@pensar/apex 2.6.1 → 2.7.0-canary.52c132f4

package/build/{agent-yby11zaq.js → agent-112gdg69.js}

@@ -1,14 +1,14 @@
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-xtc2t6me.js";
-import"./cli-1ve18npr.js";
+} from "./cli-wa52mx4p.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-dpsw2fe6.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-mm2vxyne.js";
+import"./cli-bc793xfp.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-fy6vh2a7.js";
+import"./cli-35gz0ahm.js";
 export {
   TargetedPentestAgent2 as TargetedPentestAgent,
   buildPentestSystemPrompt2 as buildPentestSystemPrompt

package/build/agent-9bh42v64.js

@@ -0,0 +1,13 @@
+import {
+  CodeAgent2
+} from "./cli-np9x97h3.js";
+import"./cli-1wtxf161.js";
+import"./cli-qba2x69h.js";
+import"./cli-ene4g09p.js";
+import"./cli-mm2vxyne.js";
+import"./cli-bc793xfp.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-35gz0ahm.js";
+export {
+  CodeAgent2 as CodeAgent
+};

package/build/agent-jg7v2yn0.js

@@ -0,0 +1,13 @@
+import {
+  runAuthenticationAgent2
+} from "./cli-087apjgk.js";
+import"./cli-1wtxf161.js";
+import"./cli-qba2x69h.js";
+import"./cli-ene4g09p.js";
+import"./cli-mm2vxyne.js";
+import"./cli-bc793xfp.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-35gz0ahm.js";
+export {
+  runAuthenticationAgent2 as runAuthenticationAgent
+};

package/build/{agent-runs-g37vkrjr.js → agent-runs-hhjzsysf.js}

@@ -1,8 +1,11 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+} from "./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
+import {
+  AgentEventBus
+} from "./cli-ene4g09p.js";
 import {
   inspectSessionEvidence2,
   RecordedRunSpecSchema,
@@ -13,28 +16,25 @@ import {
   runRecordedAgent2,
   RunRecoveryBlockedError2,
   resumeRecordedAgent2
-} from "./cli-7eea4e2y.js";
-import {
-  AgentEventBus
-} from "./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-ahk627k3.js";
+import"./cli-tb77javm.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
+import"./cli-3158x9wb.js";
+import"./cli-087apjgk.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import"./cli-xcy2vxj2.js";
 import {
   resolveWorkerExecutable,
   launchLocalWorker
-} from "./cli-gx71jcke.js";
-import"./cli-1ve18npr.js";
+} from "./cli-k8m6737j.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
 import {
   buildAuthConfig,
   init_ai
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/agent-runs.ts
@@ -115,7 +115,7 @@ async function runAgentRunsCommand(args) {
     if (!isAbsolute(values.store)) {
       throw new Error("agent-runs worker requires --store <absolute database>");
     }
-    const { serveLocalRunWorker } = await import("./index-qv4cc65p.js");
+    const { serveLocalRunWorker } = await import("./index-269a90mm.js");
     await serveLocalRunWorker({
       runId: values.run,
       databasePath: resolve(values.store)
@@ -129,7 +129,7 @@ async function runAgentRunsCommand(args) {
 ${HELP}`);
   }
   if (command === "attach") {
-    const { openRecordedRunClient } = await import("./recordedRunClient-dp032c32.js");
+    const { openRecordedRunClient } = await import("./recordedRunClient-d7947b0z.js");
     const client = await openRecordedRunClient(values.store);
     const controller = new AbortController;
     const detach = () => controller.abort();

package/build/{agent-ayreaj6z.js → agent-ydy5fq92.js}

@@ -1,15 +1,15 @@
-import"./cli-qgz1q9g5.js";
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 import {
   init_zod

package/build/{apps-xn6km9yn.js → apps-v4jc7eqb.js}

@@ -1,7 +1,4 @@
 #!/usr/bin/env bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
-import"./cli-7eea4e2y.js";
 import {
   ENDPOINT_TRANSPORTS2,
   listApps2,
@@ -18,21 +15,24 @@ import {
   searchEndpoints2,
   listDomains2,
   createDomain2
-} from "./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-ene4g09p.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
+import"./cli-ahk627k3.js";
+import"./cli-tb77javm.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
+import"./cli-3158x9wb.js";
+import"./cli-087apjgk.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/apps.ts

package/build/{auth-d105wc64.js → auth-bxkn5pcb.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env bun
+import"./cli-ene4g09p.js";
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-35gz0ahm.js";
 import {
   getPensarApiUrl2,
   getPensarConsoleUrl2,
@@ -18,23 +19,22 @@ import {
   createWorkspaceSelection2,
   pollWorkspaceSelection2,
   init_auth
-} from "./cli-c05y640n.js";
-import"./cli-7eea4e2y.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-bc793xfp.js";
+import"./cli-ahk627k3.js";
+import"./cli-tb77javm.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
+import"./cli-3158x9wb.js";
+import"./cli-087apjgk.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 import {
   __require

package/build/{blackboxAgent-s56sgx9b.js → blackboxAgent-260yqknt.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-k2nwxta0.js";
-import"./cli-1ve18npr.js";
+} from "./cli-tb77javm.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-dpsw2fe6.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-mm2vxyne.js";
+import"./cli-bc793xfp.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-fy6vh2a7.js";
+import"./cli-35gz0ahm.js";
 export {
   BlackboxAttackSurfaceAgent2 as BlackboxAttackSurfaceAgent
 };

package/build/{blackboxPentest-ps78v3w7.js → blackboxPentest-nbn588pb.js}

@@ -1,26 +1,26 @@
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
+import"./cli-ene4g09p.js";
+import"./cli-tb77javm.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import {
   readExecutionMetrics,
   writeExecutionMetrics,
   runPentestWorkflow2
-} from "./cli-d37a42dc.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
+} from "./cli-3158x9wb.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
 import {
   EMPTY_SESSION_TOKEN_USAGE,
   accumulateSessionTokens
 } from "./cli-ag6jtndp.js";
-import"./cli-1ve18npr.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
 import {
   init_ai,
   normalizeStepUsage
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/api/blackboxPentest.ts
@@ -45,7 +45,12 @@ async function runPentestAgent(input) {
       tokenUsage
     });
   }
-  const { findings, findingsPath, pocsPath, reportPath } = result;
+  const { findings, findingsPath, pocsPath, reportPath, reportedFindings } = result;
+  if ((input.hooks?.findingPolicy ?? input.findingPolicy) === "external") {
+    console.log(`
+Reported ${reportedFindings?.length ?? 0} finding(s) for external evaluation`);
+    return result;
+  }
   console.log(`
 Found ${findings.length} vulnerabilities`);
   console.log(`Findings: ${findingsPath}`);

package/build/{cli-3sp6nd8d.js → cli-087apjgk.js}

@@ -8,7 +8,7 @@ import {
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-1wtxf161.js";
 import {
   hasToolCall,
   init_dist,
@@ -16,7 +16,7 @@ import {
   init_lazyLogger,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();

package/build/{cli-1ve18npr.js → cli-1wtxf161.js}

@@ -1,10 +1,11 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-ene4g09p.js";
 
 // src/core/agents/agentRuntime.ts
 function assembleAgentHooks(opts) {
   return {
+    findingPolicy: opts.findingPolicy,
     backends: opts.backends,
     subagentSpawner: opts.subagentSpawner,
     languageModelMiddleware: opts.languageModelMiddleware,
@@ -39,7 +40,7 @@ class AgentRuntime extends OffensiveSecurityAgent {
       responseSchema: definition.responseSchema?.(opts, state),
       stopWhen: definition.stopWhen?.(opts, state) ?? opts.stopWhen,
       extraTools: mergeExtraTools(opts.extraTools, definition.extraTools?.(opts, state)),
-      resolveResult: resolveResult ? (streamResult) => resolveResult(opts, state, streamResult) : undefined,
+      resolveResult: resolveResult ? (streamResult, validatedResponse) => resolveResult(opts, state, streamResult, validatedResponse) : undefined,
       target: definition.target?.(opts, state) ?? opts.target,
       grpc: definition.grpc?.(opts, state) ?? opts.grpc,
       browserEngine: definition.browserEngine?.(opts, state) ?? opts.browserEngine,

package/build/{cli-d37a42dc.js → cli-3158x9wb.js}

@@ -12,24 +12,24 @@ import {
   pLimit,
   PLAN_MODE_TOOL_NAMES,
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-ene4g09p.js";
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-k2nwxta0.js";
+} from "./cli-tb77javm.js";
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-xtc2t6me.js";
+} from "./cli-wa52mx4p.js";
 import {
   buildPentestReport,
   renderJson,
   renderMarkdown,
   REPORT_FILENAME_MD,
   REPORT_FILENAME_JSON
-} from "./cli-n2en7j5b.js";
+} from "./cli-xe4wq07r.js";
 import {
   CodeAgent2
-} from "./cli-kb21qhvm.js";
+} from "./cli-np9x97h3.js";
 import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT,
@@ -38,7 +38,7 @@ import {
   AppInfoSchema2,
   AppsDiscoveryResultSchema2,
   DiscoverySummarySchema2
-} from "./cli-ngq9dr8n.js";
+} from "./cli-mpmpfce6.js";
 import {
   createThreatModelPrompt
 } from "./cli-q126f6ef.js";
@@ -50,7 +50,7 @@ import {
   init_session,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import {
   newSessionId,
   init_id
@@ -262,6 +262,28 @@ function loadSubagentMessages(session, key) {
     return [];
   }
 }
+function loadSubagentReportedFindings(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.reportedFindings) && data.reportedFindings.every((finding) => typeof finding === "string") ? data.reportedFindings : null;
+  } catch {
+    return null;
+  }
+}
+function loadSubagentObjectiveResults(session, key) {
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
+  if (!existsSync2(snapshotPath))
+    return null;
+  try {
+    const data = JSON.parse(readFileSync2(snapshotPath, "utf-8"));
+    return data.status === "completed" && Array.isArray(data.objectiveResults) && data.objectiveResults.every((result) => result !== null && typeof result === "object" && typeof result.objective === "string" && typeof result.completed === "boolean" && (result.result === undefined || typeof result.result === "string")) ? data.objectiveResults : null;
+  } catch {
+    return null;
+  }
+}
 function saveSubagentData(session, data) {
   const subagentsDir = join2(session.rootPath, SUBAGENTS_DIR);
   mkdirSync(subagentsDir, { recursive: true });
@@ -287,6 +309,8 @@ function saveSubagentData(session, data) {
     toolCallCount,
     stepCount,
     findingsCount: data.findingsCount ?? 0,
+    reportedFindings: data.reportedFindings,
+    objectiveResults: data.objectiveResults,
     status: data.status,
     error: data.error,
     messages: data.messages,
@@ -780,6 +804,7 @@ async function runEndpointDocumentationAgent(opts) {
       attackSurfaceRegistry
     },
     runtime: {
+      findingPolicy: hooks?.findingPolicy,
       model,
       session,
       authConfig,
@@ -7079,6 +7104,7 @@ async function runWhiteboxAttackSurfaceApp(app, appIndex, input) {
           attackSurfaceRegistry
         },
         runtime: {
+          findingPolicy: hooksForApp.findingPolicy,
           model,
           session,
           authConfig,
@@ -7937,8 +7963,22 @@ async function runPentestSwarmTarget(target, index, input) {
   const entry = manifestEntries[index];
   const subagentId = entry.id;
   const subagentName = target.name ?? entry.name;
-  if (completedIds.has(subagentId))
-    return null;
+  if (completedIds.has(subagentId)) {
+    if (sharedHooks.findingPolicy !== "external")
+      return null;
+    const reportedFindings = loadSubagentReportedFindings(session, subagentId);
+    const objectiveResults = loadSubagentObjectiveResults(session, subagentId);
+    if (!reportedFindings || !objectiveResults) {
+      throw new Error(`Cannot resume externally graded pentest: findings or objective results for completed agent ${subagentId} are unavailable`);
+    }
+    return {
+      findings: [],
+      reportedFindings,
+      objectiveResults,
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath
+    };
+  }
   const itemHooks = resolveItemHooks(sharedHooks, seams, target, index);
   const childSignal = abortSignal && itemHooks.abortSignal ? AbortSignal.any([abortSignal, itemHooks.abortSignal]) : abortSignal ?? itemHooks.abortSignal;
   const previousMessages = loadSubagentMessages(session, subagentId);
@@ -8035,14 +8075,21 @@ async function runPentestSwarmTarget(target, index, input) {
       abortSignal: childSignal
     });
     const result = await agent.consume();
+    if (itemHooks.findingPolicy === "external" && (!Array.isArray(result.reportedFindings) || !Array.isArray(result.objectiveResults))) {
+      throw new Error(`Externally graded pentest worker ${subagentId} ended without structured findings and objective results`);
+    }
     saveSubagentData(session, {
       agentName: subagentId,
       target: target.target,
       objective: objectiveStr,
       status: "completed",
-      findingsCount: result.findings.length,
+      findingsCount: result.reportedFindings?.length ?? result.findings.length,
+      ...itemHooks.findingPolicy === "external" ? {
+        reportedFindings: result.reportedFindings,
+        objectiveResults: result.objectiveResults
+      } : {},
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent.userPrompt
     });
     updateManifestEntryStatus(session, subagentId, "completed");
@@ -8060,7 +8107,7 @@ async function runPentestSwarmTarget(target, index, input) {
       status: "failed",
       error: error instanceof Error ? error.message : String(error),
       messages: [...previousMessages, ...lastMessages],
-      systemPrompt: buildPentestSystemPrompt2(session),
+      systemPrompt: buildPentestSystemPrompt2(session, "orchestrator", "default", undefined, undefined, itemHooks.findingPolicy),
       userPrompt: agent?.userPrompt ?? ""
     });
     updateManifestEntryStatus(session, subagentId, "failed");
@@ -8106,7 +8153,8 @@ async function runPentestSwarm2(input) {
     languageModelMiddleware,
     usageRecorder,
     streamIdFactory,
-    ...hooks
+    ...hooks,
+    findingPolicy: hooks?.findingPolicy ?? input.findingPolicy
   };
   const findingsRegistry = withFindingPersistedHook(rawFindingsRegistry, seams.hooks.onFindingPersisted);
   const completedIds = getCompletedAgentIds(session);
@@ -8135,11 +8183,14 @@ async function runPentestSwarm2(input) {
   };
   const results = await seams.fanOut.spawnMany(targets, (target, index) => runPentestSwarmTarget(target, index, targetInput), { concurrency, abortSignal });
   finalizeManifest(session, manifestEntries, results);
+  if (sharedHooks.findingPolicy === "external" && results.some((result) => result === null)) {
+    throw new Error("Externally graded pentest has an incomplete swarm target; findings cannot be aggregated");
+  }
   return results;
 }
 async function runPentestWorkflow2(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-mcjdvwez.js");
+    const { runFastStrike } = await import("./fastStrike-v0r461wn.js");
     return runFastStrike(input);
   }
   const {
@@ -8159,6 +8210,7 @@ async function runPentestWorkflow2(input) {
     threatModel,
     surfaceIntegrationEnabled
   } = input;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
   const seams = input.seams ?? inProcessSeams({
     fanOut: input.hooks?.subagentSpawner ?? input.subagentSpawner,
     registries: {
@@ -8234,7 +8286,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           },
           seams
         });
@@ -8254,7 +8307,8 @@ ${combined}` : combined;
             languageModelMiddleware: input.languageModelMiddleware,
             usageRecorder: input.usageRecorder,
             streamIdFactory: input.streamIdFactory,
-            ...input.hooks
+            ...input.hooks,
+            findingPolicy
           }
         });
       }
@@ -8270,6 +8324,16 @@ ${combined}` : combined;
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
     if (swarmTargets.length === 0) {
+      if (findingPolicy === "external") {
+        return {
+          findings: [],
+          reportedFindings: [],
+          objectiveResults: [],
+          findingsPath: session.findingsPath,
+          pocsPath: session.pocsPath,
+          reportPath: null
+        };
+      }
       const report = buildPentestReport([], {
         target,
         model,
@@ -8293,9 +8357,12 @@ ${combined}` : combined;
     });
     const findingsRegistry = seams.registries.findings();
     const completedCount = getCompletedAgentIds(session).size;
-    if (completedCount < swarmTargets.length) {
-      await runPentestSwarm2({
+    let externalReportedFindings = [];
+    let externalObjectiveResults = [];
+    if (findingPolicy === "external" || completedCount < swarmTargets.length) {
+      const swarmResults = await runPentestSwarm2({
         targets: swarmTargets,
+        findingPolicy,
         model,
         session,
         authConfig,
@@ -8314,10 +8381,26 @@ ${combined}` : combined;
         hooks: input.hooks,
         seams
       });
+      externalReportedFindings = swarmResults.flatMap((result) => result?.reportedFindings ?? []);
+      externalObjectiveResults = swarmResults.flatMap((result) => result?.objectiveResults ?? []);
     }
     if (abortSignal?.aborted) {
       throw new DOMException("Pentest aborted by user", "AbortError");
     }
+    if (findingPolicy === "external") {
+      eventBus?.emit("workflow-phase-complete", {
+        phase: "pentesting",
+        summary: { findingsCount: externalReportedFindings.length }
+      });
+      return {
+        findings: [],
+        reportedFindings: externalReportedFindings,
+        objectiveResults: externalObjectiveResults,
+        findingsPath: session.findingsPath,
+        pocsPath: session.pocsPath,
+        reportPath: null
+      };
+    }
     eventBus?.emit("workflow-phase-start", {
       phase: "reporting",
       label: "Report Generation"

package/build/{cli-fy6vh2a7.js → cli-35gz0ahm.js}

@@ -3,7 +3,7 @@ import {
   get2,
   update2,
   init_config2
-} from "./cli-709rvekb.js";
+} from "./cli-6vpprmxb.js";
 import {
   __esm
 } from "./cli-h6y3bt60.js";

package/build/{cli-65g6rcat.js → cli-5xdefy58.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-h6y3bt60.js";
 
 // package.json
-var version = "2.6.1", package_default;
+var version = "2.7.0-canary.52c132f4", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",

package/build/{cli-709rvekb.js → cli-6vpprmxb.js}

@@ -15,7 +15,7 @@ import {
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-65g6rcat.js";
+} from "./cli-5xdefy58.js";
 import {
   __esm
 } from "./cli-h6y3bt60.js";
@@ -287,6 +287,7 @@ function applyEnvFallbacks(parsedConfig) {
     responsibleUseAccepted: parsedConfig.responsibleUseAccepted ?? false,
     defaultHeaders: parsedConfig.defaultHeaders ?? DEFAULT_CONFIG.defaultHeaders,
     strikeMode: parsedConfig.strikeMode ?? DEFAULT_CONFIG.strikeMode,
+    findingPolicy: parsedConfig.findingPolicy === "external" ? "external" : "native",
     surfaceIntegrationEnabled: parsedConfig.surfaceIntegrationEnabled ?? parseBoolEnv(process.env.PENSAR_SURFACE_INTEGRATION),
     version,
     customProviders: loadCustomProviders(parsedConfig.customProviders),
@@ -348,7 +349,8 @@ var init_config2 = __esm(() => {
   DEFAULT_CONFIG = {
     responsibleUseAccepted: false,
     defaultHeaders: { "User-Agent": "pensar-apex" },
-    strikeMode: false
+    strikeMode: false,
+    findingPolicy: "native"
   };
 });
 

package/build/{cli-az3xq70v.js → cli-8hrdnq0e.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();