pentesting 0.16.3 → 0.16.4

package/dist/main.js

@@ -7,10 +7,11 @@ import chalk from "chalk";
 import gradient from "gradient-string";
 
 // src/platform/tui/app.tsx
+import { useState as useState2, useCallback as useCallback2, useEffect as useEffect2 } from "react";
+import { Box as Box5, useInput, useApp } from "ink";
+
+// src/platform/tui/hooks/useAgent.ts
 import { useState, useEffect, useCallback, useRef } from "react";
-import { Box as Box2, Text as Text2, useInput, useApp, Static } from "ink";
-import TextInput from "ink-text-input";
-import Spinner from "ink-spinner";
 
 // src/shared/constants/agent.ts
 var AGENT_LIMITS = {
@@ -38,8 +39,22 @@ var DISPLAY_LIMITS = {
 var ID_LENGTH = 7;
 var ID_RADIX = 36;
 var APP_NAME = "Pentest AI";
-var APP_VERSION = "0.15.0";
+var APP_VERSION = "0.16.3";
 var APP_DESCRIPTION = "Autonomous Penetration Testing AI Agent";
+var UI_ROLES = {
+  SYSTEM: "system",
+  USER: "user",
+  AI: "ai",
+  ERROR: "error"
+};
+var LLM_ROLES = {
+  SYSTEM: "system",
+  USER: "user",
+  ASSISTANT: "assistant"
+};
+
+// src/shared/utils/id.ts
+var generateId = (radix = 36, length = 8) => Math.random().toString(radix).substring(2, 2 + length);
 
 // src/shared/constants/protocol.ts
 var PHASES = {
@@ -59,7 +74,9 @@ var AGENT_ROLES = {
   WEB: "web",
   EXPLOTER: "exploit",
   DATABASE: "database",
-  INFRA: "infra"
+  INFRA: "infra",
+  VULN: "vulnerability_analysis",
+  POST_EXPLOIT: "post_exploitation"
 };
 var SERVICES = {
   HTTP: "http",
@@ -166,11 +183,6 @@ var TODO_STATUSES = {
   DONE: "done",
   SKIPPED: "skipped"
 };
-var TODO_ACTIONS = {
-  ADD: "add",
-  COMPLETE: "complete",
-  REMOVE: "remove"
-};
 var CORE_BINARIES = {
   NMAP: "nmap",
   MASSCAN: "masscan",
@@ -181,6 +193,12 @@ var CORE_BINARIES = {
   SQLMAP: "sqlmap",
   METASPLOIT: "msfconsole"
 };
+var APPROVAL_STATUSES = {
+  AUTO: "auto",
+  USER_CONFIRMED: "user_confirmed",
+  USER_REVIEWED: "user_reviewed",
+  DENIED: "denied"
+};
 var PRIORITIES = {
   HIGH: "high",
   MEDIUM: "medium",
@@ -191,6 +209,116 @@ var NOISE_LEVELS = {
   MEDIUM: "medium",
   HIGH: "high"
 };
+var EVENT_TYPES = {
+  START: "start",
+  PHASE_CHANGE: "phase_change",
+  STATE_CHANGE: "state_change",
+  REASONING_START: "reasoning_start",
+  REASONING_DELTA: "reasoning_delta",
+  REASONING_END: "reasoning_end",
+  TOOL_CALL: "tool_call",
+  TOOL_RESULT: "tool_result",
+  ERROR: "error",
+  COMPLETE: "complete",
+  THINK: "think",
+  APPROVAL_ASK: "approval_ask",
+  APPROVAL_RESULT: "approval_result",
+  DELEGATE: "delegate",
+  DELEGATE_RESULT: "delegate_result",
+  ESCALATE: "escalate",
+  AGENT_SWITCH: "agent_switch",
+  OBSERVE: "observe",
+  RETRY: "retry",
+  USAGE_UPDATE: "usage_update",
+  INPUT_REQUEST: "input_request",
+  LOG: "log"
+};
+var UI_COMMANDS = {
+  HELP: "help",
+  HELP_SHORT: "h",
+  CLEAR: "clear",
+  CLEAR_SHORT: "c",
+  TARGET: "target",
+  TARGET_SHORT: "t",
+  START: "start",
+  START_SHORT: "s",
+  FINDINGS: "findings",
+  FINDINGS_SHORT: "f",
+  EXIT: "exit",
+  QUIT: "quit",
+  EXIT_SHORT: "q"
+};
+var PASSIVE_BINARIES = ["whois", "dig", "curl -i"];
+var EXPLOIT_BINARIES = ["impacket"];
+var MASK_PARTS = {
+  C24: "24",
+  C16: "16",
+  C8: "8"
+};
+
+// src/engine/state-serializer.ts
+var StateSerializer = class {
+  /**
+   * Convert full state to a compact prompt summary
+   */
+  static toPrompt(state) {
+    const lines = [];
+    const data = state.data;
+    if (data.engagement) {
+      lines.push(`Engagement: ${data.engagement.name} (${data.engagement.client})`);
+    }
+    const scope = state.getScope();
+    if (scope) {
+      lines.push(`Scope: CIDR=[${scope.allowedCidrs.join(", ")}] Domains=[${scope.allowedDomains.join(", ")}]`);
+    }
+    const targets = state.getAllTargets();
+    if (targets.length > 0) {
+      const byCategory = /* @__PURE__ */ new Map();
+      for (const t of targets) {
+        const cat = t.primaryCategory || SERVICE_CATEGORIES.NETWORK;
+        if (!byCategory.has(cat)) byCategory.set(cat, []);
+        byCategory.get(cat).push(t);
+      }
+      lines.push(`Targets (${targets.length}):`);
+      for (const [cat, catTargets] of byCategory) {
+        lines.push(`  [${cat}] ${catTargets.length} hosts`);
+        for (const t of catTargets.slice(0, 3)) {
+          const ports = (t.ports || []).map((p) => `${p.port}/${p.service}`).join(", ");
+          lines.push(`    ${t.ip}${t.hostname ? ` (${t.hostname})` : ""}: ${ports || "unknown"}`);
+        }
+      }
+    }
+    const findings = state.getFindings();
+    if (findings.length > 0) {
+      const counts = findings.reduce((acc, f) => {
+        acc[f.severity] = (acc[f.severity] || 0) + 1;
+        return acc;
+      }, { critical: 0, high: 0, medium: 0, low: 0 });
+      lines.push(`Findings: ${findings.length} total (crit:${counts.critical} high:${counts.high} med:${counts.medium})`);
+      const important = findings.filter((f) => f.severity === "critical" || f.severity === "high");
+      if (important.length > 0) {
+        lines.push(`  Important Findings:`);
+        for (const f of important.slice(0, 5)) {
+          lines.push(`    [${f.severity.toUpperCase()}] ${f.title} (${f.category || "general"})`);
+        }
+      }
+    }
+    const loot = state.getLoot();
+    if (loot.length > 0) {
+      lines.push(`Loot: ${loot.length} items`);
+    }
+    const todo = state.getTodo();
+    if (todo.length > 0) {
+      lines.push(`TODO (${todo.length}):`);
+      for (const t of todo.slice(0, DISPLAY_LIMITS.COMPACT_LIST_ITEMS)) {
+        const status = t.status === "done" ? "[x]" : t.status === "in_progress" ? "[->]" : "[ ]";
+        lines.push(`  ${status} ${t.content} (${t.priority})`);
+      }
+    }
+    lines.push(`Phase: ${state.getPhase()}`);
+    return lines.join("\n");
+  }
+};
 
 // src/engine/state.ts
 var SharedState = class {
@@ -206,14 +334,7 @@ var SharedState = class {
       currentPhase: PHASES.RECON
     };
   }
-  // Engagement
-  setEngagement(engagement) {
-    this.data.engagement = engagement;
-  }
-  getEngagement() {
-    return this.data.engagement;
-  }
-  // Scope
+  // --- Engagement & Scope ---
   getScope() {
     return this.data.engagement?.scope || null;
   }
@@ -222,16 +343,17 @@ var SharedState = class {
       this.data.engagement.scope = scope;
     } else {
       this.data.engagement = {
-        id: Math.random().toString(36).slice(2, 10),
-        name: "auto-engagement",
-        client: "unknown",
+        id: generateId(ID_RADIX, ID_LENGTH),
+        name: "auto-assessment",
+        // Could be added to constants if needed
+        client: "internal",
         scope,
         phase: this.data.currentPhase,
         startedAt: Date.now()
       };
     }
   }
-  // Targets
+  // --- Targets ---
   addTarget(target) {
     this.data.targets.set(target.ip, target);
   }
@@ -244,142 +366,49 @@ var SharedState = class {
   getTargets() {
     return this.data.targets;
   }
-  /**
-   * Update target with service fingerprint
-   */
   addServiceFingerprint(ip, fingerprint) {
     const target = this.getTarget(ip);
-    if (target) {
-      if (!target.services) {
-        target.services = [];
-      }
-      target.services.push(fingerprint);
-      target.primaryCategory = this.getMostCommonCategory(target.services);
-    }
-  }
-  /**
-   * Get most common service category for target
-   */
-  getMostCommonCategory(services) {
-    const counts = /* @__PURE__ */ new Map();
-    for (const s of services) {
-      counts.set(s.category, (counts.get(s.category) || 0) + 1);
-    }
+    if (!target) return;
+    target.services = target.services || [];
+    target.services.push(fingerprint);
+    target.primaryCategory = this.calculatePrimaryCategory(target.services);
+  }
+  calculatePrimaryCategory(services) {
+    const counts = {};
+    let winner = SERVICE_CATEGORIES.NETWORK;
     let max = 0;
-    let result = SERVICE_CATEGORIES.NETWORK;
-    for (const [cat, count] of counts) {
-      if (count > max) {
-        max = count;
-        result = cat;
+    for (const s of services) {
+      counts[s.category] = (counts[s.category] || 0) + 1;
+      if (counts[s.category] > max) {
+        max = counts[s.category];
+        winner = s.category;
       }
     }
-    return result;
-  }
-  /**
-   * Get targets by category
-   */
-  getTargetsByCategory(category) {
-    return this.getAllTargets().filter(
-      (t) => t.primaryCategory === category || t.services?.some((s) => s.category === category)
-    );
+    return winner;
   }
-  /**
-   * Get high-risk targets
-   */
-  getHighRiskTargets() {
-    const highRisk = [SERVICE_CATEGORIES.ICS, SERVICE_CATEGORIES.AD, SERVICE_CATEGORIES.DATABASE, SERVICE_CATEGORIES.CLOUD, SERVICE_CATEGORIES.CONTAINER];
-    return this.getAllTargets().filter(
-      (t) => highRisk.includes(t.primaryCategory || SERVICE_CATEGORIES.NETWORK)
-    );
-  }
-  // Findings
+  // --- Findings & Loot ---
   addFinding(finding) {
     this.data.findings.push(finding);
   }
   getFindings() {
     return this.data.findings;
   }
-  getFindingsBySeverity(severity) {
-    return this.data.findings.filter((f) => f.severity === severity);
-  }
-  /**
-   * Get findings by category
-   */
-  getFindingsByCategory(category) {
-    return this.data.findings.filter((f) => f.category === category);
-  }
-  /**
-   * Get findings by attack tactic
-   */
-  getFindingsByTactic(tactic) {
-    return this.data.findings.filter((f) => f.attackPattern === tactic);
-  }
-  /**
-   * Get verified findings only
-   */
-  getVerifiedFindings() {
-    return this.data.findings.filter((f) => f.verified);
-  }
-  /**
-   * Get findings with available exploits
-   */
-  getExploitableFindings() {
-    return this.data.findings.filter((f) => f.exploitAvailable === true);
-  }
-  /**
-   * Get chainable findings (attack chains)
-   */
-  getChainableFindings() {
-    const chains = /* @__PURE__ */ new Map();
-    for (const f of this.data.findings) {
-      if (f.chainable && f.chainable.length > 0) {
-        chains.set(f.id, [f, ...this.data.findings.filter((o) => f.chainable?.includes(o.id))]);
-      }
-    }
-    return chains;
-  }
-  // Loot
   addLoot(loot) {
     this.data.loot.push(loot);
   }
   getLoot() {
     return this.data.loot;
   }
-  /**
-   * Get loot by category
-   */
-  getLootByCategory(category) {
-    return this.data.loot.filter((l) => l.category === category);
-  }
-  /**
-   * Get loot by type
-   */
-  getLootByType(type) {
-    return this.data.loot.filter((l) => l.type === type);
-  }
-  /**
-   * Get crackable loot (hashes, tickets)
-   */
-  getCrackableLoot() {
-    return this.data.loot.filter((l) => l.crackable === true && !l.cracked);
-  }
-  // TODO List Management
-  addTodo(content, priority = "medium") {
-    const id = Math.random().toString(ID_RADIX).substring(ID_LENGTH);
-    const todo = {
-      id,
-      content,
-      status: TODO_STATUSES.PENDING,
-      priority
-    };
-    this.data.todo.push(todo);
+  // --- TODO Management ---
+  addTodo(content, priority = PRIORITIES.MEDIUM) {
+    const id = generateId(ID_RADIX, ID_LENGTH);
+    const item = { id, content, status: TODO_STATUSES.PENDING, priority };
+    this.data.todo.push(item);
     return id;
   }
   updateTodo(id, updates) {
-    const index = this.data.todo.findIndex((t) => t.id === id);
-    if (index !== -1) {
-      this.data.todo[index] = { ...this.data.todo[index], ...updates };
-    }
+    const item = this.data.todo.find((t) => t.id === id);
+    if (item) Object.assign(item, updates);
   }
   getTodo() {
     return this.data.todo;
@@ -387,90 +416,29 @@ var SharedState = class {
   completeTodo(id) {
     this.updateTodo(id, { status: TODO_STATUSES.DONE });
   }
-  // Action Log
+  // --- Logs & Phase ---
   logAction(action) {
-    const log = {
-      id: Math.random().toString(ID_RADIX).substring(ID_LENGTH),
+    this.data.actionLog.push({
+      id: generateId(ID_RADIX, ID_LENGTH),
       timestamp: Date.now(),
       ...action
-    };
-    this.data.actionLog.push(log);
+    });
   }
   getRecentActions(count = DISPLAY_LIMITS.COMPACT_LIST_ITEMS) {
     return this.data.actionLog.slice(-count);
   }
-  getActionLog() {
-    return this.data.actionLog;
-  }
-  // Phase
   setPhase(phase) {
     this.data.currentPhase = phase;
   }
   getPhase() {
     return this.data.currentPhase;
   }
-  // Export to prompt (minimal summary)
+  /**
+   * @remarks
+   * WHY: Delegating complex string builder to specialized serializer.
+   */
   toPrompt() {
-    const lines = [];
-    if (this.data.engagement) {
-      lines.push(`Engagement: ${this.data.engagement.name} (${this.data.engagement.client})`);
-    }
-    const scope = this.getScope();
-    if (scope) {
-      lines.push(`Scope: CIDR=[${scope.allowedCidrs.join(", ")}] Domains=[${scope.allowedDomains.join(", ")}]`);
-    }
-    const targets = this.getAllTargets();
-    if (targets.length > 0) {
-      const byCategory = /* @__PURE__ */ new Map();
-      for (const t of targets) {
-        const cat = t.primaryCategory || SERVICE_CATEGORIES.NETWORK;
-        if (!byCategory.has(cat)) {
-          byCategory.set(cat, []);
-        }
-        byCategory.get(cat).push(t);
-      }
-      lines.push(`Targets (${targets.length}):`);
-      for (const [cat, catTargets] of byCategory) {
-        lines.push(`  [${cat}] ${catTargets.length} hosts`);
-        for (const t of catTargets.slice(0, 3)) {
-          const ports = t.ports.map((p) => `${p.port}/${p.service}`).join(", ");
-          lines.push(`    ${t.ip}${t.hostname ? ` (${t.hostname})` : ""}: ${ports || "unknown"}`);
-        }
-      }
-    }
-    const findings = this.getFindings();
-    if (findings.length > 0) {
-      const bySeverity = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-      for (const f of findings) {
-        bySeverity[f.severity]++;
-      }
-      lines.push(`Findings: ${findings.length} total (crit:${bySeverity.critical} high:${bySeverity.high} medium:${bySeverity.medium})`);
-      const criticalHigh = findings.filter((f) => f.severity === "critical" || f.severity === "high");
-      if (criticalHigh.length > 0) {
-        lines.push(`  Critical/High:`);
-        for (const f of criticalHigh.slice(0, 5)) {
-          lines.push(`    [${f.severity.toUpperCase()}] ${f.title} (${f.category || "general"})`);
-        }
-      }
-    }
-    const loot = this.getLoot();
-    if (loot.length > 0) {
-      const byType = /* @__PURE__ */ new Map();
-      for (const l of loot) {
-        byType.set(l.type, (byType.get(l.type) || 0) + 1);
-      }
-      lines.push(`Loot: ${loot.length} items (${Array.from(byType.entries()).map(([t, c]) => `${t}:${c}`).join(", ")})`);
-    }
-    const todo = this.getTodo();
-    if (todo.length > 0) {
-      lines.push(`TODO (${todo.length}):`);
-      for (const t of todo.slice(0, DISPLAY_LIMITS.COMPACT_LIST_ITEMS)) {
-        const status = t.status === "done" ? "[x]" : t.status === "in_progress" ? "[->]" : "[ ]";
-        lines.push(`  ${status} ${t.content} (${t.priority})`);
-      }
-    }
-    lines.push(`Phase: ${this.getPhase()}`);
-    return lines.join("\n");
+    return StateSerializer.toPrompt(this);
   }
 };
 
@@ -478,7 +446,11 @@ var SharedState = class {
 var AgentEventEmitter = class {
   listeners = /* @__PURE__ */ new Map();
   /**
-   * Subscribe to events
+   * Subscribe to a specific event type with full type safety.
+   *
+   * @remarks
+   * WHY: Generic overload narrows the event type so subscribers get
+   * autocomplete on `event.data.*` without manual casting.
    */
   on(eventType, listener) {
     if (!this.listeners.has(eventType)) {
@@ -612,17 +584,17 @@ var ScopeGuard = class {
     if (target === cidr) return true;
     if (cidr.includes("/")) {
       const [network, mask] = cidr.split("/");
-      if (mask === "24") {
+      if (mask === MASK_PARTS.C24) {
         const networkPrefix = network.split(".").slice(0, 3).join(".");
         const targetPrefix = target.split(".").slice(0, 3).join(".");
         return networkPrefix === targetPrefix;
       }
-      if (mask === "8") {
+      if (mask === MASK_PARTS.C8) {
         const networkPrefix = network.split(".")[0];
         const targetPrefix = target.split(".")[0];
         return networkPrefix === targetPrefix;
       }
-      if (mask === "16") {
+      if (mask === MASK_PARTS.C16) {
         const networkPrefix = network.split(".").slice(0, 2).join(".");
         const targetPrefix = target.split(".").slice(0, 2).join(".");
         return networkPrefix === targetPrefix;
@@ -668,7 +640,7 @@ function getApprovalLevel(toolCall) {
   const input = toolCall.input;
   if (tool === TOOL_NAMES.RUN_CMD) {
     const command = String(input.command || "").toLowerCase();
-    if (["whois", "dig", "curl -i"].some((p) => command.includes(p))) {
+    if (PASSIVE_BINARIES.some((p) => command.includes(p))) {
       return APPROVAL_LEVELS.AUTO;
     }
     if ([CORE_BINARIES.NMAP, CORE_BINARIES.FFUF, CORE_BINARIES.NUCLEI].some((p) => command.includes(p))) {
@@ -677,7 +649,7 @@ function getApprovalLevel(toolCall) {
       }
       return APPROVAL_LEVELS.CONFIRM;
     }
-    if ([CORE_BINARIES.SQLMAP, CORE_BINARIES.METASPLOIT, "impacket"].some((p) => command.includes(p))) {
+    if ([CORE_BINARIES.SQLMAP, CORE_BINARIES.METASPLOIT, ...EXPLOIT_BINARIES].some((p) => command.includes(p))) {
       return APPROVAL_LEVELS.REVIEW;
     }
   }
@@ -705,32 +677,83 @@ var ApprovalGate = class {
 };
 
 // src/engine/tools-base.ts
-import { execFileSync } from "child_process";
+import { spawn } from "child_process";
 import { readFileSync, existsSync, writeFileSync, mkdirSync } from "fs";
 import { join } from "path";
-var DEFAULT_COMMAND_TIMEOUT = 3e4;
+var DEFAULT_COMMAND_TIMEOUT = 3e5;
+var INPUT_PROMPT_PATTERNS = [
+  /\[sudo\] password/i,
+  /Password:/i,
+  /password for/i,
+  /Enter passphrase/i,
+  /Are you sure.*\(yes\/no\)/i,
+  /\(y\/N\)/i,
+  /\(Y\/n\)/i
+];
+var globalInputHandler = null;
+function setInputHandler(handler) {
+  globalInputHandler = handler;
+}
 async function runCommand(command, args = [], options = {}) {
-  try {
-    const parts = command.trim().split(/\s+/);
-    const execPath = parts[0];
-    const execArgs = [...parts.slice(1), ...args];
-    const result = execFileSync(execPath, execArgs, {
-      encoding: "utf-8",
-      stdio: "pipe",
-      timeout: DEFAULT_COMMAND_TIMEOUT,
-      ...options
+  return new Promise((resolve) => {
+    const timeout = options.timeout || DEFAULT_COMMAND_TIMEOUT;
+    const child = spawn("sh", ["-c", command], {
+      timeout,
+      env: { ...process.env, ...options.env },
+      cwd: options.cwd
     });
-    return {
-      success: true,
-      output: result.toString().trim()
-    };
-  } catch (error) {
-    return {
-      success: false,
-      output: "",
-      error: error.message || String(error)
+    let stdout = "";
+    let stderr = "";
+    let inputHandled = false;
+    const checkForInputPrompt = async (data) => {
+      if (inputHandled || !globalInputHandler) return;
+      for (const pattern of INPUT_PROMPT_PATTERNS) {
+        if (pattern.test(data)) {
+          inputHandled = true;
+          const promptText = data.trim();
+          try {
+            const userInput = await globalInputHandler(promptText);
+            if (userInput !== null && child.stdin.writable) {
+              child.stdin.write(userInput + "\n");
+            }
+          } catch {
+          }
+          return;
+        }
+      }
     };
-  }
+    child.stdout.on("data", (data) => {
+      const text = data.toString();
+      stdout += text;
+      checkForInputPrompt(text);
+    });
+    child.stderr.on("data", (data) => {
+      const text = data.toString();
+      stderr += text;
+      checkForInputPrompt(text);
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve({
+          success: true,
+          output: stdout.trim() || stderr.trim()
+        });
+      } else {
+        resolve({
+          success: false,
+          output: stdout.trim(),
+          error: stderr.trim() || `Process exited with code ${code}`
+        });
+      }
+    });
+    child.on("error", (err) => {
+      resolve({
+        success: false,
+        output: "",
+        error: err.message || String(err)
+      });
+    });
+  });
 }
 async function readFileContent(filePath) {
   try {
@@ -774,8 +797,40 @@ async function writeFileContent(filePath, content) {
   }
 }
 
+// src/engine/tools/system.ts
+var systemTools = [
+  {
+    name: TOOL_NAMES.RUN_CMD,
+    description: "Execute shell command safely. Use for reconnaissance, scanning, and exploitation.",
+    parameters: {
+      command: { type: "string", description: "The shell command to execute" }
+    },
+    required: ["command"],
+    execute: async (params) => runCommand(params.command, [])
+  },
+  {
+    name: TOOL_NAMES.READ_FILE,
+    description: "Read local file content (logs, configs, evidence)",
+    parameters: {
+      path: { type: "string", description: "Path to the file" }
+    },
+    required: ["path"],
+    execute: async (params) => readFileContent(params.path)
+  },
+  {
+    name: TOOL_NAMES.WRITE_FILE,
+    description: "Write content to file (creates parent directories if needed)",
+    parameters: {
+      path: { type: "string", description: "Absolute path to the file" },
+      content: { type: "string", description: "File content" }
+    },
+    required: ["path", "content"],
+    execute: async (params) => writeFileContent(params.path, params.content)
+  }
+];
+
 // src/engine/tools-mid.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync } from "child_process";
 async function parseNmap(xmlPath) {
   try {
     const fileResult = await readFileContent(xmlPath);
@@ -843,7 +898,7 @@ async function searchExploitDB(service, version) {
   try {
     const query = version ? `${service} ${version}` : service;
     try {
-      const output = execFileSync2("searchsploit", [query, "--color", "never"], {
+      const output = execFileSync("searchsploit", [query, "--color", "never"], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "pipe"],
         timeout: 1e4
@@ -875,59 +930,93 @@ async function searchExploitDB(service, version) {
     };
   }
 }
-async function webSearch(query, engine = "duckduckgo") {
-  try {
-    let results = [];
-    if (engine === "duckduckgo") {
-      const url = `https://html.duckduckgo.com/html/?q=${encodeURIComponent(query)}`;
-      try {
-        const html = execFileSync2("curl", ["-s", "-L", "-A", "Mozilla/5.0", url], {
-          encoding: "utf-8",
-          stdio: ["ignore", "pipe", "pipe"],
-          timeout: 15e3
-        });
-        const titleRegex = /class="result__a"[^>]*>([^<]+)</g;
-        const matches = html.match(titleRegex) || [];
-        results = matches.map((m) => m.replace(/class="result__a"[^>]*>/, "")).slice(0, 10);
-      } catch (e) {
-        results = [`Web search failed: ${e.message}`];
-      }
-    } else {
-      results = ["Search engine not supported. Use: duckduckgo"];
+
+// src/engine/tools/pentest.ts
+var createPentestTools = (state) => [
+  {
+    name: TOOL_NAMES.PARSE_NMAP,
+    description: "Parse nmap XML output to structured JSON",
+    parameters: { path: { type: "string", description: "Path to nmap XML" } },
+    required: ["path"],
+    execute: async (p) => parseNmap(p.path)
+  },
+  {
+    name: TOOL_NAMES.SEARCH_CVE,
+    description: "Search CVE and Exploit-DB for vulnerabilities",
+    parameters: {
+      service: { type: "string", description: "Service name" },
+      version: { type: "string", description: "Version number" }
+    },
+    required: ["service"],
+    execute: async (p) => searchCVE(p.service, p.version)
+  },
+  {
+    name: TOOL_NAMES.ADD_FINDING,
+    description: "Add a security finding",
+    parameters: {
+      title: { type: "string", description: "Finding title" },
+      severity: { type: "string", description: "Severity" },
+      affected: { type: "array", items: { type: "string" }, description: "Affected host:port" }
+    },
+    required: ["title", "severity"],
+    execute: async (p) => {
+      state.addFinding({
+        id: generateId(ID_RADIX, ID_LENGTH),
+        title: p.title,
+        severity: p.severity,
+        affected: p.affected || [],
+        description: p.description || "",
+        evidence: [],
+        verified: false,
+        remediation: "",
+        foundAt: Date.now()
+      });
+      return { success: true, output: `Added: ${p.title}` };
     }
-    const formatted = results.map((r, i) => `${i + 1}. ${r}`).join("\n");
-    return {
-      success: true,
-      output: formatted || `No results found for: ${query}`
-    };
-  } catch (error) {
-    return {
-      success: false,
-      output: "",
-      error: error.message || String(error)
-    };
+  },
+  {
+    name: TOOL_NAMES.GET_STATE,
+    description: "Get current engagement state summary",
+    parameters: {},
+    execute: async () => ({ success: true, output: state.toPrompt() })
   }
-}
-async function extractURLs(text) {
-  try {
-    const urlRegex = /https?:\/\/[^\s<>"{}|\\^`\[\]]+/g;
-    const urls = text.match(urlRegex) || [];
-    const uniqueURLs = [...new Set(urls)];
-    return {
+];
+
+// src/engine/tools/agents.ts
+var SUB_AGENT_PROMPTS = {
+  [AGENT_ROLES.RECON]: `You are a RECONNAISSANCE specialist. Focus on: OSINT, gathering information, and target discovery.`,
+  [AGENT_ROLES.WEB]: `You are a WEB APPLICATION specialist. Focus on: Endpoints, discovery, and web vulnerabilities.`,
+  [AGENT_ROLES.EXPLOTER]: `You are an EXPLOITATION specialist. Focus on: Exploit research and PoC development.`
+};
+var createAgentTools = (executor) => [
+  {
+    name: TOOL_NAMES.SPAWN_SUB,
+    description: "Spawn a sub-agent with specialized prompt",
+    parameters: {
+      task: { type: "string", description: "Specific task" },
+      agent_type: { type: "string", description: "Agent type (recon, web, exploit)" }
+    },
+    required: ["task"],
+    execute: async (p) => {
+      if (!executor) return { success: false, output: "SubAgentExecutor not available" };
+      const type = p.agent_type || AGENT_ROLES.RECON;
+      const prompt = SUB_AGENT_PROMPTS[type] || SUB_AGENT_PROMPTS[AGENT_ROLES.RECON];
+      const result = await executor.executeSubTask(p.task, prompt);
+      return { success: result.completed, output: result.output };
+    }
+  },
+  {
+    name: TOOL_NAMES.ASK_USER,
+    description: "Ask the user a question and wait for input.",
+    parameters: { question: { type: "string", description: "Question to ask" } },
+    required: ["question"],
+    execute: async (p) => ({
       success: true,
-      output: JSON.stringify({
-        count: uniqueURLs.length,
-        urls: uniqueURLs
-      }, null, 2)
-    };
-  } catch (error) {
-    return {
-      success: false,
-      output: "",
-      error: error.message || String(error)
-    };
+      output: `[ASK_USER] ${p.question}
+(Waiting for user response via TUI input)`
+    })
   }
-}
+];
 
 // src/engine/tools.ts
 var ToolRegistry = class {
@@ -937,348 +1026,175 @@ var ToolRegistry = class {
     this.approvalGate = approvalGate;
     this.events = events;
     this.subAgentExecutor = subAgentExecutor;
-    this.registerLowLevelTools();
-    this.registerMidLevelTools();
-    this.registerHighLevelTools();
+    this.initializeRegistry();
   }
   tools = /* @__PURE__ */ new Map();
-  /**
-   * Get all registered tools
-   */
+  initializeRegistry() {
+    const allTools = [
+      ...systemTools,
+      ...createPentestTools(this.state),
+      ...createAgentTools(this.subAgentExecutor)
+    ];
+    allTools.forEach((t) => this.tools.set(t.name, t));
+  }
   getAll() {
     return Array.from(this.tools.values());
   }
-  /**
-   * Get tool by name
-   */
   getTool(name) {
     return this.tools.get(name);
   }
   /**
-   * Execute tool with full pipeline
+   * Execute tool with integrated safety pipeline (Scope -> Approval -> Execution -> Log)
+   * Implements §8-1 (Safe Execution Pattern).
    */
   async execute(toolCall) {
     const tool = this.getTool(toolCall.name);
-    if (!tool) {
-      return {
-        success: false,
-        output: "",
-        error: `Unknown tool: ${toolCall.name}`
-      };
-    }
-    const scopeResult = this.scopeGuard.check(toolCall);
-    if (!scopeResult.allowed) {
-      return {
-        success: false,
-        output: "",
-        error: scopeResult.reason
-      };
-    }
+    if (!tool) return { success: false, output: "", error: `Unknown tool: ${toolCall.name}` };
+    const scopeCheck = this.scopeGuard.check(toolCall);
+    if (!scopeCheck.allowed) return { success: false, output: "", error: scopeCheck.reason };
     const approval = await this.approvalGate.request(toolCall);
     if (!approval.approved) {
-      this.state.logAction({
-        tool: toolCall.name,
-        command: JSON.stringify(toolCall.input),
-        approval: "denied",
-        noiseLevel: "none",
-        outputSummary: approval.reason || "Denied"
-      });
-      return {
-        success: false,
-        output: "",
-        error: approval.reason || "Execution denied"
-      };
+      this.logDeniedAction(toolCall, approval.reason || "Execution denied");
+      return { success: false, output: "", error: approval.reason || "Denied by policy" };
     }
     const result = await tool.execute(toolCall.input);
+    this.logSuccessfulAction(toolCall, approval, result);
+    return result;
+  }
+  logDeniedAction(toolCall, reason) {
     this.state.logAction({
       tool: toolCall.name,
       command: JSON.stringify(toolCall.input),
-      approval: approval.approved ? "auto" : "user_confirmed",
-      noiseLevel: getNoiseLevel(toolCall),
-      outputSummary: result.output.slice(0, 200)
+      approval: APPROVAL_STATUSES.DENIED,
+      noiseLevel: NOISE_LEVELS.LOW,
+      outputSummary: reason
     });
-    return result;
   }
-  /**
-   * Register low-level tools
-   */
-  registerLowLevelTools() {
-    this.tools.set(TOOL_NAMES.RUN_CMD, {
-      name: TOOL_NAMES.RUN_CMD,
-      description: "Execute shell command safely. Use for reconnaissance, scanning, and exploitation.",
-      parameters: {
-        command: { type: "string", description: 'The shell command to execute (e.g., "nmap -sV 10.0.0.1")' }
-      },
-      required: ["command"],
-      execute: async (params) => {
-        const command = params.command;
-        return await runCommand(command, []);
-      }
-    });
-    this.tools.set(TOOL_NAMES.READ_FILE, {
-      name: TOOL_NAMES.READ_FILE,
-      description: "Read local file content (logs, configs, evidence)",
-      parameters: {
-        path: { type: "string", description: "Path to the file" }
-      },
-      required: ["path"],
-      execute: async (params) => {
-        const filePath = params.path;
-        return await readFileContent(filePath);
-      }
-    });
-    this.tools.set(TOOL_NAMES.WRITE_FILE, {
-      name: TOOL_NAMES.WRITE_FILE,
-      description: "Write content to file (creates parent directories if needed)",
-      parameters: {
-        path: { type: "string", description: "Absolute path to the file" },
-        content: { type: "string", description: "File content" }
-      },
-      required: ["path", "content"],
-      execute: async (params) => {
-        const filePath = params.path;
-        const content = params.content;
-        return await writeFileContent(filePath, content);
-      }
+  logSuccessfulAction(toolCall, approval, result) {
+    this.state.logAction({
+      tool: toolCall.name,
+      command: JSON.stringify(toolCall.input),
+      approval: approval.approved ? APPROVAL_STATUSES.AUTO : APPROVAL_STATUSES.USER_CONFIRMED,
+      noiseLevel: this.getNoiseLevel(toolCall),
+      outputSummary: result.output.slice(0, 200)
     });
   }
-  /**
-   * Register mid-level tools
-   */
-  registerMidLevelTools() {
-    this.tools.set(TOOL_NAMES.PARSE_NMAP, {
-      name: TOOL_NAMES.PARSE_NMAP,
-      description: "Parse nmap XML output to structured JSON",
-      parameters: {
-        path: { type: "string", description: "Path to nmap XML output file" }
-      },
-      required: ["path"],
-      execute: async (params) => {
-        const xmlPath = params.path;
-        return await parseNmap(xmlPath);
-      }
-    });
-    this.tools.set(TOOL_NAMES.SEARCH_CVE, {
-      name: TOOL_NAMES.SEARCH_CVE,
-      description: "Search CVE and Exploit-DB for vulnerabilities",
-      parameters: {
-        service: { type: "string", description: 'Service name (e.g., "apache", "ssh")' },
-        version: { type: "string", description: "Version number (optional)" }
-      },
-      required: ["service"],
-      execute: async (params) => {
-        const service = params.service;
-        const version = params.version;
-        return await searchCVE(service, version);
-      }
-    });
-    this.tools.set(TOOL_NAMES.WEB_SEARCH, {
-      name: TOOL_NAMES.WEB_SEARCH,
-      description: "Search web for reconnaissance info",
-      parameters: {
-        query: { type: "string", description: "Search query" }
-      },
-      required: ["query"],
-      execute: async (params) => {
-        const query = params.query;
-        const engine = params.engine || "duckduckgo";
-        return await webSearch(query, engine);
-      }
-    });
-    this.tools.set(TOOL_NAMES.EXTRACT_URLS, {
-      name: TOOL_NAMES.EXTRACT_URLS,
-      description: "Extract and deduplicate URLs from text",
-      parameters: {
-        text: { type: "string", description: "Input text containing URLs" }
-      },
-      required: ["text"],
-      execute: async (params) => {
-        const text = params.text;
-        return await extractURLs(text);
-      }
-    });
+  getNoiseLevel(toolCall) {
+    if (toolCall.name !== TOOL_NAMES.RUN_CMD) return NOISE_LEVELS.LOW;
+    const cmd = String(toolCall.input.command || "").toLowerCase();
+    const highNoise = [CORE_BINARIES.NMAP, CORE_BINARIES.MASSCAN, CORE_BINARIES.NUCLEI, CORE_BINARIES.NIKTO];
+    if (highNoise.some((b) => cmd.includes(b))) return NOISE_LEVELS.HIGH;
+    const medNoise = [CORE_BINARIES.FFUF, CORE_BINARIES.GOBUSTER];
+    if (medNoise.some((b) => cmd.includes(b))) return NOISE_LEVELS.MEDIUM;
+    return NOISE_LEVELS.LOW;
   }
-  /**
-   * Register high-level tools
-   */
-  registerHighLevelTools() {
-    this.tools.set(TOOL_NAMES.SPAWN_SUB, {
-      name: TOOL_NAMES.SPAWN_SUB,
-      description: "Spawn a sub-agent with specialized prompt",
-      parameters: {
-        task: { type: "string", description: "Specific task for sub-agent" },
-        agent_type: { type: "string", description: "Sub-agent type (recon, web, exploit)" }
-      },
-      required: ["task"],
-      execute: async (params) => {
-        const task = params.task;
-        const agentType = params.agent_type || AGENT_ROLES.RECON;
-        if (!this.subAgentExecutor) {
-          return { success: false, output: "SubAgentExecutor not initialized in registry" };
-        }
-        const systemPrompt = this.getSpecializedPrompt(agentType, task);
-        const result = await this.subAgentExecutor.executeSubTask(task, systemPrompt);
-        return {
-          success: result.completed,
-          output: result.output
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.ADD_FINDING, {
-      name: TOOL_NAMES.ADD_FINDING,
-      description: "Add a security finding",
-      parameters: {
-        title: { type: "string", description: "Finding title" },
-        severity: { type: "string", description: "Severity (info, low, medium, high, critical)" },
-        affected: { type: "array", items: { type: "string" }, description: "Affected host:port" },
-        description: { type: "string", description: "Finding detail" }
-      },
-      required: ["title", "severity"],
-      execute: async (params) => {
-        this.state.addFinding({
-          id: Math.random().toString(ID_RADIX).substring(ID_LENGTH),
-          title: params.title,
-          severity: params.severity,
-          affected: params.affected || [],
-          description: params.description || "",
-          evidence: [],
-          verified: false,
-          remediation: "",
-          foundAt: Date.now()
-        });
-        return {
-          success: true,
-          output: `Finding added: ${params.title}`
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.UPDATE_TODO, {
-      name: TOOL_NAMES.UPDATE_TODO,
-      description: "Update plan / TODO list",
-      parameters: {
-        action: { type: "string", description: "add, complete" },
-        content: { type: "string", description: "Task content" }
-      },
-      required: ["action"],
-      execute: async (params) => {
-        if (params.action === TODO_ACTIONS.ADD) {
-          this.state.addTodo(params.content, params.priority);
-        } else if (params.action === TODO_ACTIONS.COMPLETE) {
-          this.state.completeTodo(params.id);
-        }
-        return {
-          success: true,
-          output: "TODO updated"
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.GET_STATE, {
-      name: TOOL_NAMES.GET_STATE,
-      description: "Get current engagement state summary",
-      parameters: {},
-      execute: async (params) => {
-        return {
-          success: true,
-          output: this.state.toPrompt()
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.SET_SCOPE, {
-      name: TOOL_NAMES.SET_SCOPE,
-      description: "Set engagement scope",
-      parameters: {
-        allowed: { type: "array", items: { type: "string" }, description: "Allowed CIDRs or domains" },
-        exclusions: { type: "array", items: { type: "string" }, description: "Excluded targets" }
-      },
-      required: ["allowed"],
-      execute: async (params) => {
-        const allowed = params.allowed || [];
-        const exclusions = params.exclusions || [];
-        this.state.setScope({
-          allowedCidrs: allowed.filter((a) => a.includes("/")),
-          allowedDomains: allowed.filter((a) => !a.includes("/")),
-          exclusions,
-          noDOS: true,
-          noSocial: true
-        });
-        return {
-          success: true,
-          output: `Scope set: ${allowed.length} targets`
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.ADD_TARGET, {
-      name: TOOL_NAMES.ADD_TARGET,
-      description: "Add target to engagement",
-      parameters: {
-        ip: { type: "string", description: "IP address" },
-        hostname: { type: "string", description: "Hostname (optional)" }
-      },
-      required: ["ip"],
-      execute: async (params) => {
-        const ip = params.ip;
-        const hostname = params.hostname;
-        this.state.addTarget({
-          ip,
-          hostname,
-          ports: [],
-          tags: [],
-          firstSeen: Date.now()
-        });
-        return {
-          success: true,
-          output: `Target added: ${ip}`
-        };
-      }
-    });
-    this.tools.set(TOOL_NAMES.ASK_USER, {
-      name: TOOL_NAMES.ASK_USER,
-      description: "Ask the user a question and wait for input. Use when you need clarification, authorization, or additional information.",
-      parameters: {
-        question: { type: "string", description: "Question to ask" }
-      },
-      required: ["question"],
-      execute: async (params) => {
-        const question = params.question;
-        return {
-          success: true,
-          output: `[ASK_USER] ${question}
-(Waiting for user response via TUI input)`
-        };
-      }
-    });
+};
+
+// src/shared/constants/services.ts
+var PORT_CATEGORY_MAP = {
+  80: SERVICE_CATEGORIES.WEB,
+  443: SERVICE_CATEGORIES.WEB,
+  8080: SERVICE_CATEGORIES.WEB,
+  1433: SERVICE_CATEGORIES.DATABASE,
+  3306: SERVICE_CATEGORIES.DATABASE,
+  5432: SERVICE_CATEGORIES.DATABASE,
+  88: SERVICE_CATEGORIES.AD,
+  389: SERVICE_CATEGORIES.AD,
+  445: SERVICE_CATEGORIES.AD,
+  22: SERVICE_CATEGORIES.REMOTE_ACCESS,
+  3389: SERVICE_CATEGORIES.REMOTE_ACCESS,
+  21: SERVICE_CATEGORIES.FILE_SHARING,
+  2049: SERVICE_CATEGORIES.FILE_SHARING,
+  2375: SERVICE_CATEGORIES.CONTAINER,
+  5e3: SERVICE_CATEGORIES.CONTAINER,
+  502: SERVICE_CATEGORIES.ICS,
+  102: SERVICE_CATEGORIES.ICS
+};
+var SERVICE_CATEGORY_MAP = {
+  [SERVICES.HTTP]: SERVICE_CATEGORIES.WEB,
+  [SERVICES.HTTPS]: SERVICE_CATEGORIES.WEB,
+  [SERVICES.MYSQL]: SERVICE_CATEGORIES.DATABASE,
+  [SERVICES.MSSQL]: SERVICE_CATEGORIES.DATABASE,
+  [SERVICES.SSH]: SERVICE_CATEGORIES.REMOTE_ACCESS,
+  [SERVICES.FTP]: SERVICE_CATEGORIES.FILE_SHARING,
+  "kerberos": SERVICE_CATEGORIES.AD,
+  "ldap": SERVICE_CATEGORIES.AD,
+  "docker": SERVICE_CATEGORIES.CONTAINER,
+  "modbus": SERVICE_CATEGORIES.ICS
+};
+var CATEGORY_APPROVAL2 = {
+  [SERVICE_CATEGORIES.NETWORK]: APPROVAL_LEVELS.CONFIRM,
+  [SERVICE_CATEGORIES.WEB]: APPROVAL_LEVELS.CONFIRM,
+  [SERVICE_CATEGORIES.DATABASE]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.AD]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.EMAIL]: APPROVAL_LEVELS.CONFIRM,
+  [SERVICE_CATEGORIES.REMOTE_ACCESS]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.FILE_SHARING]: APPROVAL_LEVELS.CONFIRM,
+  [SERVICE_CATEGORIES.CLOUD]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.CONTAINER]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.API]: APPROVAL_LEVELS.CONFIRM,
+  [SERVICE_CATEGORIES.WIRELESS]: APPROVAL_LEVELS.REVIEW,
+  [SERVICE_CATEGORIES.ICS]: APPROVAL_LEVELS.BLOCK
+};
+var CLOUD_KEYWORDS = [
+  "amazonaws.com",
+  "aws",
+  " azure.com",
+  "googleusercontent.com",
+  "digitalocean.com",
+  "heroku",
+  "vercel"
+];
+var PASSIVE_CATEGORIES = [
+  SERVICE_CATEGORIES.NETWORK
+];
+var ACTIVE_CATEGORIES = [
+  SERVICE_CATEGORIES.WEB,
+  SERVICE_CATEGORIES.API,
+  SERVICE_CATEGORIES.EMAIL,
+  SERVICE_CATEGORIES.FILE_SHARING
+];
+var DANGER_LEVEL_MAP = {
+  [SERVICE_CATEGORIES.NETWORK]: DANGER_LEVELS.PASSIVE,
+  [SERVICE_CATEGORIES.WEB]: DANGER_LEVELS.ACTIVE,
+  [SERVICE_CATEGORIES.API]: DANGER_LEVELS.ACTIVE,
+  [SERVICE_CATEGORIES.EMAIL]: DANGER_LEVELS.ACTIVE,
+  [SERVICE_CATEGORIES.REMOTE_ACCESS]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.FILE_SHARING]: DANGER_LEVELS.ACTIVE,
+  [SERVICE_CATEGORIES.DATABASE]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.AD]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.CLOUD]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.CONTAINER]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.WIRELESS]: DANGER_LEVELS.EXPLOIT,
+  [SERVICE_CATEGORIES.ICS]: DANGER_LEVELS.EXPLOIT
+};
+
+// src/engine/utils/service-parser.ts
+var ServiceParser = class {
+  /** Detect category from port and service name */
+  static detectCategory(port, serviceName) {
+    if (PORT_CATEGORY_MAP[port]) return PORT_CATEGORY_MAP[port];
+    if (serviceName && SERVICE_CATEGORY_MAP[serviceName.toLowerCase()]) {
+      return SERVICE_CATEGORY_MAP[serviceName.toLowerCase()];
+    }
+    if (port >= 8e3 && port <= 9e3) return SERVICE_CATEGORIES.WEB;
+    if (port >= 3e3 && port <= 3500) return SERVICE_CATEGORIES.API;
+    return null;
   }
-  /**
-   * Get specialized prompt for sub-agent type
-   * Opus4.7: Agents are prompts, not code
-   */
-  getSpecializedPrompt(agentType, task) {
-    const prompts = {
-      [AGENT_ROLES.RECON]: `You are a RECONNAISSANCE specialist.
-Your task: ${task}
-Focus on: Information gathering, OSINT, passive reconnaissance, target discovery
-Return: Structured target and port information for the main agent.`,
-      [AGENT_ROLES.WEB]: `You are a WEB APPLICATION specialist.
-Your task: ${task}
-Focus on: Web app discovery, enumeration, vulnerability scanning
-Return: Web application structure, endpoints, vulnerabilities found.`,
-      [AGENT_ROLES.EXPLOTER]: `You are an EXPLOITATION specialist.
-Your task: ${task}
-Focus on: Exploit research, proof-of-concept testing
-Return: Exploit results, shell access, credentials obtained.`
-    };
-    return prompts[agentType] || prompts[AGENT_ROLES.RECON];
+  /** Parse category from banner string */
+  static fromBanner(banner) {
+    const b = banner.toLowerCase();
+    if (CLOUD_KEYWORDS.some((k) => b.includes(k))) return SERVICE_CATEGORIES.CLOUD;
+    if (["nginx", "apache", "iis"].some((k) => b.includes(k))) return SERVICE_CATEGORIES.WEB;
+    if (["docker", "kubernetes", "kube"].some((k) => b.includes(k))) return SERVICE_CATEGORIES.CONTAINER;
+    return null;
   }
-};
-function getNoiseLevel(toolCall) {
-  if (toolCall.name === TOOL_NAMES.RUN_CMD) {
-    const command = String(toolCall.input.command || "").toLowerCase();
-    if (command.includes(CORE_BINARIES.NMAP) || command.includes(CORE_BINARIES.MASSCAN)) return NOISE_LEVELS.HIGH;
-    if (command.includes(CORE_BINARIES.NUCLEI) || command.includes(CORE_BINARIES.NIKTO)) return NOISE_LEVELS.HIGH;
-    if (command.includes(CORE_BINARIES.FFUF) || command.includes(CORE_BINARIES.GOBUSTER)) return NOISE_LEVELS.MEDIUM;
+  /** Check if hostname implies cloud infrastructure */
+  static isCloudHostname(hostname) {
+    const h = hostname.toLowerCase();
+    return CLOUD_KEYWORDS.some((k) => h.includes(k));
   }
-  return NOISE_LEVELS.LOW;
-}
+};
 
 // src/domains/registry.ts
 import { join as join2, dirname } from "path";
@@ -1360,181 +1276,12 @@ var DOMAINS = {
 };
 
 // src/engine/tools-registry.ts
-var PORT_CATEGORY_MAP = {
-  // Web
-  80: SERVICE_CATEGORIES.WEB,
-  443: SERVICE_CATEGORIES.WEB,
-  8080: SERVICE_CATEGORIES.WEB,
-  8443: SERVICE_CATEGORIES.WEB,
-  8e3: SERVICE_CATEGORIES.WEB,
-  8888: SERVICE_CATEGORIES.WEB,
-  // Database
-  1433: SERVICE_CATEGORIES.DATABASE,
-  // MSSQL
-  3306: SERVICE_CATEGORIES.DATABASE,
-  // MySQL
-  5432: SERVICE_CATEGORIES.DATABASE,
-  // PostgreSQL
-  27017: SERVICE_CATEGORIES.DATABASE,
-  // MongoDB
-  6379: SERVICE_CATEGORIES.DATABASE,
-  // Redis
-  9042: SERVICE_CATEGORIES.DATABASE,
-  // Cassandra
-  9200: SERVICE_CATEGORIES.DATABASE,
-  // Elasticsearch
-  // Active Directory
-  88: SERVICE_CATEGORIES.AD,
-  // Kerberos
-  389: SERVICE_CATEGORIES.AD,
-  // LDAP
-  636: SERVICE_CATEGORIES.AD,
-  // LDAPS
-  3268: SERVICE_CATEGORIES.AD,
-  // LDAP GC
-  3269: SERVICE_CATEGORIES.AD,
-  // LDAP GC SSL
-  445: SERVICE_CATEGORIES.AD,
-  // SMB (also file_sharing)
-  // Email
-  25: SERVICE_CATEGORIES.EMAIL,
-  // SMTP
-  587: SERVICE_CATEGORIES.EMAIL,
-  // SMTP Submission
-  465: SERVICE_CATEGORIES.EMAIL,
-  // SMTPS
-  110: SERVICE_CATEGORIES.EMAIL,
-  // POP3
-  143: SERVICE_CATEGORIES.EMAIL,
-  // IMAP
-  993: SERVICE_CATEGORIES.EMAIL,
-  // IMAPS
-  995: SERVICE_CATEGORIES.EMAIL,
-  // POP3S
-  // Remote Access
-  22: SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // SSH
-  3389: SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // RDP
-  5900: SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // VNC
-  5901: SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // VNC
-  // File Sharing
-  21: SERVICE_CATEGORIES.FILE_SHARING,
-  // FTP
-  139: SERVICE_CATEGORIES.FILE_SHARING,
-  // NetBIOS
-  2049: SERVICE_CATEGORIES.FILE_SHARING,
-  // NFS
-  111: SERVICE_CATEGORIES.FILE_SHARING,
-  // RPC
-  // Container
-  2375: SERVICE_CATEGORIES.CONTAINER,
-  // Docker API
-  2376: SERVICE_CATEGORIES.CONTAINER,
-  // Docker API TLS
-  5e3: SERVICE_CATEGORIES.CONTAINER,
-  // Docker Registry
-  // Cloud (detected via banner, common on 443)
-  // API
-  3e3: SERVICE_CATEGORIES.API,
-  5001: SERVICE_CATEGORIES.API,
-  8001: SERVICE_CATEGORIES.API,
-  // Wireless
-  // ICS
-  502: SERVICE_CATEGORIES.ICS,
-  // Modbus
-  102: SERVICE_CATEGORIES.ICS,
-  // ISO-TSAP
-  2e4: SERVICE_CATEGORIES.ICS,
-  // DNP3
-  44818: SERVICE_CATEGORIES.ICS
-  // Ethernet/IP
-};
-var SERVICE_CATEGORY_MAP = {
-  // Web
-  [SERVICES.HTTP]: SERVICE_CATEGORIES.WEB,
-  [SERVICES.HTTPS]: SERVICE_CATEGORIES.WEB,
-  "http-proxy": SERVICE_CATEGORIES.WEB,
-  "ssl/http": SERVICE_CATEGORIES.WEB,
-  "nginx": SERVICE_CATEGORIES.WEB,
-  "apache": SERVICE_CATEGORIES.WEB,
-  "iis": SERVICE_CATEGORIES.WEB,
-  // Database
-  [SERVICES.MYSQL]: SERVICE_CATEGORIES.DATABASE,
-  [SERVICES.MSSQL]: SERVICE_CATEGORIES.DATABASE,
-  [SERVICES.POSTGRES]: SERVICE_CATEGORIES.DATABASE,
-  [SERVICES.MONGODB]: SERVICE_CATEGORIES.DATABASE,
-  [SERVICES.REDIS]: SERVICE_CATEGORIES.DATABASE,
-  [SERVICES.ELASTIC]: SERVICE_CATEGORIES.DATABASE,
-  "cassandra": SERVICE_CATEGORIES.DATABASE,
-  // Active Directory
-  "kerberos": SERVICE_CATEGORIES.AD,
-  "ldap": SERVICE_CATEGORIES.AD,
-  "ldaps": SERVICE_CATEGORIES.AD,
-  "microsoft-ds": SERVICE_CATEGORIES.AD,
-  "netbios-ssn": SERVICE_CATEGORIES.AD,
-  // Email
-  "smtp": SERVICE_CATEGORIES.EMAIL,
-  "pop3": SERVICE_CATEGORIES.EMAIL,
-  "imap": SERVICE_CATEGORIES.EMAIL,
-  // Remote Access
-  [SERVICES.SSH]: SERVICE_CATEGORIES.REMOTE_ACCESS,
-  "ms-wbt-server": SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // RDP
-  "vnc": SERVICE_CATEGORIES.REMOTE_ACCESS,
-  // File Sharing
-  [SERVICES.FTP]: SERVICE_CATEGORIES.FILE_SHARING,
-  "ftp-data": SERVICE_CATEGORIES.FILE_SHARING,
-  "nfs": SERVICE_CATEGORIES.FILE_SHARING,
-  "rpcbind": SERVICE_CATEGORIES.FILE_SHARING,
-  // Container
-  "docker": SERVICE_CATEGORIES.CONTAINER,
-  "docker-swap": SERVICE_CATEGORIES.CONTAINER,
-  // Cloud APIs
-  "aws-s3": SERVICE_CATEGORIES.CLOUD,
-  "azure-storage": SERVICE_CATEGORIES.CLOUD,
-  // Wireless
-  // ICS
-  "modbus": SERVICE_CATEGORIES.ICS,
-  "iso-tsap": SERVICE_CATEGORIES.ICS,
-  "dnp3": SERVICE_CATEGORIES.ICS,
-  "enip": SERVICE_CATEGORIES.ICS
-};
-var CATEGORY_APPROVAL2 = {
-  [SERVICE_CATEGORIES.NETWORK]: APPROVAL_LEVELS.CONFIRM,
-  [SERVICE_CATEGORIES.WEB]: APPROVAL_LEVELS.CONFIRM,
-  [SERVICE_CATEGORIES.DATABASE]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.AD]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.EMAIL]: APPROVAL_LEVELS.CONFIRM,
-  [SERVICE_CATEGORIES.REMOTE_ACCESS]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.FILE_SHARING]: APPROVAL_LEVELS.CONFIRM,
-  [SERVICE_CATEGORIES.CLOUD]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.CONTAINER]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.API]: APPROVAL_LEVELS.CONFIRM,
-  [SERVICE_CATEGORIES.WIRELESS]: APPROVAL_LEVELS.REVIEW,
-  [SERVICE_CATEGORIES.ICS]: APPROVAL_LEVELS.BLOCK
-  // Requires explicit written authorization
-};
-var CATEGORY_DESCRIPTIONS = Object.entries(DOMAINS).reduce((acc, [id, info]) => {
-  acc[id] = info.description;
-  return acc;
-}, {});
 var CategorizedToolRegistry = class extends ToolRegistry {
-  categories;
-  constructor(state, scopeGuard, approvalGate, events, subAgentExecutor) {
-    super(state, scopeGuard, approvalGate, events, subAgentExecutor);
-    this.categories = /* @__PURE__ */ new Map();
+  categories = /* @__PURE__ */ new Map();
+  constructor(state, scopeGuard, approvalGate, events, executor) {
+    super(state, scopeGuard, approvalGate, events, executor);
     this.initializeCategories();
   }
-  /**
-   * Initialize all tool categories with core tools from parent ToolRegistry
-   *
-   * Every service category gets the base tools (run_cmd, read_file, write_file, etc.)
-   * Sub-agents need at least these core tools to function.
-   * spawn_sub is explicitly excluded to prevent recursion (1-level only).
-   */
   initializeCategories() {
     const coreToolNames = [
       TOOL_NAMES.RUN_CMD,
@@ -1543,244 +1290,81 @@ var CategorizedToolRegistry = class extends ToolRegistry {
       TOOL_NAMES.PARSE_NMAP,
       TOOL_NAMES.SEARCH_CVE,
       TOOL_NAMES.WEB_SEARCH,
-      TOOL_NAMES.EXTRACT_URLS,
       TOOL_NAMES.ADD_FINDING,
       TOOL_NAMES.UPDATE_TODO,
       TOOL_NAMES.GET_STATE,
       TOOL_NAMES.ADD_TARGET,
       TOOL_NAMES.ASK_USER
     ];
-    const coreTools = [];
-    for (const name of coreToolNames) {
-      const tool = this.getTool(name);
-      if (tool) {
-        coreTools.push(tool);
-      }
-    }
-    for (const category of Object.keys(CATEGORY_DESCRIPTIONS)) {
-      this.categories.set(category, {
-        name: category,
-        description: CATEGORY_DESCRIPTIONS[category],
+    const coreTools = coreToolNames.map((name) => this.getTool(name)).filter((t) => !!t);
+    Object.keys(DOMAINS).forEach((id) => {
+      const cat = id;
+      this.categories.set(cat, {
+        name: cat,
+        description: DOMAINS[cat]?.description || "",
         tools: [...coreTools],
-        // Each category gets a copy of core tools
-        subAgentPrompt: "",
-        // Loaded from Domain Registry or prompt files at runtime
-        dangerLevel: this.getDangerLevel(category),
-        defaultApproval: CATEGORY_APPROVAL2[category],
-        commonPorts: this.getCommonPorts(category),
-        commonServices: this.getCommonServices(category)
+        dangerLevel: this.calculateDanger(cat),
+        defaultApproval: CATEGORY_APPROVAL2[cat] || "confirm"
       });
-    }
-  }
-  /**
-   * Get danger level for category
-   */
-  getDangerLevel(category) {
-    const passive = [SERVICE_CATEGORIES.NETWORK];
-    const active = [SERVICE_CATEGORIES.WEB, SERVICE_CATEGORIES.API, SERVICE_CATEGORIES.EMAIL, SERVICE_CATEGORIES.FILE_SHARING];
-    if (passive.includes(category)) return DANGER_LEVELS.PASSIVE;
-    if (active.includes(category)) return DANGER_LEVELS.ACTIVE;
-    return DANGER_LEVELS.EXPLOIT;
-  }
-  /**
-   * Get common ports for category
-   */
-  getCommonPorts(category) {
-    const ports = {
-      [SERVICE_CATEGORIES.NETWORK]: [1, 7, 9, 21, 22, 23, 25, 53, 79, 80, 110, 111, 135, 139, 143, 443, 445, 993, 995, 1723, 3306, 3389, 5432, 5900, 8080],
-      [SERVICE_CATEGORIES.WEB]: [80, 443, 8e3, 8080, 8443, 8888],
-      [SERVICE_CATEGORIES.DATABASE]: [1433, 3306, 5432, 6379, 9042, 9200, 27017, 1521],
-      [SERVICE_CATEGORIES.AD]: [88, 135, 139, 389, 445, 636, 3268, 3269, 5722],
-      [SERVICE_CATEGORIES.EMAIL]: [25, 110, 143, 465, 587, 993, 995],
-      [SERVICE_CATEGORIES.REMOTE_ACCESS]: [22, 23, 3389, 5900, 5901],
-      [SERVICE_CATEGORIES.FILE_SHARING]: [21, 139, 445, 2049, 111],
-      [SERVICE_CATEGORIES.CLOUD]: [443],
-      // Detected via banner
-      [SERVICE_CATEGORIES.CONTAINER]: [2375, 2376, 5e3],
-      [SERVICE_CATEGORIES.API]: [3e3, 5e3, 5001, 8e3, 8001, 8080],
-      [SERVICE_CATEGORIES.WIRELESS]: [],
-      [SERVICE_CATEGORIES.ICS]: [102, 502, 44818, 2e4]
-    };
-    return ports[category] || [];
-  }
-  /**
-   * Get common services for category
-   */
-  getCommonServices(category) {
-    const services = {
-      [SERVICE_CATEGORIES.NETWORK]: [SERVICES.FTP, SERVICES.SSH, "telnet", "smtp", SERVICES.HTTP, "pop3", "imap", SERVICES.HTTPS],
-      [SERVICE_CATEGORIES.WEB]: [SERVICES.HTTP, SERVICES.HTTPS, "nginx", "apache", "iis"],
-      [SERVICE_CATEGORIES.DATABASE]: [SERVICES.MYSQL, SERVICES.MSSQL, SERVICES.POSTGRES, SERVICES.MONGODB, SERVICES.REDIS, SERVICES.ELASTIC],
-      [SERVICE_CATEGORIES.AD]: ["kerberos", "ldap", "microsoft-ds", "netbios-ssn"],
-      [SERVICE_CATEGORIES.EMAIL]: ["smtp", "pop3", "imap"],
-      [SERVICE_CATEGORIES.REMOTE_ACCESS]: [SERVICES.SSH, "ms-wbt-server", "vnc"],
-      [SERVICE_CATEGORIES.FILE_SHARING]: [SERVICES.FTP, "microsoft-ds", "nfs"],
-      [SERVICE_CATEGORIES.CLOUD]: [SERVICES.HTTP, SERVICES.HTTPS],
-      // Detected via banner analysis
-      [SERVICE_CATEGORIES.CONTAINER]: ["docker"],
-      [SERVICE_CATEGORIES.API]: [SERVICES.HTTP, SERVICES.HTTPS],
-      [SERVICE_CATEGORIES.WIRELESS]: [],
-      [SERVICE_CATEGORIES.ICS]: ["modbus", "iso-tsap", "dnp3", "enip"]
-    };
-    return services[category] || [];
-  }
-  /**
-   * Get all tools in a category
-   */
-  getByCategory(category) {
-    return this.categories.get(category)?.tools || [];
-  }
-  /**
-   * Get category definition
-   */
-  getCategory(category) {
-    return this.categories.get(category);
+    });
   }
-  /**
-   * Get all categories
-   */
-  getAllCategories() {
-    return Array.from(this.categories.values());
+  calculateDanger(cat) {
+    return DANGER_LEVEL_MAP[cat] || DANGER_LEVELS.EXPLOIT;
   }
   /**
-   * Suggest tools based on discovered target
+   * Suggest tools based on target services
    */
   suggestTools(target) {
-    const suggestions = [];
-    for (const port of target.ports) {
-      const category = this.detectCategoryFromPort(port.port, port.service);
-      if (category && !suggestions.find((s) => s.category === category)) {
-        const catTools = this.getByCategory(category);
-        suggestions.push({
-          category,
-          tools: catTools.map((t) => t.name)
-        });
-      }
-    }
-    if (target.hostname) {
-      const cloudCat = this.detectCloudProvider(target.hostname);
-      if (cloudCat && !suggestions.find((s) => s.category === cloudCat)) {
-        const catTools = this.getByCategory(cloudCat);
-        suggestions.push({
-          category: cloudCat,
-          tools: catTools.map((t) => t.name)
-        });
-      }
-    }
-    return suggestions;
-  }
-  /**
-   * Detect category from port number and service name
-   */
-  detectCategoryFromPort(port, serviceName) {
-    if (PORT_CATEGORY_MAP[port]) {
-      return PORT_CATEGORY_MAP[port];
-    }
-    if (serviceName && SERVICE_CATEGORY_MAP[serviceName.toLowerCase()]) {
-      return SERVICE_CATEGORY_MAP[serviceName.toLowerCase()];
-    }
-    if (port >= 8e3 && port <= 9e3) return SERVICE_CATEGORIES.WEB;
-    if (port >= 3e3 && port <= 3500) return SERVICE_CATEGORIES.API;
-    return null;
-  }
-  /**
-   * Detect cloud provider from hostname
-   */
-  detectCloudProvider(hostname) {
-    const cloudProviders = [
-      "amazonaws.com",
-      "aws",
-      "s3.amazonaws.com",
-      "azure.com",
-      "azurewebsites.net",
-      "windows.net",
-      "gcp",
-      "googleusercontent.com",
-      "appspot.com",
-      "digitalocean.com",
-      "do.co",
-      "herokuapp.com",
-      "vercel.app",
-      "netlify.app"
-    ];
-    const lowerHostname = hostname.toLowerCase();
-    for (const provider of cloudProviders) {
-      if (lowerHostname.includes(provider)) {
-        return SERVICE_CATEGORIES.CLOUD;
+    const results = [];
+    const seen = /* @__PURE__ */ new Set();
+    target.ports.forEach((p) => {
+      const cat = ServiceParser.detectCategory(p.port, p.service);
+      if (cat && !seen.has(cat)) {
+        seen.add(cat);
+        results.push({ category: cat, tools: this.getByCategory(cat).map((t) => t.name) });
       }
+    });
+    if (target.hostname && ServiceParser.isCloudHostname(target.hostname) && !seen.has(SERVICE_CATEGORIES.CLOUD)) {
+      results.push({ category: SERVICE_CATEGORIES.CLOUD, tools: this.getByCategory(SERVICE_CATEGORIES.CLOUD).map((t) => t.name) });
     }
-    return null;
+    return results;
   }
-  /**
-   * Suggest sub-agent type for target
-   */
   suggestSubAgent(target) {
     const suggestions = this.suggestTools(target);
     const priority = [
       SERVICE_CATEGORIES.ICS,
-      // Critical - block
       SERVICE_CATEGORIES.AD,
-      // High value - review
       SERVICE_CATEGORIES.DATABASE,
-      // High value - review
       SERVICE_CATEGORIES.CLOUD,
-      // High value - review
       SERVICE_CATEGORIES.CONTAINER,
-      // Escalation - review
-      SERVICE_CATEGORIES.REMOTE_ACCESS,
-      // Access - review
       SERVICE_CATEGORIES.WEB,
-      // Common - confirm
-      SERVICE_CATEGORIES.API,
-      // Common - confirm
-      SERVICE_CATEGORIES.EMAIL,
-      // Info - confirm
-      SERVICE_CATEGORIES.FILE_SHARING,
-      // Access - confirm
-      SERVICE_CATEGORIES.NETWORK,
-      // Basic - confirm
-      SERVICE_CATEGORIES.WIRELESS
-      // Special - review
+      SERVICE_CATEGORIES.NETWORK
     ];
     for (const cat of priority) {
-      if (suggestions.find((s) => s.category === cat)) {
-        return cat;
-      }
+      if (suggestions.some((s) => s.category === cat)) return cat;
     }
-    return PHASES.RECON;
+    return AGENT_ROLES.RECON;
   }
-  /**
-   * Get approval level for category
-   */
-  getApprovalForCategory(category) {
-    return CATEGORY_APPROVAL2[category];
-  }
-  /**
-   * Check if category requires special handling
-   */
-  isHighRiskCategory(category) {
-    return [SERVICE_CATEGORIES.ICS, SERVICE_CATEGORIES.AD, SERVICE_CATEGORIES.DATABASE, SERVICE_CATEGORIES.CLOUD, SERVICE_CATEGORIES.CONTAINER].includes(category);
-  }
-  /**
-   * Get service fingerprint from port data
-   */
   fingerprintService(port) {
-    const category = this.detectCategoryFromPort(port.port, port.service);
+    const category = ServiceParser.detectCategory(port.port, port.service);
     if (!category) return null;
     return {
       port: port.port,
       service: port.service,
       version: port.version,
-      banner: port.notes[0] || void 0,
+      banner: port.notes[0],
       category,
       confidence: port.version ? 0.9 : 0.7
     };
   }
-  /**
-   * Get category description
-   */
-  getCategoryDescription(category) {
-    return CATEGORY_DESCRIPTIONS[category];
+  getByCategory(cat) {
+    return this.categories.get(cat)?.tools || [];
+  }
+  getAllCategories() {
+    return Array.from(this.categories.values());
+  }
+  getApprovalForCategory(cat) {
+    return CATEGORY_APPROVAL2[cat] || "confirm";
   }
 };
 
@@ -1946,6 +1530,21 @@ function getModel() {
 
 // src/engine/llm.ts
 import Anthropic from "@anthropic-ai/sdk";
+
+// src/shared/constants/llm.ts
+var RETRY_CONFIG = {
+  baseDelayMs: 2e3,
+  maxDelayMs: 6e4,
+  jitterMs: 1e3
+};
+var LLM_LIMITS = {
+  nonStreamMaxTokens: 4096,
+  streamMaxTokens: 8192,
+  /** WHY: ~3.5 chars/token is a reasonable average for mixed English/CJK content */
+  charsPerTokenEstimate: 3.5
+};
+
+// src/engine/llm.ts
 var LLMClient = class {
   client;
   model;
@@ -1957,15 +1556,46 @@ var LLMClient = class {
     });
     this.model = getModel();
   }
+  /** Non-streaming response with automatic retry */
+  async generateResponse(messages, tools, systemPrompt, callbacks) {
+    return this.withRetry(callbacks, () => this.executeNonStream(messages, tools, systemPrompt));
+  }
+  /** Streaming response with reasoning callbacks and automatic retry */
+  async generateResponseStream(messages, tools, systemPrompt, callbacks) {
+    return this.withRetry(callbacks, () => this.executeStream(messages, tools, systemPrompt, callbacks));
+  }
+  getModelName() {
+    return this.model;
+  }
+  // ─── Retry Logic ─────────────────────────────────────────────
   /**
-   * Generate response from messages and tools (non-streaming)
+   * Unified retry wrapper — retries unconditionally on all errors,
+   * respects AbortSignal for instant cancellation.
    */
-  async generateResponse(messages, tools, systemPrompt) {
+  async withRetry(callbacks, operation) {
+    let attempt = 0;
+    const signal = callbacks?.abortSignal;
+    while (true) {
+      if (signal?.aborted) this.throwAbort();
+      try {
+        return await operation();
+      } catch (error) {
+        if (this.isAbortError(error, signal)) this.throwAbort();
+        const delayMs = this.calculateRetryDelay(attempt);
+        const errorMsg = this.extractErrorMessage(error);
+        callbacks?.onRetry?.(attempt + 1, 0, delayMs, errorMsg);
+        await this.sleep(delayMs, signal);
+        attempt++;
+      }
+    }
+  }
+  // ─── Non-Streaming Execution ─────────────────────────────────
+  async executeNonStream(messages, tools, systemPrompt) {
     const response = await this.client.messages.create({
       model: this.model,
-      max_tokens: 4096,
+      max_tokens: LLM_LIMITS.nonStreamMaxTokens,
       system: systemPrompt,
-      messages: messages.filter((m) => m.role !== "system"),
+      messages: this.filterSystemMessages(messages),
       tools
     });
     const textBlock = response.content.find((b) => b.type === "text");
@@ -1977,65 +1607,138 @@ var LLMClient = class {
         name: b.name,
         input: b.input
       })),
-      rawResponse: response
+      rawResponse: response,
+      usage: response.usage ? { input_tokens: response.usage.input_tokens, output_tokens: response.usage.output_tokens } : void 0
     };
   }
-  /**
-   * Generate response with streaming support for real-time thinking display
-   * This is like opencode's reasoning stream handling
-   */
-  async generateResponseStream(messages, tools, systemPrompt, callbacks) {
+  // ─── Streaming Execution ─────────────────────────────────────
+  async executeStream(messages, tools, systemPrompt, callbacks) {
     const stream = await this.client.messages.create({
       model: this.model,
-      max_tokens: 4096,
+      max_tokens: LLM_LIMITS.streamMaxTokens,
       system: systemPrompt,
-      messages: messages.filter((m) => m.role !== "system"),
+      messages: this.filterSystemMessages(messages),
       tools,
       stream: true
     });
     let fullContent = "";
+    let fullReasoning = "";
     const toolCallsMap = /* @__PURE__ */ new Map();
-    callbacks?.onThinkingStart?.(systemPrompt ? "processing" : "default", 0);
+    let isReasoningBlock = false;
+    let isTextBlock = false;
+    let usage = { input_tokens: 0, output_tokens: 0 };
+    let totalChars = 0;
     for await (const event of stream) {
       switch (event.type) {
         case "content_block_start":
-          if (event.content_block.type === "text") {
-          } else if (event.content_block.type === "tool_use") {
-            const toolId = event.content_block.id;
-            toolCallsMap.set(toolId, { id: toolId, name: "", input: {} });
-          }
+          this.handleBlockStart(
+            event,
+            toolCallsMap,
+            callbacks,
+            () => {
+              isTextBlock = true;
+            },
+            () => {
+              isReasoningBlock = true;
+            }
+          );
           break;
-        case "content_block_delta":
-          if (event.delta.type === "text_delta") {
-            const text = event.delta.text;
-            fullContent += text;
-            callbacks?.onThinkingDelta?.(text);
-          } else if (event.delta.type === "input_json_delta") {
+        case "content_block_delta": {
+          const delta = event.delta;
+          if (delta.type === "text_delta" && isTextBlock) {
+            fullContent += delta.text;
+            totalChars += delta.text.length;
+            callbacks?.onOutputDelta?.(delta.text);
+          } else if (delta.type === "thinking_delta" && isReasoningBlock) {
+            const text = delta.thinking || "";
+            fullReasoning += text;
+            totalChars += text.length;
+            callbacks?.onReasoningDelta?.(text);
+          } else if (delta.type === "input_json_delta") {
+            totalChars += (delta.partial_json || "").length;
           }
+          const estimatedOutput = Math.ceil(totalChars / LLM_LIMITS.charsPerTokenEstimate);
+          callbacks?.onUsageUpdate?.({ input_tokens: usage.input_tokens, output_tokens: estimatedOutput });
           break;
+        }
         case "content_block_stop":
+          if (isReasoningBlock) callbacks?.onReasoningEnd?.();
+          if (isTextBlock) callbacks?.onOutputEnd?.();
+          isReasoningBlock = false;
+          isTextBlock = false;
           break;
-        case "message_start":
-          break;
-        case "message_delta":
+        case "message_start": {
+          const msg = event.message;
+          if (msg?.usage) {
+            usage = { ...msg.usage };
+            callbacks?.onUsageUpdate?.({ ...usage });
+          }
           break;
-        case "message_stop":
+        }
+        case "message_delta": {
+          const deltaUsage = event.usage;
+          if (deltaUsage) {
+            usage.output_tokens = deltaUsage.output_tokens || 0;
+            callbacks?.onUsageUpdate?.({ ...usage });
+          }
           break;
+        }
       }
     }
-    callbacks?.onThinkingEnd?.();
     const toolCalls = Array.from(toolCallsMap.values());
     return {
       content: fullContent,
       toolCalls: toolCalls.length > 0 ? toolCalls : void 0,
-      rawResponse: null
+      rawResponse: null,
+      reasoning: fullReasoning || void 0,
+      usage: usage.input_tokens > 0 || usage.output_tokens > 0 ? usage : void 0
     };
   }
-  /**
-   * Get current model name
-   */
-  getModelName() {
-    return this.model;
+  // ─── Helpers ─────────────────────────────────────────────────
+  handleBlockStart(event, toolCallsMap, callbacks, onText, onReasoning) {
+    const blockType = event.content_block?.type;
+    if (blockType === "text") {
+      onText();
+      callbacks?.onOutputStart?.();
+    } else if (blockType === "thinking" || blockType === "reasoning") {
+      onReasoning();
+      callbacks?.onReasoningStart?.();
+    } else if (blockType === "tool_use") {
+      const block = event.content_block;
+      toolCallsMap.set(block.id, { id: block.id, name: block.name || "", input: block.input || {} });
+    }
+  }
+  filterSystemMessages(messages) {
+    return messages.filter((m) => m.role !== "system");
+  }
+  calculateRetryDelay(attempt) {
+    const exponentialDelay = RETRY_CONFIG.baseDelayMs * Math.pow(2, attempt);
+    const jitter = Math.random() * RETRY_CONFIG.jitterMs;
+    return Math.min(exponentialDelay + jitter, RETRY_CONFIG.maxDelayMs);
+  }
+  extractErrorMessage(error) {
+    const e = error;
+    return e?.error?.error?.message || e?.error?.message || e?.message || String(error);
+  }
+  /** Abortable sleep — rejects immediately if signal fires */
+  sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal?.aborted) {
+        reject(new DOMException("Aborted", "AbortError"));
+        return;
+      }
+      const timer = setTimeout(resolve, ms);
+      signal?.addEventListener("abort", () => {
+        clearTimeout(timer);
+        reject(new DOMException("Aborted", "AbortError"));
+      }, { once: true });
+    });
+  }
+  isAbortError(error, signal) {
+    return error?.name === "AbortError" || !!signal?.aborted;
+  }
+  throwAbort() {
+    throw new DOMException("Aborted", "AbortError");
   }
 };
 var llmInstance = null;
@@ -2054,6 +1757,7 @@ var CoreAgent = class {
   toolRegistry;
   agentType;
   maxIterations;
+  abortController = null;
   constructor(agentType, state, events, toolRegistry, maxIterations) {
     this.agentType = agentType;
     this.state = state;
@@ -2062,22 +1766,35 @@ var CoreAgent = class {
     this.llm = getLLMClient();
     this.maxIterations = maxIterations || AGENT_LIMITS.MAX_ITERATIONS;
   }
-  /**
-   * The core loop: think -> act -> observe
-   */
+  /** Abort the current execution — immediately cancels LLM calls and retries */
+  abort() {
+    this.abortController?.abort();
+  }
+  /** The core loop: Think → Act → Observe */
   async run(task, systemPrompt) {
-    const messages = [{ role: "user", content: task }];
+    this.abortController = new AbortController();
+    const messages = [{ role: LLM_ROLES.USER, content: task }];
     let toolsExecutedCount = 0;
     for (let iteration = 0; iteration < this.maxIterations; iteration++) {
-      const result = await this.step(iteration, messages, systemPrompt);
-      toolsExecutedCount += result.toolsExecuted;
-      if (result.completed) {
-        return {
-          output: result.output,
-          iterations: iteration + 1,
-          toolsExecuted: toolsExecutedCount,
-          completed: true
-        };
+      if (this.abortController.signal.aborted) {
+        return this.buildCancelledResult(iteration, toolsExecutedCount);
+      }
+      try {
+        const result = await this.step(iteration, messages, systemPrompt);
+        toolsExecutedCount += result.toolsExecuted;
+        if (result.completed) {
+          return {
+            output: result.output,
+            iterations: iteration + 1,
+            toolsExecuted: toolsExecutedCount,
+            completed: true
+          };
+        }
+      } catch (error) {
+        if (this.isAbortError(error)) {
+          return this.buildCancelledResult(iteration, toolsExecutedCount);
+        }
+        throw error;
       }
     }
     return {
@@ -2087,40 +1804,59 @@ var CoreAgent = class {
       completed: false
     };
   }
-  /**
-   * Execute a single iteration step with real-time thinking display
-   */
+  // ─── Step Execution ──────────────────────────────────────────
+  /** Execute a single Think → Act → Observe iteration */
   async step(iteration, messages, systemPrompt) {
     const phase = this.state.getPhase();
-    this.emitThinkingStart(phase, iteration);
+    const stepStartTime = Date.now();
     this.emitThink(iteration);
+    const callbacks = this.buildStreamCallbacks(phase);
     const response = await this.llm.generateResponseStream(
       messages,
       this.getToolSchemas(),
       systemPrompt,
-      {
-        onThinkingStart: (phase2, iter) => {
-        },
-        onThinkingDelta: (content) => {
-          this.emitThinkingDelta(content, phase);
-        },
-        onThinkingEnd: () => {
-          this.emitThinkingEnd(phase);
-        }
-      }
+      callbacks
     );
-    messages.push({ role: "assistant", content: response.content });
-    if (!response.toolCalls || response.toolCalls.length === 0) {
-      this.emitComplete(response.content, iteration, 0);
+    messages.push({ role: LLM_ROLES.ASSISTANT, content: response.content });
+    const stepDuration = Date.now() - stepStartTime;
+    const tokens = response.usage ? { input: response.usage.input_tokens, output: response.usage.output_tokens } : void 0;
+    if (!response.toolCalls?.length) {
+      this.emitComplete(response.content, iteration, 0, stepDuration, tokens);
       return { output: response.content, toolsExecuted: 0, completed: true };
     }
     const results = await this.processToolCalls(response.toolCalls);
     this.addToolResultsToMessages(messages, results);
     return { output: "", toolsExecuted: results.length, completed: false };
   }
+  // ─── Callback Builder ────────────────────────────────────────
+  buildStreamCallbacks(phase) {
+    return {
+      onReasoningStart: () => this.emitReasoningStart(phase),
+      onReasoningDelta: (content) => this.emitReasoningDelta(content, phase),
+      onReasoningEnd: () => this.emitReasoningEnd(phase),
+      onOutputDelta: () => {
+      },
+      onRetry: (attempt, maxRetries, delayMs, error) => {
+        this.events.emit({
+          type: EVENT_TYPES.RETRY,
+          timestamp: Date.now(),
+          data: { attempt, maxRetries, delayMs, error, phase }
+        });
+      },
+      onUsageUpdate: (usage) => {
+        this.events.emit({
+          type: EVENT_TYPES.USAGE_UPDATE,
+          timestamp: Date.now(),
+          data: { inputTokens: usage.input_tokens, outputTokens: usage.output_tokens }
+        });
+      },
+      abortSignal: this.abortController?.signal
+    };
+  }
+  // ─── Event Emitters ──────────────────────────────────────────
   emitThink(iteration) {
     this.events.emit({
-      type: "think",
+      type: EVENT_TYPES.THINK,
       timestamp: Date.now(),
       data: {
         thought: `${this.agentType} agent iteration ${iteration + 1}: Decision making`,
@@ -2128,60 +1864,34 @@ var CoreAgent = class {
       }
     });
   }
-  /**
-   * Emit thinking start event - like opencode's reasoning-start
-   */
-  emitThinkingStart(phase, iteration) {
-    this.events.emit({
-      type: "thinking_start",
-      timestamp: Date.now(),
-      data: {
-        phase,
-        iteration
-      }
-    });
+  /** Emit reasoning lifecycle events for extended thinking */
+  emitReasoningStart(phase) {
+    this.events.emit({ type: EVENT_TYPES.REASONING_START, timestamp: Date.now(), data: { phase } });
   }
-  /**
-   * Emit thinking delta event - like opencode's reasoning-delta
-   * This provides real-time transparency of the model's thinking process
-   */
-  emitThinkingDelta(content, phase) {
-    this.events.emit({
-      type: "thinking_delta",
-      timestamp: Date.now(),
-      data: {
-        content,
-        phase
-      }
-    });
+  emitReasoningDelta(content, phase) {
+    this.events.emit({ type: EVENT_TYPES.REASONING_DELTA, timestamp: Date.now(), data: { content, phase } });
   }
-  /**
-   * Emit thinking end event - like opencode's reasoning-end
-   */
-  emitThinkingEnd(phase) {
-    this.events.emit({
-      type: "thinking_end",
-      timestamp: Date.now(),
-      data: {
-        phase
-      }
-    });
+  emitReasoningEnd(phase) {
+    this.events.emit({ type: EVENT_TYPES.REASONING_END, timestamp: Date.now(), data: { phase } });
   }
-  emitComplete(output, iteration, toolsExecuted) {
+  emitComplete(output, iteration, toolsExecuted, durationMs, tokens) {
     this.events.emit({
-      type: "complete",
+      type: EVENT_TYPES.COMPLETE,
       timestamp: Date.now(),
       data: {
         finalOutput: output,
         iterations: iteration + 1,
-        toolsExecuted
+        toolsExecuted,
+        durationMs,
+        tokens
       }
     });
   }
+  // ─── Tool Processing ─────────────────────────────────────────
   addToolResultsToMessages(messages, results) {
     for (const res of results) {
       messages.push({
-        role: "user",
+        role: LLM_ROLES.USER,
         content: [
           {
             type: "tool_result",
@@ -2196,10 +1906,11 @@ var CoreAgent = class {
   async processToolCalls(toolCalls) {
     const results = [];
     for (const call of toolCalls) {
-      const toolName = call.name;
-      const toolInput = call.input;
       try {
-        const result = await this.toolRegistry.execute({ name: toolName, input: toolInput });
+        const result = await this.toolRegistry.execute({
+          name: call.name,
+          input: call.input
+        });
         results.push({ toolCallId: call.id, output: result.output, error: result.error });
       } catch (error) {
         results.push({ toolCallId: call.id, output: String(error), error: String(error) });
@@ -2218,103 +1929,137 @@ var CoreAgent = class {
       }
     }));
   }
+  // ─── Abort Helpers ───────────────────────────────────────────
+  isAbortError(error) {
+    return error?.name === "AbortError" || !!this.abortController?.signal.aborted;
+  }
+  buildCancelledResult(iteration, toolsExecuted) {
+    return {
+      output: "Operation cancelled by user",
+      iterations: iteration,
+      toolsExecuted,
+      completed: false
+    };
+  }
 };
 
 // src/agents/prompt-builder.ts
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { join as join3, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
+
+// src/shared/constants/prompts.ts
+var PROMPT_XML = {
+  PHASE: (phase, content) => `<phase-instructions phase="${phase}">
+${content}
+</phase-instructions>`,
+  SCOPE: (allowed, domains, exclude, flags) => `<scope type="ABSOLUTE_CONSTRAINT">
+Authorized CIDR: ${allowed}
+Authorized Domains: ${domains}
+Exclusions: ${exclude}
+Constraints: ${flags}
+</scope>`,
+  STATE: (content) => `<current-state>
+${content}
+</current-state>`,
+  TODO: (content) => `<todo>
+${content}
+</todo>`
+};
+var PROMPT_DEFAULTS = {
+  NO_SCOPE: "<scope>NO SCOPE DEFINED. STOP.</scope>",
+  EMPTY_TODO: "Create initial plan",
+  USER_CONTEXT: (context) => `User Context: ${context}`
+};
+var PROMPT_PATHS = {
+  ROOT: "../shared/prompts",
+  PHASES: "phases",
+  BASE: "base.md",
+  FILE_EXT: ".md",
+  AGENT_FILES: {
+    ORCHESTRATOR: "orchestrator.md",
+    RECON: "recon.md",
+    VULN: "vuln.md",
+    EXPLOIT: "exploit.md",
+    POST: "post.md",
+    REPORT: "report.md",
+    INFRA: "infra.md"
+  }
+};
+var PROMPT_CONFIG = {
+  ENCODING: "utf-8"
+};
+var INITIAL_TASKS = {
+  RECON: "Initial reconnaissance and target discovery"
+};
+
+// src/agents/prompt-builder.ts
 var __dirname3 = dirname2(fileURLToPath3(import.meta.url));
 var PromptBuilder = class {
   state;
   promptDir;
   constructor(state) {
     this.state = state;
-    this.promptDir = join3(__dirname3, "../shared/prompts");
+    this.promptDir = join3(__dirname3, PROMPT_PATHS.ROOT);
   }
   /**
    * Build complete prompt for LLM iteration
+   * Implements §7-2 (Abstraction Level Consistency)
    */
   build(userInput, phase) {
-    return [
-      this.loadFragment("base.md"),
+    const fragments = [
+      this.loadFragment(PROMPT_PATHS.BASE),
       this.loadPhasePrompt(phase),
       this.getScopeFragment(),
       this.getStateFragment(),
       this.getTodoFragment(),
-      `User Context: ${userInput}`
-    ].join("\n\n");
+      PROMPT_DEFAULTS.USER_CONTEXT(userInput)
+    ];
+    return fragments.filter((f) => !!f).join("\n\n");
   }
   loadFragment(filename) {
     const path2 = join3(this.promptDir, filename);
-    if (!existsSync2(path2)) return "";
-    return readFileSync2(path2, "utf-8");
+    return existsSync2(path2) ? readFileSync2(path2, PROMPT_CONFIG.ENCODING) : "";
   }
   loadPhasePrompt(phase) {
-    const path2 = join3(this.promptDir, "phases", `${phase}.md`);
-    return existsSync2(path2) ? `<phase-instructions phase="${phase}">
-${readFileSync2(path2, "utf-8")}
-</phase-instructions>` : "";
+    const path2 = join3(this.promptDir, PROMPT_PATHS.PHASES, `${phase}${PROMPT_PATHS.FILE_EXT}`);
+    return existsSync2(path2) ? PROMPT_XML.PHASE(phase, readFileSync2(path2, PROMPT_CONFIG.ENCODING)) : "";
   }
   getScopeFragment() {
     const scope = this.state.getScope();
-    if (!scope) return "<scope>NO SCOPE DEFINED. STOP.</scope>";
-    return `<scope type="ABSOLUTE_CONSTRAINT">
-Authorized CIDR: ${scope.allowedCidrs.join(", ")}
-Authorized Domains: ${scope.allowedDomains.join(", ")}
-Exclusions: ${scope.exclusions.join(", ") || "none"}
-NoDoS: ${scope.noDOS} | NoSocial: ${scope.noSocial}
-</scope>`;
+    if (!scope) return PROMPT_DEFAULTS.NO_SCOPE;
+    const flags = `NoDoS: ${scope.noDOS} | NoSocial: ${scope.noSocial}`;
+    return PROMPT_XML.SCOPE(
+      scope.allowedCidrs.join(", ") || "none",
+      scope.allowedDomains.join(", ") || "none",
+      scope.exclusions.join(", ") || "none",
+      flags
+    );
   }
   getStateFragment() {
-    return `<current-state>
-${this.state.toPrompt()}
-</current-state>`;
+    return PROMPT_XML.STATE(this.state.toPrompt());
   }
   getTodoFragment() {
     const todo = this.state.getTodo();
-    const list = todo.map((t) => `[${t.status === "done" ? "x" : " "}] ${t.content} (${t.priority})`).join("\n");
-    return `<todo>
-${list || "Create initial plan"}
-</todo>`;
-  }
-};
-
-// src/agents/sub-agent-executor.ts
-var SubAgentExecutor = class extends CoreAgent {
-  constructor(state, events, toolRegistry) {
-    super(AGENT_ROLES.RECON, state, events, toolRegistry);
-  }
-  /**
-   * Entry point for executing a sub-task
-   */
-  async executeSubTask(task, systemPrompt) {
-    console.log(`[SubAgent] Executing specialized task: ${task.slice(0, 50)}...`);
-    return await this.run(task, systemPrompt);
+    const list = todo.map((t) => `[${t.status === TODO_STATUSES.DONE ? "x" : " "}] ${t.content} (${t.priority})`).join("\n");
+    return PROMPT_XML.TODO(list || PROMPT_DEFAULTS.EMPTY_TODO);
   }
 };
 
 // src/agents/main-agent.ts
 var MainAgent = class extends CoreAgent {
-  promptBuilder;
-  approvalGate;
-  scopeGuard;
-  userInput = "";
-  constructor() {
-    const state = new SharedState();
-    const events = new AgentEventEmitter();
-    const approvalGate = new ApprovalGate(false);
-    const scopeGuard = new ScopeGuard(state);
-    const subAgentExecutor = new SubAgentExecutor(state, events, null);
-    const toolRegistry = new CategorizedToolRegistry(state, scopeGuard, approvalGate, events, subAgentExecutor);
-    subAgentExecutor.toolRegistry = toolRegistry;
+  promptBuilder;
+  approvalGate;
+  scopeGuard;
+  userInput = "";
+  constructor(state, events, toolRegistry, approvalGate, scopeGuard) {
     super(AGENT_ROLES.ORCHESTRATOR, state, events, toolRegistry);
     this.approvalGate = approvalGate;
     this.scopeGuard = scopeGuard;
     this.promptBuilder = new PromptBuilder(state);
   }
   /**
-   * Public entry point for running the agent with a simple string input
+   * Public entry point for running the agent
    */
   async execute(userInput) {
     this.userInput = userInput;
@@ -2323,26 +2068,19 @@ var MainAgent = class extends CoreAgent {
     const result = await this.run(userInput, this.getCurrentPrompt());
     return result.output;
   }
-  /**
-   * Override CoreAgent.run to enforce dynamic prompt injection per iteration
-   * But keep the signature compatible with CoreAgent
-   */
   async run(task, _systemPrompt) {
     return super.run(task, _systemPrompt);
   }
-  /**
-   * Override step to ensure prompt is always fresh with latest state
-   */
   async step(iteration, messages, _unusedPrompt) {
     const dynamicPrompt = this.getCurrentPrompt();
     const result = await super.step(iteration, messages, dynamicPrompt);
     this.emitStateChange();
     return result;
   }
-  // --- Internal Helpers (Refactored for Readability) ---
+  // --- Internal Helpers ---
   initializeTask() {
     if (this.state.getTodo().length === 0) {
-      this.state.addTodo("Initial reconnaissance and target discovery", PRIORITIES.HIGH);
+      this.state.addTodo(INITIAL_TASKS.RECON, PRIORITIES.HIGH);
     }
   }
   getCurrentPrompt() {
@@ -2351,14 +2089,14 @@ var MainAgent = class extends CoreAgent {
   }
   emitStart(userInput) {
     this.events.emit({
-      type: "start",
+      type: EVENT_TYPES.START,
       timestamp: Date.now(),
       data: { userInput, phase: this.state.getPhase() }
     });
   }
   emitStateChange() {
     this.events.emit({
-      type: "state_change",
+      type: EVENT_TYPES.STATE_CHANGE,
       timestamp: Date.now(),
       data: {
         phase: this.state.getPhase(),
@@ -2403,6 +2141,43 @@ var MainAgent = class extends CoreAgent {
   }
 };
 
+// src/agents/sub-agent-executor.ts
+var SubAgentExecutor = class extends CoreAgent {
+  constructor(state, events, toolRegistry) {
+    super(AGENT_ROLES.RECON, state, events, toolRegistry);
+  }
+  /**
+   * Entry point for executing a sub-task
+   */
+  async executeSubTask(task, systemPrompt) {
+    console.log(`[SubAgent] Executing specialized task: ${task.slice(0, 50)}...`);
+    return await this.run(task, systemPrompt);
+  }
+};
+
+// src/agents/factory.ts
+var AgentFactory = class {
+  /**
+   * Create a fully initialized MainAgent system
+   */
+  static createMainAgent(autoApprove = false) {
+    const state = new SharedState();
+    const events = new AgentEventEmitter();
+    const approvalGate = new ApprovalGate(autoApprove);
+    const scopeGuard = new ScopeGuard(state);
+    const subAgentExecutor = new SubAgentExecutor(state, events, null);
+    const toolRegistry = new CategorizedToolRegistry(
+      state,
+      scopeGuard,
+      approvalGate,
+      events,
+      subAgentExecutor
+    );
+    subAgentExecutor.toolRegistry = toolRegistry;
+    return new MainAgent(state, events, toolRegistry, approvalGate, scopeGuard);
+  }
+};
+
 // src/shared/constants/thought.ts
 var THOUGHT_TYPE = {
   THINKING: "thinking",
@@ -2555,378 +2330,586 @@ var THOUGHT_LABELS = {
   [THOUGHT_TYPE.BREAKTHROUGH]: "[!]"
 };
 
-// src/platform/tui/components/footer.tsx
-import { Box, Text } from "ink";
-import { jsx, jsxs } from "react/jsx-runtime";
-var Footer = ({ phase, targets, findings, todo, elapsedTime, isProcessing }) => {
-  return /* @__PURE__ */ jsxs(
-    Box,
-    {
-      paddingX: 1,
-      marginTop: 0,
-      justifyContent: "space-between",
-      children: [
-        /* @__PURE__ */ jsxs(Box, { gap: 2, children: [
-          /* @__PURE__ */ jsxs(Text, { color: THEME.text.accent, children: [
-            "Phase: ",
-            /* @__PURE__ */ jsx(Text, { color: THEME.text.primary, children: phase })
-          ] }),
-          /* @__PURE__ */ jsxs(Text, { color: THEME.text.secondary, children: [
-            "Targets: ",
-            /* @__PURE__ */ jsx(Text, { color: THEME.text.primary, children: targets })
-          ] }),
-          /* @__PURE__ */ jsxs(Text, { color: THEME.status.warning, children: [
-            "Findings: ",
-            /* @__PURE__ */ jsx(Text, { color: THEME.text.primary, children: findings })
-          ] }),
-          /* @__PURE__ */ jsxs(Text, { color: THEME.text.muted, children: [
-            "Tasks: ",
-            /* @__PURE__ */ jsx(Text, { color: THEME.text.primary, children: todo })
-          ] })
-        ] }),
-        /* @__PURE__ */ jsxs(Box, { children: [
-          /* @__PURE__ */ jsx(Text, { color: isProcessing ? THEME.status.running : THEME.text.muted, children: isProcessing ? "\u25CF Running " : "\u25CB Idle " }),
-          /* @__PURE__ */ jsxs(Text, { color: THEME.text.secondary, children: [
-            Math.floor(elapsedTime / 60),
-            "m ",
-            Math.floor(elapsedTime % 60),
-            "s"
-          ] })
-        ] })
-      ]
-    }
-  );
+// src/platform/tui/constants/display.ts
+var DISPLAY_LIMITS2 = {
+  reasoningBuffer: 1e3,
+  reasoningPreview: 300,
+  reasoningHistorySlice: 500,
+  toolInputPreview: 50,
+  toolInputTruncated: 47,
+  toolOutputPreview: 300,
+  statusThoughtPreview: 100,
+  statusThoughtTruncated: 97,
+  retryErrorPreview: 40,
+  retryErrorTruncated: 37,
+  timerInterval: 1e3,
+  exitDelay: 100
 };
-var footer_default = Footer;
+var MESSAGE_STYLES = {
+  colors: {
+    user: THEME.text.accent,
+    assistant: THEME.text.primary,
+    system: THEME.text.muted,
+    error: THEME.status.error,
+    tool: THEME.status.running,
+    result: THEME.text.muted,
+    reasoning: THEME.status.warning
+  },
+  prefixes: {
+    user: "\u276F",
+    assistant: ">",
+    system: "\u2022",
+    error: "\u2717",
+    tool: "  \u23BF",
+    result: "  \u2713",
+    reasoning: "REASONING"
+  }
+};
+var HELP_TEXT = `
+\u2500\u2500 Commands \u2500\u2500
+/target <ip>     Set target
+/start [goal]    Start autonomous pentest
+/stop            Stop operation
+/findings        Show findings
+/status          Show status
+/clear           Clear screen
+/exit            Exit
 
-// src/platform/tui/app.tsx
-import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
-var App = ({ autoApprove = false, target }) => {
-  const { exit } = useApp();
+\u2500\u2500 Examples \u2500\u2500
+/target 192.168.1.1
+/start "Recon the target"
+/findings
+`;
+
+// src/platform/tui/utils/format.ts
+var formatDuration = (ms) => {
+  const totalSec = ms / 1e3;
+  if (totalSec < 60) return `${totalSec.toFixed(1)}s`;
+  const minutes = Math.floor(totalSec / 60);
+  const seconds = Math.floor(totalSec % 60);
+  return `${minutes}m ${seconds}s`;
+};
+var formatTokens = (count) => {
+  if (count >= 1e6) return (count / 1e6).toFixed(1) + "M";
+  if (count >= 1e3) return (count / 1e3).toFixed(1) + "K";
+  return String(count);
+};
+var formatMeta = (ms, tokens) => {
+  const parts = [];
+  if (ms > 0) parts.push(formatDuration(ms));
+  if (tokens > 0) parts.push(`\u2191 ${formatTokens(tokens)} tokens`);
+  return parts.length > 0 ? `(${parts.join(" \xB7 ")})` : "";
+};
+
+// src/platform/tui/hooks/useAgent.ts
+var useAgent = (autoApprove, target) => {
   const [messages, setMessages] = useState([]);
-  const [input, setInput] = useState("");
   const [isProcessing, setIsProcessing] = useState(false);
   const [currentStatus, setCurrentStatus] = useState("");
   const [elapsedTime, setElapsedTime] = useState(0);
-  const [thinking, setThinking] = useState({ isActive: false, content: "", phase: "" });
-  const [stats, setStats] = useState({
-    phase: "init",
-    targets: 0,
-    findings: 0,
-    todo: 0
+  const [reasoning, setReasoning] = useState({ isActive: false, content: "", phase: "" });
+  const [retryState, setRetryState] = useState({
+    isRetrying: false,
+    attempt: 0,
+    maxRetries: 0,
+    delayMs: 0,
+    error: "",
+    countdown: 0
   });
-  const [agent] = useState(() => {
-    const ag = new MainAgent();
-    if (autoApprove) {
-      ag.setAutoApprove(true);
-    }
-    if (target) {
-      ag.addTarget(target);
-      ag.setScope([target]);
-    }
-    return ag;
+  const [currentTokens, setCurrentTokens] = useState(0);
+  const [inputRequest, setInputRequest] = useState({
+    active: false,
+    prompt: "",
+    isPassword: false,
+    resolve: null
   });
+  const [stats, setStats] = useState({ phase: "init", targets: 0, findings: 0, todo: 0 });
+  const lastResponseMetaRef = useRef(null);
   const startTimeRef = useRef(0);
   const timerRef = useRef(null);
-  const startTimer = useCallback(() => {
-    startTimeRef.current = Date.now();
-    timerRef.current = setInterval(() => {
-      setElapsedTime(Math.floor((Date.now() - startTimeRef.current) / 1e3));
-    }, 1e3);
-  }, []);
-  const stopTimer = useCallback(() => {
-    if (timerRef.current) {
-      clearInterval(timerRef.current);
-      timerRef.current = null;
+  const retryCountdownRef = useRef(null);
+  const retryCountRef = useRef(0);
+  const tokenAccumRef = useRef(0);
+  const lastStepTokensRef = useRef(0);
+  const [agent] = useState(() => AgentFactory.createMainAgent(autoApprove));
+  useEffect(() => {
+    if (target) {
+      agent.addTarget(target);
+      agent.setScope([target]);
     }
-    const duration = Math.floor((Date.now() - startTimeRef.current) / 100) / 10;
-    setElapsedTime(0);
-    return duration;
-  }, []);
+  }, [agent, target]);
+  const eventsRef = useRef(agent.getEventEmitter());
   const addMessage = useCallback((type, content) => {
     const id = Math.random().toString(36).substring(7);
     setMessages((prev) => [...prev, { id, type, content, timestamp: /* @__PURE__ */ new Date() }]);
   }, []);
-  useEffect(() => {
-    if (target) {
-      addMessage("system", `Target: ${target}`);
+  const resetCumulativeCounters = useCallback(() => {
+    setCurrentTokens(0);
+    retryCountRef.current = 0;
+    tokenAccumRef.current = 0;
+    lastStepTokensRef.current = 0;
+    lastResponseMetaRef.current = null;
+  }, []);
+  const manageTimer = useCallback((action) => {
+    if (action === "start") {
+      startTimeRef.current = Date.now();
+      timerRef.current = setInterval(() => {
+        setElapsedTime(Math.floor((Date.now() - startTimeRef.current) / 1e3));
+      }, DISPLAY_LIMITS2.timerInterval);
+    } else {
+      if (timerRef.current) clearInterval(timerRef.current);
+      timerRef.current = null;
+      setElapsedTime(0);
     }
-    if (autoApprove) {
-      addMessage("system", "YOLO Mode: Auto-approving all tool executions");
+  }, []);
+  const executeTask = useCallback(async (task) => {
+    setIsProcessing(true);
+    manageTimer("start");
+    setCurrentStatus("Thinking");
+    resetCumulativeCounters();
+    try {
+      const response = await agent.execute(task);
+      const meta = lastResponseMetaRef.current;
+      const suffix = meta ? ` ${formatMeta(meta.durationMs || 0, (meta.tokens?.input || 0) + (meta.tokens?.output || 0))}` : "";
+      addMessage(UI_ROLES.AI, response + suffix);
+    } catch (e) {
+      addMessage(UI_ROLES.ERROR, e instanceof Error ? e.message : String(e));
+    } finally {
+      manageTimer("stop");
+      setIsProcessing(false);
+      setCurrentStatus("");
     }
-    const events = agent.getEventEmitter();
-    events.on("thinking_start", (event) => {
-      setThinking({ isActive: true, content: "", phase: event.data.phase });
-    });
-    events.on("thinking_delta", (event) => {
-      setThinking((prev) => {
-        const newContent = prev.content + event.data.content;
-        return {
-          ...prev,
-          content: newContent.slice(-500)
-          // Keep only last 500 chars for display
-        };
-      });
-    });
-    events.on("thinking_end", (event) => {
-      setThinking((prev) => ({ ...prev, isActive: false }));
-    });
-    events.on("tool_call", (event) => {
-      const data = event.data;
-      setCurrentStatus(`Executing: ${data.toolName}`);
+  }, [agent, addMessage, manageTimer, resetCumulativeCounters]);
+  const abort = useCallback(() => {
+    agent.abort();
+    setIsProcessing(false);
+    manageTimer("stop");
+    setCurrentStatus("");
+    addMessage(UI_ROLES.SYSTEM, "Interrupted");
+  }, [agent, addMessage, manageTimer]);
+  const cancelInputRequest = useCallback(() => {
+    if (inputRequest.active && inputRequest.resolve) {
+      inputRequest.resolve(null);
+      setInputRequest({ active: false, prompt: "", isPassword: false, resolve: null });
+      addMessage(UI_ROLES.SYSTEM, "Input cancelled");
+    }
+  }, [inputRequest, addMessage]);
+  useEffect(() => {
+    const events = eventsRef.current;
+    const onToolCall = (e) => {
+      setCurrentStatus(`Executing: ${e.data.toolName}`);
       let inputStr = "";
       try {
-        if (data.input) {
-          const str = JSON.stringify(data.input);
-          inputStr = str.length > 50 ? str.substring(0, 47) + "..." : str;
+        if (e.data.input) {
+          const str = JSON.stringify(e.data.input);
+          inputStr = str.length > DISPLAY_LIMITS2.toolInputPreview ? str.substring(0, DISPLAY_LIMITS2.toolInputTruncated) + "..." : str;
         }
-      } catch (e) {
+      } catch {
       }
-      addMessage("tool", `  \u23BF ${data.toolName} ${inputStr}`);
-    });
-    events.on("tool_result", (event) => {
-      const data = event.data;
-      const icon = data.success ? "\u2713" : "\u2717";
-      const output = data.output || "";
-      const preview = output.slice(0, 300).replace(/\n/g, " ");
-      const more = output.length > 300 ? "..." : "";
+      addMessage("tool", `  \u23BF ${e.data.toolName} ${inputStr}`);
+    };
+    const onToolResult = (e) => {
+      const icon = e.data.success ? "\u2713" : "\u2717";
+      const preview = (e.data.output || "").slice(0, DISPLAY_LIMITS2.toolOutputPreview).replace(/\n/g, " ");
+      const more = (e.data.output || "").length > DISPLAY_LIMITS2.toolOutputPreview ? "..." : "";
       addMessage("result", `    ${icon} ${preview}${more}`);
+    };
+    const onReasoningStart = (e) => setReasoning({ isActive: true, content: "", phase: e.data.phase });
+    const onReasoningDelta = (e) => setReasoning((prev) => ({
+      ...prev,
+      content: (prev.content + e.data.content).slice(-DISPLAY_LIMITS2.reasoningBuffer)
+    }));
+    const onReasoningEnd = () => setReasoning((prev) => {
+      if (prev.content) addMessage("reasoning", `REASONING ${prev.content.slice(-DISPLAY_LIMITS2.reasoningHistorySlice)}`);
+      return { ...prev, isActive: false };
     });
-    events.on("think", (event) => {
-      const data = event.data;
-      const thought = data.thought.length > 100 ? data.thought.substring(0, 97) + "..." : data.thought;
-      setCurrentStatus(thought);
-    });
-    events.on("complete", (event) => {
-      const data = event.data;
-      addMessage("system", `\u2713 Complete (${data.toolsExecuted} tools)`);
-    });
-    events.on("error", (event) => {
-      const data = event.data;
-      addMessage("error", data.message || "An error occurred");
+    const onComplete = (e) => {
+      addMessage("system", `\u2713 Complete ${formatMeta(e.data.durationMs || 0, (e.data.tokens?.input || 0) + (e.data.tokens?.output || 0))}`);
+      lastResponseMetaRef.current = { durationMs: e.data.durationMs, tokens: e.data.tokens };
+    };
+    const onRetry = (e) => {
+      const delaySec = Math.ceil(e.data.delayMs / 1e3);
+      retryCountRef.current += 1;
+      const retryNum = retryCountRef.current;
+      addMessage("system", `\u27F3 Retry #${retryNum} \xB7 ${e.data.error} \xB7 waiting ${delaySec}s...`);
+      setRetryState({ isRetrying: true, attempt: retryNum, maxRetries: e.data.maxRetries, delayMs: e.data.delayMs, error: e.data.error, countdown: delaySec });
+      if (retryCountdownRef.current) clearInterval(retryCountdownRef.current);
+      let remaining = delaySec;
+      retryCountdownRef.current = setInterval(() => {
+        remaining -= 1;
+        if (remaining <= 0) {
+          setRetryState((prev) => ({ ...prev, isRetrying: false, countdown: 0 }));
+          if (retryCountdownRef.current) clearInterval(retryCountdownRef.current);
+        } else {
+          setRetryState((prev) => ({ ...prev, countdown: remaining }));
+        }
+      }, 1e3);
+    };
+    const onUsageUpdate = (e) => {
+      const stepTokens = e.data.inputTokens + e.data.outputTokens;
+      if (stepTokens < lastStepTokensRef.current) tokenAccumRef.current += lastStepTokensRef.current;
+      lastStepTokensRef.current = stepTokens;
+      setCurrentTokens(tokenAccumRef.current + stepTokens);
+    };
+    setInputHandler((p) => {
+      return new Promise((resolve) => setInputRequest({ active: true, prompt: p.trim(), isPassword: /password|passphrase/i.test(p), resolve }));
     });
     const updateStats = () => {
-      const state = agent.getState();
-      setStats({
-        phase: agent.getPhase(),
-        targets: state.getTargets().size,
-        findings: state.getFindings().length,
-        todo: state.getTodo().length
-      });
+      const s = agent.getState();
+      setStats({ phase: agent.getPhase(), targets: s.getTargets().size, findings: s.getFindings().length, todo: s.getTodo().length });
     };
+    events.on("tool_call", onToolCall);
+    events.on("tool_result", onToolResult);
+    events.on("reasoning_start", onReasoningStart);
+    events.on("reasoning_delta", onReasoningDelta);
+    events.on("reasoning_end", onReasoningEnd);
+    events.on("think", (e) => {
+      const t = e.data.thought;
+      setCurrentStatus(t.length > DISPLAY_LIMITS2.statusThoughtPreview ? t.substring(0, DISPLAY_LIMITS2.statusThoughtTruncated) + "..." : t);
+    });
+    events.on("complete", onComplete);
+    events.on("error", (e) => addMessage("error", e.data.message || "An error occurred"));
+    events.on("retry", onRetry);
+    events.on("usage_update", onUsageUpdate);
     events.on("state_change", updateStats);
     events.on("start", updateStats);
-    events.on("complete", updateStats);
     updateStats();
     return () => {
+      events.removeAllListeners();
       if (timerRef.current) clearInterval(timerRef.current);
-      events.off("state_change", updateStats);
-      events.off("start", updateStats);
-      events.off("complete", updateStats);
+      if (retryCountdownRef.current) clearInterval(retryCountdownRef.current);
     };
-  }, [agent, target, autoApprove, addMessage, startTimer]);
-  const handleExit = useCallback(async () => {
-    setCurrentStatus("Exiting");
-    if (timerRef.current) {
-      clearInterval(timerRef.current);
+  }, [agent, addMessage]);
+  return {
+    agent,
+    messages,
+    setMessages,
+    isProcessing,
+    currentStatus,
+    elapsedTime,
+    reasoning,
+    retryState,
+    currentTokens,
+    inputRequest,
+    setInputRequest,
+    stats,
+    executeTask,
+    abort,
+    cancelInputRequest,
+    addMessage
+  };
+};
+
+// src/platform/tui/components/MessageList.tsx
+import { Box, Text, Static } from "ink";
+import { jsx, jsxs } from "react/jsx-runtime";
+var MessageList = ({ messages }) => {
+  return /* @__PURE__ */ jsx(Static, { items: messages, children: (msg) => /* @__PURE__ */ jsx(Box, { children: /* @__PURE__ */ jsxs(Text, { color: MESSAGE_STYLES.colors[msg.type], dimColor: msg.type === "result", children: [
+    MESSAGE_STYLES.prefixes[msg.type],
+    " ",
+    msg.content
+  ] }) }, msg.id) });
+};
+
+// src/platform/tui/components/StatusDisplay.tsx
+import { Box as Box2, Text as Text2 } from "ink";
+import Spinner from "ink-spinner";
+import { jsx as jsx2, jsxs as jsxs2 } from "react/jsx-runtime";
+var StatusDisplay = ({
+  reasoning,
+  retryState,
+  isProcessing,
+  currentStatus,
+  elapsedTime,
+  currentTokens
+}) => {
+  const truncateError = (err) => {
+    return err.length > DISPLAY_LIMITS2.retryErrorPreview ? err.substring(0, DISPLAY_LIMITS2.retryErrorTruncated) + "..." : err;
+  };
+  const meta = formatMeta(elapsedTime * 1e3, currentTokens);
+  return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", marginTop: 0, children: [
+    reasoning.isActive && reasoning.content && /* @__PURE__ */ jsxs2(Box2, { marginBottom: 1, flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs2(Box2, { children: [
+        /* @__PURE__ */ jsx2(Text2, { color: THEME.status.warning, children: /* @__PURE__ */ jsx2(Spinner, { type: "dots" }) }),
+        /* @__PURE__ */ jsx2(Text2, { color: THEME.status.warning, bold: true, children: " REASONING" }),
+        /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
+          " ",
+          meta
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx2(Text2, { color: THEME.text.secondary, dimColor: true, children: reasoning.content.slice(-DISPLAY_LIMITS2.reasoningPreview) })
+    ] }),
+    retryState.isRetrying && /* @__PURE__ */ jsxs2(Box2, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx2(Text2, { color: THEME.status.warning, children: /* @__PURE__ */ jsx2(Spinner, { type: "dots" }) }),
+      /* @__PURE__ */ jsxs2(Text2, { color: THEME.status.warning, children: [
+        " \u27F3 Retry #",
+        retryState.attempt
+      ] }),
+      /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
+        " \xB7 ",
+        truncateError(retryState.error)
+      ] }),
+      /* @__PURE__ */ jsxs2(Text2, { color: THEME.accent.cyan, bold: true, children: [
+        " \xB7 ",
+        retryState.countdown,
+        "s"
+      ] })
+    ] }),
+    isProcessing && !reasoning.isActive && !retryState.isRetrying && /* @__PURE__ */ jsxs2(Box2, { marginBottom: 1, children: [
+      /* @__PURE__ */ jsx2(Text2, { color: THEME.spinner, children: /* @__PURE__ */ jsx2(Spinner, { type: "dots" }) }),
+      /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
+        " ",
+        currentStatus || "Processing"
+      ] }),
+      /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
+        " ",
+        meta
+      ] })
+    ] })
+  ] });
+};
+
+// src/platform/tui/components/ChatInput.tsx
+import { Box as Box3, Text as Text3 } from "ink";
+import TextInput from "ink-text-input";
+import { jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
+var ChatInput = ({
+  value,
+  onChange,
+  onSubmit,
+  placeholder,
+  inputRequest,
+  secretInput,
+  setSecretInput,
+  onSecretSubmit
+}) => {
+  return /* @__PURE__ */ jsx3(
+    Box3,
+    {
+      borderStyle: "single",
+      borderColor: inputRequest.active ? THEME.status.warning : THEME.border.default,
+      paddingX: 1,
+      children: inputRequest.active ? /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx3(Text3, { color: THEME.status.warning, children: "\u{1F512}" }),
+        /* @__PURE__ */ jsxs3(Text3, { color: THEME.text.muted, children: [
+          " ",
+          inputRequest.prompt,
+          " "
+        ] }),
+        /* @__PURE__ */ jsx3(
+          TextInput,
+          {
+            value: secretInput,
+            onChange: setSecretInput,
+            onSubmit: onSecretSubmit,
+            placeholder: "Enter input...",
+            mask: inputRequest.isPassword ? "\u2022" : void 0
+          }
+        )
+      ] }) : /* @__PURE__ */ jsxs3(Box3, { children: [
+        /* @__PURE__ */ jsx3(Text3, { color: THEME.text.secondary, children: "\u25B8" }),
+        /* @__PURE__ */ jsx3(Text3, { children: " " }),
+        /* @__PURE__ */ jsx3(
+          TextInput,
+          {
+            value,
+            onChange,
+            onSubmit,
+            placeholder
+          }
+        )
+      ] })
+    }
+  );
+};
+
+// src/platform/tui/components/footer.tsx
+import { Box as Box4, Text as Text4 } from "ink";
+import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
+var formatElapsed = (totalSeconds) => {
+  const hours = Math.floor(totalSeconds / 3600);
+  const minutes = Math.floor(totalSeconds % 3600 / 60);
+  const seconds = Math.floor(totalSeconds % 60);
+  const pad = (n) => String(n).padStart(2, "0");
+  if (hours > 0) {
+    return `${hours}:${pad(minutes)}:${pad(seconds)}`;
+  }
+  return `${minutes}:${pad(seconds)}`;
+};
+var Footer = ({ phase, targets, findings, todo, elapsedTime, isProcessing }) => {
+  return /* @__PURE__ */ jsxs4(
+    Box4,
+    {
+      paddingX: 1,
+      marginTop: 0,
+      justifyContent: "space-between",
+      children: [
+        /* @__PURE__ */ jsxs4(Box4, { gap: 2, children: [
+          /* @__PURE__ */ jsxs4(Text4, { color: THEME.text.secondary, children: [
+            "Phase: ",
+            /* @__PURE__ */ jsx4(Text4, { color: THEME.text.primary, children: phase })
+          ] }),
+          /* @__PURE__ */ jsxs4(Text4, { color: THEME.text.secondary, children: [
+            "Targets: ",
+            /* @__PURE__ */ jsx4(Text4, { color: THEME.text.primary, children: targets })
+          ] }),
+          /* @__PURE__ */ jsxs4(Text4, { color: THEME.text.secondary, children: [
+            "Findings: ",
+            /* @__PURE__ */ jsx4(Text4, { color: THEME.text.primary, children: findings })
+          ] }),
+          /* @__PURE__ */ jsxs4(Text4, { color: THEME.text.secondary, children: [
+            "Tasks: ",
+            /* @__PURE__ */ jsx4(Text4, { color: THEME.text.primary, children: todo })
+          ] })
+        ] }),
+        /* @__PURE__ */ jsxs4(Box4, { children: [
+          /* @__PURE__ */ jsx4(Text4, { color: THEME.text.muted, children: isProcessing ? "Running " : "Idle " }),
+          /* @__PURE__ */ jsx4(Text4, { color: THEME.text.secondary, children: formatElapsed(elapsedTime) })
+        ] })
+      ]
     }
+  );
+};
+var footer_default = Footer;
+
+// src/platform/tui/app.tsx
+import { jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
+var App = ({ autoApprove = false, target }) => {
+  const { exit } = useApp();
+  const [input, setInput] = useState2("");
+  const [secretInput, setSecretInput] = useState2("");
+  const {
+    agent,
+    messages,
+    setMessages,
+    isProcessing,
+    currentStatus,
+    elapsedTime,
+    reasoning,
+    retryState,
+    currentTokens,
+    inputRequest,
+    stats,
+    executeTask,
+    abort,
+    cancelInputRequest,
+    addMessage
+  } = useAgent(autoApprove, target);
+  const handleExit = useCallback2(() => {
+    if (inputRequest.active && inputRequest.resolve) inputRequest.resolve(null);
     exit();
-  }, [exit]);
-  useEffect(() => {
-    const onExit = () => {
-      handleExit();
-    };
-    process.on("SIGINT", onExit);
-    process.on("SIGTERM", onExit);
-    return () => {
-      process.off("SIGINT", onExit);
-      process.off("SIGTERM", onExit);
-    };
-  }, [handleExit, exit]);
-  const handleSubmit = useCallback(async (value) => {
+    setTimeout(() => process.exit(0), DISPLAY_LIMITS2.exitDelay);
+  }, [exit, inputRequest, cancelInputRequest]);
+  const handleCommand = useCallback2(async (cmd, args) => {
+    switch (cmd) {
+      case UI_COMMANDS.HELP:
+      case UI_COMMANDS.HELP_SHORT:
+        addMessage(UI_ROLES.SYSTEM, HELP_TEXT);
+        break;
+      case UI_COMMANDS.CLEAR:
+      case UI_COMMANDS.CLEAR_SHORT:
+        setMessages([]);
+        break;
+      case UI_COMMANDS.TARGET:
+      case UI_COMMANDS.TARGET_SHORT:
+        if (!args[0]) {
+          addMessage(UI_ROLES.ERROR, "Usage: /target <ip>");
+          break;
+        }
+        agent.addTarget(args[0]);
+        agent.setScope([args[0]]);
+        addMessage(UI_ROLES.SYSTEM, `Target \u2192 ${args[0]}`);
+        break;
+      case UI_COMMANDS.START:
+      case UI_COMMANDS.START_SHORT:
+        if (!agent.getState().getTargets().size) {
+          addMessage(UI_ROLES.ERROR, "Set target first: /target <ip>");
+          break;
+        }
+        executeTask(args.join(" ") || "Perform comprehensive penetration testing");
+        break;
+      case UI_COMMANDS.FINDINGS:
+      case UI_COMMANDS.FINDINGS_SHORT:
+        const findings = agent.getState().getFindings();
+        if (!findings.length) {
+          addMessage(UI_ROLES.SYSTEM, "No findings.");
+          break;
+        }
+        addMessage(UI_ROLES.SYSTEM, `--- ${findings.length} Findings ---`);
+        findings.forEach((f) => addMessage(UI_ROLES.SYSTEM, `[${f.severity}] ${f.title}`));
+        break;
+      case UI_COMMANDS.EXIT:
+      case UI_COMMANDS.QUIT:
+      case UI_COMMANDS.EXIT_SHORT:
+        handleExit();
+        break;
+      default:
+        addMessage(UI_ROLES.ERROR, `Unknown command: /${cmd}`);
+    }
+  }, [agent, addMessage, executeTask, setMessages, handleExit]);
+  const handleSubmit = useCallback2(async (value) => {
     const trimmed = value.trim();
     if (!trimmed) return;
     setInput("");
-    addMessage("user", trimmed);
+    addMessage(UI_ROLES.USER, trimmed);
     if (trimmed.startsWith("/")) {
       const [cmd, ...args] = trimmed.slice(1).split(" ");
-      switch (cmd) {
-        case "help":
-        case "h":
-          addMessage("system", `
-\u2500\u2500 Commands \u2500\u2500
-/target <ip>     Set target
-/start [goal]    Start autonomous pentest
-/stop            Stop operation
-/findings        Show findings
-/status          Show status
-/clear           Clear screen
-/exit            Exit
-
-\u2500\u2500 Examples \u2500\u2500
-/target 192.168.1.1
-/start "Recon the target"
-/findings
-                    `);
-          return;
-        case "target":
-        case "t":
-          if (args[0]) {
-            agent.addTarget(args[0]);
-            agent.setScope([args[0]]);
-            addMessage("system", `Target \u2192 ${args[0]}`);
-          } else {
-            addMessage("system", "Usage: /target <ip>");
-          }
-          return;
-        case "start":
-        case "s":
-          if (!agent.getState().getTargets().size) {
-            addMessage("error", "Set target first: /target <ip>");
-            return;
-          }
-          setIsProcessing(true);
-          startTimer();
-          setCurrentStatus("Initializing");
-          addMessage("system", `Starting: ${args.join(" ") || "Perform comprehensive penetration testing"}`);
-          try {
-            await agent.execute(args.join(" ") || "Perform comprehensive penetration testing");
-          } catch (e) {
-            addMessage("error", e instanceof Error ? e.message : String(e));
-          }
-          stopTimer();
-          setIsProcessing(false);
-          setCurrentStatus("");
-          return;
-        case "stop":
-          addMessage("system", "Stopping...");
-          setIsProcessing(false);
-          setCurrentStatus("");
-          return;
-        case "findings":
-        case "f":
-          const findings = agent.getState().getFindings();
-          if (findings.length === 0) {
-            addMessage("system", "No findings.");
-          } else {
-            addMessage("system", `--- ${findings.length} Findings ---`);
-            findings.forEach((f) => addMessage("system", `[${f.severity}] ${f.title}`));
-          }
-          return;
-        case "status":
-          const state = agent.getState();
-          addMessage("system", `Status:
-   Phase: ${agent.getPhase()}
-   Targets: ${state.getTargets().size}
-   Findings: ${state.getFindings().length}
-   TODO: ${state.getTodo().length}
-                    `);
-          return;
-        case "clear":
-        case "c":
-          setMessages([]);
-          return;
-        case "exit":
-        case "quit":
-        case "q":
-          await handleExit();
-          return;
-        default:
-          addMessage("error", `Unknown command: /${cmd}`);
-          return;
-      }
-    }
-    setIsProcessing(true);
-    startTimer();
-    setCurrentStatus("Thinking");
-    try {
-      const response = await agent.execute(trimmed);
-      addMessage("assistant", response);
-    } catch (e) {
-      addMessage("error", e instanceof Error ? e.message : String(e));
-    } finally {
-      stopTimer();
-      setIsProcessing(false);
-      setCurrentStatus("");
-    }
-  }, [agent, addMessage, startTimer, stopTimer, handleExit]);
-  useInput((input2, key) => {
-    if (key.ctrl && input2 === "c") {
-      if (isProcessing) {
-        setIsProcessing(false);
-        stopTimer();
-        setCurrentStatus("");
-        addMessage("system", "Interrupted");
-      } else {
-        exit();
-      }
-      return;
-    }
+      await handleCommand(cmd, args);
+    } else {
+      await executeTask(trimmed);
+    }
+  }, [addMessage, executeTask, handleCommand]);
+  const handleSecretSubmit = useCallback2((value) => {
+    if (!inputRequest.active || !inputRequest.resolve) return;
+    const displayText = inputRequest.isPassword ? "\u2022".repeat(value.length) : value;
+    addMessage(UI_ROLES.SYSTEM, `\u21B3 ${inputRequest.prompt} ${displayText}`);
+    inputRequest.resolve(value);
+    setSecretInput("");
+  }, [inputRequest, addMessage]);
+  useInput((ch, key) => {
+    if (key.escape) {
+      if (inputRequest.active) cancelInputRequest();
+      else if (isProcessing) abort();
+    }
+    if (key.ctrl && ch === "c") handleExit();
   });
-  return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", paddingX: 1, children: [
-    /* @__PURE__ */ jsx2(Box2, { flexDirection: "column", marginBottom: 1, flexGrow: 1, children: /* @__PURE__ */ jsx2(Static, { items: messages, children: (msg) => {
-      const colors = {
-        user: THEME.text.accent,
-        assistant: THEME.text.primary,
-        system: THEME.text.muted,
-        error: THEME.status.error,
-        tool: THEME.status.running,
-        result: THEME.text.muted,
-        thinking: THEME.status.warning
-      };
-      const prefixes = {
-        user: "\u276F",
-        assistant: ">",
-        system: "\u2022",
-        error: "\u2717",
-        tool: "  \u23BF",
-        result: "  \u2713",
-        thinking: "\u{1F9E0}"
-      };
-      return /* @__PURE__ */ jsx2(Box2, { children: /* @__PURE__ */ jsxs2(Text2, { color: colors[msg.type], dimColor: msg.type === "result", children: [
-        prefixes[msg.type],
-        " ",
-        msg.content
-      ] }) }, msg.id);
-    } }) }),
-    /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", marginTop: 0, children: [
-      thinking.isActive && thinking.content && /* @__PURE__ */ jsxs2(Box2, { marginBottom: 1, children: [
-        /* @__PURE__ */ jsx2(Text2, { color: THEME.status.running, children: /* @__PURE__ */ jsx2(Spinner, { type: "dots" }) }),
-        /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
-          " ",
-          "Thinking: "
-        ] }),
-        /* @__PURE__ */ jsx2(Text2, { color: THEME.text.secondary, dimColor: true, children: thinking.content.slice(-200) })
-      ] }),
-      isProcessing && !thinking.isActive && /* @__PURE__ */ jsxs2(Box2, { marginBottom: 1, children: [
-        /* @__PURE__ */ jsx2(Text2, { color: THEME.spinner, children: /* @__PURE__ */ jsx2(Spinner, { type: "dots" }) }),
-        /* @__PURE__ */ jsxs2(Text2, { color: THEME.text.muted, children: [
-          " ",
-          currentStatus || "Processing"
-        ] })
-      ] }),
-      /* @__PURE__ */ jsx2(
-        Box2,
+  useEffect2(() => {
+    const onSignal = () => handleExit();
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+    return () => {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+    };
+  }, [handleExit]);
+  return /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", paddingX: 1, children: [
+    /* @__PURE__ */ jsx5(Box5, { flexDirection: "column", marginBottom: 1, flexGrow: 1, children: /* @__PURE__ */ jsx5(MessageList, { messages }) }),
+    /* @__PURE__ */ jsxs5(Box5, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx5(
+        StatusDisplay,
         {
-          borderStyle: "single",
-          borderColor: THEME.border.default,
-          paddingX: 1,
-          children: /* @__PURE__ */ jsxs2(Box2, { children: [
-            /* @__PURE__ */ jsx2(Text2, { color: THEME.text.secondary, children: "\u25B8" }),
-            /* @__PURE__ */ jsx2(Text2, { children: " " }),
-            /* @__PURE__ */ jsx2(
-              TextInput,
-              {
-                value: input,
-                onChange: setInput,
-                onSubmit: handleSubmit,
-                placeholder: "Message or /help..."
-              }
-            )
-          ] })
+          reasoning,
+          retryState,
+          isProcessing,
+          currentStatus,
+          elapsedTime,
+          currentTokens
+        }
+      ),
+      /* @__PURE__ */ jsx5(
+        ChatInput,
+        {
+          value: input,
+          onChange: setInput,
+          onSubmit: handleSubmit,
+          placeholder: "Message or /help...",
+          inputRequest,
+          secretInput,
+          setSecretInput,
+          onSecretSubmit: handleSecretSubmit
         }
       ),
-      /* @__PURE__ */ jsx2(
+      /* @__PURE__ */ jsx5(
         footer_default,
         {
           phase: stats.phase,
@@ -2956,7 +2939,7 @@ var EXIT_CODE = {
 };
 
 // src/platform/tui/main.tsx
-import { jsx as jsx3 } from "react/jsx-runtime";
+import { jsx as jsx6 } from "react/jsx-runtime";
 var program = new Command();
 program.name("pentesting").version(APP_VERSION).description(APP_DESCRIPTION).option("--dangerously-skip-permissions", "Skip all permission prompts (dangerous!)").option("-t, --target <target>", "Set initial target");
 program.command("interactive", { isDefault: true }).alias("i").description("Start interactive TUI mode").action(async () => {
@@ -2972,7 +2955,7 @@ program.command("interactive", { isDefault: true }).alias("i").description("Star
     console.log(chalk.hex(THEME.status.error)("[!] All tool executions will be auto-approved!\n"));
   }
   const { waitUntilExit } = render(
-    /* @__PURE__ */ jsx3(
+    /* @__PURE__ */ jsx6(
       app_default,
       {
         autoApprove: skipPermissions,
@@ -2991,7 +2974,7 @@ program.command("run <objective>").alias("r").description("Run a single objectiv
   }
   console.log(chalk.hex(THEME.text.accent)(`[target] Objective: ${objective}
 `));
-  const agent = new MainAgent();
+  const agent = AgentFactory.createMainAgent(skipPermissions);
   if (skipPermissions) {
     agent.setAutoApprove(true);
   }
@@ -3029,10 +3012,7 @@ program.command("scan <target>").description("Quick scan a target").option("-s,
   console.log(chalk.hex(THEME.text.accent)(`
 [scan] Target: ${target} (${options.scanType})
 `));
-  const agent = new MainAgent();
-  if (skipPermissions) {
-    agent.setAutoApprove(true);
-  }
+  const agent = AgentFactory.createMainAgent(skipPermissions);
   agent.addTarget(target);
   agent.setScope([target]);
   const shutdown = async (exitCode = 0) => {