@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/src/core/workflows/pentest.test.ts

@@ -573,3 +573,107 @@ describe("runPentestWorkflow — threads seams into the whitebox discovery phase
     expect(mocks.whiteboxCalls[0]?.seams).toBe(seams);
   });
 });
+
+describe("external pentest workflow", () => {
+  it("returns worker findings without native report generation and retains them on resume", async () => {
+    const emit = vi.fn();
+    mocks.consumeImpl = async () => ({
+      findings: [],
+      reportedFindings: ["GET /api reveals another tenant's data"],
+      objectiveResults: [
+        {
+          objective: "Test the target",
+          completed: true,
+          result: "Extracted FLAG{example} through the confirmed weakness",
+        },
+      ],
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+    });
+    const input: PentestWorkflowInput = {
+      target: "https://example.com",
+      model: {} as PentestWorkflowInput["model"],
+      session,
+      findingPolicy: "external",
+      eventBus: { emit } as unknown as NonNullable<
+        PentestWorkflowInput["eventBus"]
+      >,
+      hooks: { findingPolicy: undefined },
+    };
+
+    const first = await runPentestWorkflow(input);
+    expect(first).toMatchObject({
+      findings: [],
+      reportedFindings: ["GET /api reveals another tenant's data"],
+      objectiveResults: [
+        {
+          objective: "Test the target",
+          completed: true,
+          result: "Extracted FLAG{example} through the confirmed weakness",
+        },
+      ],
+      reportPath: null,
+    });
+    expect(mocks.targetedInputs).toHaveLength(1);
+    expect(mocks.targetedInputs[0]?.findingPolicy).toBe("external");
+    expect(emit).toHaveBeenCalledWith("workflow-phase-complete", {
+      phase: "pentesting",
+      summary: { findingsCount: 1 },
+    });
+
+    mocks.consumeImpl = async () => {
+      throw new Error("completed worker was rerun");
+    };
+    const resumed = await runPentestWorkflow(input);
+    expect(resumed.reportedFindings).toEqual(first.reportedFindings);
+    expect(resumed.objectiveResults).toEqual(first.objectiveResults);
+    expect(mocks.targetedInputs).toHaveLength(1);
+  });
+
+  it("does not generate a native report when discovery has no targets", async () => {
+    mocks.loadAttackSurfaceResults.mockReturnValue({ targets: [] });
+    const result = await runPentestWorkflow({
+      target: "https://example.com",
+      model: {} as PentestWorkflowInput["model"],
+      session,
+      findingPolicy: "external",
+    });
+    expect(result).toMatchObject({
+      findings: [],
+      reportedFindings: [],
+      objectiveResults: [],
+      reportPath: null,
+    });
+  });
+
+  it("rejects an external worker result without objective outcomes", async () => {
+    mocks.consumeImpl = async () => ({
+      findings: [],
+      reportedFindings: ["A finding"],
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+    });
+    await expect(
+      runPentestWorkflow({
+        target: "https://example.com",
+        model: {} as PentestWorkflowInput["model"],
+        session,
+        findingPolicy: "external",
+      }),
+    ).rejects.toThrow("incomplete swarm target");
+  });
+
+  it("fails rather than treating an incomplete external worker as no finding", async () => {
+    mocks.consumeImpl = async () => {
+      throw new Error("worker failed");
+    };
+    await expect(
+      runPentestWorkflow({
+        target: "https://example.com",
+        model: {} as PentestWorkflowInput["model"],
+        session,
+        findingPolicy: "external",
+      }),
+    ).rejects.toThrow("incomplete swarm target");
+  });
+});

package/src/core/workflows/pentest.ts

@@ -7,7 +7,7 @@ import type {
   ToolSet,
 } from "ai";
 import { hasToolCall } from "ai";
-import type { AgentHooks, Finding } from "../agents/offSecAgent";
+import type { AgentHooks, Finding, FindingPolicy } from "../agents/offSecAgent";
 import {
   OffensiveSecurityAgent,
   PLAN_MODE_TOOL_NAMES,
@@ -64,6 +64,8 @@ import {
   finalizeManifest,
   getCompletedAgentIds,
   loadSubagentMessages,
+  loadSubagentObjectiveResults,
+  loadSubagentReportedFindings,
   readAgentManifest,
   reconcileManifestOnResume,
   type SwarmTarget,
@@ -99,6 +101,7 @@ export const DEFAULT_CONCURRENCY = 10;
 // ---------------------------------------------------------------------------
 
 export interface PentestWorkflowInput {
+  findingPolicy?: FindingPolicy;
   /** Live target URL — always required */
   target: string;
 
@@ -170,6 +173,11 @@ export interface PentestWorkflowInput {
 
 export interface PentestWorkflowResult {
   findings: Finding[];
+  reportedFindings?: string[];
+  objectiveResults?: PentestResult["objectiveResults"];
+  submissionJson?: string;
+  solved?: boolean;
+  summary?: string;
   findingsPath: string;
   pocsPath: string;
   reportPath: string | null;
@@ -178,6 +186,7 @@ export interface PentestWorkflowResult {
 export type { SwarmTarget } from "../session/persistence";
 
 export interface PentestSwarmInput {
+  findingPolicy?: FindingPolicy;
   targets: SwarmTarget[];
   model: AIModel;
   session: SessionInfo;
@@ -290,7 +299,23 @@ export async function runPentestSwarmTarget(
   const subagentId = entry.id;
   const subagentName = target.name ?? entry.name;
 
-  if (completedIds.has(subagentId)) return null;
+  if (completedIds.has(subagentId)) {
+    if (sharedHooks.findingPolicy !== "external") return null;
+    const reportedFindings = loadSubagentReportedFindings(session, subagentId);
+    const objectiveResults = loadSubagentObjectiveResults(session, subagentId);
+    if (!reportedFindings || !objectiveResults) {
+      throw new Error(
+        `Cannot resume externally graded pentest: findings or objective results for completed agent ${subagentId} are unavailable`,
+      );
+    }
+    return {
+      findings: [],
+      reportedFindings,
+      objectiveResults,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+    };
+  }
 
   // Per-target AgentHooks: seams.hooksForItem can give this one target
   // (e.g. its own lease/backends, its own politeness budget) different
@@ -418,15 +443,37 @@ export async function runPentestSwarmTarget(
     });
 
     const result = await agent.consume();
+    if (
+      itemHooks.findingPolicy === "external" &&
+      (!Array.isArray(result.reportedFindings) ||
+        !Array.isArray(result.objectiveResults))
+    ) {
+      throw new Error(
+        `Externally graded pentest worker ${subagentId} ended without structured findings and objective results`,
+      );
+    }
 
     saveSubagentData(session, {
       agentName: subagentId,
       target: target.target,
       objective: objectiveStr,
       status: "completed",
-      findingsCount: result.findings.length,
+      findingsCount: result.reportedFindings?.length ?? result.findings.length,
+      ...(itemHooks.findingPolicy === "external"
+        ? {
+            reportedFindings: result.reportedFindings,
+            objectiveResults: result.objectiveResults,
+          }
+        : {}),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt(session),
+      systemPrompt: buildPentestSystemPrompt(
+        session,
+        "orchestrator",
+        "default",
+        undefined,
+        undefined,
+        itemHooks.findingPolicy,
+      ),
       userPrompt: agent.userPrompt,
     });
     updateManifestEntryStatus(session, subagentId, "completed");
@@ -450,7 +497,14 @@ export async function runPentestSwarmTarget(
       status: "failed",
       error: error instanceof Error ? error.message : String(error),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt(session),
+      systemPrompt: buildPentestSystemPrompt(
+        session,
+        "orchestrator",
+        "default",
+        undefined,
+        undefined,
+        itemHooks.findingPolicy,
+      ),
       userPrompt: agent?.userPrompt ?? "",
     });
     updateManifestEntryStatus(session, subagentId, "failed");
@@ -522,6 +576,7 @@ export async function runPentestSwarm(
     usageRecorder,
     streamIdFactory,
     ...hooks,
+    findingPolicy: hooks?.findingPolicy ?? input.findingPolicy,
   };
 
   // Ops-typed by the seam; TargetedPentestAgent/OffensiveSecurityAgent only
@@ -574,6 +629,15 @@ export async function runPentestSwarm(
 
   finalizeManifest(session, manifestEntries, results);
 
+  if (
+    sharedHooks.findingPolicy === "external" &&
+    results.some((result) => result === null)
+  ) {
+    throw new Error(
+      "Externally graded pentest has an incomplete swarm target; findings cannot be aggregated",
+    );
+  }
+
   return results;
 }
 
@@ -613,6 +677,7 @@ export async function runPentestWorkflow(
     threatModel,
     surfaceIntegrationEnabled,
   } = input;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
 
   // Default registries mirror today's `FindingsRegistry.fromDirectory` resume
   // behavior (dedup against on-disk findings, model-backed semantic dedup).
@@ -706,6 +771,7 @@ export async function runPentestWorkflow(
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
             ...input.hooks,
+            findingPolicy,
           },
           seams,
         });
@@ -726,6 +792,7 @@ export async function runPentestWorkflow(
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
             ...input.hooks,
+            findingPolicy,
           },
         });
       }
@@ -744,6 +811,16 @@ export async function runPentestWorkflow(
     }
 
     if (swarmTargets.length === 0) {
+      if (findingPolicy === "external") {
+        return {
+          findings: [],
+          reportedFindings: [],
+          objectiveResults: [],
+          findingsPath: session.findingsPath,
+          pocsPath: session.pocsPath,
+          reportPath: null,
+        };
+      }
       const report = buildPentestReport([], {
         target,
         model,
@@ -778,10 +855,15 @@ export async function runPentestWorkflow(
     const findingsRegistry = seams.registries.findings() as FindingsRegistry;
 
     const completedCount = getCompletedAgentIds(session).size;
+    let externalReportedFindings: string[] = [];
+    let externalObjectiveResults: NonNullable<
+      PentestResult["objectiveResults"]
+    > = [];
 
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm({
+    if (findingPolicy === "external" || completedCount < swarmTargets.length) {
+      const swarmResults = await runPentestSwarm({
         targets: swarmTargets,
+        findingPolicy,
         model,
         session,
         authConfig,
@@ -800,12 +882,33 @@ export async function runPentestWorkflow(
         hooks: input.hooks,
         seams,
       });
+      externalReportedFindings = swarmResults.flatMap(
+        (result) => result?.reportedFindings ?? [],
+      );
+      externalObjectiveResults = swarmResults.flatMap(
+        (result) => result?.objectiveResults ?? [],
+      );
     }
 
     if (abortSignal?.aborted) {
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
 
+    if (findingPolicy === "external") {
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "pentesting",
+        summary: { findingsCount: externalReportedFindings.length },
+      });
+      return {
+        findings: [],
+        reportedFindings: externalReportedFindings,
+        objectiveResults: externalObjectiveResults,
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: null,
+      };
+    }
+
     // =========================================================================
     // Phase 3: Aggregate results
     // =========================================================================

package/src/core/workflows/seams.test.ts

@@ -312,6 +312,19 @@ describe("resolveItemHooks recorder scope", () => {
   });
 });
 
+it("does not let a per-item hook re-enable native finding judging under an external run", () => {
+  const seams = inProcessSeams({
+    hooksForItem: () => ({ findingPolicy: "native" }),
+  });
+  const child = resolveItemHooks(
+    { findingPolicy: "external" },
+    seams,
+    "target",
+    0,
+  );
+  expect(child.findingPolicy).toBe("external");
+});
+
 it("requires a child inference binding instead of inheriting the parent's journal", () => {
   const recorder: InferenceRecorder = {
     runId: "parent",

package/src/core/workflows/seams.ts

@@ -266,11 +266,15 @@ export function resolveItemHooks<TItem>(
   item: TItem,
   index: number,
 ): AgentHooks {
+  const itemHooks = seams.hooksForItem?.(item, index);
   return {
     ...hooks,
     contextRecorder: undefined,
     inferenceRecorder: undefined,
     toolExecutionRecorder: undefined,
-    ...seams.hooksForItem?.(item, index),
+    ...itemHooks,
+    ...(hooks?.findingPolicy === "external"
+      ? { findingPolicy: "external" as const }
+      : {}),
   };
 }

package/src/core/workflows/whiteboxAttackSurface.ts

@@ -298,6 +298,7 @@ export async function runWhiteboxAttackSurfaceApp(
             attackSurfaceRegistry,
           },
           runtime: {
+            findingPolicy: hooksForApp.findingPolicy,
             model,
             session,
             authConfig,

package/src/tui/components/chat/loading-indicator.tsx

@@ -7,6 +7,7 @@
 import { useEffect, useRef, useState } from "react";
 import { INTERNAL_ID_PATTERN } from "../../../core/operator";
 import { useTheme } from "../../theme";
+import { CompactingIcon } from "../shared";
 
 // Braille spinner frames for smooth animation
 const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
@@ -16,7 +17,12 @@ const SPINNER_INTERVAL = 80;
 const DOTS_FRAMES = ["", ".", "..", "..."];
 const DOTS_INTERVAL = 400;
 
-export type LoadingState = "thinking" | "executing" | "streaming" | "waiting";
+export type LoadingState =
+  | "thinking"
+  | "compacting"
+  | "executing"
+  | "streaming"
+  | "waiting";
 
 interface LoadingIndicatorProps {
   /** Current loading state */
@@ -42,19 +48,21 @@ export function LoadingIndicator({
 
   // Spinner animation
   useEffect(() => {
+    if (state === "compacting") return;
     const interval = setInterval(() => {
       setSpinnerFrame((f) => (f + 1) % SPINNER_FRAMES.length);
     }, SPINNER_INTERVAL);
     return () => clearInterval(interval);
-  }, []);
+  }, [state]);
 
   // Dots animation
   useEffect(() => {
+    if (state === "compacting") return;
     const interval = setInterval(() => {
       setDotsFrame((f) => (f + 1) % DOTS_FRAMES.length);
     }, DOTS_INTERVAL);
     return () => clearInterval(interval);
-  }, []);
+  }, [state]);
 
   const spinner = SPINNER_FRAMES[spinnerFrame];
   const dots = DOTS_FRAMES[dotsFrame];
@@ -64,6 +72,8 @@ export function LoadingIndicator({
     switch (state) {
       case "thinking":
         return `Thinking${dots}`;
+      case "compacting":
+        return "Compacting";
       case "streaming":
         return `Responding${dots}`;
       case "waiting":
@@ -95,6 +105,8 @@ export function LoadingIndicator({
     switch (state) {
       case "thinking":
         return colors.warning;
+      case "compacting":
+        return colors.primary;
       case "streaming":
         return colors.primary;
       case "waiting":
@@ -108,7 +120,11 @@ export function LoadingIndicator({
 
   return (
     <box flexDirection="row" marginTop={1} marginLeft={2} gap={1}>
-      <text fg={getColor()}>{spinner}</text>
+      {state === "compacting" ? (
+        <CompactingIcon fg={getColor()} />
+      ) : (
+        <text fg={getColor()}>{spinner}</text>
+      )}
       <text fg={colors.textMuted}>{getMessage()}</text>
     </box>
   );

package/src/tui/components/chat/message-list.tsx

@@ -39,6 +39,7 @@ function getLoadingState(
   pendingToolName: string | null,
 ): LoadingState {
   if (hasPendingTool) {
+    if (pendingToolName === "summarize_conversation") return "compacting";
     if (pendingToolName && SUBAGENT_TOOLS.has(pendingToolName)) {
       return "waiting";
     }

package/src/tui/components/commands/__tests__/advanced-settings-lifecycle.tsx

@@ -0,0 +1,176 @@
+import { mock } from "bun:test";
+import assert from "node:assert/strict";
+import { join } from "node:path";
+import { testRender } from "@opentui/react/test-utils";
+import { act } from "react";
+import type { Config } from "../../../../core/config/config";
+
+const scenario = process.argv[2];
+assert.ok(
+  scenario === "native" || scenario === "external" || scenario === "compact",
+);
+const compact = scenario === "compact";
+
+const saved: Partial<Config>[] = [];
+let closes = 0;
+mock.module(join(import.meta.dirname, "../../../context/config.tsx"), () => ({
+  useConfig: () => ({
+    data: { strikeMode: false, findingPolicy: "native" },
+    update: async (patch: Partial<Config>) => {
+      saved.push(patch);
+    },
+  }),
+}));
+
+const { default: AdvancedSettings } = await import("../advanced-settings.tsx");
+const { TerminalDimensionsProvider } = await import(
+  "../../../context/dimensions"
+);
+const { registerBuiltinThemes, ThemeProvider } = await import("../../../theme");
+registerBuiltinThemes();
+
+const setup = await testRender(
+  <ThemeProvider>
+    <TerminalDimensionsProvider>
+      <AdvancedSettings onClose={() => (closes += 1)} />
+    </TerminalDimensionsProvider>
+  </ThemeProvider>,
+  {
+    width: compact ? 60 : 80,
+    height: compact ? 18 : 24,
+    exitOnCtrlC: false,
+  },
+);
+
+const settle = async () => {
+  for (let i = 0; i < 3; i++) await act(async () => {});
+  await act(setup.renderOnce);
+};
+const frame = async () => {
+  await settle();
+  return setup.captureCharFrame();
+};
+const press = async (key: string) => {
+  await act(async () => setup.mockInput.pressKey(key));
+  await settle();
+};
+
+try {
+  const initialFrame = await frame();
+  assert.ok(initialFrame.includes("Strike Mode"), initialFrame);
+  assert.ok(initialFrame.includes("❯ Strike Mode"), initialFrame);
+  assert.ok(initialFrame.includes("Save settings"), initialFrame);
+  assert.ok(!initialFrame.includes("Finding judge"), initialFrame);
+  assert.ok(!initialFrame.includes("Judge off"), initialFrame);
+  assert.deepEqual(saved, []);
+
+  await press("TAB");
+  const strikeOnFrame = await frame();
+  assert.ok(strikeOnFrame.includes("● Enabled"), strikeOnFrame);
+  assert.ok(strikeOnFrame.includes("❯ Strike Mode"), strikeOnFrame);
+  assert.ok(strikeOnFrame.includes("Finding judge"), strikeOnFrame);
+  assert.ok(strikeOnFrame.includes("Apex judge"), strikeOnFrame);
+  assert.ok(!strikeOnFrame.includes("[J]"), strikeOnFrame);
+  if (compact) {
+    assert.ok(strikeOnFrame.includes("Save settings"), strikeOnFrame);
+  }
+
+  await press("j");
+  assert.ok(!(await frame()).includes("Off (report findings only)"));
+
+  await press("ARROW_DOWN");
+  const judgeFocusedFrame = await frame();
+  assert.ok(judgeFocusedFrame.includes("❯ Finding judge"), judgeFocusedFrame);
+  await press("TAB");
+  const judgeOffFrame = await frame();
+  assert.ok(judgeOffFrame.includes("❯ Finding judge"), judgeOffFrame);
+  assert.ok(judgeOffFrame.includes("● Enabled"), judgeOffFrame);
+  assert.ok(judgeOffFrame.includes("Disabled ▾"), judgeOffFrame);
+  assert.ok(
+    !judgeOffFrame.includes("Off (report findings only)"),
+    judgeOffFrame,
+  );
+  await press("TAB");
+  const judgeOnFrame = await frame();
+  assert.ok(judgeOnFrame.includes("❯ Finding judge"), judgeOnFrame);
+  assert.ok(judgeOnFrame.includes("● Enabled"), judgeOnFrame);
+  assert.ok(judgeOnFrame.includes("Apex judge ▾"), judgeOnFrame);
+  assert.deepEqual(saved, []);
+
+  await press("RETURN");
+  const findingSelectFrame = await frame();
+  if (compact) {
+    assert.ok(
+      findingSelectFrame.includes("Apex judge (default)"),
+      findingSelectFrame,
+    );
+    assert.ok(findingSelectFrame.includes("Save settings"), findingSelectFrame);
+  }
+  assert.ok(
+    findingSelectFrame.includes("Off (report findings only)"),
+    findingSelectFrame,
+  );
+  await press("ARROW_DOWN");
+  const offFocusedFrame = await frame();
+  assert.ok(
+    offFocusedFrame.includes("❯ Off (report findings only)"),
+    offFocusedFrame,
+  );
+  await press("RETURN");
+  assert.ok((await frame()).includes("Disabled ▾"));
+  assert.deepEqual(saved, []);
+
+  if (scenario === "native") {
+    await press("ARROW_UP");
+    const strikeFocusedFrame = await frame();
+    assert.ok(strikeFocusedFrame.includes("❯ Strike Mode"), strikeFocusedFrame);
+    assert.ok(strikeFocusedFrame.includes("Disabled ▾"), strikeFocusedFrame);
+    await press("TAB");
+    const strikeOffFrame = await frame();
+    assert.ok(strikeOffFrame.includes("○ Disabled"));
+    assert.ok(!strikeOffFrame.includes("Finding judge"), strikeOffFrame);
+    assert.ok(!strikeOffFrame.includes("Judge off"), strikeOffFrame);
+    assert.ok(!strikeOffFrame.includes("Disabled ▾"));
+    assert.ok(strikeOffFrame.includes("❯ Strike Mode"), strikeOffFrame);
+  }
+
+  await press("ARROW_DOWN");
+  const saveFocusedFrame = await frame();
+  assert.ok(saveFocusedFrame.includes("❯ Save settings"), saveFocusedFrame);
+  await press("TAB");
+  const afterSaveTabFrame = await frame();
+  assert.ok(afterSaveTabFrame.includes("❯ Save settings"), afterSaveTabFrame);
+  assert.ok(
+    afterSaveTabFrame.includes(
+      scenario === "native" ? "○ Disabled" : "● Enabled",
+    ),
+    afterSaveTabFrame,
+  );
+  assert.ok(
+    scenario === "native"
+      ? !afterSaveTabFrame.includes("Finding judge")
+      : afterSaveTabFrame.includes("Disabled ▾"),
+    afterSaveTabFrame,
+  );
+  assert.deepEqual(saved, []);
+  assert.equal(closes, 0);
+  await press("ARROW_UP");
+  const previousFocusedFrame = await frame();
+  assert.ok(
+    previousFocusedFrame.includes(
+      scenario === "native" ? "❯ Strike Mode" : "❯ Finding judge",
+    ),
+    previousFocusedFrame,
+  );
+  await press("ARROW_DOWN");
+  assert.ok((await frame()).includes("❯ Save settings"));
+  await press("RETURN");
+  assert.deepEqual(saved, [
+    scenario === "native"
+      ? { strikeMode: false, findingPolicy: "native" }
+      : { strikeMode: true, findingPolicy: "external" },
+  ]);
+  assert.equal(closes, 1);
+} finally {
+  await act(async () => setup.renderer.destroy());
+}

package/src/tui/components/commands/advanced-settings.test.ts

@@ -0,0 +1,28 @@
+import { spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { expect, it } from "vitest";
+
+for (const scenario of [
+  {
+    name: "Tab toggles the focused Judge and resets it when Strike turns off",
+    mode: "native",
+  },
+  {
+    name: "Tab on Save does not change Strike or Judge",
+    mode: "external",
+  },
+  { name: "keeps judge choices and Save visible at 60x18", mode: "compact" },
+] as const) {
+  it(scenario.name, () => {
+    const result = spawnSync(
+      "bun",
+      [
+        join(import.meta.dirname, "__tests__/advanced-settings-lifecycle.tsx"),
+        scenario.mode,
+      ],
+      { encoding: "utf8", timeout: 30_000 },
+    );
+    expect(result.error).toBeUndefined();
+    expect(result.status, result.stderr).toBe(0);
+  });
+}