@pensar/apex 2.6.1 → 2.7.0-canary.52c132f4

package/src/tui/components/commands/advanced-settings.tsx

@@ -1,22 +1,88 @@
 import { useKeyboard } from "@opentui/react";
 import { useCallback, useState } from "react";
+import type { FindingPolicy } from "../../../core/agents/offSecAgent";
 import { useConfig } from "../../context/config";
 import { Dialog } from "../../context/dialog";
+import { useDimensions } from "../../context/dimensions";
 import { useTheme } from "../../theme";
 import DialogLayout from "../dialog-layout";
 
+const FINDING_POLICIES: { value: FindingPolicy; label: string }[] = [
+  { value: "native", label: "Apex judge (default)" },
+  { value: "external", label: "Off (report findings only)" },
+];
+
 interface AdvancedSettingsProps {
   onClose: () => void;
 }
 
+type FocusedSetting = "strike" | "judge" | "save";
+
 export default function AdvancedSettings({ onClose }: AdvancedSettingsProps) {
   const { colors } = useTheme();
+  const dimensions = useDimensions();
+  const compact = dimensions.width < 65 || dimensions.height < 24;
   const config = useConfig();
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [draftStrikeMode, setDraftStrikeMode] = useState(
     config.data.strikeMode ?? false,
   );
+  const [draftFindingPolicy, setDraftFindingPolicy] = useState<FindingPolicy>(
+    config.data.strikeMode ? (config.data.findingPolicy ?? "native") : "native",
+  );
+  const [findingSelectOpen, setFindingSelectOpen] = useState(false);
+  const [highlightedFindingIndex, setHighlightedFindingIndex] = useState(0);
+  const [focusedSetting, setFocusedSetting] =
+    useState<FocusedSetting>("strike");
+
+  const openFindingSelect = useCallback(() => {
+    if (!draftStrikeMode) return;
+    setHighlightedFindingIndex(
+      Math.max(
+        0,
+        FINDING_POLICIES.findIndex(
+          (option) => option.value === draftFindingPolicy,
+        ),
+      ),
+    );
+    setFindingSelectOpen(true);
+  }, [draftFindingPolicy, draftStrikeMode]);
+
+  const toggleStrikeMode = useCallback(() => {
+    if (draftStrikeMode) {
+      setDraftFindingPolicy("native");
+      setFindingSelectOpen(false);
+      setFocusedSetting((focused) =>
+        focused === "judge" ? "strike" : focused,
+      );
+    }
+    setDraftStrikeMode(!draftStrikeMode);
+  }, [draftStrikeMode]);
+
+  const toggleFindingPolicy = useCallback(() => {
+    if (!draftStrikeMode) return;
+    setDraftFindingPolicy((policy) =>
+      policy === "native" ? "external" : "native",
+    );
+    setFindingSelectOpen(false);
+  }, [draftStrikeMode]);
+
+  const moveFocus = useCallback(
+    (direction: number) => {
+      const visibleSettings: FocusedSetting[] = draftStrikeMode
+        ? ["strike", "judge", "save"]
+        : ["strike", "save"];
+      setFocusedSetting((focused) => {
+        const currentIndex = Math.max(0, visibleSettings.indexOf(focused));
+        const nextIndex =
+          (currentIndex + direction + visibleSettings.length) %
+          visibleSettings.length;
+        return visibleSettings[nextIndex] ?? "strike";
+      });
+    },
+    [draftStrikeMode],
+  );
 
   const saveSettings = useCallback(async () => {
     if (saving) return;
@@ -24,34 +90,72 @@ export default function AdvancedSettings({ onClose }: AdvancedSettingsProps) {
     setSaving(true);
     setError(null);
     try {
-      await config.update({ strikeMode: draftStrikeMode });
+      await config.update({
+        strikeMode: draftStrikeMode,
+        findingPolicy: draftStrikeMode ? draftFindingPolicy : "native",
+      });
       onClose();
     } catch (cause) {
       setError(
         cause instanceof Error
-          ? `Could not save Strike Mode: ${cause.message}`
-          : "Could not save Strike Mode.",
+          ? `Could not save advanced settings: ${cause.message}`
+          : "Could not save advanced settings.",
       );
       setSaving(false);
     }
-  }, [config, draftStrikeMode, onClose, saving]);
+  }, [config, draftFindingPolicy, draftStrikeMode, onClose, saving]);
 
   useKeyboard((key) => {
+    if (key.name === "tab") {
+      key.preventDefault();
+      if (focusedSetting === "strike") toggleStrikeMode();
+      else if (focusedSetting === "judge") toggleFindingPolicy();
+      return;
+    }
+
+    if (findingSelectOpen) {
+      key.preventDefault();
+
+      if (key.name === "escape") {
+        setFindingSelectOpen(false);
+        return;
+      }
+
+      if (key.name === "up" || key.name === "down") {
+        const direction = key.name === "up" ? -1 : 1;
+        setHighlightedFindingIndex(
+          (index) =>
+            (index + direction + FINDING_POLICIES.length) %
+            FINDING_POLICIES.length,
+        );
+        return;
+      }
+
+      if (key.name === "return") {
+        const selected = FINDING_POLICIES[highlightedFindingIndex];
+        if (selected) setDraftFindingPolicy(selected.value);
+        setFindingSelectOpen(false);
+      }
+      return;
+    }
+
     if (key.name === "escape") {
       key.preventDefault();
       onClose();
       return;
     }
 
-    if (key.name === "tab") {
+    if (key.name === "up" || key.name === "down") {
       key.preventDefault();
-      setDraftStrikeMode((enabled) => !enabled);
+      moveFocus(key.name === "up" ? -1 : 1);
       return;
     }
 
     if (key.name === "return") {
       key.preventDefault();
-      void saveSettings();
+      if (focusedSetting === "strike") toggleStrikeMode();
+      else if (focusedSetting === "judge") openFindingSelect();
+      else void saveSettings();
     }
   });
 
@@ -59,31 +163,145 @@ export default function AdvancedSettings({ onClose }: AdvancedSettingsProps) {
     <Dialog size="medium" onClose={onClose}>
       <DialogLayout
         title="Advanced Settings"
+        escLabel={findingSelectOpen ? "back" : "close"}
         footerActions={[
-          { key: "Enter", label: "Save & Close", variant: "primary" },
-          { key: "Tab", label: "Toggle" },
+          findingSelectOpen
+            ? { key: "Enter", label: "Select", variant: "primary" }
+            : { key: "Enter", label: "Activate", variant: "primary" },
+          findingSelectOpen
+            ? { key: "↑/↓", label: "Choose" }
+            : { key: "↑/↓", label: "Navigate" },
+          ...(dimensions.width >= 60 && focusedSetting !== "save"
+            ? [{ key: "Tab", label: "Toggle" }]
+            : []),
         ]}
       >
-        <box flexDirection="column" gap={1} overflow="hidden">
+        <box flexDirection="column" gap={compact ? 0 : 1} overflow="hidden">
           <box
             flexDirection="row"
             justifyContent="space-between"
             overflow="hidden"
+            backgroundColor={
+              focusedSetting === "strike" && !findingSelectOpen
+                ? colors.backgroundSelected
+                : undefined
+            }
+            onMouseDown={() => {
+              setFocusedSetting("strike");
+              toggleStrikeMode();
+            }}
           >
-            <text fg={colors.text}>Strike Mode</text>
+            <text
+              fg={focusedSetting === "strike" ? colors.primary : colors.text}
+            >
+              {focusedSetting === "strike" ? "❯ " : "  "}Strike Mode
+            </text>
             <text fg={draftStrikeMode ? colors.warning : colors.textMuted}>
               {draftStrikeMode ? "● Enabled" : "○ Disabled"}
             </text>
           </box>
 
-          <text fg={colors.textMuted}>
-            Use one focused operator for iterative vulnerability research.
-            Disables automatic discovery and agent fan-out.
-          </text>
-          <text fg={colors.textMuted}>
-            Applies to new operator sessions. Existing sessions keep their saved
-            mode.
-          </text>
+          {!compact && (
+            <text fg={colors.textMuted}>
+              Focused research; no auto-discovery or agent fan-out.
+            </text>
+          )}
+
+          {draftStrikeMode && (
+            <>
+              <box
+                flexDirection="row"
+                justifyContent="space-between"
+                overflow="hidden"
+                backgroundColor={
+                  focusedSetting === "judge" && !findingSelectOpen
+                    ? colors.backgroundSelected
+                    : undefined
+                }
+                onMouseDown={() => {
+                  setFocusedSetting("judge");
+                  openFindingSelect();
+                }}
+              >
+                <text
+                  fg={focusedSetting === "judge" ? colors.primary : colors.text}
+                >
+                  {focusedSetting === "judge" ? "❯ " : "  "}Finding judge
+                </text>
+                <text
+                  fg={
+                    draftFindingPolicy === "native"
+                      ? colors.primary
+                      : colors.warning
+                  }
+                >
+                  {draftFindingPolicy === "native" ? "Apex judge" : "Disabled"}
+                  {" ▾"}
+                </text>
+              </box>
+
+              {findingSelectOpen && (
+                <box flexDirection="column" overflow="hidden">
+                  {FINDING_POLICIES.map((option, index) => {
+                    const highlighted = index === highlightedFindingIndex;
+                    return (
+                      <box
+                        key={option.value}
+                        flexDirection="row"
+                        paddingLeft={1}
+                        paddingRight={1}
+                        overflow="hidden"
+                        backgroundColor={
+                          highlighted ? colors.backgroundSelected : undefined
+                        }
+                        onMouseDown={() => {
+                          setDraftFindingPolicy(option.value);
+                          setFindingSelectOpen(false);
+                        }}
+                      >
+                        <text fg={highlighted ? colors.primary : colors.text}>
+                          {highlighted ? "❯ " : "  "}
+                          {option.label}
+                        </text>
+                        {draftFindingPolicy === option.value && (
+                          <text fg={colors.primary}> ✓</text>
+                        )}
+                      </box>
+                    );
+                  })}
+                </box>
+              )}
+
+              {!compact && (
+                <>
+                  <text fg={colors.textMuted}>
+                    Judge off skips in-run review and report.
+                  </text>
+                  <text fg={colors.textMuted}>
+                    New sessions only; TUI has no external evaluator.
+                  </text>
+                </>
+              )}
+            </>
+          )}
+
+          <box
+            flexDirection="row"
+            overflow="hidden"
+            backgroundColor={
+              focusedSetting === "save" && !findingSelectOpen
+                ? colors.backgroundSelected
+                : undefined
+            }
+            onMouseDown={() => {
+              setFocusedSetting("save");
+              void saveSettings();
+            }}
+          >
+            <text fg={focusedSetting === "save" ? colors.primary : colors.text}>
+              {focusedSetting === "save" ? "❯ " : "  "}Save settings
+            </text>
+          </box>
 
           {saving && <text fg={colors.textMuted}>Saving…</text>}
           {error && <text fg={colors.error}>{error}</text>}

package/src/tui/components/operator-dashboard/index.tsx

@@ -29,6 +29,7 @@ import {
   type AgentMode,
   ALL_TOOL_NAMES,
   ASK_USER_QUESTIONS_TOOL_NAME,
+  type FindingPolicy,
   PLAN_MODE_TOOL_NAMES,
   SKILL_TOOL_NAMES,
 } from "../../../core/agents/offSecAgent";
@@ -108,12 +109,15 @@ import {
   type DashboardStatus,
   filterOperatorAutocomplete,
   resolveAbortAction,
+  resolveActiveFindingPolicy,
   resolveInputFocused,
   resolveKeyboardShortcut,
   resolveOperatorAgentMode,
+  resolveOperatorFindingPolicy,
   resolveOperatorStrikeMode,
   resolveSubmit,
   routeCommand,
+  shouldHandleQueuedMessageKey,
 } from "./logic";
 import {
   createQueuedMessage,
@@ -159,6 +163,7 @@ export default function OperatorDashboard({
     target?: string;
     operatorMode?: OperatorMode;
     strikeMode?: boolean;
+    findingPolicy?: FindingPolicy;
     sandbox?: boolean;
     taskDriven?: boolean;
     headers?: Record<string, string>;
@@ -206,6 +211,17 @@ export default function OperatorDashboard({
     }),
   );
   const [strikeMode, setStrikeMode] = useState(initialStrikeModeRef.current);
+  const initialFindingPolicyRef = useRef(
+    resolveOperatorFindingPolicy({
+      resuming: !!sessionId,
+      strikeMode: initialStrikeModeRef.current,
+      routeOverride: initialConfig?.findingPolicy,
+      persistedDefault: config.data.findingPolicy,
+    }),
+  );
+  const [findingPolicy, setFindingPolicy] = useState(
+    initialFindingPolicyRef.current,
+  );
 
   // biome-ignore lint/correctness/useExhaustiveDependencies: `skillsVersion` is an intentional cache-buster — forces recomputation when skills are refreshed even though `skillsRegistry` (stable ref) hasn't changed.
   const autocompleteOptions = useMemo(() => {
@@ -361,6 +377,10 @@ export default function OperatorDashboard({
     operatorMode,
     strikeMode,
   );
+  const activeFindingPolicy = resolveActiveFindingPolicy(
+    agentMode,
+    findingPolicy,
+  );
   const requireApproval = operatorMode === "manual";
   // Plan mode review state
   const [approvedPlanContent, setApprovedPlanContent] = useState<string | null>(
@@ -427,10 +447,16 @@ export default function OperatorDashboard({
           const s = await sessions.get(sessionId);
           setSession(s);
           setSessionCwd(s.rootPath);
-          setStrikeMode(
-            resolveOperatorStrikeMode({
+          const resumedStrikeMode = resolveOperatorStrikeMode({
+            resuming: true,
+            savedSessionValue: s.config?.operatorSettings?.strikeMode,
+          });
+          setStrikeMode(resumedStrikeMode);
+          setFindingPolicy(
+            resolveOperatorFindingPolicy({
               resuming: true,
-              savedSessionValue: s.config?.operatorSettings?.strikeMode,
+              strikeMode: resumedStrikeMode,
+              savedSessionValue: s.config?.operatorSettings?.findingPolicy,
             }),
           );
 
@@ -516,6 +542,7 @@ export default function OperatorDashboard({
           // New session — just set up operator config; the agent creates the
           // session on the first runAgent call.
           setStrikeMode(initialStrikeModeRef.current);
+          setFindingPolicy(initialFindingPolicyRef.current);
           const newMode = initialConfig?.operatorMode ?? "manual";
           setOperatorMode(newMode);
           const requireApproval = newMode === "manual";
@@ -871,6 +898,7 @@ export default function OperatorDashboard({
           ...SKILL_TOOL_NAMES,
         ] as string[],
         mode: agentMode,
+        findingPolicy: activeFindingPolicy,
         authConfig: buildAuthConfig(config.data),
         approvalGate: approvalGateRef.current,
         commandCancelHandle: cancelHandleRef.current,
@@ -926,6 +954,7 @@ export default function OperatorDashboard({
               agentMode !== "plan" ? approvedPlanRef.current : null,
             taskDriven:
               session?.config?.taskDriven ?? initialConfig?.taskDriven,
+            findingPolicy: activeFindingPolicy,
           },
         );
 
@@ -945,6 +974,7 @@ export default function OperatorDashboard({
               requireApproval,
               enableSuggestions: true,
               strikeMode,
+              findingPolicy,
             },
             agentCwd: initialConfig?.sandbox ? undefined : process.cwd(),
             codebasePath: initialConfig?.sandbox ? undefined : process.cwd(),
@@ -1082,6 +1112,8 @@ export default function OperatorDashboard({
       initialConfig?.headers,
       initialConfig?.promptInjectionLibrarySource,
       strikeMode,
+      findingPolicy,
+      activeFindingPolicy,
       route.data,
       setSessionCwd,
       skillsRegistry.buildCatalog,
@@ -1634,11 +1666,16 @@ This three-phase flow is specific to the TUI \`/threat-model\` command. The same
 
   // Keyboard shortcuts
   useKeyboard((key) => {
+    const dialogOpen =
+      stack.length > 0 || externalDialogOpen || !!pendingQuestions;
     // Queue navigation: handle before general shortcuts
     if (
-      status === "running" &&
-      queuedMessages.length > 0 &&
-      !inputValue.trim()
+      shouldHandleQueuedMessageKey(
+        status,
+        queuedMessages.length,
+        inputValue,
+        dialogOpen,
+      )
     ) {
       if (key.name === "up") {
         key.preventDefault?.();
@@ -1765,9 +1802,6 @@ This three-phase flow is specific to the TUI \`/threat-model\` command. The same
 
     // Treat the questions form as a dialog so that dashboard-level shortcuts
     // (Shift+Tab cycle-mode, etc.) don't fire while the form owns the keyboard.
-    const dialogOpen =
-      stack.length > 0 || externalDialogOpen || !!pendingQuestions;
-
     // Ctrl+A to open subagent dialog (skip if another dialog is open)
     if (
       key.ctrl &&
@@ -1926,6 +1960,9 @@ This three-phase flow is specific to the TUI \`/threat-model\` command. The same
         <box flexDirection="row" gap={2}>
           <text fg={colors.text}>{session?.name ?? "New Session"}</text>
           {strikeMode && <text fg={colors.warning}>STRIKE</text>}
+          {activeFindingPolicy === "external" && (
+            <text fg={colors.textMuted}>JUDGE OFF</text>
+          )}
           {(session?.targets[0] || initialConfig?.target) && (
             <>
               <text fg={colors.textMuted}>•</text>

package/src/tui/components/operator-dashboard/logic.test.ts

@@ -6,12 +6,15 @@ import {
   type DashboardStatus,
   filterOperatorAutocomplete,
   resolveAbortAction,
+  resolveActiveFindingPolicy,
   resolveInputFocused,
   resolveKeyboardShortcut,
   resolveOperatorAgentMode,
+  resolveOperatorFindingPolicy,
   resolveOperatorStrikeMode,
   resolveSubmit,
   routeCommand,
+  shouldHandleQueuedMessageKey,
 } from "./logic";
 
 // ---------------------------------------------------------------------------
@@ -130,6 +133,98 @@ describe("resolveOperatorStrikeMode", () => {
   });
 });
 
+describe("resolveOperatorFindingPolicy", () => {
+  it("defaults new sessions to Apex finding review", () => {
+    expect(
+      resolveOperatorFindingPolicy({ resuming: false, strikeMode: true }),
+    ).toBe("native");
+  });
+
+  it("uses the saved preference for new Strike sessions", () => {
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: false,
+        strikeMode: true,
+        persistedDefault: "external",
+      }),
+    ).toBe("external");
+  });
+
+  it("lets an explicit workflow override the saved preference", () => {
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: false,
+        strikeMode: true,
+        routeOverride: "native",
+        persistedDefault: "external",
+      }),
+    ).toBe("native");
+  });
+
+  it("restores the policy saved with a resumed Strike session", () => {
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: true,
+        strikeMode: true,
+        savedSessionValue: "external",
+        persistedDefault: "native",
+      }),
+    ).toBe("external");
+  });
+
+  it("keeps legacy resumed sessions native despite a newer global preference", () => {
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: true,
+        strikeMode: true,
+        persistedDefault: "external",
+      }),
+    ).toBe("native");
+  });
+
+  it("keeps standard sessions native despite external preferences or overrides", () => {
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: false,
+        strikeMode: false,
+        routeOverride: "external",
+        persistedDefault: "external",
+      }),
+    ).toBe("native");
+    expect(
+      resolveOperatorFindingPolicy({
+        resuming: true,
+        strikeMode: false,
+        savedSessionValue: "external",
+      }),
+    ).toBe("native");
+  });
+});
+
+describe("resolveActiveFindingPolicy", () => {
+  it("allows judge off only while the agent is in Fast Strike", () => {
+    expect(resolveActiveFindingPolicy("fast-strike", "external")).toBe(
+      "external",
+    );
+    expect(resolveActiveFindingPolicy("default", "external")).toBe("native");
+    expect(resolveActiveFindingPolicy("plan", "external")).toBe("native");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Queue navigation
+// ---------------------------------------------------------------------------
+
+describe("shouldHandleQueuedMessageKey", () => {
+  it("leaves queue navigation to the dashboard only when no dialog owns the keyboard", () => {
+    expect(shouldHandleQueuedMessageKey("running", 2, "", false)).toBe(true);
+    expect(shouldHandleQueuedMessageKey("running", 2, "", true)).toBe(false);
+    expect(
+      shouldHandleQueuedMessageKey("running", 2, " /advanced ", false),
+    ).toBe(false);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // resolveSubmit
 // ---------------------------------------------------------------------------
@@ -623,6 +718,17 @@ describe("buildOperatorSystemPrompt", () => {
     expect(prompt).toContain("account for each viable primitive");
   });
 
+  it("keeps Strike's research loop while leaving finding review to the caller", () => {
+    const prompt = buildOperatorSystemPrompt(target, state, "fast-strike", {
+      findingPolicy: "external",
+    });
+    expect(prompt).toContain("# Strike Mode");
+    expect(prompt).toContain("requested output format");
+    expect(prompt).not.toContain("document_vulnerability");
+    expect(prompt).not.toContain("document confirmed vulnerabilities");
+    expect(prompt).not.toContain("official report is generated automatically");
+  });
+
   it("does not include Strike Mode instructions in the standard mode", () => {
     const prompt = buildOperatorSystemPrompt(target, state, "default");
     expect(prompt).not.toContain("# Strike Mode");