@pensar/apex 2.6.1 → 2.7.0-canary.52c132f4

package/build/{cli-qgz1q9g5.js → cli-ene4g09p.js}

@@ -1,14 +1,14 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-35gz0ahm.js";
 import {
   getPensarApiUrl2,
   init_constants,
   ensureValidToken2,
   signGatewayRequest2,
   init_auth
-} from "./cli-c05y640n.js";
+} from "./cli-bc793xfp.js";
 import {
   parseTargetUrl
 } from "./cli-0wsh8j2t.js";
@@ -42,7 +42,7 @@ import {
   normalizeStepUsage,
   streamResponse,
   generateObjectResponse
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import {
   init_v4,
   tool
@@ -82,7 +82,7 @@ import {
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-65g6rcat.js";
+} from "./cli-5xdefy58.js";
 import {
   require_src6
 } from "./cli-bb02pjt0.js";
@@ -100316,11 +100316,12 @@ ${lines.join(`
 
 ${readGuidance} A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
 }
-function buildSessionWorkspaceSection(session, agentCwd, activeTools, fileWorkspaceRoot) {
+function buildSessionWorkspaceSection(session, agentCwd, activeTools, fileWorkspaceRoot, findingPolicy = "native") {
   const sandboxMode = agentCwd === session.rootPath;
   const providedFilesSection = buildProvidedFilesSection(session.rootPath, fileWorkspaceRoot);
-  const sourceAssessmentSection = buildSourceAssessmentSection(session, agentCwd, { sandboxMode, activeTools, fileWorkspaceRoot });
+  const sourceAssessmentSection = buildSourceAssessmentSection(session, agentCwd, { sandboxMode, activeTools, fileWorkspaceRoot }, findingPolicy);
   if (fileWorkspaceRoot) {
+    const artifactsGuidance = findingPolicy === "external" ? `Session artifacts live at ${session.rootPath}. Follow the caller's output contract for findings; browser tools save their own evidence.` : `Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence.`;
     return `
 
 # Working Directory and File Workspace
@@ -100329,9 +100330,16 @@ Your shell starts in ${agentCwd}. Native file tools are confined to ${fileWorksp
 
 Create and edit helper scripts inside the file workspace. Use absolute helper paths with \`execute_command\` to check and run them. Do not prefix native file-tool paths with \`scratchpad/\` or \`provided_files/\` to reach session directories outside the file workspace.
 
-Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence. Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
+${artifactsGuidance} Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
   }
   if (sandboxMode) {
+    if (findingPolicy === "external") {
+      return `
+
+# Session Workspace
+
+Your shell is already set to the session directory. Use relative paths for session files. The session provides scratchpad/ for temporary work, logs/ for execution logs, evidence/ for browser evidence, and provided_files/ for supplied inputs. Follow the caller's output contract for findings.${providedFilesSection}${sourceAssessmentSection}`;
+    }
     return `
 
 # Session Workspace
@@ -100347,6 +100355,14 @@ The session directory (${session.rootPath}) contains these subdirectories:
 - **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
 
 Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+  if (findingPolicy === "external") {
+    return `
+
+# Working Directory
+
+Your shell starts in the user's project directory: ${agentCwd}
+Use relative paths to reference project files. Session artifacts are stored at ${session.rootPath}; use scratchpad/ for temporary work, logs/ for execution logs, and evidence/ for browser evidence. Follow the caller's output contract for findings.${providedFilesSection}${sourceAssessmentSection}`;
   }
   return `
 
@@ -100381,7 +100397,7 @@ function buildSourceAssessmentSection(session, agentCwd, {
   sandboxMode,
   activeTools,
   fileWorkspaceRoot
-}) {
+}, findingPolicy) {
   const codebasePath = session.config?.codebasePath;
   const hasSourceAccess = Boolean(codebasePath) || !sandboxMode && !fileWorkspaceRoot;
   if (!hasSourceAccess)
@@ -100405,7 +100421,7 @@ The configured codebase path is ${codebasePath}, while your shell starts in ${ag
     hasTool("run_whitebox_scan") && "- Use `run_whitebox_scan` for installed scanners.",
     hasTool("spawn_coding_agent") && "- Use `spawn_coding_agent` for independent deep dives.",
     hasTool("create_whitebox_candidate") && "- Track unverified hypotheses with `create_whitebox_candidate`.",
-    hasTool("document_vulnerability") && "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
+    findingPolicy !== "external" && hasTool("document_vulnerability") && "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
     hasTool("start_whitebox_job") && hasTool("poll_whitebox_job") && "- Run builds, local servers, sanitizer runs, and microfuzzers through bounded whitebox jobs so logs and crashes are preserved as artifacts."
   ].filter(Boolean).join(`
 `);
@@ -100421,6 +100437,14 @@ ${toolGuidance}${repoEditBullet}`;
 }
 function buildBaseSystemPrompt(options) {
   const sandboxMode = options?.sandboxMode ?? true;
+  const externalFindings = options?.findingPolicy === "external";
+  const exploitationCapability = externalFindings ? "- **Exploitation and proof development** — use the available tools only as far as the assigned objective requires" : "- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them";
+  const reportingCapability = externalFindings ? "- **Reporting** — submit concise findings through the caller's requested output contract; the caller grades them after the run" : "- **Reporting** — document confirmed findings with evidence, impact, and remediation";
+  const findingToolReference = externalFindings ? `## Findings
+- Use the caller's requested output format for any discovered vulnerabilities. Include the affected surface, observed behavior, and likely security impact.` : `## Findings & PoCs
+- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.`;
+  const findingWorkRule = externalFindings ? "6. **Report findings through the requested output.** Focus on discovering vulnerabilities and gathering the evidence required by the user's task. Do not spend time on a separate in-run finding review." : "6. **Document security work as you go.** During reconnaissance or pentesting, call `document_app` for discovered applications and `document_endpoint` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call `document_vulnerability` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.";
+  const reportRule = externalFindings ? "5. **Follow the caller's output contract.** Keep intermediate files in scratchpad/ and submit final finding artifacts only where the caller requested." : "5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the `response` tool or inline text, not standalone report files.";
   const stayInSessionParagraph = sandboxMode ? `
 
 **Stay in the session folder.** Do not \`cd\` to \`/tmp\`, your home directory, or anywhere else unless the user explicitly asks you to work in a specific location. Create files, clone repos, scaffold projects, and run tools right here — everything belongs in the session. Use relative paths (e.g. \`scratchpad/notes.txt\`, \`test-app/\`) rather than absolute paths to external directories.` : "";
@@ -100433,9 +100457,9 @@ You work interactively with the user. Execute the task they ask for, report your
 You can perform the full lifecycle of a penetration test and support a wide range of cybersecurity tasks:
 - **Reconnaissance & attack surface mapping** — subdomain enumeration, endpoint discovery, JS analysis, authenticated crawling
 - **Vulnerability testing** — injection flaws, auth bypasses, access control issues, misconfigurations, business logic flaws
-- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them
+${exploitationCapability}
 - **Source code analysis** — read and search codebases for security-relevant patterns, misconfigurations, and vulnerabilities
-- **Reporting** — document confirmed findings with evidence, impact, and remediation
+${reportingCapability}
 
 # Tool Reference
 
@@ -100486,8 +100510,7 @@ You can perform the full lifecycle of a penetration test and support a wide rang
 
 These tools use the authenticated API client in the running Apex process. Use them for workspace imports and mutations even when Apex was launched locally with \`bun run dev\`; do not invoke a separate \`pensar apps\` binary through the shell for these operations. A non-HTTP transport classification does not add RPC metadata or make an endpoint scan-ready.
 
-## Findings & PoCs
-- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.
+${findingToolReference}
 
 ## Orchestration
 - **run_attack_surface** — Launch a full attack surface discovery workflow. Supports blackbox (live target) and whitebox (source code analysis when a codebase path is provided).
@@ -100515,7 +100538,7 @@ Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI
 3. **Be thorough within the ask.** When given a task, see it through completely. Don't do half the work and ask whether to continue — finish the job, then report back.
 4. **Use the right level of automation.** For large tasks (e.g., "pentest this entire application"), use orchestration tools like \`run_attack_surface\` and \`spawn_pentest_swarm\` to parallelize the work. For focused tasks (e.g., "check if this parameter is vulnerable to XSS"), work directly with \`http_request\`, \`execute_command\`, or the browser tools.
 5. **Authenticate when needed.** If the user provides credentials or auth instructions, use them. Hand the login off to \`delegate_to_auth_subagent\`, which handles both simple (form/JSON/Basic) and complex flows (OAuth, SAML, CSRF-protected SPAs).
-6. **Document security work as you go.** During reconnaissance or pentesting, call \`document_app\` for discovered applications and \`document_endpoint\` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call \`document_vulnerability\` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.
+${findingWorkRule}
 7. **Consult memories first.** When you begin testing a specific application, framework, or path, call \`list_memories\` to check for saved knowledge from previous sessions — past findings, useful payloads, endpoint patterns, or target-specific notes. Use relevant memories to inform your approach before starting from scratch.
 
 # Command Execution
@@ -100533,7 +100556,7 @@ For long-running services (servers, listeners, watchers), background them with *
 2. **Stay in scope.** Only test targets and systems explicitly provided by the user or discovered within the authorized scope. Respect any scope constraints in the session config.
 3. **Handle failures gracefully.** If a tool call fails or a technique doesn't work, try alternative approaches. If your PoC approach fails repeatedly, pivot to a different technique.
 4. **Summarize results.** After completing a task, give the user a clear summary of what you found, what you tried, and what the next steps could be.
-5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the \`response\` tool or inline text, not standalone report files.`;
+${reportRule}`;
 }
 var BASE_SYSTEM_PROMPT = buildBaseSystemPrompt();
 
@@ -112607,18 +112630,20 @@ function inProcessSeams(overrides) {
   };
 }
 function resolveItemHooks(hooks, seams, item, index) {
+  const itemHooks = seams.hooksForItem?.(item, index);
   return {
     ...hooks,
     contextRecorder: undefined,
     inferenceRecorder: undefined,
     toolExecutionRecorder: undefined,
-    ...seams.hooksForItem?.(item, index)
+    ...itemHooks,
+    ...hooks?.findingPolicy === "external" ? { findingPolicy: "external" } : {}
   };
 }
 
 // src/core/agents/offSecAgent/subagentSpawner.ts
 async function runSpawnedPentestWorker(spec, input) {
-  const { TargetedPentestAgent } = await import("./agent-yby11zaq.js");
+  const { TargetedPentestAgent } = await import("./agent-112gdg69.js");
   const hooks = resolveItemHooks(input.hooks, input.seams, spec, 0);
   const agent = new TargetedPentestAgent({
     target: spec.target,
@@ -112678,6 +112703,7 @@ var runPentestChild = async (spec, ctx) => {
     openAIReasoningEffort: ctx.openAIReasoningEffort,
     display: ctx.display,
     hooks: {
+      findingPolicy: ctx.findingPolicy,
       backends: ctx.backends,
       sandbox: ctx.sandbox,
       languageModelMiddleware: ctx.languageModelMiddleware,
@@ -112695,8 +112721,9 @@ var runPentestChild = async (spec, ctx) => {
   };
 };
 var runCodeChild = async (spec, ctx) => {
-  const { CodeAgent } = await import("./agent-9zx75feh.js");
+  const { CodeAgent } = await import("./agent-9bh42v64.js");
   const agent = new CodeAgent({
+    findingPolicy: ctx.findingPolicy,
     codebasePath: spec.codebasePath,
     objective: spec.objective,
     system: spec.system,
@@ -112727,8 +112754,9 @@ var runCodeChild = async (spec, ctx) => {
   return { run: () => agent.consume(), drained: () => agent.drained };
 };
 var runWhiteboxChild = async (spec, ctx) => {
-  const { WhiteboxAttackSurfaceAgent } = await import("./index-n65z6v7b.js");
+  const { WhiteboxAttackSurfaceAgent } = await import("./index-ffay4gb2.js");
   const agent = new WhiteboxAttackSurfaceAgent({
+    findingPolicy: ctx.findingPolicy,
     codebasePath: spec.codebasePath,
     attackSurfaceRegistry: spec.attackSurfaceRegistry,
     model: ctx.model,
@@ -112747,8 +112775,9 @@ var runWhiteboxChild = async (spec, ctx) => {
   return { run: () => agent.consume(), drained: () => agent.drained };
 };
 var runBlackboxChild = async (spec, ctx) => {
-  const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-s56sgx9b.js");
+  const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-260yqknt.js");
   const agent = new BlackboxAttackSurfaceAgent({
+    findingPolicy: ctx.findingPolicy,
     target: spec.target,
     attackSurfaceRegistry: spec.attackSurfaceRegistry,
     model: ctx.model,
@@ -112766,9 +112795,10 @@ var runBlackboxChild = async (spec, ctx) => {
   return { run: () => agent.consume(), drained: () => agent.drained };
 };
 var runAuthChild = async (spec, ctx) => {
-  const { runAuthenticationAgent } = await import("./agent-6w7egcf1.js");
+  const { runAuthenticationAgent } = await import("./agent-jg7v2yn0.js");
   return {
     run: () => runAuthenticationAgent({
+      findingPolicy: ctx.findingPolicy,
       target: spec.target,
       authHints: spec.authHints,
       session: ctx.session,
@@ -112788,7 +112818,7 @@ var runAuthChild = async (spec, ctx) => {
   };
 };
 var runJudgeChild = async (spec, ctx) => {
-  const { judgeFinding } = await import("./index-ns4m4s01.js");
+  const { judgeFinding } = await import("./index-gw6t92t5.js");
   return {
     run: () => judgeFinding(spec.judgeInput, {
       model: ctx.model,
@@ -116817,6 +116847,7 @@ IMPORTANT: Pass protectedEndpoints in authHints when you've discovered 401/403 e
         const result = await spawner.spawn({
           spec: { type: "authentication", target, authHints },
           runtime: {
+            findingPolicy: ctx.findingPolicy,
             session: ctx.session,
             model: ctx.model,
             authConfig: ctx.authConfig,
@@ -117692,6 +117723,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
           excludeTools: ["document_endpoint", "document_app"]
         },
         runtime: {
+          findingPolicy: ctx.findingPolicy,
           session: ctx.session,
           model,
           authConfig: ctx.authConfig,
@@ -124836,34 +124868,86 @@ Each directory entry is suffixed with "/" for easy identification.`,
 // src/core/agents/offSecAgent/tools/listMemories.ts
 init_dist();
 init_zod();
+var PAGE_SIZE = 20;
+var PAGE_CHAR_BUDGET = 12000;
 var listMemoriesInputSchema = object({
   category: _enum(MEMORY_CATEGORIES).optional().describe('Filter by category: "app", "framework", or "general". ' + "Omit to list memories across all categories."),
   tag: string().optional().describe("Optional tag to filter memories by (exact match)"),
+  cursor: object({
+    createdAt: string(),
+    category: _enum(MEMORY_CATEGORIES),
+    id: string()
+  }).optional().describe("Pass the previous nextCursor to continue a listing"),
   toolCallDescription: string().describe("A concise, human-readable description of what this tool call is doing (e.g., 'Listing stored recon notes')")
 });
+function compareMemories(a, b) {
+  const byCreatedAt = Date.parse(b.createdAt) - Date.parse(a.createdAt);
+  if (byCreatedAt > 0 || byCreatedAt < 0)
+    return byCreatedAt;
+  return a.category.localeCompare(b.category) || a.id.localeCompare(b.id);
+}
+function previewSummary(memory) {
+  const title = memory.title.slice(0, 160);
+  const tags = memory.tags.slice(0, 8).map((tag) => tag.slice(0, 48));
+  const truncated = title.length < memory.title.length || tags.length < memory.tags.length || tags.some((tag, index) => tag.length < (memory.tags[index]?.length ?? tag.length));
+  return {
+    id: memory.id,
+    category: memory.category,
+    title,
+    tags,
+    createdAt: memory.createdAt,
+    ...truncated ? { truncated: true } : {}
+  };
+}
 function listMemories2(ctx) {
   return tool({
     description: `List saved memories, optionally filtered by category and/or tag.
 
-Returns lightweight summaries (id, category, title, tags, createdAt) sorted by
-most recent first. Use the returned category + id with get_memory to retrieve
-full content.`,
+Returns up to 20 lightweight summaries (id, category, title, tags, createdAt)
+sorted by most recent first. Use nextCursor to continue until it is null;
+count is the current total matching memories. A fresh listing includes newer
+memories added ahead of a cursor. Titles and tags may be abbreviated in the
+listing. Use category + id with get_memory to retrieve full content.`,
     inputSchema: listMemoriesInputSchema,
-    execute: async ({ category, tag }, { toolCallId }) => {
+    execute: async ({ category, tag, cursor }, { toolCallId }) => {
       try {
         const memories = await listMemories({ category, tag }, { sessionId: ctx.session.id, toolCallId });
+        const ordered = [...memories].sort(compareMemories);
+        let start = 0;
+        if (cursor) {
+          start = ordered.findIndex((memory) => compareMemories(memory, cursor) > 0);
+          if (start < 0)
+            start = ordered.length;
+        }
+        const page = [];
+        let pageChars = 0;
+        for (const memory of ordered.slice(start, start + PAGE_SIZE)) {
+          const summary = previewSummary(memory);
+          const chars = JSON.stringify(summary).length + 1;
+          if (page.length > 0 && pageChars + chars > PAGE_CHAR_BUDGET)
+            break;
+          page.push(summary);
+          pageChars += chars;
+        }
+        const last = page.at(-1);
         return {
           success: true,
           error: "",
-          memories,
-          count: memories.length
+          memories: page,
+          count: memories.length,
+          nextCursor: start + page.length < ordered.length && last ? {
+            createdAt: last.createdAt,
+            category: last.category,
+            id: last.id
+          } : null
         };
       } catch (err) {
         return {
           success: false,
           error: err instanceof Error ? err.message : String(err),
           memories: [],
-          count: 0
+          count: 0,
+          nextCursor: null
         };
       }
     }
@@ -125507,7 +125591,8 @@ var ReportErrorReasonSchema = _enum([
   "blocked",
   "other"
 ]);
-function createReportErrorTool(onError) {
+function createReportErrorTool(onError, findingPolicy = "native") {
+  const vulnerabilityGuidance = findingPolicy === "external" ? "Do NOT use this for vulnerabilities (include them in your final response)" : "Do NOT use this for vulnerabilities (use document_vulnerability)";
   return tool({
     description: `Report a blocking error that prevents you from completing the pentest, and END your run.
 
@@ -125516,7 +125601,7 @@ Call this ONLY when you genuinely cannot continue, for example:
 - The target is unreachable or responds in a way that makes testing impossible.
 - Some other runtime condition blocks you from carrying out the objectives.
 
-Do NOT use this for vulnerabilities (use document_vulnerability) or for normal completion (use response). Provide a clear, specific message describing exactly what blocked you — include the failing URL, status codes, or the auth step that failed where relevant — so it can be surfaced to the operator.`,
+${vulnerabilityGuidance} or for normal completion (use response). Provide a clear, specific message describing exactly what blocked you — include the failing URL, status codes, or the auth step that failed where relevant — so it can be surfaced to the operator.`,
     inputSchema: object({
       reason: ReportErrorReasonSchema.describe("Coarse category of the blocking error."),
       message: string().min(1).describe("Clear, specific explanation of what blocked you (the failing URL, status codes, or auth step where relevant).")
@@ -125600,6 +125685,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
               attackSurfaceRegistry: ctx.attackSurfaceRegistry
             },
             runtime: {
+              findingPolicy: ctx.findingPolicy,
               session: ctx.session,
               model: ctx.model,
               authConfig: ctx.authConfig,
@@ -125652,6 +125738,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
             attackSurfaceRegistry: ctx.attackSurfaceRegistry
           },
           runtime: {
+            findingPolicy: ctx.findingPolicy,
             session: ctx.session,
             model: ctx.model,
             authConfig: ctx.authConfig,
@@ -125849,13 +125936,14 @@ ${output.stderr}` : "");
 init_dist();
 init_zod();
 function runPentestWorkflow(ctx) {
+  const resultStep = ctx.findingPolicy === "external" ? "3. Return evidence-backed findings for the caller's evaluation" : "3. Aggregate findings and generate the final report";
   return tool({
     description: `Run the full autonomous penetration test pipeline against a target.
 
 This single tool call executes the entire pentest workflow:
 1. Attack surface discovery (blackbox or whitebox)
 2. Spawn a swarm of targeted pentest agents
-3. Aggregate findings and generate the final report
+${resultStep}
 
 Use this when you want to run a complete, end-to-end pentest. The workflow
 handles session creation, concurrency, persistence, and reporting automatically.
@@ -125868,7 +125956,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
       toolCallDescription: string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ target, cwd }) => {
-      const { runPentestWorkflow: workflow } = await import("./pentest-e61hc38s.js");
+      const { runPentestWorkflow: workflow } = await import("./pentest-t0p4nw2a.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -125878,6 +125966,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
       const startedAt = Date.now();
       try {
         const result = await workflow({
+          findingPolicy: ctx.findingPolicy,
           target,
           cwd,
           model: ctx.model,
@@ -125890,6 +125979,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
           openAIReasoningEffort: ctx.openAIReasoningEffort,
           surfaceIntegrationEnabled: ctx.surfaceIntegrationEnabled,
           hooks: {
+            findingPolicy: ctx.findingPolicy,
             backends: ctx.backends,
             subagentSpawner: ctx.subagentSpawner,
             languageModelMiddleware: ctx.languageModelMiddleware,
@@ -125903,6 +125993,17 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
         const elapsedSeconds = Math.round((Date.now() - startedAt) / 1000);
         const minutes = Math.floor(elapsedSeconds / 60);
         const seconds = elapsedSeconds % 60;
+        if (ctx.findingPolicy === "external") {
+          const reportedFindings = result.reportedFindings ?? [];
+          return {
+            success: true,
+            totalFindings: reportedFindings.length,
+            reportedFindings,
+            objectiveResults: result.objectiveResults ?? [],
+            duration: `${minutes}m ${seconds}s`,
+            message: `Pentest complete. ${reportedFindings.length} finding(s) returned for external evaluation.`
+          };
+        }
         return {
           success: true,
           totalFindings: result.findings.length,
@@ -125949,13 +126050,14 @@ var ScanKindSchema = _enum([
   "fuzzing"
 ]);
 function runWhiteboxScan(ctx) {
+  const verificationGuidance = ctx.findingPolicy === "external" ? "as recoverable conditions. Static results are candidates only; assess them against the caller's evidence requirements." : `as recoverable conditions. Static results are candidates only; verify before
+calling document_vulnerability.`;
   return tool({
     description: `Run installed whitebox security scanners with bounded output.
 
 The tool detects applicable scanner adapters for the repository and normalizes
 results into concise summaries plus artifact paths. Missing tools are reported
-as recoverable conditions. Static results are candidates only; verify before
-calling document_vulnerability.`,
+${verificationGuidance}`,
     inputSchema: object({
       path: string().optional().describe("Repository root to scan; must stay under the configured codebase root."),
       kind: ScanKindSchema.optional().describe("Restrict scan family"),
@@ -126241,6 +126343,7 @@ async function runSingleCodingAgent(ctx, spawner, codebasePath, objective, _agen
   const result = await spawner.spawn({
     spec: { type: "code", codebasePath, objective },
     runtime: {
+      findingPolicy: ctx.findingPolicy,
       session: ctx.session,
       model: ctx.model,
       authConfig: ctx.authConfig,
@@ -126282,6 +126385,14 @@ init_zod();
 var WORKER_DRAIN_GRACE_MS = 30000;
 var ORIGIN_AUTH_FAILURE_GUIDANCE = `A 401/403 from one resource does not by itself prove authentication failure. Verify the session against a known protected or session endpoint and re-authenticate on the assigned origin only if needed. Call report_error with reason "authentication_failed" only if required authentication cannot be established and this blocks the assigned objective or all further testing; otherwise continue any reachable testing.`;
 function spawnPentestAgent(ctx) {
+  const externalFindings = ctx.findingPolicy === "external";
+  const findingSteps = externalFindings ? `2. Reports concise evidence-backed findings in its response
+3. Leaves acceptance to the caller's external evaluator` : `2. Confirms vulnerabilities with POC scripts
+3. Documents findings to the shared findings registry only when the exploit path and material security impact are proven`;
+  const findingGuidance = externalFindings ? "False-positive discipline: report a security weakness only when observations support a material abuse path. Include the affected target, evidence, and impact; do not add a separate in-run finding review." : "False-positive discipline: workers should not call document_vulnerability for public/unauthenticated behavior, missing best-practice controls, generic errors, local HTTP deployment context, or other low-signal observations unless they prove a material abuse path such as non-public data access, credentialed cross-origin abuse, state change, denial of service, account takeover, or another concrete exploit chain.";
+  const returnGuidance = externalFindings ? "Returns the worker's summary, objective results, and reported findings so the parent can investigate chains." : "Returns the worker's summary, objective results, and finding count — but NOT the findings themselves (those land in the shared registry).";
+  const exploratoryGuidance = externalFindings ? "Spawn a follow-up exploratory worker only when the assigned objective requires broader coverage or a credible untested lead remains. For detection-only work, finish once the requested evidence is sufficient." : 'After fanning out one worker per objective, call this tool ONE MORE TIME for a final "exploratory" worker. Pass it the URLs of any suspicious behaviors discovered by earlier workers and ask it to chain findings together and probe for additional, unspecified vulnerabilities.';
+  const objectiveGuidance = externalFindings ? "Pass one focused objective per worker. A follow-up objective may cover a concrete chain or untested lead when the assignment calls for it." : "For per-objective fan-out, pass exactly one objective. For the final exploratory pass, pass a single composite objective describing chaining + exploration.";
   const targetScopeGuidance = ctx.systemScope && ctx.systemScope.memberHosts.length > 0 ? `For a cross-service follow-up, you may instead use a full URL on one of these authorized System Scope members: ${ctx.systemScope.memberHosts.join(", ")}.` : "No structured System Scope is present, so keep the assigned host unchanged.";
   return tool({
     description: `Spawn a single focused pentest sub-agent (worker) to test ONE objective at a time.
@@ -126294,22 +126405,21 @@ Authentication state is origin-specific. Before spawning a cross-service worker
 
 Each spawn produces an independent TargetedPentestAgent that:
 1. Tests the assigned objective(s) deeply (execute_command, http_request, browser tools)
-2. Confirms vulnerabilities with POC scripts
-3. Documents findings to the shared findings registry only when the exploit path and material security impact are proven
+${findingSteps}
 
 Cloned browser session — the worker gets its OWN isolated Chromium instance, but it is seeded at spawn time with a snapshot of your current cookies and localStorage. If you've already authenticated in your browser (or recon set up useful state), the worker starts already authenticated for the same origins. Critically, the worker's browser is a COPY: its navigations, form fills, \`localStorage.setItem\`, alerts, and any other browser-side mutations stay inside the worker's own browser and do NOT leak back to you or to sibling workers. If you want state to be visible to the next worker, set it up in YOUR browser before spawning.
 
 The worker has no further spawn capability — it cannot recursively spawn other pentest agents.
 
-After fanning out one worker per objective, call this tool ONE MORE TIME for a final "exploratory" worker. Pass it the URLs of any suspicious behaviors discovered by earlier workers and ask it to chain findings together and probe for additional, unspecified vulnerabilities.
+${exploratoryGuidance}
 
-False-positive discipline: workers should not call document_vulnerability for public/unauthenticated behavior, missing best-practice controls, generic errors, local HTTP deployment context, or other low-signal observations unless they prove a material abuse path such as non-public data access, credentialed cross-origin abuse, state change, denial of service, account takeover, or another concrete exploit chain.
+${findingGuidance}
 
-Returns the worker's summary, objective results, and finding count — but NOT the findings themselves (those land in the shared registry).`,
+${returnGuidance}`,
     inputSchema: object({
       name: string().describe("Short human-readable label for this sub-agent shown in the UI (e.g. 'SQLi /api/users', 'IDOR orders', 'Final chain & explore')."),
       target: string().describe(`Full target URL INCLUDING the endpoint path you want this worker to focus on (e.g. 'https://example.com/api/users/{id}', 'https://example.com/login'). Use the orchestrator's assigned URL by default and never strip it to a bare domain. A recon-supported sibling endpoint is allowed when it belongs to the objective. ${targetScopeGuidance} Never invent a host or endpoint.`),
-      objectives: array(string()).min(1).describe("Testing objectives for this worker. For per-objective fan-out, pass exactly one objective. For the final exploratory pass, pass a single composite objective describing chaining + exploration."),
+      objectives: array(string()).min(1).describe(`Testing objectives for this worker. ${objectiveGuidance}`),
       context: string().optional().describe("Additional grounding context for the worker — e.g. summaries of what earlier workers found, suspicious endpoints to chain, or application-specific guidance. Treated as guidance, not as code to read."),
       toolCallDescription: string().describe("Concise, human-readable description of what this spawn is doing (shown in the UI).")
     }),
@@ -126345,7 +126455,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
       const spawner = ctx.subagentSpawner;
       let subagentId = "";
       try {
-        const { findings, objectiveResults } = await spawner.spawn({
+        const { findings, reportedFindings, objectiveResults } = await spawner.spawn({
           spec: {
             type: "pentest",
             target,
@@ -126358,6 +126468,7 @@ Returns the worker's summary, objective results, and finding count — but NOT t
             browserSession: sharedBrowserSession
           },
           runtime: {
+            findingPolicy: ctx.findingPolicy,
             session: ctx.session,
             model: ctx.model,
             authConfig: ctx.authConfig,
@@ -126390,9 +126501,10 @@ Returns the worker's summary, objective results, and finding count — but NOT t
         return {
           success: true,
           subagentId,
-          findingsCount: findings.length,
+          findingsCount: externalFindings ? reportedFindings?.length ?? 0 : findings.length,
+          ...externalFindings ? { reportedFindings: reportedFindings ?? [] } : {},
           objectiveResults,
-          message: `Worker '${name}' complete. Documented ${findings.length} finding(s).`
+          message: externalFindings ? `Worker '${name}' complete. Reported ${reportedFindings?.length ?? 0} finding(s) for external evaluation.` : `Worker '${name}' complete. Documented ${findings.length} finding(s).`
         };
       } catch (error) {
         const message = error instanceof Error ? error.message : String(error);
@@ -126432,15 +126544,19 @@ init_structured();
 init_lazyLogger();
 var log8 = scopedLogger(() => createLogger("spawn-pentest-swarm"));
 function spawnPentestSwarm(ctx) {
+  const externalFindings = ctx.findingPolicy === "external";
+  const findingSteps = externalFindings ? `2. Surface concise evidence-backed findings in its response
+3. Leave finding acceptance to the caller's evaluator` : `2. Create POC scripts for confirmed vulnerabilities
+3. Document findings with evidence and remediation`;
+  const findingDestination = externalFindings ? "Reported findings are returned to this caller; no native finding review runs." : "All findings are written to the shared session directory.";
   return tool({
     description: `Launch a swarm of targeted pentest sub-agents to test multiple targets in parallel.
 
 Call this AFTER completing attack surface discovery. Each entry in 'targets' spawns an independent TargetedPentestAgent that will:
 1. Test the specified target for the given objectives
-2. Create POC scripts for confirmed vulnerabilities
-3. Document findings with evidence and remediation
+${findingSteps}
 
-All findings are written to the shared session directory.
+${findingDestination}
 
 Pass every target you want tested — the swarm handles concurrency automatically.`,
     inputSchema: object({
@@ -126453,7 +126569,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
       toolCallDescription: string().describe("A concise, human-readable description of what this tool call is doing")
     }),
     execute: async ({ targets }) => {
-      const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-e61hc38s.js");
+      const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-t0p4nw2a.js");
       if (!ctx.model) {
         return {
           success: false,
@@ -126469,6 +126585,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
       const total = targets.length;
       log8.info(`Spawning pentest swarm: ${total} agents (concurrency: ${DEFAULT_CONCURRENCY})`);
       const swarmResults = await runPentestSwarm({
+        findingPolicy: ctx.findingPolicy,
         targets,
         model: ctx.model,
         session: ctx.session,
@@ -126484,6 +126601,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
         openAIReasoningEffort: ctx.openAIReasoningEffort,
         display: ctx.display,
         hooks: {
+          findingPolicy: ctx.findingPolicy,
           backends: ctx.backends,
           subagentSpawner: ctx.subagentSpawner,
           languageModelMiddleware: ctx.languageModelMiddleware,
@@ -126494,7 +126612,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
           sandbox: ctx.sandbox
         }
       });
-      const totalFindings = swarmResults.reduce((sum, r) => sum + (r?.findings.length ?? 0), 0);
+      const totalFindings = swarmResults.reduce((sum, r) => sum + (externalFindings ? r?.reportedFindings?.length ?? 0 : r?.findings.length ?? 0), 0);
       const failedCount = swarmResults.filter((r) => r == null).length;
       return {
         success: true,
@@ -126503,7 +126621,11 @@ Pass every target you want tested — the swarm handles concurrency automaticall
         failedTargets: failedCount,
         results: targets.map((t, i) => ({
           target: t.target,
-          findingsCount: swarmResults[i]?.findings.length ?? 0,
+          findingsCount: externalFindings ? swarmResults[i]?.reportedFindings?.length ?? 0 : swarmResults[i]?.findings.length ?? 0,
+          ...externalFindings ? {
+            reportedFindings: swarmResults[i]?.reportedFindings ?? [],
+            objectiveResults: swarmResults[i]?.objectiveResults ?? []
+          } : {},
           error: swarmResults[i] == null ? "Agent failed" : undefined
         })),
         message: `Swarm complete. ${totalFindings} findings across ${total} targets. ${failedCount > 0 ? `${failedCount} targets failed.` : "All targets tested successfully."}`
@@ -126758,12 +126880,13 @@ var updateTaskInputSchema = object({
   observation: string().optional().describe("Intermediate observations or notes from testing")
 });
 function updateTask2(ctx) {
+  const completedGuidance = ctx.findingPolicy === "external" ? "vulnerability identified with supporting evidence, OR conclusively determined the endpoint is not vulnerable / materiality is not met for this technique." : "vulnerability found and documented via document_vulnerability, OR conclusively determined the endpoint is not vulnerable / materiality is not met for this technique. Documentation is NOT required to complete a non-vulnerable task.";
   return tool({
     description: `Update a task's status and record results.
 
 Status transitions:
 - "in_progress" — Set when you START testing a task. Pick one pending task at a time.
-- "completed" — Set when testing is done: vulnerability found and documented via document_vulnerability, OR conclusively determined the endpoint is not vulnerable / materiality is not met for this technique. Documentation is NOT required to complete a non-vulnerable task.
+- "completed" — Set when testing is done: ${completedGuidance}
 - "failed" — Set when the technique didn't work: rate limited, blocked by WAF, dead end, or approach not applicable. Then create a NEW task with an alternative technique.
 
 Always include a result or observation explaining the outcome.`,
@@ -127115,12 +127238,13 @@ var CandidateStateSchema = _enum([
   "deferred"
 ]);
 function createWhiteboxCandidate2(ctx) {
+  const candidateGuidance = ctx.findingPolicy === "external" ? "for the caller's final evaluation. Candidates keep hypotheses, source-to-sink traces, scanner artifacts, fuzzing logs, and verification status separate from reported findings." : `for document_vulnerability. Candidates keep hypotheses, source-to-sink traces,
+scanner artifacts, fuzzing logs, and verification status out of official findings.`;
   return tool({
     description: `Create a whitebox vulnerability candidate.
 
 Use this for plausible source-code findings that are not yet confirmed enough
-for document_vulnerability. Candidates keep hypotheses, source-to-sink traces,
-scanner artifacts, fuzzing logs, and verification status out of official findings.`,
+${candidateGuidance}`,
     inputSchema: object({
       title: string(),
       vulnerabilityClass: string(),
@@ -127147,7 +127271,7 @@ scanner artifacts, fuzzing logs, and verification status out of official finding
         artifactPaths: candidate.artifacts.map((artifact) => artifact.path),
         nextActions: [
           "Move candidate to investigating after reading source context.",
-          "Attempt a reproducer or dynamic verification before document_vulnerability."
+          ctx.findingPolicy === "external" ? "Gather the evidence required by the caller before reporting this candidate." : "Attempt a reproducer or dynamic verification before document_vulnerability."
         ],
         truncated: false
       };
@@ -127191,7 +127315,7 @@ State machine: hypothesis -> investigating -> repro_attempted -> confirmed (requ
           data: { candidate },
           artifactPaths: candidate.artifacts.map((artifact) => artifact.path),
           nextActions: candidate.state === "confirmed" ? [
-            "Use document_vulnerability only if the proof demonstrates exploitability."
+            ctx.findingPolicy === "external" ? "Report only the evidence-backed conclusion to the caller." : "Use document_vulnerability only if the proof demonstrates exploitability."
           ] : [
             "Continue tracing or verification based on the candidate state."
           ],
@@ -128662,6 +128786,7 @@ class OffensiveSecurityAgent {
     const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join28(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join28(input.session.rootPath, "tasks") : undefined);
     const credentialManager = input.credentialManager ?? input.session.credentialManager;
     const toolCtx = {
+      findingPolicy: input.findingPolicy,
       ...input.attackSurfaceArtifactsPath ? { attackSurfaceArtifactsPath: input.attackSurfaceArtifactsPath } : {},
       session: input.session,
       agentCwd,
@@ -128738,9 +128863,13 @@ class OffensiveSecurityAgent {
         activeTools = [...activeTools, RESPONSE_TOOL_NAME];
       }
     }
+    if (input.findingPolicy === "external") {
+      activeTools = activeTools.filter((name) => name !== "document_vulnerability");
+    }
     activeTools = filterWorkspaceToolsForRun(activeTools, input.prompt, input.approvalGate !== undefined);
     const builtinTools = createToolsForNames(toolCtx, activeTools);
-    let tools = input.extraTools ? { ...builtinTools, ...input.extraTools } : { ...builtinTools };
+    const extraTools = input.findingPolicy === "external" && input.extraTools ? Object.fromEntries(Object.entries(input.extraTools).filter(([name]) => name !== "document_vulnerability")) : input.extraTools;
+    let tools = extraTools ? { ...builtinTools, ...extraTools } : { ...builtinTools };
     if (input.toolExecutionRecorder) {
       tools = wrapRecordedTools(tools, input.toolExecutionRecorder);
     }
@@ -128765,7 +128894,7 @@ class OffensiveSecurityAgent {
                   get: () => Promise.race([sr.response, this._drainRejection])
                 }
               });
-              return customResolve(guarded);
+              return customResolve(guarded, result);
             }).then((resolved) => {
               this._capturedResponse = resolved;
               this._resolveResponseCaptured(resolved);
@@ -128803,13 +128932,27 @@ class OffensiveSecurityAgent {
       mkdirSync10(messagesDir, { recursive: true });
     }
     this.messagesPath = join28(messagesDir, "messages.json");
-    const initialMessagesRef = {
-      current: input.messages ? [...input.messages] : [
-        {
-          role: "user",
-          content: [{ type: "text", text: input.prompt }]
-        }
-      ]
+    const preparedContextRef = {
+      current: {
+        messages: input.messages ? [...input.messages] : [
+          {
+            role: "user",
+            content: [{ type: "text", text: input.prompt }]
+          }
+        ],
+        responseMessageOffset: 0
+      }
+    };
+    const legacyMessages = (responseMessages) => [
+      ...preparedContextRef.current.messages,
+      ...responseMessages.slice(preparedContextRef.current.responseMessageOffset)
+    ];
+    const persistedMessages = (messages) => {
+      let first = 0;
+      while (messages[first]?.role === "system" && messages[first]?.providerOptions) {
+        first++;
+      }
+      return first === 0 ? messages : messages.slice(first);
     };
     this.writer = new AgentMessageWriter({ messagesPath: this.messagesPath });
     this.finalizeInterruptedStep = createInterruptedStepFinalizer({
@@ -128823,10 +128966,11 @@ class OffensiveSecurityAgent {
     });
     const schedulePersist = () => this.writer.schedulePersist();
     const baseSystemPrompt = input.system ?? buildBaseSystemPrompt({
-      sandboxMode: agentCwd === input.session.rootPath
+      sandboxMode: agentCwd === input.session.rootPath,
+      findingPolicy: input.findingPolicy
     });
     const commandPlatform = resolveCommandPlatform(toolCtx);
-    const workspaceSection = buildSessionWorkspaceSection(input.session, agentCwd, activeTools, fileWorkspaceRoot);
+    const workspaceSection = buildSessionWorkspaceSection(input.session, agentCwd, activeTools, fileWorkspaceRoot, input.findingPolicy);
     const bundledAssets = input.backends || input.sandbox ? null : buildBundledAssetsSection();
     const assembleBaseSystemPrompt = (facts) => {
       const sections = [baseSystemPrompt];
@@ -128863,6 +129007,12 @@ class OffensiveSecurityAgent {
         usageRecorder: input.usageRecorder,
         contextRecorder: input.contextRecorder,
         inferenceRecorder: input.inferenceRecorder,
+        onContextPrepared: (context) => {
+          preparedContextRef.current = {
+            messages: [...context.messages],
+            responseMessageOffset: context.responseMessageOffset
+          };
+        },
         sessionPath: messagesDir,
         sessionId: this.busSessionId,
         onStepFinish: async (event) => {
@@ -128873,11 +129023,8 @@ class OffensiveSecurityAgent {
             await input.onStepFinish?.(event);
             return;
           }
-          const canonical = input.contextRecorder?.latest() ?? [
-            ...initialMessagesRef.current,
-            ...event.response.messages
-          ];
-          this.writer.setLatest(canonical);
+          const canonical = input.contextRecorder?.latest() ?? legacyMessages(event.response.messages);
+          this.writer.setLatest(persistedMessages(canonical));
           schedulePersist();
           traceWriter.recordStep(event.response.messages, stepUsage);
           this.eventBus.emit("step-finish", {
@@ -128890,16 +129037,16 @@ class OffensiveSecurityAgent {
           await input.onStepFinish?.(event);
         },
         onSummarized: () => {
-          initialMessagesRef.current = [];
+          preparedContextRef.current = {
+            messages: [],
+            responseMessageOffset: 0
+          };
           traceWriter.markSummarized();
         },
         onFinish: async (event) => {
           this.writer.cancelTimer();
           if (!this.writer.syntheticsPersisted) {
-            const finalMessages = input.contextRecorder?.latest() ?? this.writer.latest ?? [
-              ...initialMessagesRef.current,
-              ...event.response.messages
-            ];
+            const finalMessages = persistedMessages(input.contextRecorder?.latest() ?? this.writer.latest ?? legacyMessages(event.response.messages));
             this.writer.setLatest(finalMessages);
             await this.writer.enqueueWrite(finalMessages).catch(() => {});
           }