@pensar/apex 2.6.1 → 2.7.0-canary.52c132f4

package/build/{index-n65z6v7b.js → index-ffay4gb2.js}

@@ -6,14 +6,14 @@ import {
   AppsDiscoveryResultSchema2,
   DiscoverySummarySchema2,
   WhiteboxAttackSurfaceAgent2
-} from "./cli-ngq9dr8n.js";
-import"./cli-1ve18npr.js";
+} from "./cli-mpmpfce6.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-dpsw2fe6.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-mm2vxyne.js";
+import"./cli-bc793xfp.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-fy6vh2a7.js";
+import"./cli-35gz0ahm.js";
 export {
   AppInfoSchema2 as AppInfoSchema,
   AppsDiscoveryResultSchema2 as AppsDiscoveryResultSchema,

package/build/{index-ns4m4s01.js → index-gw6t92t5.js}

@@ -1,11 +1,11 @@
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
 import {
   scopedLogger,
   init_lazyLogger,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/agents/specialized/findingJudge/index.ts
@@ -14,7 +14,7 @@ init_lazyLogger();
 var log = scopedLogger(() => createLogger("FindingJudge"));
 async function judgeFinding(input, ctx) {
   try {
-    const { FindingJudgeAgent } = await import("./agent-ayreaj6z.js");
+    const { FindingJudgeAgent } = await import("./agent-ydy5fq92.js");
     const agent = new FindingJudgeAgent({
       finding: input,
       model: ctx.model,

package/build/{index-dr3tg1w3.js → index-kkt51z6t.js}

@@ -1,7 +1,7 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-35gz0ahm.js";
 init_config();
 
 export {

package/build/{index-fv64eb32.js → index-kmaq2ym2.js}

@@ -14,8 +14,8 @@ import {
   createWorkspaceSelection2,
   pollWorkspaceSelection2,
   init_auth
-} from "./cli-c05y640n.js";
-import"./cli-fy6vh2a7.js";
+} from "./cli-bc793xfp.js";
+import"./cli-35gz0ahm.js";
 init_auth();
 
 export {

package/build/{index-je6hcsqr.js → index-wgas3zgb.js}

@@ -3,7 +3,7 @@ import {
   get2,
   update2,
   init_config2
-} from "./cli-709rvekb.js";
+} from "./cli-6vpprmxb.js";
 
 // src/core/config/index.ts
 init_config2();

package/build/{index-r9yjkfrv.js → index-xfqh0wte.js}

@@ -1,10 +1,10 @@
 import {
   ALL_TOOL_NAMES2,
   SKILL_TOOL_NAMES2
-} from "./cli-qgz1q9g5.js";
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
-import"./cli-dpsw2fe6.js";
+} from "./cli-ene4g09p.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
+import"./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 export {
   ALL_TOOL_NAMES2 as ALL_TOOL_NAMES,

package/build/{issues-eb3q9d3a.js → issues-sq3zya6y.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
 import {
   CLOSED_DISPOSITIONS2,
   listIssues2,
@@ -11,22 +12,21 @@ import {
   retestIssue2,
   linkPullRequest2,
   listIssuePullRequests2
-} from "./cli-7eea4e2y.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-ahk627k3.js";
+import"./cli-tb77javm.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
+import"./cli-3158x9wb.js";
+import"./cli-087apjgk.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/issues.ts

package/build/{knowledge-fqsvtx0f.js → knowledge-kzd0cgcm.js}

@@ -1,6 +1,7 @@
 #!/usr/bin/env bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-ene4g09p.js";
+import"./cli-35gz0ahm.js";
+import"./cli-bc793xfp.js";
 import {
   KNOWLEDGE_CATEGORIES2,
   KNOWLEDGE_STATUSES2,
@@ -9,22 +10,21 @@ import {
   createKnowledge2,
   updateKnowledge2,
   archiveKnowledge2
-} from "./cli-7eea4e2y.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-ahk627k3.js";
+import"./cli-tb77javm.js";
+import"./cli-np9x97h3.js";
+import"./cli-mpmpfce6.js";
+import"./cli-3158x9wb.js";
+import"./cli-087apjgk.js";
+import"./cli-wa52mx4p.js";
+import"./cli-xe4wq07r.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-1wtxf161.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-mm2vxyne.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/knowledge.ts

package/build/lib/{chunk-r4j8ybn9.js → chunk-0parq6kp.js}

@@ -19,7 +19,7 @@ import {
   scopedLogger,
   normalizeStepUsage2,
   streamResponse2
-} from "./chunk-ba41jh41.js";
+} from "./chunk-7zayxxn6.js";
 import {
   PerCommandShell2,
   resolveBrowserHeaderPolicy2,
@@ -47,7 +47,7 @@ import {
 } from "./chunk-fy3bbbqy.js";
 import {
   inProcessSubagentSpawner2
-} from "./chunk-3c00n0cy.js";
+} from "./chunk-83nets1m.js";
 import {
   addMemory2,
   ASK_USER_QUESTIONS_TOOL_NAME2,
@@ -120,7 +120,7 @@ import {
   FAST_STRIKE_EXCLUDED_TOOL_NAMES2,
   PLAN_MODE_TOOL_NAMES2,
   SKILL_TOOL_NAMES2
-} from "./chunk-2qsq76xq.js";
+} from "./chunk-fy2a1dm3.js";
 import {
   ApexFindingObject2
 } from "./chunk-q5e23acz.js";
@@ -140,6 +140,7 @@ __export(exports_offSecAgent, {
   BROWSER_TOOL_NAMES: () => BROWSER_TOOL_NAMES2,
   EMAIL_TOOL_NAMES: () => EMAIL_TOOL_NAMES2,
   EMAIL_TOOL_NAMES_ACTIVE: () => EMAIL_TOOL_NAMES2,
+  EXTERNAL_FINDING_POLICY_CAPABILITY: () => EXTERNAL_FINDING_POLICY_CAPABILITY2,
   FAST_STRIKE_EXCLUDED_TOOL_NAMES: () => FAST_STRIKE_EXCLUDED_TOOL_NAMES2,
   OffensiveSecurityAgent: () => OffensiveSecurityAgent2,
   PLAN_MODE_TOOL_NAMES: () => PLAN_MODE_TOOL_NAMES2,
@@ -516,11 +517,12 @@ ${lines.join(`
 
 ${readGuidance} A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
 }
-function buildSessionWorkspaceSection2(session, agentCwd, activeTools, fileWorkspaceRoot) {
+function buildSessionWorkspaceSection2(session, agentCwd, activeTools, fileWorkspaceRoot, findingPolicy = "native") {
   const sandboxMode = agentCwd === session.rootPath;
   const providedFilesSection = buildProvidedFilesSection2(session.rootPath, fileWorkspaceRoot);
-  const sourceAssessmentSection = buildSourceAssessmentSection(session, agentCwd, { sandboxMode, activeTools, fileWorkspaceRoot });
+  const sourceAssessmentSection = buildSourceAssessmentSection(session, agentCwd, { sandboxMode, activeTools, fileWorkspaceRoot }, findingPolicy);
   if (fileWorkspaceRoot) {
+    const artifactsGuidance = findingPolicy === "external" ? `Session artifacts live at ${session.rootPath}. Follow the caller's output contract for findings; browser tools save their own evidence.` : `Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence.`;
     return `
 
 # Working Directory and File Workspace
@@ -529,9 +531,16 @@ Your shell starts in ${agentCwd}. Native file tools are confined to ${fileWorksp
 
 Create and edit helper scripts inside the file workspace. Use absolute helper paths with \`execute_command\` to check and run them. Do not prefix native file-tool paths with \`scratchpad/\` or \`provided_files/\` to reach session directories outside the file workspace.
 
-Session artifacts live at ${session.rootPath}. Findings and published PoCs are written by \`document_vulnerability\`, and browser tools save their own evidence. Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
+${artifactsGuidance} Session logs and provided files outside the file workspace must be inspected through command tools or copied into the file workspace before native file tools can read them.${providedFilesSection}${sourceAssessmentSection}`;
   }
   if (sandboxMode) {
+    if (findingPolicy === "external") {
+      return `
+
+# Session Workspace
+
+Your shell is already set to the session directory. Use relative paths for session files. The session provides scratchpad/ for temporary work, logs/ for execution logs, evidence/ for browser evidence, and provided_files/ for supplied inputs. Follow the caller's output contract for findings.${providedFilesSection}${sourceAssessmentSection}`;
+    }
     return `
 
 # Session Workspace
@@ -547,6 +556,14 @@ The session directory (${session.rootPath}) contains these subdirectories:
 - **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
 
 Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}${sourceAssessmentSection}`;
+  }
+  if (findingPolicy === "external") {
+    return `
+
+# Working Directory
+
+Your shell starts in the user's project directory: ${agentCwd}
+Use relative paths to reference project files. Session artifacts are stored at ${session.rootPath}; use scratchpad/ for temporary work, logs/ for execution logs, and evidence/ for browser evidence. Follow the caller's output contract for findings.${providedFilesSection}${sourceAssessmentSection}`;
   }
   return `
 
@@ -581,7 +598,7 @@ function buildSourceAssessmentSection(session, agentCwd, {
   sandboxMode,
   activeTools,
   fileWorkspaceRoot
-}) {
+}, findingPolicy) {
   const codebasePath = session.config?.codebasePath;
   const hasSourceAccess = Boolean(codebasePath) || !sandboxMode && !fileWorkspaceRoot;
   if (!hasSourceAccess)
@@ -605,7 +622,7 @@ The configured codebase path is ${codebasePath}, while your shell starts in ${ag
     hasTool("run_whitebox_scan") && "- Use `run_whitebox_scan` for installed scanners.",
     hasTool("spawn_coding_agent") && "- Use `spawn_coding_agent` for independent deep dives.",
     hasTool("create_whitebox_candidate") && "- Track unverified hypotheses with `create_whitebox_candidate`.",
-    hasTool("document_vulnerability") && "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
+    findingPolicy !== "external" && hasTool("document_vulnerability") && "- Only call `document_vulnerability` after a PoC, crash reproducer, or dynamic check confirms exploitability.",
     hasTool("start_whitebox_job") && hasTool("poll_whitebox_job") && "- Run builds, local servers, sanitizer runs, and microfuzzers through bounded whitebox jobs so logs and crashes are preserved as artifacts."
   ].filter(Boolean).join(`
 `);
@@ -621,6 +638,14 @@ ${toolGuidance}${repoEditBullet}`;
 }
 function buildBaseSystemPrompt2(options) {
   const sandboxMode = options?.sandboxMode ?? true;
+  const externalFindings = options?.findingPolicy === "external";
+  const exploitationCapability = externalFindings ? "- **Exploitation and proof development** — use the available tools only as far as the assigned objective requires" : "- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them";
+  const reportingCapability = externalFindings ? "- **Reporting** — submit concise findings through the caller's requested output contract; the caller grades them after the run" : "- **Reporting** — document confirmed findings with evidence, impact, and remediation";
+  const findingToolReference = externalFindings ? `## Findings
+- Use the caller's requested output format for any discovered vulnerabilities. Include the affected surface, observed behavior, and likely security impact.` : `## Findings & PoCs
+- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.`;
+  const findingWorkRule = externalFindings ? "6. **Report findings through the requested output.** Focus on discovering vulnerabilities and gathering the evidence required by the user's task. Do not spend time on a separate in-run finding review." : "6. **Document security work as you go.** During reconnaissance or pentesting, call `document_app` for discovered applications and `document_endpoint` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call `document_vulnerability` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.";
+  const reportRule = externalFindings ? "5. **Follow the caller's output contract.** Keep intermediate files in scratchpad/ and submit final finding artifacts only where the caller requested." : "5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the `response` tool or inline text, not standalone report files.";
   const stayInSessionParagraph = sandboxMode ? `
 
 **Stay in the session folder.** Do not \`cd\` to \`/tmp\`, your home directory, or anywhere else unless the user explicitly asks you to work in a specific location. Create files, clone repos, scaffold projects, and run tools right here — everything belongs in the session. Use relative paths (e.g. \`scratchpad/notes.txt\`, \`test-app/\`) rather than absolute paths to external directories.` : "";
@@ -633,9 +658,9 @@ You work interactively with the user. Execute the task they ask for, report your
 You can perform the full lifecycle of a penetration test and support a wide range of cybersecurity tasks:
 - **Reconnaissance & attack surface mapping** — subdomain enumeration, endpoint discovery, JS analysis, authenticated crawling
 - **Vulnerability testing** — injection flaws, auth bypasses, access control issues, misconfigurations, business logic flaws
-- **Exploitation & proof-of-concept development** — provide PoC scripts inline to document_vulnerability which executes and validates them
+${exploitationCapability}
 - **Source code analysis** — read and search codebases for security-relevant patterns, misconfigurations, and vulnerabilities
-- **Reporting** — document confirmed findings with evidence, impact, and remediation
+${reportingCapability}
 
 # Tool Reference
 
@@ -686,8 +711,7 @@ You can perform the full lifecycle of a penetration test and support a wide rang
 
 These tools use the authenticated API client in the running Apex process. Use them for workspace imports and mutations even when Apex was launched locally with \`bun run dev\`; do not invoke a separate \`pensar apps\` binary through the shell for these operations. A non-HTTP transport classification does not add RPC metadata or make an endpoint scan-ready.
 
-## Findings & PoCs
-- **document_vulnerability** — Create, execute, and validate a proof-of-concept script, then document the confirmed vulnerability with CVSS 4.0 scoring. Provide your POC script inline via pocContent. The tool handles execution, validation, scoring, and persistence.
+${findingToolReference}
 
 ## Orchestration
 - **run_attack_surface** — Launch a full attack surface discovery workflow. Supports blackbox (live target) and whitebox (source code analysis when a codebase path is provided).
@@ -715,7 +739,7 @@ Run \`pensar --help\` or \`pensar <command> --help\` for exact flags — the CLI
 3. **Be thorough within the ask.** When given a task, see it through completely. Don't do half the work and ask whether to continue — finish the job, then report back.
 4. **Use the right level of automation.** For large tasks (e.g., "pentest this entire application"), use orchestration tools like \`run_attack_surface\` and \`spawn_pentest_swarm\` to parallelize the work. For focused tasks (e.g., "check if this parameter is vulnerable to XSS"), work directly with \`http_request\`, \`execute_command\`, or the browser tools.
 5. **Authenticate when needed.** If the user provides credentials or auth instructions, use them. Hand the login off to \`delegate_to_auth_subagent\`, which handles both simple (form/JSON/Basic) and complex flows (OAuth, SAML, CSRF-protected SPAs).
-6. **Document security work as you go.** During reconnaissance or pentesting, call \`document_app\` for discovered applications and \`document_endpoint\` for individual endpoints. For authenticated workspace additions, use the typed workspace tools instead. Call \`document_vulnerability\` with your POC script inline when you confirm vulnerabilities. Don't defer documentation to the end.
+${findingWorkRule}
 7. **Consult memories first.** When you begin testing a specific application, framework, or path, call \`list_memories\` to check for saved knowledge from previous sessions — past findings, useful payloads, endpoint patterns, or target-specific notes. Use relevant memories to inform your approach before starting from scratch.
 
 # Command Execution
@@ -733,7 +757,7 @@ For long-running services (servers, listeners, watchers), background them with *
 2. **Stay in scope.** Only test targets and systems explicitly provided by the user or discovered within the authorized scope. Respect any scope constraints in the session config.
 3. **Handle failures gracefully.** If a tool call fails or a technique doesn't work, try alternative approaches. If your PoC approach fails repeatedly, pivot to a different technique.
 4. **Summarize results.** After completing a task, give the user a clear summary of what you found, what you tried, and what the next steps could be.
-5. **No reports in scratchpad.** Do NOT write synthesized report documents to scratchpad/ (e.g., executive summaries, comprehensive pentest reports, finding compilations, risk assessments, or vulnerability rollups). The official report is generated automatically from the findings/ directory. Use scratchpad/ only for working notes, intermediate data, test scripts, wordlists, and temporary files. Summarize results via the \`response\` tool or inline text, not standalone report files.`;
+${reportRule}`;
 }
 var BASE_SYSTEM_PROMPT2 = buildBaseSystemPrompt2();
 
@@ -1769,6 +1793,7 @@ class OffensiveSecurityAgent2 {
     const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join3(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join3(input.session.rootPath, "tasks") : undefined);
     const credentialManager = input.credentialManager ?? input.session.credentialManager;
     const toolCtx = {
+      findingPolicy: input.findingPolicy,
       ...input.attackSurfaceArtifactsPath ? { attackSurfaceArtifactsPath: input.attackSurfaceArtifactsPath } : {},
       session: input.session,
       agentCwd,
@@ -1845,9 +1870,13 @@ class OffensiveSecurityAgent2 {
         activeTools = [...activeTools, RESPONSE_TOOL_NAME2];
       }
     }
+    if (input.findingPolicy === "external") {
+      activeTools = activeTools.filter((name) => name !== "document_vulnerability");
+    }
     activeTools = filterWorkspaceToolsForRun(activeTools, input.prompt, input.approvalGate !== undefined);
     const builtinTools = createToolsForNames2(toolCtx, activeTools);
-    let tools = input.extraTools ? { ...builtinTools, ...input.extraTools } : { ...builtinTools };
+    const extraTools = input.findingPolicy === "external" && input.extraTools ? Object.fromEntries(Object.entries(input.extraTools).filter(([name]) => name !== "document_vulnerability")) : input.extraTools;
+    let tools = extraTools ? { ...builtinTools, ...extraTools } : { ...builtinTools };
     if (input.toolExecutionRecorder) {
       tools = wrapRecordedTools(tools, input.toolExecutionRecorder);
     }
@@ -1872,7 +1901,7 @@ class OffensiveSecurityAgent2 {
                   get: () => Promise.race([sr.response, this._drainRejection])
                 }
               });
-              return customResolve(guarded);
+              return customResolve(guarded, result);
             }).then((resolved) => {
               this._capturedResponse = resolved;
               this._resolveResponseCaptured(resolved);
@@ -1910,13 +1939,27 @@ class OffensiveSecurityAgent2 {
       mkdirSync2(messagesDir, { recursive: true });
     }
     this.messagesPath = join3(messagesDir, "messages.json");
-    const initialMessagesRef = {
-      current: input.messages ? [...input.messages] : [
-        {
-          role: "user",
-          content: [{ type: "text", text: input.prompt }]
-        }
-      ]
+    const preparedContextRef = {
+      current: {
+        messages: input.messages ? [...input.messages] : [
+          {
+            role: "user",
+            content: [{ type: "text", text: input.prompt }]
+          }
+        ],
+        responseMessageOffset: 0
+      }
+    };
+    const legacyMessages = (responseMessages) => [
+      ...preparedContextRef.current.messages,
+      ...responseMessages.slice(preparedContextRef.current.responseMessageOffset)
+    ];
+    const persistedMessages = (messages) => {
+      let first = 0;
+      while (messages[first]?.role === "system" && messages[first]?.providerOptions) {
+        first++;
+      }
+      return first === 0 ? messages : messages.slice(first);
     };
     this.writer = new AgentMessageWriter({ messagesPath: this.messagesPath });
     this.finalizeInterruptedStep = createInterruptedStepFinalizer({
@@ -1930,10 +1973,11 @@ class OffensiveSecurityAgent2 {
     });
     const schedulePersist = () => this.writer.schedulePersist();
     const baseSystemPrompt = input.system ?? buildBaseSystemPrompt2({
-      sandboxMode: agentCwd === input.session.rootPath
+      sandboxMode: agentCwd === input.session.rootPath,
+      findingPolicy: input.findingPolicy
     });
     const commandPlatform = resolveCommandPlatform(toolCtx);
-    const workspaceSection = buildSessionWorkspaceSection2(input.session, agentCwd, activeTools, fileWorkspaceRoot);
+    const workspaceSection = buildSessionWorkspaceSection2(input.session, agentCwd, activeTools, fileWorkspaceRoot, input.findingPolicy);
     const bundledAssets = input.backends || input.sandbox ? null : buildBundledAssetsSection();
     const assembleBaseSystemPrompt = (facts) => {
       const sections = [baseSystemPrompt];
@@ -1970,6 +2014,12 @@ class OffensiveSecurityAgent2 {
         usageRecorder: input.usageRecorder,
         contextRecorder: input.contextRecorder,
         inferenceRecorder: input.inferenceRecorder,
+        onContextPrepared: (context) => {
+          preparedContextRef.current = {
+            messages: [...context.messages],
+            responseMessageOffset: context.responseMessageOffset
+          };
+        },
         sessionPath: messagesDir,
         sessionId: this.busSessionId,
         onStepFinish: async (event) => {
@@ -1980,11 +2030,8 @@ class OffensiveSecurityAgent2 {
             await input.onStepFinish?.(event);
             return;
           }
-          const canonical = input.contextRecorder?.latest() ?? [
-            ...initialMessagesRef.current,
-            ...event.response.messages
-          ];
-          this.writer.setLatest(canonical);
+          const canonical = input.contextRecorder?.latest() ?? legacyMessages(event.response.messages);
+          this.writer.setLatest(persistedMessages(canonical));
           schedulePersist();
           traceWriter.recordStep(event.response.messages, stepUsage);
           this.eventBus.emit("step-finish", {
@@ -1997,16 +2044,16 @@ class OffensiveSecurityAgent2 {
           await input.onStepFinish?.(event);
         },
         onSummarized: () => {
-          initialMessagesRef.current = [];
+          preparedContextRef.current = {
+            messages: [],
+            responseMessageOffset: 0
+          };
           traceWriter.markSummarized();
         },
         onFinish: async (event) => {
           this.writer.cancelTimer();
           if (!this.writer.syntheticsPersisted) {
-            const finalMessages = input.contextRecorder?.latest() ?? this.writer.latest ?? [
-              ...initialMessagesRef.current,
-              ...event.response.messages
-            ];
+            const finalMessages = persistedMessages(input.contextRecorder?.latest() ?? this.writer.latest ?? legacyMessages(event.response.messages));
             this.writer.setLatest(finalMessages);
             await this.writer.enqueueWrite(finalMessages).catch(() => {});
           }
@@ -2426,4 +2473,8 @@ function safePreview(value) {
     return "[unserializable result]";
   }
 }
-export { buildProvidedFilesSection2, buildSessionWorkspaceSection2, buildBaseSystemPrompt2, BASE_SYSTEM_PROMPT2, StepTraceWriter2, OffensiveSecurityAgent2, exports_offSecAgent };
+
+// src/core/agents/offSecAgent/index.ts
+var EXTERNAL_FINDING_POLICY_CAPABILITY2 = "v1";
+
+export { buildProvidedFilesSection2, buildSessionWorkspaceSection2, buildBaseSystemPrompt2, BASE_SYSTEM_PROMPT2, StepTraceWriter2, OffensiveSecurityAgent2, EXTERNAL_FINDING_POLICY_CAPABILITY2, exports_offSecAgent };