jaku.sh 1.0.0

package/src/agents/orchestrator.js

@@ -0,0 +1,323 @@
+import { EventBus } from './event-bus.js';
+import { FindingsLedger } from './findings-ledger.js';
+import { BrowserManager } from '../core/browser-manager.js';
+
+/**
+ * Orchestrator — Central coordinator for the JAKU multi-agent system.
+ * 
+ * Responsibilities:
+ * 1. Register and manage agent lifecycle
+ * 2. Resolve dependencies via topological sort
+ * 3. Execute independent agents in parallel
+ * 4. Provide shared context (config, logger, event bus, surface inventory)
+ * 5. Synthesize final results (dedup, correlate, score)
+ */
+export class Orchestrator {
+    constructor(config, logger) {
+        this.config = config;
+        this.logger = logger;
+        this.eventBus = new EventBus();
+        this.ledger = new FindingsLedger(this.eventBus);
+
+        this._agents = new Map();       // name → agent instance
+        this._sharedContext = {         // passed to all agents
+            config,
+            logger,
+            eventBus: this.eventBus,
+            ledger: this.ledger,
+            surfaceInventory: null,       // set by JAKU-CRAWL
+        };
+
+        this._startTime = null;
+        this._haltedOnCritical = false;
+    }
+
+    /**
+     * Register an agent with the orchestrator.
+     */
+    register(agent) {
+        if (this._agents.has(agent.name)) {
+            this.logger?.warn?.(`Agent "${agent.name}" already registered, skipping`);
+            return this;
+        }
+        this._agents.set(agent.name, agent);
+        this.logger?.info?.(`Registered agent: ${agent.name}`);
+        return this; // chainable
+    }
+
+    /**
+     * Subscribe to orchestrator events.
+     */
+    on(event, handler) {
+        this.eventBus.on(event, handler);
+        return this;
+    }
+
+    /**
+     * Run all registered agents with dependency resolution and parallel execution.
+     */
+    async run() {
+        this._startTime = Date.now();
+        const executionOrder = this._resolveExecutionOrder();
+
+        this.eventBus.emit('scan:started', {
+            timestamp: new Date().toISOString(),
+            modules: [...this._agents.keys()],
+        });
+
+        this.logger?.info?.(`Orchestrator starting with ${this._agents.size} agents`);
+        this.logger?.info?.(`Execution order: ${executionOrder.map(g => g.map(a => a.name).join(' + ')).join(' → ')}`);
+
+        // Initialize all agents
+        for (const [, agent] of this._agents) {
+            await agent.init(this._sharedContext);
+        }
+
+        // Listen for critical findings if halt_on_critical is enabled
+        if (this.config.halt_on_critical) {
+            this.eventBus.on('finding:new', ({ finding }) => {
+                if (finding?.severity === 'critical') {
+                    this._haltedOnCritical = true;
+                    this.logger?.warn?.(`\n⛔ CRITICAL finding detected — halting scan (halt_on_critical=true)`);
+                    this.logger?.warn?.(`   ${finding.title}`);
+                }
+            });
+        }
+
+        // Execute in dependency-resolved waves
+        for (const wave of executionOrder) {
+            // Fix 4: Session heartbeat — re-authenticate if session expired before each wave
+            await this._checkSessionHealth();
+
+            if (wave.length === 1) {
+                // Single agent — run sequentially
+                await this._runAgent(wave[0]);
+            } else {
+                // Multiple agents — run in parallel
+                this.logger?.info?.(`Running ${wave.length} agents in parallel: ${wave.map(a => a.name).join(', ')}`);
+                const results = await Promise.allSettled(
+                    wave.map(agent => this._runAgent(agent))
+                );
+
+                // Log any failures
+                for (let i = 0; i < results.length; i++) {
+                    if (results[i].status === 'rejected') {
+                        this.logger?.error?.(`Agent ${wave[i].name} failed: ${results[i].reason?.message}`);
+                    }
+                }
+            }
+
+            // Check halt_on_critical after each wave
+            if (this._haltedOnCritical) {
+                this.logger?.warn?.('Scan halted after critical finding. Proceeding to synthesis.');
+                break;
+            }
+        }
+
+        // Cleanup all agents
+        for (const [, agent] of this._agents) {
+            try {
+                await agent.cleanup();
+            } catch (err) {
+                this.logger?.debug?.(`Cleanup for ${agent.name}: ${err.message}`);
+            }
+        }
+
+        // Fix 2: Ensure all browsers are closed via BrowserManager
+        await BrowserManager.closeAll().catch(() => { });
+
+        // Synthesis phase
+        const duration = Date.now() - this._startTime;
+        const results = this._synthesize(duration);
+
+        this.eventBus.emit('scan:completed', {
+            timestamp: new Date().toISOString(),
+            duration,
+            totalFindings: this.ledger.count,
+            haltedOnCritical: this._haltedOnCritical,
+        });
+
+        // Send webhook notification if configured
+        if (this.config.notify_webhook) {
+            await this._sendWebhook(results);
+        }
+
+        return results;
+    }
+
+    /**
+     * Run a single agent with error boundary.
+     */
+    async _runAgent(agent) {
+        try {
+            await agent.run();
+
+            // If this is the crawl agent, store surface inventory for downstream agents
+            if (agent.name === 'JAKU-CRAWL' && this._sharedContext.surfaceInventory === null) {
+                // The crawl agent should have set this
+                this.logger?.debug?.('Surface inventory should be set by JAKU-CRAWL');
+            }
+        } catch (error) {
+            // Agent errors are non-fatal — other agents continue
+            this.logger?.error?.(`Agent ${agent.name} failed: ${error.message}`);
+        }
+    }
+
+    /**
+     * Resolve agents into execution waves based on dependencies.
+     * Uses topological sort — agents in the same wave have no inter-dependencies.
+     * 
+     * Example:
+     *   JAKU-CRAWL (no deps)    → Wave 1
+     *   JAKU-QA (dep: CRAWL)    → Wave 2
+     *   JAKU-SEC (dep: CRAWL)   → Wave 2 (parallel with QA)
+     */
+    _resolveExecutionOrder() {
+        const waves = [];
+        const completed = new Set();
+        const remaining = new Map(this._agents);
+
+        let iterations = 0;
+        const maxIterations = remaining.size + 1;
+
+        while (remaining.size > 0 && iterations < maxIterations) {
+            iterations++;
+            const currentWave = [];
+
+            for (const [name, agent] of remaining) {
+                const depsResolved = agent.dependencies.every(dep => completed.has(dep));
+                if (depsResolved) {
+                    currentWave.push(agent);
+                }
+            }
+
+            if (currentWave.length === 0) {
+                const stuck = [...remaining.keys()].join(', ');
+                throw new Error(`Circular dependency detected among agents: ${stuck}`);
+            }
+
+            for (const agent of currentWave) {
+                remaining.delete(agent.name);
+                completed.add(agent.name);
+            }
+
+            waves.push(currentWave);
+        }
+
+        return waves;
+    }
+
+    /**
+     * Synthesis phase — deduplicate, correlate, and build final report data.
+     */
+    _synthesize(duration) {
+        const exported = this.ledger.export();
+
+        // Build per-agent summary
+        const agentSummaries = {};
+        for (const [name, agent] of this._agents) {
+            agentSummaries[name] = {
+                status: agent.status,
+                duration: agent.duration,
+                findingsCount: agent.findings.length,
+            };
+        }
+
+        return {
+            findings: exported.findings,
+            deduplicated: exported.deduplicated,
+            summary: exported.summary,
+            dedupSummary: exported.dedupSummary,
+            dedupStats: exported.dedupStats,
+            correlations: exported.correlations,
+            agents: agentSummaries,
+            surfaceInventory: this._sharedContext.surfaceInventory,
+            duration,
+            eventLog: this.eventBus.getLog(),
+        };
+    }
+
+    /**
+     * Get the status of all agents.
+     */
+    getStatus() {
+        const status = {};
+        for (const [name, agent] of this._agents) {
+            status[name] = {
+                status: agent.status,
+                duration: agent.duration,
+                findings: agent.findings.length,
+            };
+        }
+        return status;
+    }
+
+    /**
+     * Send scan results to configured webhook (Slack, Linear, PagerDuty, etc.)
+     */
+    async _sendWebhook(results) {
+        const webhookUrl = this.config.notify_webhook;
+        if (!webhookUrl) return;
+
+        try {
+            const payload = {
+                agent: 'JAKU',
+                version: '1.0.0',
+                target: this.config.target_url,
+                timestamp: new Date().toISOString(),
+                duration: results.duration,
+                totalFindings: results.findings?.length || 0,
+                summary: results.summary,
+                criticalCount: results.summary?.critical || 0,
+                highCount: results.summary?.high || 0,
+                haltedOnCritical: this._haltedOnCritical,
+            };
+
+            await fetch(webhookUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(payload),
+                signal: AbortSignal.timeout(10000),
+            });
+
+            this.logger?.info?.(`Webhook notification sent to ${webhookUrl}`);
+        } catch (err) {
+            this.logger?.warn?.(`Webhook notification failed: ${err.message}`);
+        }
+    }
+    /**
+     * Fix 4: Session heartbeat — check if auth session is still valid.
+     * If the target returns 401/403, attempt re-authentication.
+     */
+    async _checkSessionHealth() {
+        const authManager = this.config._authManager;
+        if (!authManager?.isAuthenticated) return; // No auth, nothing to check
+
+        const targetUrl = this.config.target_url;
+
+        try {
+            const resp = await fetch(targetUrl, {
+                method: 'HEAD',
+                signal: AbortSignal.timeout(5000),
+                redirect: 'follow',
+            });
+
+            if (resp.status === 401 || resp.status === 403) {
+                this.logger?.warn?.('⚠ Session appears expired — re-authenticating...');
+                try {
+                    await authManager.authenticate();
+                    // Update the shared context with refreshed auth state
+                    this._sharedContext.config._authManager = authManager;
+                    this.logger?.info?.('✔ Re-authentication successful');
+                } catch (err) {
+                    this.logger?.error?.(`Re-authentication failed: ${err.message}`);
+                }
+            }
+        } catch {
+            // Network error — skip heartbeat silently
+        }
+    }
+
+}
+
+export default Orchestrator;

package/src/agents/qa-agent.js

@@ -0,0 +1,149 @@
+import { BaseAgent } from './base-agent.js';
+import { BrokenFlowDetector } from '../core/broken-flow-detector.js';
+import { ConsoleMonitor } from '../core/console-monitor.js';
+import { TestGenerator } from '../core/test-generator.js';
+import { TestRunner } from '../core/test-runner.js';
+import { FormValidator } from '../core/form-validator.js';
+import { ResponsiveChecker } from '../core/responsive-checker.js';
+import { PerformanceChecker } from '../core/performance-checker.js';
+import { AccessibilityChecker } from '../core/accessibility-checker.js';
+
+/**
+ * JAKU-QA — Quality Assurance & Functional Testing Agent
+ *
+ * Pipeline (7 phases):
+ * 1. Broken Flow Detection  — 404s, redirect loops, missing auth redirects
+ * 2. Console Monitoring     — JS errors, unhandled promises, network failures
+ * 3. Test Generation & Run  — Smoke tests per discovered page with deduplication
+ * 4. Form Validation        — Required fields, type checking, error messaging
+ * 5. Responsive Checking    — Mobile/tablet/desktop layout issues
+ * 6. Performance Checking   — Core Web Vitals: LCP, FCP, TTFB, TBT, CLS
+ * 7. Accessibility Checking — WCAG 2.2 via axe-core (real-browser injection)
+ *
+ * Dependencies: JAKU-CRAWL
+ */
+export class QAAgent extends BaseAgent {
+    get name() { return 'JAKU-QA'; }
+    get dependencies() { return ['JAKU-CRAWL']; }
+
+    constructor() {
+        super();
+        this._testSummary = {};
+    }
+
+    get testSummary() { return this._testSummary; }
+
+    async _execute(context) {
+        const { config, logger, surfaceInventory } = context;
+
+        if (!surfaceInventory) {
+            throw new Error('No surface inventory available — JAKU-CRAWL must run first');
+        }
+
+        const phases = [
+            { name: 'broken-flows', label: 'Detecting broken flows' },
+            { name: 'console', label: 'Analyzing console output' },
+            { name: 'tests', label: 'Generating & running tests' },
+            { name: 'forms', label: 'Validating forms' },
+            { name: 'responsive', label: 'Checking responsiveness' },
+            { name: 'performance', label: 'Measuring Core Web Vitals' },
+            { name: 'accessibility', label: 'Checking WCAG 2.2 accessibility' },
+        ];
+
+        let completedPhases = 0;
+
+        // Phase 1: Broken Flow Detection
+        this.progress(phases[0].name, phases[0].label, 0);
+        try {
+            const detector = new BrokenFlowDetector(logger);
+            const findings = detector.analyze(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Broken flows: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Broken flow detection failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+        this.progress(phases[0].name, `Broken flows complete`, (completedPhases / phases.length) * 100);
+
+        // Phase 2: Console Monitoring
+        this.progress(phases[1].name, phases[1].label, (completedPhases / phases.length) * 100);
+        try {
+            const monitor = new ConsoleMonitor(logger);
+            const findings = monitor.analyze(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Console: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Console analysis failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 3: Test Generation & Execution
+        this.progress(phases[2].name, phases[2].label, (completedPhases / phases.length) * 100);
+        try {
+            const generator = new TestGenerator(logger);
+            const testCases = generator.generate(surfaceInventory);
+            this._log(`Generated ${testCases.length} test cases`);
+
+            const runner = new TestRunner(config, logger);
+            const results = await runner.run(testCases);
+            this._testSummary = results.summary;
+            this.addFindings(results.findings);
+            this._log(`Tests: ${results.summary.passed} passed, ${results.summary.failed} failed`);
+        } catch (err) {
+            this._log(`Test execution failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 4: Form Validation
+        this.progress(phases[3].name, phases[3].label, (completedPhases / phases.length) * 100);
+        try {
+            const validator = new FormValidator(config, logger);
+            const findings = await validator.validate(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Forms: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Form validation failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 5: Responsive Checking
+        this.progress(phases[4].name, phases[4].label, (completedPhases / phases.length) * 100);
+        try {
+            const checker = new ResponsiveChecker(config, logger);
+            const findings = await checker.check(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Responsive: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Responsive check failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 6: Performance Checking — Core Web Vitals
+        this.progress(phases[5].name, phases[5].label, (completedPhases / phases.length) * 100);
+        try {
+            const perfChecker = new PerformanceChecker(config, logger);
+            const findings = await perfChecker.check(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Performance: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Performance checking failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 7: Accessibility Checking — WCAG 2.2 / axe-core
+        this.progress(phases[6].name, phases[6].label, (completedPhases / phases.length) * 100);
+        try {
+            const a11yChecker = new AccessibilityChecker(config, logger);
+            const findings = await a11yChecker.check(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Accessibility: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Accessibility checking failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        this.progress('complete', `QA complete — ${this._findings.length} total findings`, 100);
+    }
+}
+
+export default QAAgent;

package/src/agents/security-agent.js

@@ -0,0 +1,211 @@
+import { BaseAgent } from './base-agent.js';
+import { HeaderAnalyzer } from '../core/security/header-analyzer.js';
+import { SecretDetector } from '../core/security/secret-detector.js';
+import { XSSScanner } from '../core/security/xss-scanner.js';
+import { SQLiProber } from '../core/security/sqli-prober.js';
+import { DependencyAuditor } from '../core/security/dependency-auditor.js';
+import { TLSChecker } from '../core/security/tls-checker.js';
+import { InfraScanner } from '../core/security/infra-scanner.js';
+import { FileUploadTester } from '../core/security/file-upload-tester.js';
+import { CORSProber } from '../core/security/cors-prober.js';
+import { CSRFProber } from '../core/security/csrf-prober.js';
+import { PrototypePollutionScanner } from '../core/security/prototype-pollution.js';
+import { PathTraversalScanner } from '../core/security/path-traversal.js';
+
+/**
+ * JAKU-SEC — Security Vulnerability Scanning Agent
+ *
+ * Pipeline (12 phases):
+ * 1. Header Analysis      — CSP, HSTS, X-Frame-Options, etc.
+ * 2. Secret Detection     — API keys, tokens, credentials in JS/HTML
+ * 3. XSS Scanning         — Reflected, stored, DOM, AngularJS/Vue template injection
+ * 4. SQL Injection         — Error-based, boolean-based, time-based
+ * 5. Dependency Audit     — CVE lookup for npm/pip/gem packages
+ * 6. TLS Check            — Protocol version, cipher strength, cert validity
+ * 7. Infrastructure Scan  — Open ports, service disclosure, misconfigured services
+ * 8. File Upload Testing  — MIME bypass, polyglot files, path traversal in upload
+ * 9. CORS Probing         — Arbitrary origin reflection, null origin, pre-flight bypass
+ * 10. CSRF Probing        — Cookie SameSite, token absence, state-changing GET
+ * 11. Prototype Pollution — __proto__ and constructor.prototype injection via URL/JSON
+ * 12. Path Traversal / LFI — ../ variants, encoding bypasses, cloud metadata SSRF
+ *
+ * Dependencies: JAKU-CRAWL
+ */
+export class SecurityAgent extends BaseAgent {
+    get name() { return 'JAKU-SEC'; }
+    get dependencies() { return ['JAKU-CRAWL']; }
+
+    async _execute(context) {
+        const { config, logger, surfaceInventory } = context;
+
+        if (!surfaceInventory) {
+            throw new Error('No surface inventory available — JAKU-CRAWL must run first');
+        }
+
+        const phases = [
+            { name: 'headers', label: 'Analyzing security headers' },
+            { name: 'secrets', label: 'Scanning for exposed secrets' },
+            { name: 'xss', label: 'Probing for XSS vulnerabilities' },
+            { name: 'sqli', label: 'Probing for SQL injection' },
+            { name: 'deps', label: 'Auditing dependencies' },
+            { name: 'tls', label: 'Checking TLS configuration' },
+            { name: 'infra', label: 'Scanning infrastructure' },
+            { name: 'upload', label: 'Testing file upload security' },
+            { name: 'cors', label: 'Probing CORS misconfigurations' },
+            { name: 'csrf', label: 'Testing CSRF protection' },
+            { name: 'proto', label: 'Scanning for prototype pollution' },
+            { name: 'traversal', label: 'Testing path traversal / LFI' },
+        ];
+
+        let completedPhases = 0;
+
+        // Phase 1: Header Analysis
+        this.progress(phases[0].name, phases[0].label, 0);
+        try {
+            const analyzer = new HeaderAnalyzer(logger);
+            const findings = await analyzer.analyze(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Headers: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Header analysis failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+        this.progress(phases[0].name, 'Header analysis complete', (completedPhases / phases.length) * 100);
+
+        // Phase 2: Secret Detection
+        this.progress(phases[1].name, phases[1].label, (completedPhases / phases.length) * 100);
+        try {
+            const detector = new SecretDetector(logger);
+            const findings = await detector.detect(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Secrets: ${findings.length} exposures`);
+        } catch (err) {
+            this._log(`Secret detection failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 3: XSS Scanning
+        this.progress(phases[2].name, phases[2].label, (completedPhases / phases.length) * 100);
+        try {
+            const scanner = new XSSScanner(logger);
+            const findings = await scanner.scan(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`XSS: ${findings.length} vulnerabilities`);
+        } catch (err) {
+            this._log(`XSS scanning failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 4: SQL Injection Probing
+        this.progress(phases[3].name, phases[3].label, (completedPhases / phases.length) * 100);
+        try {
+            const prober = new SQLiProber(logger);
+            const findings = await prober.probe(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`SQLi: ${findings.length} vulnerabilities`);
+        } catch (err) {
+            this._log(`SQLi probing failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 5: Dependency Audit
+        this.progress(phases[4].name, phases[4].label, (completedPhases / phases.length) * 100);
+        try {
+            const auditor = new DependencyAuditor(config, logger);
+            const findings = await auditor.audit();
+            this.addFindings(findings);
+            this._log(`Dependencies: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Dependency audit failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 6: TLS/SSL Check
+        this.progress(phases[5].name, phases[5].label, (completedPhases / phases.length) * 100);
+        try {
+            const checker = new TLSChecker(logger);
+            const findings = await checker.check(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`TLS: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`TLS check failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 7: Infrastructure Scan
+        this.progress(phases[6].name, phases[6].label, (completedPhases / phases.length) * 100);
+        try {
+            const scanner = new InfraScanner(logger);
+            const findings = await scanner.scan(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Infrastructure: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Infrastructure scan failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 8: File Upload Testing
+        this.progress(phases[7].name, phases[7].label, (completedPhases / phases.length) * 100);
+        try {
+            const uploader = new FileUploadTester(logger);
+            const findings = await uploader.test(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`File uploads: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`File upload testing failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 9: CORS Probing
+        this.progress(phases[8].name, phases[8].label, (completedPhases / phases.length) * 100);
+        try {
+            const corsProber = new CORSProber(logger);
+            const findings = await corsProber.probe(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`CORS: ${findings.length} misconfigurations`);
+        } catch (err) {
+            this._log(`CORS probing failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 10: CSRF Probing
+        this.progress(phases[9].name, phases[9].label, (completedPhases / phases.length) * 100);
+        try {
+            const csrfProber = new CSRFProber(logger);
+            const findings = await csrfProber.probe(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`CSRF: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`CSRF probing failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 11: Prototype Pollution
+        this.progress(phases[10].name, phases[10].label, (completedPhases / phases.length) * 100);
+        try {
+            const ppScanner = new PrototypePollutionScanner(logger);
+            const findings = await ppScanner.scan(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Prototype pollution: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Prototype pollution scan failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        // Phase 12: Path Traversal / LFI
+        this.progress(phases[11].name, phases[11].label, (completedPhases / phases.length) * 100);
+        try {
+            const traversalScanner = new PathTraversalScanner(logger);
+            const findings = await traversalScanner.scan(surfaceInventory);
+            this.addFindings(findings);
+            this._log(`Path traversal: ${findings.length} issues`);
+        } catch (err) {
+            this._log(`Path traversal scan failed: ${err.message}`, 'error');
+        }
+        completedPhases++;
+
+        this.progress('complete', `Security scan complete — ${this._findings.length} total findings`, 100);
+    }
+}
+
+export default SecurityAgent;