securewithtrace 0.28.1 → 0.29.0

package/dist/index.js

@@ -22463,10 +22463,23 @@ var AgentSessionEventResponseSchema = external_exports.object({
   hasOverflowPayload: external_exports.boolean(),
   createdAt: external_exports.coerce.date()
 });
+var AgentSessionSpawnContextSchema = external_exports.object({
+  /** The spawn's tool-use id = the child thread's `parentToolUseId`. */
+  toolUseId: external_exports.string(),
+  subagentType: external_exports.string().nullable(),
+  description: external_exports.string().nullable(),
+  prompt: external_exports.string().nullable()
+});
 var ListAgentSessionEventsResponseSchema = external_exports.object({
   events: external_exports.array(AgentSessionEventResponseSchema),
   /** Session-wide high-water mark (poll cursor even when `events` is capped). */
-  lastEventSeq: external_exports.number().int().nonnegative()
+  lastEventSeq: external_exports.number().int().nonnegative(),
+  /**
+   * Spawn descriptors for subagent threads referenced by children in `events`
+   * whose `Agent` tool-use is outside this window. Optional for deploy-skew
+   * tolerance — an older API omits it and the client defaults to none.
+   */
+  ancestorSpawns: external_exports.array(AgentSessionSpawnContextSchema).optional()
 });
 var AgentSessionEventPayloadUrlResponseSchema = external_exports.object({
   /** Presigned S3 GET for the overflow payload (short TTL). */
@@ -28510,14 +28523,33 @@ var PentestFindingListItemSchema = PentestFindingResponseSchema.omit({
   verification: true
 });
 var ListPentestFindingsResponseSchema = external_exports.array(PentestFindingListItemSchema);
+var OperatorFindingEvidenceSchema = external_exports.object({
+  artifactId: external_exports.uuid(),
+  kind: PentestExploitArtifactKind,
+  description: external_exports.string().nullable(),
+  customerFacing: external_exports.boolean(),
+  section: ValidationEvidenceSection.nullable(),
+  displayOrder: external_exports.number().int().nullable()
+});
+var OperatorFindingContestSchema = external_exports.object({
+  contestId: external_exports.uuid(),
+  reason: ContestReason,
+  justification: external_exports.string(),
+  contestedAt: external_exports.coerce.date(),
+  resolution: external_exports.string().nullable(),
+  resolvedAt: external_exports.coerce.date().nullable()
+});
 var OperatorFindingReadSchema = PentestFindingResponseSchema.omit({
   organizationId: true,
   pentestId: true,
   createdById: true,
   createdByName: true,
   reportProseAt: true,
-  reportProseStatus: true,
-  publishedAt: true
+  reportProseStatus: true
+});
+var OperatorFindingDetailSchema = OperatorFindingReadSchema.extend({
+  evidence: external_exports.array(OperatorFindingEvidenceSchema),
+  contests: external_exports.array(OperatorFindingContestSchema)
 });
 var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
   organizationId: true,
@@ -28525,8 +28557,7 @@ var OperatorFindingListSchema = PentestFindingListItemSchema.omit({
   createdById: true,
   createdByName: true,
   reportProseAt: true,
-  reportProseStatus: true,
-  publishedAt: true
+  reportProseStatus: true
 });
 var CustomerPentestFindingRepositorySchema = PentestFindingRepositorySchema.omit({
   repositoryId: true
@@ -28592,6 +28623,21 @@ var ConfirmedFindingProseSchema = external_exports.object({
 var ConfirmFindingProseResponseSchema = external_exports.object({
   confirmed: external_exports.array(ConfirmedFindingProseSchema)
 });
+var PublishAllFindingsRequestSchema = external_exports.object({
+  /**
+   * Empty/omitted = the bulk default set: every un-published, non-DISMISSED
+   * finding. Explicit ids publish a specific subset; ids that don't exist are a
+   * 404 and already-published / dismissed ids are a 400 (mirrors prose-confirm).
+   */
+  pentestFindingIds: external_exports.array(external_exports.uuid()).max(200).optional()
+});
+var PublishedFindingSchema = external_exports.object({
+  pentestFindingId: external_exports.uuid(),
+  displayId: external_exports.int()
+});
+var PublishAllFindingsResponseSchema = external_exports.object({
+  published: external_exports.array(PublishedFindingSchema)
+});
 var FindingProseSchema = FindingRewriteJsonSchema.pick({
   description: true,
   rootCauseAnalysis: true,
@@ -28913,6 +28959,20 @@ var pentestFindingContract = c24.router({
       500: ErrorResponseSchema
     }
   },
+  publishAllFindings: {
+    method: "POST",
+    path: "/organizations/:organizationId/pentests/:pentestId/findings/publications",
+    pathParams: PentestFindingParamsSchema,
+    body: PublishAllFindingsRequestSchema,
+    responses: {
+      200: PublishAllFindingsResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      403: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
   updateFinding: {
     method: "PATCH",
     path: "/organizations/:organizationId/pentests/:pentestId/findings/:pentestFindingId",
@@ -31857,6 +31917,42 @@ var RecordValidationResultRequestSchema = external_exports.object({
    * strings here (e.g. `CWE-89`, `89`); the api canonicalizes to `CWE-<n>`.
    */
   cweIds: external_exports.array(external_exports.string().min(1).max(64)).max(20).optional(),
+  /**
+   * Agent-assigned vulnerability class for the promoted finding (PROVEN-only);
+   * 1–4 words, e.g. "Broken Access Control", "Injection". Authoritative when
+   * present; the api falls back to the source-derived type, then a neutral
+   * floor, only when absent. A source-less agent finding has no Vulnerability
+   * row to inherit a category from, so this is its only path to a real class.
+   */
+  category: external_exports.string().min(1).max(120).nullable().optional(),
+  /**
+   * Agent-assigned OWASP Top 10:2025 bucket, verbatim as "<code> <name>"
+   * (PROVEN-only). Validated against the closed set api-side: a non-member
+   * explicit value is rejected (400); absent → null.
+   */
+  owaspCategory: external_exports.string().min(1).max(120).nullable().optional(),
+  /**
+   * Agent-assigned CVSS v3.1 base vector for the demonstrated impact
+   * (PROVEN-only). The api derives and persists the canonical vector + base
+   * score server-side; an unparseable explicit vector is rejected (400). The
+   * score is NEVER client-supplied. Absent → both cvss columns null.
+   */
+  cvssVector: external_exports.string().min(1).max(120).nullable().optional(),
+  /**
+   * Repos the proven flaw lives in (PROVEN-only). Each cites the manifest
+   * `repoAlias` (the `/workspace/repos/<alias>` dir name); the api resolves it
+   * to the canonical repositoryId + pinned commitSha via the session's repo
+   * pins (unknown alias → 400). `filePath` is repo-relative; `commitSha` is
+   * never agent-supplied.
+   */
+  repositories: external_exports.array(
+    external_exports.object({
+      repoAlias: external_exports.string().min(1).max(128),
+      filePath: external_exports.string().min(1).max(1024).nullable().optional(),
+      startLine: external_exports.number().int().positive().nullable().optional(),
+      endLine: external_exports.number().int().positive().nullable().optional()
+    }).strict()
+  ).max(50).optional(),
   /** Source vulns/manual findings, scoped to this pentest's repos. */
   sourceVulnerabilityIds: external_exports.array(external_exports.uuid()).max(50).optional(),
   sourceManualFindingIds: external_exports.array(external_exports.uuid()).max(50).optional(),
@@ -31962,6 +32058,164 @@ var OperatorListFindingsResponseSchema = external_exports.object({
 var OperatorListHypothesesResponseSchema = external_exports.object({
   hypotheses: external_exports.array(OperatorHypothesisListSchema)
 });
+var operatorRunVersion = external_exports.number().int().nonnegative();
+var operatorReason = external_exports.string().min(1).max(2e3);
+var OperatorUpdateFindingRequestSchema = UpdatePentestFindingRequestSchema.omit({
+  // publish is a report-workflow action; CVSS goes through apply_finding_cvss
+  // (server-derived score) — not raw scalar edits here.
+  publishedAt: true,
+  cvssVector: true,
+  cvssScore: true
+}).extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid(),
+  expectedUpdatedAt: external_exports.coerce.date()
+});
+var OperatorApplyFindingProseRequestSchema = ApplyFindingProseRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorPublishFindingRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid(),
+  expectedUpdatedAt: external_exports.coerce.date()
+});
+var OperatorApplyFindingCvssRequestSchema = ApplyFindingCvssRequestSchema.omit({
+  rationale: true
+  // the operator `reason` IS the cvss audit rationale
+}).extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorCreateFindingRequestSchema = CreatePentestFindingRequestSchema.omit({
+  cvssVector: true,
+  cvssScore: true
+  // set CVSS via apply_finding_cvss after create (derived score)
+}).extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason
+});
+var OperatorCurateEvidenceRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid(),
+  artifactId: external_exports.uuid(),
+  customerFacing: external_exports.boolean().optional(),
+  caption: external_exports.string().min(1).max(500).nullable().optional(),
+  section: ValidationEvidenceSection.nullable().optional(),
+  displayOrder: external_exports.number().int().min(0).optional()
+});
+var OperatorAddFindingNoteRequestSchema = CreatePentestFindingNoteRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorRecordFindingRetestRequestSchema = CreatePentestFindingRetestRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorMarkRemediationReportedRequestSchema = MarkPentestFindingRemediationReportedRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorAcceptFindingWithControlsRequestSchema = AcceptPentestFindingWithControlsRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorReopenFindingRequestSchema = ReopenPentestFindingRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  pentestFindingId: external_exports.uuid()
+});
+var OperatorResolveContestRequestSchema = ResolvePentestFindingContestRequestSchema.extend(
+  {
+    runVersion: operatorRunVersion,
+    reason: operatorReason,
+    pentestFindingId: external_exports.uuid(),
+    contestId: external_exports.uuid()
+  }
+);
+var OperatorCreateHypothesisRequestSchema = CreatePentestHypothesisRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason
+});
+var OperatorUpdateHypothesisRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  hypothesisId: external_exports.uuid(),
+  expectedUpdatedAt: external_exports.coerce.date(),
+  title: external_exports.string().min(1).max(500).optional(),
+  description: external_exports.string().min(1).max(5e4).optional(),
+  attackChain: external_exports.string().min(1).max(5e4).optional(),
+  exploitTechnique: external_exports.string().min(1).max(5e4).optional(),
+  prerequisiteAccess: external_exports.string().min(1).max(5e4).nullable().optional(),
+  expectedOutcome: external_exports.string().min(1).max(5e4).optional(),
+  confidence: external_exports.number().min(0).max(1).optional(),
+  reviewNotes: external_exports.string().max(1e4).nullable().optional(),
+  sourceVulnerabilityIds: external_exports.array(external_exports.uuid()).max(200).optional(),
+  sourceManualFindingIds: external_exports.array(external_exports.uuid()).max(200).optional()
+});
+var OperatorReviewHypothesisRequestSchema = ReviewPentestHypothesisRequestSchema.extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  hypothesisId: external_exports.uuid()
+});
+var OperatorPromoteHypothesisRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  hypothesisId: external_exports.uuid(),
+  title: external_exports.string().min(1).max(500).optional(),
+  description: external_exports.string().min(1).max(5e4).optional(),
+  severity: PentestFindingSeverity.optional(),
+  category: external_exports.string().min(1).max(200).optional(),
+  proofOfConcept: external_exports.string().max(5e4).optional(),
+  remediation: external_exports.string().max(5e4).optional(),
+  vulnerabilityIds: external_exports.array(external_exports.uuid()).max(200).optional(),
+  manualFindingIds: external_exports.array(external_exports.uuid()).max(200).optional()
+});
+var OperatorUpdatePentestRequestSchema = UpdatePentestRequestSchema.pick({
+  title: true,
+  description: true,
+  customerConcernsContext: true,
+  customerPriorityCategories: true
+}).extend({
+  runVersion: operatorRunVersion,
+  reason: operatorReason,
+  // Lifecycle status only — NOT CLOSED. Closing an engagement is terminal and routes
+  // through the report-delivery workflow, outside the non-destructive operator tier.
+  status: PentestStatus.exclude(["CLOSED"]).optional(),
+  // The status the operator read (get_pentest_context); a mismatch → 409.
+  expectedStatus: PentestStatus
+});
+var OperatorAdvanceValidationReviewRequestSchema = external_exports.object({
+  runVersion: operatorRunVersion,
+  reason: operatorReason
+});
+var OperatorNoteAckSchema = external_exports.object({
+  noteId: external_exports.uuid(),
+  createdAt: external_exports.coerce.date()
+});
+var OperatorContestAckSchema = external_exports.object({
+  contestId: external_exports.uuid(),
+  resolvedAt: external_exports.coerce.date().nullable()
+});
+var OperatorCuratedEvidenceSchema = external_exports.object({
+  artifactId: external_exports.uuid(),
+  customerFacing: external_exports.boolean(),
+  section: ValidationEvidenceSection.nullable(),
+  displayOrder: external_exports.number().int().nullable(),
+  caption: external_exports.string().nullable()
+});
+var OperatorStageTransitionResponseSchema = external_exports.object({
+  currentStage: PentestStage
+});
 var agentSessionInternalContract = c40.router({
   postEvents: {
     method: "POST",
@@ -32144,7 +32398,7 @@ var agentSessionInternalContract = c40.router({
     pathParams: AgentSessionInternalParamsSchema,
     body: OperatorGetFindingRequestSchema,
     responses: {
-      200: OperatorFindingReadSchema,
+      200: OperatorFindingDetailSchema,
       400: ErrorResponseSchema,
       401: ErrorResponseSchema,
       // Finding id not in this pentest.
@@ -32180,6 +32434,260 @@ var agentSessionInternalContract = c40.router({
       409: ErrorResponseSchema,
       500: ErrorResponseSchema
     }
+  },
+  // ----- Operator mutate (operator-session PR 2). All run-token authed; org+pentest
+  // + target re-scoped to the session row. 409 carries `errorCode` so the host can
+  // tell `RUN_REVOKED` (fatal) from an entity conflict (`*_STALE`/`STAGE_MISMATCH`/
+  // …, recoverable → re-read). 404 = target id not in this pentest. -----
+  updateFinding: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/update",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorUpdateFindingRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  applyFindingProse: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/prose",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorApplyFindingProseRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  publishFinding: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/publish",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorPublishFindingRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  applyFindingCvss: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/cvss",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorApplyFindingCvssRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createFinding: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/create",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorCreateFindingRequestSchema,
+    responses: {
+      201: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  curateEvidence: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/evidence/curate",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorCurateEvidenceRequestSchema,
+    responses: {
+      200: OperatorCuratedEvidenceSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  addFindingNote: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/notes/create",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorAddFindingNoteRequestSchema,
+    responses: {
+      201: OperatorNoteAckSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  recordFindingRetest: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/retest",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorRecordFindingRetestRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  markRemediationReported: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/remediation",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorMarkRemediationReportedRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  acceptFindingWithControls: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/accept",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorAcceptFindingWithControlsRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  reopenFinding: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/reopen",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorReopenFindingRequestSchema,
+    responses: {
+      200: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  resolveContest: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/findings/contest/resolve",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorResolveContestRequestSchema,
+    responses: {
+      200: OperatorContestAckSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  createHypothesis: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/hypotheses/create",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorCreateHypothesisRequestSchema,
+    responses: {
+      201: OperatorHypothesisListSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updateHypothesis: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/hypotheses/update",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorUpdateHypothesisRequestSchema,
+    responses: {
+      200: OperatorHypothesisListSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  reviewHypothesis: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/hypotheses/review",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorReviewHypothesisRequestSchema,
+    responses: {
+      200: OperatorHypothesisListSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  promoteHypothesis: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/hypotheses/promote",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorPromoteHypothesisRequestSchema,
+    responses: {
+      201: OperatorFindingReadSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  updatePentest: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/pentest/update",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorUpdatePentestRequestSchema,
+    responses: {
+      200: OperatorPentestContextSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
+  },
+  advanceValidationReview: {
+    method: "POST",
+    path: "/internal/v1/agent-sessions/:agentSessionId/operator/pentest/validation-review-complete",
+    pathParams: AgentSessionInternalParamsSchema,
+    body: OperatorAdvanceValidationReviewRequestSchema,
+    responses: {
+      200: OperatorStageTransitionResponseSchema,
+      400: ErrorResponseSchema,
+      401: ErrorResponseSchema,
+      404: ErrorResponseSchema,
+      409: ErrorResponseSchema,
+      500: ErrorResponseSchema
+    }
   }
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securewithtrace",
-  "version": "0.28.1",
+  "version": "0.29.0",
   "description": "Official Trace CLI for vulnerability intelligence in your terminal",
   "type": "module",
   "bin": {