pwnkit-cli 0.3.0 → 0.3.1

package/README.md

@@ -1,34 +1,34 @@
 <p align="center">
-  <img src="assets/pwnkit-icon.gif" alt="pwnkit" width="80" />
+ <img src="assets/pwnkit-icon.gif" alt="pwnkit" width="80" />
 </p>
 
 <h1 align="center">pwnkit</h1>
 
 <p align="center">
-  <strong>General-purpose autonomous pentesting framework</strong><br/>
-  <em>Scan LLM endpoints. Audit npm packages. Review source code. Pentest web apps. Re-exploit to kill false positives.</em>
+ <strong>General-purpose autonomous pentesting framework</strong><br/>
+ <em>Scan LLM endpoints. Audit npm packages. Review source code. Pentest web apps. Re-exploit to kill false positives.</em>
 </p>
 
 <p align="center">
-  <a href="https://www.npmjs.com/package/pwnkit-cli"><img src="https://img.shields.io/npm/v/pwnkit-cli?color=crimson&style=flat-square" alt="npm version" /></a>
-  <a href="https://github.com/peaktwilight/pwnkit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue?style=flat-square" alt="license" /></a>
-  <a href="https://github.com/peaktwilight/pwnkit/actions"><img src="https://img.shields.io/github/actions/workflow/status/peaktwilight/pwnkit/ci.yml?style=flat-square" alt="CI" /></a>
-  <a href="https://github.com/peaktwilight/pwnkit/stargazers"><img src="https://img.shields.io/github/stars/peaktwilight/pwnkit?style=flat-square&color=gold" alt="stars" /></a>
-  <a href="https://pwnkit.com"><img src="https://pwnkit.com/badge/peaktwilight/pwnkit" alt="pwnkit verified" /></a>
+ <a href="https://www.npmjs.com/package/pwnkit-cli"><img src="https://img.shields.io/npm/v/pwnkit-cli?color=crimson&style=flat-square" alt="npm version" /></a>
+ <a href="https://github.com/peaktwilight/pwnkit/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue?style=flat-square" alt="license" /></a>
+ <a href="https://github.com/peaktwilight/pwnkit/actions"><img src="https://img.shields.io/github/actions/workflow/status/peaktwilight/pwnkit/ci.yml?style=flat-square" alt="CI" /></a>
+ <a href="https://github.com/peaktwilight/pwnkit/stargazers"><img src="https://img.shields.io/github/stars/peaktwilight/pwnkit?style=flat-square&color=gold" alt="stars" /></a>
+ <a href="https://pwnkit.com"><img src="https://pwnkit.com/badge/peaktwilight/pwnkit" alt="pwnkit verified" /></a>
 </p>
 
 <p align="center">
-  <img src="assets/demo.gif" alt="pwnkit Demo" width="700" />
+ <img src="assets/demo.gif" alt="pwnkit Demo" width="700" />
 </p>
 
 <p align="center">
-  <a href="#quick-start">Quick Start</a> &middot;
-  <a href="#commands">Commands</a> &middot;
-  <a href="#how-it-works">How It Works</a> &middot;
-  <a href="#what-pwnkit-scans">What It Scans</a> &middot;
-  <a href="#how-it-compares">Comparison</a> &middot;
-  <a href="#github-action">CI/CD</a> &middot;
-  <a href="#built-by">About</a>
+ <a href="#quick-start">Quick Start</a> &middot;
+ <a href="#commands">Commands</a> &middot;
+ <a href="#how-it-works">How It Works</a> &middot;
+ <a href="#what-pwnkit-scans">What It Scans</a> &middot;
+ <a href="#how-it-compares">Comparison</a> &middot;
+ <a href="#github-action">CI/CD</a> &middot;
+ <a href="#built-by">About</a>
 </p>
 
 ---
@@ -50,10 +50,10 @@ npx pwnkit-cli audit lodash
 npx pwnkit-cli review ./my-ai-app
 
 # Or just point pwnkit at a target — it auto-detects what to do
-npx pwnkit-cli express          # audits npm package
-npx pwnkit-cli ./my-repo        # reviews source code
-npx pwnkit-cli https://github.com/user/repo  # clones and reviews
-npx pwnkit-cli https://example.com           # scans web endpoint
+npx pwnkit-cli express     # audits npm package
+npx pwnkit-cli ./my-repo    # reviews source code
+npx pwnkit-cli https://github.com/user/repo # clones and reviews
+npx pwnkit-cli https://example.com      # scans web endpoint
 ```
 
 That's it. pwnkit discovers your attack surface, launches targeted attacks, verifies findings, and generates a report — all in under 5 minutes.
@@ -90,16 +90,16 @@ pwnkit ships five commands — from quick API probes to deep source-level audits
 pwnkit runs autonomous AI agents in a research-then-verify pipeline. Each agent uses tools (`read_file`, `run_command`, `send_prompt`, `save_finding`) and makes multi-turn decisions — adapting its strategy based on what it learns:
 
 ```
-  +-----------+     +------------------+     +-----------+
-  | RESEARCH  | --> |  BLIND VERIFY    | --> |  REPORT   |
-  | (Discover |     | (PoC + path only |     | (Output)  |
-  |  + Attack |     |  no reasoning)   |     |           |
-  |  + PoC)   |     +------------------+     +-----------+
-  +-----------+      Runs in parallel         Only confirmed
-   Single agent      per finding —            findings in SARIF,
-   session: recon,   independently            Markdown, and JSON
-   payloads, and     reproduces or            with severity +
-   proof-of-concept  kills finding            remediation
+ +-----------+   +------------------+   +-----------+
+ | RESEARCH | --> | BLIND VERIFY  | --> | REPORT  |
+ | (Discover |   | (PoC + path only |   | (Output) |
+ | + Attack |   | no reasoning)  |   |      |
+ | + PoC)  |   +------------------+   +-----------+
+ +-----------+   Runs in parallel     Only confirmed
+  Single agent   per finding —      findings in SARIF,
+  session: recon,  independently      Markdown, and JSON
+  payloads, and   reproduces or      with severity +
+  proof-of-concept kills finding      remediation
 ```
 
 | Agent | Role | What It Does |
@@ -178,7 +178,7 @@ Bring your own agent CLI — pwnkit orchestrates it:
 | `claude` | `--runtime claude` | Attack generation, deep analysis — spawns Claude Code CLI |
 | `codex` | `--runtime codex` | Verification, source analysis — spawns Codex CLI |
 | `gemini` | `--runtime gemini` | Large context source analysis — spawns Gemini CLI |
-| `opencode` | `--runtime opencode` | Multi-provider flexibility — spawns OpenCode CLI |
+| `` | `--runtime ` | Multi-provider flexibility — spawns CLI |
 | `auto` | `--runtime auto` | Best overall — auto-detects installed runtimes, picks best per stage |
 
 Combined with scan modes:
@@ -190,7 +190,7 @@ Combined with scan modes:
 | `mcp` | `--mode mcp` | Connect to MCP server, enumerate tools, test each for security issues |
 | `web` | `--mode web` | Full web pentesting — SQLi, XSS, SSRF, auth bypass, IDOR |
 
-> `deep`, `mcp`, and `web` modes require a process runtime (`claude`, `codex`, `gemini`, `opencode`, or `auto`).
+> `deep`, `mcp`, and `web` modes require a process runtime (`claude`, `codex`, `gemini`, ``, or `auto`).
 
 ## How It Compares
 
@@ -220,28 +220,28 @@ name: AI Security Scan
 on: [push, pull_request]
 
 permissions:
-  contents: read
-  security-events: write
+ contents: read
+ security-events: write
 
 jobs:
-  pwnkit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run pwnkit
-        uses: peaktwilight/pwnkit/action@v1
-        with:
-          target: ${{ secrets.STAGING_API_URL }}
-          depth: default  # quick | default | deep
-          fail-on-severity: high  # critical | high | medium | low | info | none
-        env:
-          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
-
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: pwnkit-report/report.sarif
+ pwnkit:
+  runs-on: ubuntu-latest
+  steps:
+   - uses: actions/checkout@v4
+
+   - name: Run pwnkit
+    uses: peaktwilight/pwnkit/action@v1
+    with:
+     target: ${{ secrets.STAGING_API_URL }}
+     depth: default # quick | default | deep
+     fail-on-severity: high # critical | high | medium | low | info | none
+    env:
+     OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+
+   - name: Upload SARIF
+    uses: github/codeql-action/upload-sarif@v3
+    with:
+     sarif_file: pwnkit-report/report.sarif
 ```
 
 > **API Key Priority:** pwnkit checks for `OPENROUTER_API_KEY` first, then `ANTHROPIC_API_KEY`, then `OPENAI_API_KEY`. OpenRouter gives you access to many models (including free ones) through a single key at [openrouter.ai](https://openrouter.ai).
@@ -291,7 +291,7 @@ Finding lifecycle: `discovered → verified → confirmed → scored → reporte
 - [x] MCP server scanning
 - [x] npm package auditing
 - [x] Source code review (local + GitHub)
-- [x] Multi-runtime support (Claude, Codex, Gemini, OpenCode)
+- [x] Multi-runtime support (Claude, Codex, Gemini)
 - [x] Multi-turn agentic attacks (agents adapt payloads based on responses)
 - [x] Web pentesting mode (SQLi, XSS, SSRF, auth bypass, IDOR)
 - [ ] RAG pipeline security (poisoning, extraction)

package/dist/index.js

@@ -3561,7 +3561,7 @@ var VERSION, DEPTH_CONFIG;
 var init_constants = __esm({
   "packages/shared/dist/constants.js"() {
     "use strict";
-    VERSION = "0.3.0";
+    VERSION = "0.3.1";
     DEPTH_CONFIG = {
       quick: { maxTemplates: 5, maxPayloadsPerTemplate: 1, multiTurn: false },
       default: { maxTemplates: 20, maxPayloadsPerTemplate: 3, multiTurn: false },
@@ -10924,8 +10924,7 @@ var init_process = __esm({
     RUNTIME_COMMANDS = {
       claude: "claude",
       codex: "codex",
-      gemini: "gemini",
-      opencode: "opencode"
+      gemini: "gemini"
     };
     ProcessRuntime = class {
       type;
@@ -11064,8 +11063,6 @@ var init_process = __esm({
             const args = ["-p", prompt, "--output-format", "stream-json"];
             return args;
           }
-          case "opencode":
-            return ["-p", prompt, "--output", "text"];
           default:
             return ["-p", prompt];
         }
@@ -11089,6 +11086,75 @@ var init_process = __esm({
   }
 });
 
+// packages/core/dist/runtime/registry.js
+var registry_exports = {};
+__export(registry_exports, {
+  RUNTIME_REGISTRY: () => RUNTIME_REGISTRY,
+  detectAvailableRuntimes: () => detectAvailableRuntimes,
+  getRuntimeInfo: () => getRuntimeInfo,
+  pickRuntimeForStage: () => pickRuntimeForStage
+});
+function pickRuntimeForStage(stage, availableRuntimes) {
+  const prefs = STAGE_PREFERENCES[stage];
+  for (const rt2 of prefs) {
+    if (availableRuntimes.has(rt2))
+      return rt2;
+  }
+  const first = availableRuntimes.values().next();
+  return first.done ? "claude" : first.value;
+}
+async function detectAvailableRuntimes() {
+  const { ProcessRuntime: ProcessRuntime2 } = await Promise.resolve().then(() => (init_process(), process_exports));
+  const available = /* @__PURE__ */ new Set();
+  const checks = RUNTIME_REGISTRY.map(async (info) => {
+    const rt2 = new ProcessRuntime2({ type: info.type, timeout: 5e3 });
+    if (await rt2.isAvailable()) {
+      available.add(info.type);
+    }
+  });
+  await Promise.all(checks);
+  return available;
+}
+function getRuntimeInfo(type) {
+  return RUNTIME_REGISTRY.find((r) => r.type === type);
+}
+var RUNTIME_REGISTRY, STAGE_PREFERENCES;
+var init_registry = __esm({
+  "packages/core/dist/runtime/registry.js"() {
+    "use strict";
+    RUNTIME_REGISTRY = [
+      {
+        type: "claude",
+        command: "claude",
+        description: "Claude Code CLI \u2014 best for creative attack generation and deep analysis",
+        strengths: ["attack", "source-analysis", "report"],
+        supportsSystemPrompt: true
+      },
+      {
+        type: "codex",
+        command: "codex",
+        description: "Codex CLI \u2014 strong at code review, pattern matching, and verification",
+        strengths: ["verify", "source-analysis", "discovery"],
+        supportsSystemPrompt: false
+      },
+      {
+        type: "gemini",
+        command: "gemini",
+        description: "Gemini CLI \u2014 large context window, good for source analysis",
+        strengths: ["source-analysis", "report", "discovery"],
+        supportsSystemPrompt: false
+      }
+    ];
+    STAGE_PREFERENCES = {
+      "discovery": ["claude", "codex", "gemini"],
+      "source-analysis": ["claude", "gemini", "codex"],
+      "attack": ["claude", "codex", "gemini"],
+      "verify": ["codex", "claude", "gemini"],
+      "report": ["claude", "gemini", "codex"]
+    };
+  }
+});
+
 // packages/db/dist/schema.js
 var schema_exports = {};
 __export(schema_exports, {
@@ -44109,14 +44175,22 @@ var init_devtools_window_polyfill = __esm({
   }
 });
 
+// stub:react-devtools-core
+var react_devtools_core_default;
+var init_react_devtools_core = __esm({
+  "stub:react-devtools-core"() {
+    react_devtools_core_default = {};
+  }
+});
+
 // node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react@19.2.4/node_modules/ink/build/devtools.js
 var devtools_exports = {};
-import devtools from "react-devtools-core";
 var init_devtools = __esm({
   "node_modules/.pnpm/ink@6.8.0_@types+react@19.2.14_react@19.2.4/node_modules/ink/build/devtools.js"() {
     init_devtools_window_polyfill();
-    devtools.initialize();
-    devtools.connectToDevTools();
+    init_react_devtools_core();
+    react_devtools_core_default.initialize();
+    react_devtools_core_default.connectToDevTools();
   }
 });
 
@@ -52419,12 +52493,20 @@ function formatDuration2(ms) {
 }
 function StageRow({ stage }) {
   const icon = stage.status === "done" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: GREEN, children: "\u2713" }) : stage.status === "running" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: CRIMSON, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(build_default, { type: "dots" }) }) : stage.status === "error" ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: CRIMSON, children: "\u2717" }) : /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: GRAY, children: "\u25CC" });
+  let verifyCount = "";
+  if (stage.id === "verify" && stage.status === "done" && stage.actions.length > 0) {
+    const confirmed = stage.actions.filter((a) => a.startsWith("\u2713")).length;
+    const total = stage.actions.filter((a) => a.startsWith("\u2713") || a.startsWith("\u2717")).length;
+    if (total > 0) {
+      verifyCount = `${confirmed}/${total} confirmed`;
+    }
+  }
   return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { flexDirection: "column", children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Box_default, { gap: 1, children: [
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { children: "  " }),
       icon,
       /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { bold: true, color: stage.status === "pending" ? GRAY : void 0, children: stage.label.padEnd(12) }),
-      stage.detail && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: stage.status === "done" ? GRAY : void 0, dimColor: stage.status === "done", children: stage.detail }),
+      verifyCount ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: GREEN, children: verifyCount }) : stage.detail ? /* @__PURE__ */ (0, import_jsx_runtime.jsx)(Text, { color: stage.status === "done" ? GRAY : void 0, dimColor: stage.status === "done", children: stage.detail }) : null,
       stage.duration !== void 0 && /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, { color: GRAY, children: [
         " ",
         formatDuration2(stage.duration)
@@ -52434,7 +52516,19 @@ function StageRow({ stage }) {
       if (stage.id === "verify") {
         const isConfirmed = action.startsWith("\u2713");
         const isRejected = action.startsWith("\u2717");
-        return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, { color: isConfirmed ? GREEN : isRejected ? GRAY : CYAN, children: [
+        if (isConfirmed) {
+          return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, { color: GREEN, bold: true, children: [
+            "\u2192 ",
+            action
+          ] }, i);
+        }
+        if (isRejected) {
+          return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, { color: CRIMSON, dimColor: true, strikethrough: true, children: [
+            "\u2192 ",
+            action
+          ] }, i);
+        }
+        return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(Text, { color: CYAN, children: [
           "\u2192 ",
           action
         ] }, i);
@@ -52627,10 +52721,12 @@ function renderScanUI(opts) {
     if (event.type === "verify:result") {
       const data = event.data;
       const confirmed = data?.confirmed;
-      const msg2 = event.message ?? "";
+      const title = data?.title ?? event.message;
+      const reason = data?.reason;
+      const label = confirmed ? `\u2713 ${title}` : `\u2717 ${title}${reason ? ` \u2014 ${reason}` : ""}`;
       updateStage("verify", (s) => ({
         ...s,
-        actions: [...s.actions, `${confirmed ? "\u2713" : "\u2717"} ${msg2}`]
+        actions: [...s.actions, label]
       }));
       return;
     }
@@ -54859,68 +54955,7 @@ var LlmApiRuntime = class {
 
 // packages/core/dist/runtime/index.js
 init_process();
-
-// packages/core/dist/runtime/registry.js
-var RUNTIME_REGISTRY = [
-  {
-    type: "claude",
-    command: "claude",
-    description: "Claude Code CLI \u2014 best for creative attack generation and deep analysis",
-    strengths: ["attack", "source-analysis", "report"],
-    supportsSystemPrompt: true
-  },
-  {
-    type: "codex",
-    command: "codex",
-    description: "Codex CLI \u2014 strong at code review, pattern matching, and verification",
-    strengths: ["verify", "source-analysis", "discovery"],
-    supportsSystemPrompt: false
-  },
-  {
-    type: "gemini",
-    command: "gemini",
-    description: "Gemini CLI \u2014 large context window, good for source analysis",
-    strengths: ["source-analysis", "report", "discovery"],
-    supportsSystemPrompt: false
-  },
-  {
-    type: "opencode",
-    command: "opencode",
-    description: "OpenCode CLI \u2014 multi-provider runtime with flexible model selection",
-    strengths: ["source-analysis", "verify", "attack"],
-    supportsSystemPrompt: false
-  }
-];
-var STAGE_PREFERENCES = {
-  "discovery": ["claude", "codex", "gemini", "opencode"],
-  "source-analysis": ["claude", "gemini", "codex", "opencode"],
-  "attack": ["claude", "codex", "gemini", "opencode"],
-  "verify": ["codex", "claude", "gemini", "opencode"],
-  "report": ["claude", "gemini", "codex", "opencode"]
-};
-function pickRuntimeForStage(stage, availableRuntimes) {
-  const prefs = STAGE_PREFERENCES[stage];
-  for (const rt2 of prefs) {
-    if (availableRuntimes.has(rt2))
-      return rt2;
-  }
-  const first = availableRuntimes.values().next();
-  return first.done ? "claude" : first.value;
-}
-async function detectAvailableRuntimes() {
-  const { ProcessRuntime: ProcessRuntime2 } = await Promise.resolve().then(() => (init_process(), process_exports));
-  const available = /* @__PURE__ */ new Set();
-  const checks = RUNTIME_REGISTRY.map(async (info) => {
-    const rt2 = new ProcessRuntime2({ type: info.type, timeout: 5e3 });
-    if (await rt2.isAvailable()) {
-      available.add(info.type);
-    }
-  });
-  await Promise.all(checks);
-  return available;
-}
-
-// packages/core/dist/runtime/index.js
+init_registry();
 init_process();
 function createRuntime(config) {
   switch (config.type) {
@@ -54929,11 +54964,13 @@ function createRuntime(config) {
     case "claude":
     case "codex":
     case "gemini":
-    case "opencode":
       return new ProcessRuntime(config);
   }
 }
 
+// packages/core/dist/scanner.js
+init_registry();
+
 // packages/core/dist/http.js
 async function sendPrompt(target, prompt, options) {
   const start = Date.now();
@@ -56706,7 +56743,7 @@ async function scan(config, onEvent, dbPath) {
   if (isAuto) {
     availableRuntimes = await detectAvailableRuntimes();
     if (availableRuntimes.size === 0) {
-      throw new Error("--runtime auto: no CLI runtimes (claude, codex, gemini, opencode) detected. Install at least one or use --runtime api.");
+      throw new Error("--runtime auto: no CLI runtimes (claude, codex, gemini) detected. Install at least one or use --runtime api.");
     }
   }
   function getRuntimeForStage(stage) {
@@ -57559,9 +57596,12 @@ Rate based on REAL exploitability:
 - Call done when you've thoroughly reviewed the codebase`;
 }
 
+// packages/core/dist/agent-runner.js
+init_registry();
+
 // packages/core/dist/shared-analysis.js
 import { execFileSync } from "node:child_process";
-var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini", "opencode"]);
+var CLI_RUNTIME_TYPES = /* @__PURE__ */ new Set(["claude", "codex", "gemini"]);
 function bufferToString(value) {
   if (!value) {
     return "";
@@ -58700,77 +58740,87 @@ async function runPipeline(opts) {
       stage: "analyze",
       message: `Analysis complete: ${semgrepFindings.length} semgrep findings, ${npmAuditFindings.length} npm advisories`
     });
-    emit({ type: "stage:start", stage: "research", message: "Researching vulnerabilities..." });
-    const researchEmit = (event) => {
-      if (event.type === "stage:start") {
-        emit({ type: "stage:start", stage: "research", message: event.message });
-      } else if (event.type === "finding") {
-        emit(event);
-      }
-    };
+    const hasApiKey = !!(opts.apiKey || process.env.OPENROUTER_API_KEY || process.env.ANTHROPIC_API_KEY || process.env.OPENAI_API_KEY);
+    const { detectAvailableRuntimes: detectAvailableRuntimes2 } = await Promise.resolve().then(() => (init_registry(), registry_exports));
+    const availableRuntimes = await detectAvailableRuntimes2();
+    const hasCliRuntime = availableRuntimes.size > 0;
+    if (!hasApiKey && !hasCliRuntime) {
+      warnings.push({ stage: "research", message: "No API key or CLI runtime available. AI analysis skipped. Set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, or OPENAI_API_KEY." });
+      emit({ type: "stage:end", stage: "research", message: "Skipped \u2014 no API key or CLI runtime" });
+      emit({ type: "stage:end", stage: "verify", message: "Skipped" });
+    }
     let findings2 = [];
-    if (prepared.resolvedType === "npm-package" || prepared.resolvedType === "source-code") {
-      const targetLabel = prepared.resolvedType === "npm-package" ? `npm package ${prepared.packageName}@${prepared.packageVersion}` : "repository";
-      const agentSystemPrompt = researchPrompt(prepared.scopePath, semgrepFindings.map((f) => ({ ruleId: f.ruleId, message: f.message, path: f.path, startLine: f.startLine })), npmAuditFindings.map((f) => ({ name: f.name, severity: f.severity, title: f.title })), targetLabel);
-      findings2 = await runAnalysisAgent({
-        role: prepared.resolvedType === "npm-package" ? "audit" : "review",
-        scopePath: prepared.scopePath,
-        target: prepared.resolvedTarget,
-        scanId,
-        config: {
-          runtime: opts.runtime,
-          timeout: opts.timeout,
-          depth: opts.depth,
-          apiKey: opts.apiKey,
-          model: opts.model
-        },
-        db,
-        emit: researchEmit,
-        cliPrompt: buildCliPrompt(prepared.scopePath, semgrepFindings, npmAuditFindings, targetLabel),
-        agentSystemPrompt,
-        cliSystemPrompt: "You are a security researcher performing an authorized source code audit. For EACH vulnerability you find, output it using the exact ---FINDING--- / ---END--- format specified in the prompt. Do NOT write prose analysis \u2014 only output structured finding blocks. If you find no vulnerabilities, say 'No vulnerabilities found.' and nothing else."
-      });
-    } else {
-      warnings.push({
+    if (hasApiKey || hasCliRuntime) {
+      emit({ type: "stage:start", stage: "research", message: "Researching vulnerabilities..." });
+      const researchEmit = (event) => {
+        if (event.type === "stage:start") {
+          emit({ type: "stage:start", stage: "research", message: event.message });
+        } else if (event.type === "finding") {
+          emit(event);
+        }
+      };
+      if (prepared.resolvedType === "npm-package" || prepared.resolvedType === "source-code") {
+        const targetLabel = prepared.resolvedType === "npm-package" ? `npm package ${prepared.packageName}@${prepared.packageVersion}` : "repository";
+        const agentSystemPrompt = researchPrompt(prepared.scopePath, semgrepFindings.map((f) => ({ ruleId: f.ruleId, message: f.message, path: f.path, startLine: f.startLine })), npmAuditFindings.map((f) => ({ name: f.name, severity: f.severity, title: f.title })), targetLabel);
+        findings2 = await runAnalysisAgent({
+          role: prepared.resolvedType === "npm-package" ? "audit" : "review",
+          scopePath: prepared.scopePath,
+          target: prepared.resolvedTarget,
+          scanId,
+          config: {
+            runtime: opts.runtime,
+            timeout: opts.timeout,
+            depth: opts.depth,
+            apiKey: opts.apiKey,
+            model: opts.model
+          },
+          db,
+          emit: researchEmit,
+          cliPrompt: buildCliPrompt(prepared.scopePath, semgrepFindings, npmAuditFindings, targetLabel),
+          agentSystemPrompt,
+          cliSystemPrompt: "You are a security researcher performing an authorized source code audit. For EACH vulnerability you find, output it using the exact ---FINDING--- / ---END--- format specified in the prompt. Do NOT write prose analysis \u2014 only output structured finding blocks. If you find no vulnerabilities, say 'No vulnerabilities found.' and nothing else."
+        });
+      } else {
+        warnings.push({
+          stage: "research",
+          message: `Target type "${prepared.resolvedType}" is not yet supported in the unified pipeline. Use 'pwnkit scan' for URL/web-app targets.`
+        });
+      }
+      emit({
+        type: "stage:end",
         stage: "research",
-        message: `Target type "${prepared.resolvedType}" is not yet supported in the unified pipeline. Use 'pwnkit scan' for URL/web-app targets.`
+        message: `${findings2.length} findings discovered`
       });
-    }
-    emit({
-      type: "stage:end",
-      stage: "research",
-      message: `${findings2.length} findings discovered`
-    });
-    if (findings2.length > 0 && (prepared.resolvedType === "source-code" || prepared.resolvedType === "npm-package")) {
-      emit({ type: "stage:start", stage: "verify", message: `Blind-verifying ${findings2.length} findings...` });
-      try {
-        const verifyResults = await Promise.all(findings2.map(async (finding) => {
-          const filePath = finding.evidence.request || "";
-          const poc = finding.evidence.response || finding.evidence.analysis || "";
-          const claimedSeverity = finding.severity;
-          const verifySystemPrompt = blindVerifyPrompt(filePath, poc, claimedSeverity, prepared.scopePath);
-          const verifyEmit = (event) => {
-            if (event.type === "finding") {
-              emit({ type: "verify:result", message: `Confirmed: ${finding.title}`, data: { confirmed: true, finding } });
-            }
-          };
-          try {
-            const verifiedFindings = await runAnalysisAgent({
-              role: "review",
-              scopePath: prepared.scopePath,
-              target: prepared.resolvedTarget,
-              scanId,
-              config: {
-                runtime: "api",
-                // API runtime: cheaper and faster for focused verification
-                timeout: Math.min(opts.timeout ?? 12e4, 12e4),
-                depth: "quick",
-                apiKey: opts.apiKey,
-                model: opts.model
-              },
-              db,
-              emit: verifyEmit,
-              cliPrompt: `Verify this vulnerability in ${filePath}:
+      if (findings2.length > 0 && (prepared.resolvedType === "source-code" || prepared.resolvedType === "npm-package")) {
+        emit({ type: "stage:start", stage: "verify", message: `Blind-verifying ${findings2.length} findings...` });
+        try {
+          const verifyResults = await Promise.all(findings2.map(async (finding) => {
+            const filePath = finding.evidence.request || "";
+            const poc = finding.evidence.response || finding.evidence.analysis || "";
+            const claimedSeverity = finding.severity;
+            const verifySystemPrompt = blindVerifyPrompt(filePath, poc, claimedSeverity, prepared.scopePath);
+            const verifyEmit = (event) => {
+              if (event.type === "finding") {
+                emit({ type: "verify:result", message: `Confirmed: ${finding.title}`, data: { confirmed: true, finding } });
+              }
+            };
+            try {
+              const verifiedFindings = await runAnalysisAgent({
+                role: "review",
+                scopePath: prepared.scopePath,
+                target: prepared.resolvedTarget,
+                scanId,
+                config: {
+                  runtime: "api",
+                  // API runtime: cheaper and faster for focused verification
+                  timeout: Math.min(opts.timeout ?? 12e4, 12e4),
+                  depth: "quick",
+                  apiKey: opts.apiKey,
+                  model: opts.model
+                },
+                db,
+                emit: verifyEmit,
+                cliPrompt: `Verify this vulnerability in ${filePath}:
 
 PoC:
 ${poc}
@@ -58778,44 +58828,46 @@ ${poc}
 Claimed severity: ${claimedSeverity}
 
 Read the file, trace data flow, confirm or reject.`,
-              agentSystemPrompt: verifySystemPrompt,
-              cliSystemPrompt: "You are a blind verification agent. Read the file, trace the PoC, confirm or reject the vulnerability."
-            });
-            const confirmed = verifiedFindings.length > 0;
-            return { finding, confirmed, verifiedFinding: verifiedFindings[0] ?? null };
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            warnings.push({ stage: "verify", message: `Verification failed for "${finding.title}": ${msg}` });
-            return { finding, confirmed: true, verifiedFinding: null };
-          }
-        }));
-        let confirmedCount = 0;
-        let rejectedCount = 0;
-        findings2 = verifyResults.map(({ finding, confirmed, verifiedFinding }) => {
-          if (confirmed) {
-            confirmedCount++;
-            emit({ type: "verify:result", message: `Confirmed: ${finding.title}`, data: { confirmed: true, title: finding.title } });
-            return {
-              ...finding,
-              status: "verified",
-              confidence: verifiedFinding?.confidence ?? finding.confidence,
-              severity: verifiedFinding?.severity ?? finding.severity
-            };
-          } else {
-            rejectedCount++;
-            emit({ type: "verify:result", message: `Rejected: ${finding.title}`, data: { confirmed: false, title: finding.title } });
-            return { ...finding, status: "false-positive" };
-          }
-        });
-        emit({
-          type: "stage:end",
-          stage: "verify",
-          message: `Verification complete: ${confirmedCount} confirmed, ${rejectedCount} rejected`
-        });
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        warnings.push({ stage: "verify", message: `Verification failed: ${msg}` });
-        emit({ type: "stage:end", stage: "verify", message: `Verification failed: ${msg}` });
+                agentSystemPrompt: verifySystemPrompt,
+                cliSystemPrompt: "You are a blind verification agent. Read the file, trace the PoC, confirm or reject the vulnerability."
+              });
+              const confirmed = verifiedFindings.length > 0;
+              const rejectionReason = confirmed ? void 0 : "Could not independently reproduce";
+              return { finding, confirmed, verifiedFinding: verifiedFindings[0] ?? null, rejectionReason };
+            } catch (err) {
+              const msg = err instanceof Error ? err.message : String(err);
+              warnings.push({ stage: "verify", message: `Verification failed for "${finding.title}": ${msg}` });
+              return { finding, confirmed: true, verifiedFinding: null };
+            }
+          }));
+          let confirmedCount = 0;
+          let rejectedCount = 0;
+          findings2 = verifyResults.map(({ finding, confirmed, verifiedFinding, rejectionReason }) => {
+            if (confirmed) {
+              confirmedCount++;
+              emit({ type: "verify:result", message: `Confirmed: ${finding.title}`, data: { confirmed: true, title: finding.title } });
+              return {
+                ...finding,
+                status: "verified",
+                confidence: verifiedFinding?.confidence ?? finding.confidence,
+                severity: verifiedFinding?.severity ?? finding.severity
+              };
+            } else {
+              rejectedCount++;
+              emit({ type: "verify:result", message: `Rejected: ${finding.title}`, data: { confirmed: false, title: finding.title, reason: rejectionReason ?? "Could not independently reproduce" } });
+              return { ...finding, status: "false-positive" };
+            }
+          });
+          emit({
+            type: "stage:end",
+            stage: "verify",
+            message: `Verification complete: ${confirmedCount} confirmed, ${rejectedCount} rejected`
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          warnings.push({ stage: "verify", message: `Verification failed: ${msg}` });
+          emit({ type: "stage:end", stage: "verify", message: `Verification failed: ${msg}` });
+        }
       }
     }
     const confirmedFindings = findings2.filter((f) => f.status !== "false-positive");
@@ -59577,7 +59629,7 @@ function createEventHandler(opts) {
 // packages/cli/src/commands/scan.ts
 init_utils();
 function registerScanCommand(program3) {
-  program3.command("scan").description("Run security scan against an LLM endpoint").requiredOption("--target <url>", "Target API endpoint URL").option("--depth <depth>", "Scan depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: api, claude, codex, gemini, opencode, auto", "api").option("--mode <mode>", "Scan mode: probe, deep, mcp, web", "probe").option("--repo <path>", "Path to target repo for deep scan source analysis").option("--timeout <ms>", "Request timeout in milliseconds", "30000").option("--agentic", "Use multi-turn agentic scan with tool use and SQLite persistence", false).option("--db-path <path>", "Path to SQLite database (default: ~/.pwnkit/pwnkit.db)").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output with live attack replay", false).option("--replay", "Replay the last scan's results as an animated attack chain", false).action(async (opts) => {
+  program3.command("scan").description("Run security scan against an LLM endpoint").requiredOption("--target <url>", "Target API endpoint URL").option("--depth <depth>", "Scan depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: api, claude, codex, gemini, auto", "api").option("--mode <mode>", "Scan mode: probe, deep, mcp, web", "probe").option("--repo <path>", "Path to target repo for deep scan source analysis").option("--timeout <ms>", "Request timeout in milliseconds", "30000").option("--agentic", "Use multi-turn agentic scan with tool use and SQLite persistence", false).option("--db-path <path>", "Path to SQLite database (default: ~/.pwnkit/pwnkit.db)").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output with live attack replay", false).option("--replay", "Replay the last scan's results as an animated attack chain", false).action(async (opts) => {
     const depth = opts.depth;
     const format = opts.format === "md" ? "markdown" : opts.format;
     const runtime = opts.runtime;
@@ -59635,7 +59687,7 @@ function registerScanCommand(program3) {
         process.exit(2);
       }
     }
-    const validRuntimes = ["api", "claude", "codex", "gemini", "opencode", "auto"];
+    const validRuntimes = ["api", "claude", "codex", "gemini", "auto"];
     if (!validRuntimes.includes(runtime)) {
       console.error(
         source_default.red(`Unknown runtime '${runtime}'. Valid: ${validRuntimes.join(", ")}`)
@@ -59644,7 +59696,7 @@ function registerScanCommand(program3) {
     }
     if (mode !== "probe" && mode !== "web" && runtime === "api") {
       console.error(
-        source_default.red(`Mode '${mode}' requires a process runtime (claude, codex, gemini, opencode, or auto)`)
+        source_default.red(`Mode '${mode}' requires a process runtime (claude, codex, gemini, or auto)`)
       );
       process.exit(2);
     }
@@ -59957,7 +60009,7 @@ init_source();
 init_dist();
 init_utils();
 function registerReviewCommand(program3) {
-  program3.command("review").description("Deep source code security review of a repository").argument("<repo>", "Local path or git URL to review").option("--depth <depth>", "Review depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: auto, claude, codex, gemini, opencode, api", "auto").option("--db-path <path>", "Path to SQLite database").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output", false).option("--timeout <ms>", "AI agent timeout in milliseconds", "600000").action(async (repo, opts) => {
+  program3.command("review").description("Deep source code security review of a repository").argument("<repo>", "Local path or git URL to review").option("--depth <depth>", "Review depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: auto, claude, codex, gemini, api", "auto").option("--db-path <path>", "Path to SQLite database").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output", false).option("--timeout <ms>", "AI agent timeout in milliseconds", "600000").action(async (repo, opts) => {
     const depth = opts.depth ?? "default";
     const format = opts.format === "md" ? "markdown" : opts.format;
     const runtime = opts.runtime;
@@ -60026,12 +60078,12 @@ init_source();
 init_dist();
 init_utils();
 function registerAuditCommand(program3) {
-  program3.command("audit").description("Audit an npm package for security vulnerabilities").argument("<package>", "npm package name (e.g. lodash, express)").option("--version <version>", "Specific version to audit (default: latest)").option("--depth <depth>", "Audit depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: auto, claude, codex, gemini, opencode, api", "auto").option("--db-path <path>", "Path to SQLite database").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output", false).option("--timeout <ms>", "AI agent timeout in milliseconds", "600000").action(async (packageName, opts) => {
+  program3.command("audit").description("Audit an npm package for security vulnerabilities").argument("<package>", "npm package name (e.g. lodash, express)").option("--version <version>", "Specific version to audit (default: latest)").option("--depth <depth>", "Audit depth: quick, default, deep", "default").option("--format <format>", "Output format: terminal, json, md", "terminal").option("--runtime <runtime>", "Runtime: auto, claude, codex, gemini, api", "auto").option("--db-path <path>", "Path to SQLite database").option("--api-key <key>", "API key for LLM provider (or set OPENROUTER_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY)").option("--model <model>", "LLM model to use (or set PWNKIT_MODEL)").option("--verbose", "Show detailed output", false).option("--timeout <ms>", "AI agent timeout in milliseconds", "600000").action(async (packageName, opts) => {
     const depth = opts.depth ?? "default";
     const format = opts.format === "md" ? "markdown" : opts.format;
     const runtime = opts.runtime;
     const verbose = opts.verbose;
-    const validRuntimes = ["api", "claude", "codex", "gemini", "opencode", "auto"];
+    const validRuntimes = ["api", "claude", "codex", "gemini", "auto"];
     if (!validRuntimes.includes(runtime)) {
       console.error(
         source_default.red(`Unknown runtime '${runtime}'. Valid: ${validRuntimes.join(", ")}`)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pwnkit-cli",
   "type": "module",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "AI-powered agentic security scanner. Scan endpoints, audit packages, review source code. Autonomous agents discover, attack, verify, and report.",
   "bin": {
     "pwnkit": "dist/index.js"