSchema.safeParse({
+        solved: true,
+        summary: "Found it",
+        reportedFindings: [],
+        submissionJson,
+      }).success,
+    ).toBe(true);
+    expect(
+      responseSchema.safeParse({ solved: true, summary: "Found it" }).success,
+    ).toBe(false);
+  });
+
+  it("fails closed when the external response omits the submission", async () => {
+    mocks.consumeImpl = async () => ({
+      solved: true,
+      summary: "Found it",
+      reportedFindings: ["finding"],
+    });
+    await expect(
+      runFastStrike({
+        target: "https://example.com",
+        model: {} as PentestWorkflowInput["model"],
+        session,
+        findingPolicy: "external",
+      }),
+    ).rejects.toThrow("without a structured findings response");
+  });
+
+  it.each([
+    ["undefined", undefined],
+    ["null", null],
+    [
+      "wrong field types",
+      {
+        solved: true,
+        summary: "claimed",
+        reportedFindings: "claimed",
+        submissionJson: "{}",
+      },
+    ],
+  ])("marks a %s external response as failed before completion hooks", async (_label, outcome) => {
+    mocks.consumeImpl = async () => outcome;
+    const emit = vi.fn();
+    const onEndpointDone = vi.fn();
+    const onEndpointFailed = vi.fn();
+
+    await expect(
+      runFastStrike({
+        target: "https://example.com",
+        model: {} as PentestWorkflowInput["model"],
+        session,
+        findingPolicy: "external",
+        eventBus: { emit } as unknown as NonNullable<
+          PentestWorkflowInput["eventBus"]
+        >,
+        seams: inProcessSeams({
+          hooks: { onEndpointDone, onEndpointFailed },
+          registries: {
+            findings: () => mocks.registry,
+            attackSurface: () => ({}) as never,
+          },
+        }),
+      }),
+    ).rejects.toThrow("without a structured findings response");
+
+    expect(onEndpointDone).not.toHaveBeenCalled();
+    expect(onEndpointFailed).toHaveBeenCalledOnce();
+    expect(emit).toHaveBeenCalledWith("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "failed",
+    });
+    expect(emit).not.toHaveBeenCalledWith("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "completed",
+    });
+  });
+});

package/src/core/workflows/fastStrike.test.ts

@@ -1,5 +1,8 @@
 import { describe, expect, it } from "vitest";
-import { FAST_STRIKE_SYSTEM_PROMPT } from "./fastStrike";
+import {
+  buildFastStrikeSystemPrompt,
+  FAST_STRIKE_SYSTEM_PROMPT,
+} from "./fastStrike";
 
 describe("Fast Strike system prompt", () => {
   it("externalizes complex exploit chains into editable scripts", () => {
@@ -26,4 +29,18 @@ describe("Fast Strike system prompt", () => {
       "call the response tool with the correct solved value",
     );
   });
+
+  it("keeps the native prompt as the default policy", () => {
+    expect(buildFastStrikeSystemPrompt()).toBe(FAST_STRIKE_SYSTEM_PROMPT);
+  });
+
+  it("keeps the Strike loop but hands finding acceptance to the caller", () => {
+    const prompt = buildFastStrikeSystemPrompt("external");
+    expect(prompt).toContain("OBSERVE");
+    expect(prompt).toContain("HYPOTHESIZE");
+    expect(prompt).toContain("editable script");
+    expect(prompt).toContain("submissionJson");
+    expect(prompt).not.toContain("document_vulnerability");
+    expect(prompt).not.toContain("validation judge");
+  });
 });

package/src/core/workflows/fastStrike.ts

@@ -1,6 +1,7 @@
 import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
+import type { FindingPolicy } from "../agents/offSecAgent";
 import { OffensiveSecurityAgent } from "../agents/offSecAgent";
 import { FindingsRegistry } from "../findings/registry";
 import {
@@ -32,9 +33,44 @@ const FastStrikeResult = z.object({
     ),
 });
 
-type FastStrikeOutcome = z.infer<typeof FastStrikeResult>;
+const FastStrikeExternalResult = z.object({
+  solved: z.boolean().describe("True if the supplied objective was met."),
+  summary: z
+    .string()
+    .describe(
+      "Concise account of security findings and the evidence observed, including any flag or sensitive data extracted for an exfiltration objective.",
+    ),
+  reportedFindings: z
+    .array(z.string())
+    .describe(
+      "One concise evidence-backed description per discovered vulnerability.",
+    ),
+  submissionJson: z
+    .string()
+    .describe(
+      "The exact task-defined JSON submission as a string, or an empty string when no JSON submission was requested. Do not invent fields.",
+    ),
+});
+
+type FastStrikeOutcome =
+  | z.infer<typeof FastStrikeResult>
+  | z.infer<typeof FastStrikeExternalResult>;
 
-export const FAST_STRIKE_SYSTEM_PROMPT = `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
+export function buildFastStrikeSystemPrompt(
+  findingPolicy: FindingPolicy = "native",
+): string {
+  const external = findingPolicy === "external";
+  const objectiveStep = external
+    ? "5. FOLLOW THE OBJECTIVE — Determine whether the observed behavior establishes a security weakness. For a detection-only objective, stop once the requested evidence is sufficient; develop an exploit or pivot only when the objective requires it."
+    : "5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.";
+  const finishStep = external
+    ? "6. REPORT & FINISH — Include each credible finding and its supporting observations in the caller's requested output. If the caller requested a JSON submission, include the exact JSON text in the response tool's submissionJson field as well; otherwise use an empty string. The caller evaluates findings after the run. Once the objective is met or credible leads are exhausted, call the response tool with the correct solved value and a concise summary."
+    : "6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.";
+  const evidenceRule = external
+    ? "- Bias toward the shortest path that satisfies the assigned objective. Distinguish observed evidence from hypotheses, and avoid separate in-run finding review."
+    : "- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.";
+
+  return `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
 
 Run this loop, tightly:
 
@@ -42,15 +78,18 @@ Run this loop, tightly:
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
 3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops. For blind/out-of-band testing (SSRF, blind RCE, XSS callbacks), start_callback_listener gives you a nonce-correlated listener that survives intervening commands: embed the returned callback URL (only an address you know the target can reach — never a guessed one) in the payload, then poll_callback_listener for hits. Listener readiness and the tool's own self-test never count as target evidence; stop_callback_listener when done.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
+${objectiveStep}
+${finishStep}
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
 - Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
-- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
+${evidenceRule}
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
+}
+
+export const FAST_STRIKE_SYSTEM_PROMPT = buildFastStrikeSystemPrompt();
 
 /** Single-operator pentest: skips attack-surface/swarm, returns {@link PentestWorkflowResult}. */
 export async function runFastStrike(
@@ -67,6 +106,7 @@ export async function runFastStrike(
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     prompt,
     threatModel,
@@ -116,6 +156,7 @@ export async function runFastStrike(
   }
 
   const operatorGuidance = session.config?.prompt;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
 
   const mode: "blackbox" | "whitebox" = cwd ? "whitebox" : "blackbox";
 
@@ -136,8 +177,15 @@ export async function runFastStrike(
   const promptParts: string[] = [`Target: ${target}`];
   if (operatorGuidance) promptParts.push(operatorGuidance);
   promptParts.push(
-    "Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.",
+    findingPolicy === "external"
+      ? "Run the fast strike: investigate the target, identify security weaknesses, and submit the findings in the requested output. Stop when the supplied objective is met."
+      : "Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.",
   );
+  if (findingPolicy === "external" && session.config?.exfilMode) {
+    promptParts.push(
+      "Exfiltration goal: locate and extract FLAG{...} or the assigned sensitive data through a confirmed weakness. Do not stop at discovery; include the extraction result in the final summary.",
+    );
+  }
 
   const agent = new OffensiveSecurityAgent<FastStrikeOutcome>({
     subagentSpawner: input.subagentSpawner,
@@ -145,14 +193,18 @@ export async function runFastStrike(
     usageRecorder: input.usageRecorder,
     streamIdFactory: input.streamIdFactory,
     ...input.hooks,
-    system: FAST_STRIKE_SYSTEM_PROMPT,
+    system: buildFastStrikeSystemPrompt(findingPolicy),
     prompt: promptParts.join("\n\n"),
     model,
     session,
     target,
     mode: "fast-strike",
+    findingPolicy,
     activeTools: [],
-    responseSchema: FastStrikeResult,
+    responseSchema:
+      findingPolicy === "external"
+        ? FastStrikeExternalResult
+        : FastStrikeResult,
     findingsRegistry,
     subagentId: "fast-strike",
     authConfig,
@@ -164,6 +216,7 @@ export async function runFastStrike(
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
   });
 
@@ -179,16 +232,32 @@ export async function runFastStrike(
     target,
   });
 
-  let strikeResult: FastStrikeOutcome;
+  let completed:
+    | { policy: "native"; outcome: FastStrikeOutcome }
+    | {
+        policy: "external";
+        outcome: z.infer<typeof FastStrikeExternalResult>;
+      };
   try {
-    strikeResult = await agent.consume();
+    const strikeResult = await agent.consume();
+    if (findingPolicy === "external") {
+      const parsed = FastStrikeExternalResult.safeParse(strikeResult);
+      if (!parsed.success) {
+        throw new Error(
+          "Externally graded Fast Strike ended without a structured findings response",
+        );
+      }
+      completed = { policy: "external", outcome: parsed.data };
+    } else {
+      completed = { policy: "native", outcome: strikeResult };
+    }
     eventBus?.emit("subagent-complete", {
       subagentId: "fast-strike",
       status: "completed",
     });
     await seams.hooks.onEndpointDone?.(
       { subagentId: "fast-strike", subagentName: "Fast Strike", target },
-      strikeResult,
+      completed.outcome,
     );
   } catch (e) {
     eventBus?.emit("subagent-complete", {
@@ -206,8 +275,31 @@ export async function runFastStrike(
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
 
+  if (completed.policy === "external") {
+    const strikeResult = completed.outcome;
+    eventBus?.emit("workflow-phase-complete", {
+      phase: "pentesting",
+      summary: {
+        findingsCount: strikeResult.reportedFindings.length,
+        solved: strikeResult.solved,
+        operatorSummary: strikeResult.summary,
+      },
+    });
+    return {
+      findings: [],
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+      reportPath: null,
+      reportedFindings: strikeResult.reportedFindings,
+      submissionJson: strikeResult.submissionJson,
+      solved: strikeResult.solved,
+      summary: strikeResult.summary,
+    };
+  }
+
   await findingsRegistry.groupByRootCause();
   const findings = [...findingsRegistry.getFindings()];
+  const strikeResult = completed.outcome;
 
   const report = buildPentestReport(findings, {
     target,