fix: update lz4_flex 0.11.5 → 0.11.6 (RUSTSEC-2026-0041)

Fixes high-severity advisory: decompressing invalid data can leak
uninitialized memory. Transitive dep via tantivy → compliance-graph.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -4,3 +4,6 @@
 *.swo
 *~
 .DS_Store
+.playwright-mcp/
+report-preview-full.png
+compliance-dashboard/attack-chain-final.html

Cargo.lock

@@ -8,6 +8,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aead"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
+dependencies = [
+ "crypto-common",
+ "generic-array",
+]
+
 [[package]]
 name = "aes"
 version = "0.8.4"
@@ -19,6 +29,20 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "aes-gcm"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
+dependencies = [
+ "aead",
+ "aes",
+ "cipher",
+ "ctr",
+ "ghash",
+ "subtle",
+]
+
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -635,13 +659,16 @@ dependencies = [
 name = "compliance-agent"
 version = "0.1.0"
 dependencies = [
+ "aes-gcm",
  "axum",
  "base64",
  "chrono",
  "compliance-core",
  "compliance-dast",
  "compliance-graph",
+ "dashmap",
  "dotenvy",
+ "futures-core",
  "futures-util",
  "git2",
  "hex",
@@ -658,6 +685,8 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-cron-scheduler",
+ "tokio-stream",
+ "tokio-tungstenite 0.26.2",
  "tower-http",
  "tracing",
  "tracing-subscriber",
@@ -730,11 +759,13 @@ dependencies = [
 name = "compliance-dast"
 version = "0.1.0"
 dependencies = [
+ "base64",
  "bollard",
  "bson",
  "chromiumoxide",
  "chrono",
  "compliance-core",
+ "futures-util",
  "mongodb",
  "native-tls",
  "reqwest",
@@ -744,6 +775,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-native-tls",
+ "tokio-tungstenite 0.26.2",
  "tracing",
  "url",
  "uuid",
@@ -1089,6 +1121,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -1115,6 +1148,15 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "ctr"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "darling"
 version = "0.21.3"
@@ -2314,6 +2356,16 @@ dependencies = [
  "wasip3",
 ]
 
+[[package]]
+name = "ghash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
+dependencies = [
+ "opaque-debug",
+ "polyval",
+]
+
 [[package]]
 name = "git2"
 version = "0.20.4"
@@ -2672,7 +2724,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
+ "webpki-roots 1.0.6",
 ]
 
 [[package]]
@@ -3193,9 +3245,9 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
 [[package]]
 name = "lz4_flex"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08ab2867e3eeeca90e844d1940eab391c9dc5228783db2ed999acbc0a9ed375a"
+checksum = "373f5eceeeab7925e0c1098212f2fbc4d416adec9d35051a6ab251e824c1854a"
 
 [[package]]
 name = "lzma-rs"
@@ -3513,7 +3565,7 @@ dependencies = [
  "tokio-util",
  "typed-builder",
  "uuid",
- "webpki-roots",
+ "webpki-roots 1.0.6",
 ]
 
 [[package]]
@@ -3747,6 +3799,12 @@ version = "0.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "269bca4c2591a28585d6bf10d9ed0332b7d76900a1b02bec41bdc3a2cdcda107"
 
+[[package]]
+name = "opaque-debug"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
+
 [[package]]
 name = "openssl"
 version = "0.10.75"
@@ -4052,6 +4110,18 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "polyval"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "opaque-debug",
+ "universal-hash",
+]
+
 [[package]]
 name = "portable-atomic"
 version = "1.13.1"
@@ -4456,7 +4526,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots",
+ "webpki-roots 1.0.6",
 ]
 
 [[package]]
@@ -5662,6 +5732,22 @@ dependencies = [
  "tokio-util",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a9daff607c6d2bf6c16fd681ccb7eecc83e4e2cdc1ca067ffaadfca5de7f084"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tungstenite 0.26.2",
+ "webpki-roots 0.26.11",
+]
+
 [[package]]
 name = "tokio-tungstenite"
 version = "0.27.0"
@@ -6060,6 +6146,25 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "tungstenite"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4793cb5e56680ecbb1d843515b23b6de9a75eb04b66643e256a396d43be33c13"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.9.2",
+ "rustls",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror 2.0.18",
+ "utf-8",
+]
+
 [[package]]
 name = "tungstenite"
 version = "0.27.0"
@@ -6171,6 +6276,16 @@ version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
+[[package]]
+name = "universal-hash"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+dependencies = [
+ "crypto-common",
+ "subtle",
+]
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -6448,6 +6563,15 @@ dependencies = [
  "string_cache_codegen",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.6",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.6"

Cargo.toml

@@ -30,3 +30,6 @@ uuid = { version = "1", features = ["v4", "serde"] }
 secrecy = { version = "0.10", features = ["serde"] }
 regex = "1"
 zip = { version = "2", features = ["aes-crypto", "deflate"] }
+dashmap = "6"
+tokio-stream = { version = "0.1", features = ["sync"] }
+aes-gcm = "0.10"

compliance-agent/Cargo.toml

@@ -37,5 +37,8 @@ urlencoding = "2"
 futures-util = "0.3"
 jsonwebtoken = "9"
 zip = { workspace = true }
+aes-gcm = { workspace = true }
 tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
 futures-core = "0.3"
+dashmap = { workspace = true }
+tokio-stream = { workspace = true }

compliance-agent/src/agent.rs

@@ -1,17 +1,30 @@
 use std::sync::Arc;
 
+use dashmap::DashMap;
+use tokio::sync::{broadcast, watch, Semaphore};
+
+use compliance_core::models::pentest::PentestEvent;
 use compliance_core::AgentConfig;
 
 use crate::database::Database;
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::PipelineOrchestrator;
 
+/// Default maximum concurrent pentest sessions.
+const DEFAULT_MAX_CONCURRENT_SESSIONS: usize = 5;
+
 #[derive(Clone)]
 pub struct ComplianceAgent {
     pub config: AgentConfig,
     pub db: Database,
     pub llm: Arc<LlmClient>,
     pub http: reqwest::Client,
+    /// Per-session broadcast senders for SSE streaming.
+    pub session_streams: Arc<DashMap<String, broadcast::Sender<PentestEvent>>>,
+    /// Per-session pause controls (true = paused).
+    pub session_pause: Arc<DashMap<String, watch::Sender<bool>>>,
+    /// Semaphore limiting concurrent pentest sessions.
+    pub session_semaphore: Arc<Semaphore>,
 }
 
 impl ComplianceAgent {
@@ -27,6 +40,9 @@ impl ComplianceAgent {
             db,
             llm,
             http: reqwest::Client::new(),
+            session_streams: Arc::new(DashMap::new()),
+            session_pause: Arc::new(DashMap::new()),
+            session_semaphore: Arc::new(Semaphore::new(DEFAULT_MAX_CONCURRENT_SESSIONS)),
         }
     }
 
@@ -74,4 +90,54 @@ impl ComplianceAgent {
             .run_pr_review(&repo, repo_id, pr_number, base_sha, head_sha)
             .await
     }
+
+    // ── Session stream management ──────────────────────────────────
+
+    /// Register a broadcast sender for a session. Returns the sender.
+    pub fn register_session_stream(&self, session_id: &str) -> broadcast::Sender<PentestEvent> {
+        let (tx, _) = broadcast::channel(256);
+        self.session_streams
+            .insert(session_id.to_string(), tx.clone());
+        tx
+    }
+
+    /// Subscribe to a session's broadcast stream.
+    pub fn subscribe_session(&self, session_id: &str) -> Option<broadcast::Receiver<PentestEvent>> {
+        self.session_streams
+            .get(session_id)
+            .map(|tx| tx.subscribe())
+    }
+
+    // ── Session pause/resume management ────────────────────────────
+
+    /// Register a pause control for a session. Returns the watch receiver.
+    pub fn register_pause_control(&self, session_id: &str) -> watch::Receiver<bool> {
+        let (tx, rx) = watch::channel(false);
+        self.session_pause.insert(session_id.to_string(), tx);
+        rx
+    }
+
+    /// Pause a session.
+    pub fn pause_session(&self, session_id: &str) -> bool {
+        if let Some(tx) = self.session_pause.get(session_id) {
+            tx.send(true).is_ok()
+        } else {
+            false
+        }
+    }
+
+    /// Resume a session.
+    pub fn resume_session(&self, session_id: &str) -> bool {
+        if let Some(tx) = self.session_pause.get(session_id) {
+            tx.send(false).is_ok()
+        } else {
+            false
+        }
+    }
+
+    /// Clean up all per-session resources.
+    pub fn cleanup_session(&self, session_id: &str) {
+        self.session_streams.remove(session_id);
+        self.session_pause.remove(session_id);
+    }
 }

compliance-agent/src/api/handlers/pentest_handlers/export.rs

@@ -7,8 +7,12 @@ use axum::Json;
 use mongodb::bson::doc;
 use serde::Deserialize;
 
+use futures_util::StreamExt;
+
 use compliance_core::models::dast::DastFinding;
+use compliance_core::models::finding::Finding;
 use compliance_core::models::pentest::*;
+use compliance_core::models::sbom::SbomEntry;
 
 use crate::agent::ComplianceAgent;
 
@@ -103,6 +107,97 @@ pub async fn export_session_report(
         Err(_) => Vec::new(),
     };
 
+    // Fetch SAST findings, SBOM, and code context for the linked repository
+    let repo_id = session
+        .repo_id
+        .clone()
+        .or_else(|| target.as_ref().and_then(|t| t.repo_id.clone()));
+
+    let (sast_findings, sbom_entries, code_context) = if let Some(ref rid) = repo_id {
+        let sast: Vec<Finding> = match agent
+            .db
+            .findings()
+            .find(doc! {
+                "repo_id": rid,
+                "status": { "$in": ["open", "triaged"] },
+            })
+            .sort(doc! { "severity": -1 })
+            .limit(100)
+            .await
+        {
+            Ok(mut cursor) => {
+                let mut results = Vec::new();
+                while let Some(Ok(f)) = cursor.next().await {
+                    results.push(f);
+                }
+                results
+            }
+            Err(_) => Vec::new(),
+        };
+
+        let sbom: Vec<SbomEntry> = match agent
+            .db
+            .sbom_entries()
+            .find(doc! {
+                "repo_id": rid,
+                "known_vulnerabilities": { "$exists": true, "$ne": [] },
+            })
+            .limit(50)
+            .await
+        {
+            Ok(mut cursor) => {
+                let mut results = Vec::new();
+                while let Some(Ok(e)) = cursor.next().await {
+                    results.push(e);
+                }
+                results
+            }
+            Err(_) => Vec::new(),
+        };
+
+        // Build code context from graph nodes
+        let code_ctx: Vec<CodeContextHint> = match agent
+            .db
+            .graph_nodes()
+            .find(doc! { "repo_id": rid, "is_entry_point": true })
+            .limit(50)
+            .await
+        {
+            Ok(mut cursor) => {
+                let mut nodes_vec = Vec::new();
+                while let Some(Ok(n)) = cursor.next().await {
+                    let linked_vulns: Vec<String> = sast
+                        .iter()
+                        .filter(|f| f.file_path.as_deref() == Some(&n.file_path))
+                        .map(|f| {
+                            format!(
+                                "[{}] {}: {} (line {})",
+                                f.severity,
+                                f.scanner,
+                                f.title,
+                                f.line_number.unwrap_or(0)
+                            )
+                        })
+                        .collect();
+                    nodes_vec.push(CodeContextHint {
+                        endpoint_pattern: n.qualified_name.clone(),
+                        handler_function: n.name.clone(),
+                        file_path: n.file_path.clone(),
+                        code_snippet: String::new(),
+                        known_vulnerabilities: linked_vulns,
+                    });
+                }
+                nodes_vec
+            }
+            Err(_) => Vec::new(),
+        };
+
+        (sast, sbom, code_ctx)
+    } else {
+        (Vec::new(), Vec::new(), Vec::new())
+    };
+
+    let config = session.config.clone();
     let ctx = crate::pentest::report::ReportContext {
         session,
         target_name,
@@ -115,6 +210,10 @@ pub async fn export_session_report(
             body.requester_name
         },
         requester_email: body.requester_email,
+        config,
+        sast_findings,
+        sbom_entries,
+        code_context,
     };
 
     let report = crate::pentest::generate_encrypted_report(&ctx, &body.password)

compliance-agent/src/api/handlers/pentest_handlers/session.rs

@@ -17,10 +17,12 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 
 #[derive(Deserialize)]
 pub struct CreateSessionRequest {
-    pub target_id: String,
+    pub target_id: Option<String>,
     #[serde(default = "default_strategy")]
     pub strategy: String,
     pub message: Option<String>,
+    /// Wizard configuration — if present, takes precedence over legacy fields
+    pub config: Option<PentestConfig>,
 }
 
 fn default_strategy() -> String {
@@ -32,83 +34,365 @@ pub struct SendMessageRequest {
     pub message: String,
 }
 
+#[derive(Deserialize)]
+pub struct LookupRepoQuery {
+    pub url: String,
+}
+
 /// POST /api/v1/pentest/sessions — Create a new pentest session and start the orchestrator
 #[tracing::instrument(skip_all)]
 pub async fn create_session(
     Extension(agent): AgentExt,
     Json(req): Json<CreateSessionRequest>,
 ) -> Result<Json<ApiResponse<PentestSession>>, (StatusCode, String)> {
-    let oid = mongodb::bson::oid::ObjectId::parse_str(&req.target_id).map_err(|_| {
-        (
-            StatusCode::BAD_REQUEST,
-            "Invalid target_id format".to_string(),
-        )
-    })?;
-
-    // Look up the target
-    let target = agent
-        .db
-        .dast_targets()
-        .find_one(doc! { "_id": oid })
-        .await
-        .map_err(|e| {
+    // Try to acquire a concurrency permit
+    let permit = agent
+        .session_semaphore
+        .clone()
+        .try_acquire_owned()
+        .map_err(|_| {
             (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Database error: {e}"),
+                StatusCode::TOO_MANY_REQUESTS,
+                "Maximum concurrent pentest sessions reached. Try again later.".to_string(),
             )
-        })?
-        .ok_or_else(|| (StatusCode::NOT_FOUND, "Target not found".to_string()))?;
+        })?;
 
-    // Parse strategy
-    let strategy = match req.strategy.as_str() {
+    if let Some(ref config) = req.config {
+        // ── Wizard path ──────────────────────────────────────────────
+        if !config.disclaimer_accepted {
+            return Err((
+                StatusCode::BAD_REQUEST,
+                "Disclaimer must be accepted".to_string(),
+            ));
+        }
+
+        // Look up or auto-create DastTarget by app_url
+        let target = match agent
+            .db
+            .dast_targets()
+            .find_one(doc! { "base_url": &config.app_url })
+            .await
+            .map_err(|e| (StatusCode::INTERNAL_SERVER_ERROR, format!("DB error: {e}")))?
+        {
+            Some(t) => t,
+            None => {
+                use compliance_core::models::dast::{DastTarget, DastTargetType};
+                let mut t = DastTarget::new(
+                    config.app_url.clone(),
+                    config.app_url.clone(),
+                    DastTargetType::WebApp,
+                );
+                if let Some(rl) = config.rate_limit {
+                    t.rate_limit = rl;
+                }
+                t.allow_destructive = config.allow_destructive;
+                t.excluded_paths = config.scope_exclusions.clone();
+                let res = agent.db.dast_targets().insert_one(&t).await.map_err(|e| {
+                    (
+                        StatusCode::INTERNAL_SERVER_ERROR,
+                        format!("Failed to create target: {e}"),
+                    )
+                })?;
+                t.id = res.inserted_id.as_object_id();
+                t
+            }
+        };
+
+        let target_id = target.id.map(|oid| oid.to_hex()).unwrap_or_default();
+
+        // Parse strategy from config or request
+        let strat_str = config.strategy.as_deref().unwrap_or(req.strategy.as_str());
+        let strategy = parse_strategy(strat_str);
+
+        let mut session = PentestSession::new(target_id, strategy);
+        session.config = Some(config.clone());
+        session.repo_id = target.repo_id.clone();
+
+        // Resolve repo_id from git_repo_url if provided
+        if let Some(ref git_url) = config.git_repo_url {
+            if let Ok(Some(repo)) = agent
+                .db
+                .repositories()
+                .find_one(doc! { "git_url": git_url })
+                .await
+            {
+                session.repo_id = repo.id.map(|oid| oid.to_hex());
+            }
+        }
+
+        let insert_result = agent
+            .db
+            .pentest_sessions()
+            .insert_one(&session)
+            .await
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create session: {e}"),
+                )
+            })?;
+        session.id = insert_result.inserted_id.as_object_id();
+
+        let session_id_str = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+
+        // Register broadcast stream and pause control
+        let event_tx = agent.register_session_stream(&session_id_str);
+        let pause_rx = agent.register_pause_control(&session_id_str);
+
+        // Merge server-default IMAP/email settings where wizard left blanks
+        if let Some(ref mut cfg) = session.config {
+            if cfg.auth.mode == AuthMode::AutoRegister {
+                if cfg.auth.verification_email.is_none() {
+                    cfg.auth.verification_email = agent.config.pentest_verification_email.clone();
+                }
+                if cfg.auth.imap_host.is_none() {
+                    cfg.auth.imap_host = agent.config.pentest_imap_host.clone();
+                }
+                if cfg.auth.imap_port.is_none() {
+                    cfg.auth.imap_port = agent.config.pentest_imap_port;
+                }
+                if cfg.auth.imap_username.is_none() {
+                    cfg.auth.imap_username = agent.config.pentest_imap_username.clone();
+                }
+                if cfg.auth.imap_password.is_none() {
+                    cfg.auth.imap_password = agent.config.pentest_imap_password.as_ref().map(|s| {
+                        use secrecy::ExposeSecret;
+                        s.expose_secret().to_string()
+                    });
+                }
+            }
+        }
+
+        // Pre-populate test user record for auto-register sessions
+        if let Some(ref cfg) = session.config {
+            if cfg.auth.mode == AuthMode::AutoRegister {
+                let verification_email = cfg.auth.verification_email.clone();
+                // Build plus-addressed email for this session
+                let test_email = verification_email.as_deref().map(|email| {
+                    let parts: Vec<&str> = email.splitn(2, '@').collect();
+                    if parts.len() == 2 {
+                        format!("{}+{}@{}", parts[0], session_id_str, parts[1])
+                    } else {
+                        email.to_string()
+                    }
+                });
+
+                // Detect identity provider from keycloak config
+                let provider = if agent.config.keycloak_url.is_some() {
+                    Some(compliance_core::models::pentest::IdentityProvider::Keycloak)
+                } else {
+                    None
+                };
+
+                session.test_user = Some(compliance_core::models::pentest::TestUserRecord {
+                    username: None, // LLM will choose; updated after registration
+                    email: test_email,
+                    provider_user_id: None,
+                    provider,
+                    cleaned_up: false,
+                });
+            }
+        }
+
+        // Encrypt credentials before they linger in memory
+        let mut session_for_task = session.clone();
+        if let Some(ref mut cfg) = session_for_task.config {
+            cfg.auth.username = cfg
+                .auth
+                .username
+                .as_ref()
+                .map(|u| crate::pentest::crypto::encrypt(u));
+            cfg.auth.password = cfg
+                .auth
+                .password
+                .as_ref()
+                .map(|p| crate::pentest::crypto::encrypt(p));
+        }
+
+        // Persist encrypted credentials to DB
+        if session_for_task.config.is_some() {
+            if let Some(sid) = session.id {
+                let _ = agent
+                    .db
+                    .pentest_sessions()
+                    .update_one(
+                        doc! { "_id": sid },
+                        doc! { "$set": {
+                            "config.auth.username": session_for_task.config.as_ref()
+                                .and_then(|c| c.auth.username.as_deref())
+                                .map(|s| mongodb::bson::Bson::String(s.to_string()))
+                                .unwrap_or(mongodb::bson::Bson::Null),
+                            "config.auth.password": session_for_task.config.as_ref()
+                                .and_then(|c| c.auth.password.as_deref())
+                                .map(|s| mongodb::bson::Bson::String(s.to_string()))
+                                .unwrap_or(mongodb::bson::Bson::Null),
+                        }},
+                    )
+                    .await;
+            }
+        }
+
+        let initial_message = config
+            .initial_instructions
+            .clone()
+            .or(req.message.clone())
+            .unwrap_or_else(|| {
+                format!(
+                    "Begin a {} penetration test against {} ({}). \
+                     Identify vulnerabilities and provide evidence for each finding.",
+                    session.strategy, target.name, target.base_url,
+                )
+            });
+
+        let llm = agent.llm.clone();
+        let db = agent.db.clone();
+        let session_clone = session.clone();
+        let target_clone = target.clone();
+        let agent_ref = agent.clone();
+        tokio::spawn(async move {
+            let orchestrator = PentestOrchestrator::new(llm, db, event_tx, Some(pause_rx));
+            orchestrator
+                .run_session_guarded(&session_clone, &target_clone, &initial_message)
+                .await;
+            // Clean up session resources
+            agent_ref.cleanup_session(&session_id_str);
+            // Release concurrency permit
+            drop(permit);
+        });
+
+        // Redact credentials in response
+        let mut response_session = session;
+        if let Some(ref mut cfg) = response_session.config {
+            if cfg.auth.username.is_some() {
+                cfg.auth.username = Some("********".to_string());
+            }
+            if cfg.auth.password.is_some() {
+                cfg.auth.password = Some("********".to_string());
+            }
+        }
+
+        Ok(Json(ApiResponse {
+            data: response_session,
+            total: None,
+            page: None,
+        }))
+    } else {
+        // ── Legacy path ──────────────────────────────────────────────
+        let target_id = req.target_id.clone().ok_or_else(|| {
+            (
+                StatusCode::BAD_REQUEST,
+                "target_id is required for legacy creation".to_string(),
+            )
+        })?;
+
+        let oid = mongodb::bson::oid::ObjectId::parse_str(&target_id).map_err(|_| {
+            (
+                StatusCode::BAD_REQUEST,
+                "Invalid target_id format".to_string(),
+            )
+        })?;
+
+        let target = agent
+            .db
+            .dast_targets()
+            .find_one(doc! { "_id": oid })
+            .await
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Database error: {e}"),
+                )
+            })?
+            .ok_or_else(|| (StatusCode::NOT_FOUND, "Target not found".to_string()))?;
+
+        let strategy = parse_strategy(&req.strategy);
+
+        let mut session = PentestSession::new(target_id, strategy);
+        session.repo_id = target.repo_id.clone();
+
+        let insert_result = agent
+            .db
+            .pentest_sessions()
+            .insert_one(&session)
+            .await
+            .map_err(|e| {
+                (
+                    StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("Failed to create session: {e}"),
+                )
+            })?;
+        session.id = insert_result.inserted_id.as_object_id();
+
+        let session_id_str = session.id.map(|oid| oid.to_hex()).unwrap_or_default();
+
+        // Register broadcast stream and pause control
+        let event_tx = agent.register_session_stream(&session_id_str);
+        let pause_rx = agent.register_pause_control(&session_id_str);
+
+        let initial_message = req.message.unwrap_or_else(|| {
+            format!(
+                "Begin a {} penetration test against {} ({}). \
+                 Identify vulnerabilities and provide evidence for each finding.",
+                session.strategy, target.name, target.base_url,
+            )
+        });
+
+        let llm = agent.llm.clone();
+        let db = agent.db.clone();
+        let session_clone = session.clone();
+        let target_clone = target.clone();
+        let agent_ref = agent.clone();
+        tokio::spawn(async move {
+            let orchestrator = PentestOrchestrator::new(llm, db, event_tx, Some(pause_rx));
+            orchestrator
+                .run_session_guarded(&session_clone, &target_clone, &initial_message)
+                .await;
+            agent_ref.cleanup_session(&session_id_str);
+            drop(permit);
+        });
+
+        Ok(Json(ApiResponse {
+            data: session,
+            total: None,
+            page: None,
+        }))
+    }
+}
+
+fn parse_strategy(s: &str) -> PentestStrategy {
+    match s {
         "quick" => PentestStrategy::Quick,
         "targeted" => PentestStrategy::Targeted,
         "aggressive" => PentestStrategy::Aggressive,
         "stealth" => PentestStrategy::Stealth,
         _ => PentestStrategy::Comprehensive,
+    }
+}
+
+/// GET /api/v1/pentest/lookup-repo — Look up a tracked repository by git URL
+#[tracing::instrument(skip_all)]
+pub async fn lookup_repo(
+    Extension(agent): AgentExt,
+    Query(params): Query<LookupRepoQuery>,
+) -> Result<Json<ApiResponse<serde_json::Value>>, StatusCode> {
+    let repo = agent
+        .db
+        .repositories()
+        .find_one(doc! { "git_url": &params.url })
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    let data = match repo {
+        Some(r) => serde_json::json!({
+            "name": r.name,
+            "default_branch": r.default_branch,
+            "last_scanned_commit": r.last_scanned_commit,
+        }),
+        None => serde_json::Value::Null,
     };
 
-    // Create session
-    let mut session = PentestSession::new(req.target_id.clone(), strategy);
-    session.repo_id = target.repo_id.clone();
-
-    let insert_result = agent
-        .db
-        .pentest_sessions()
-        .insert_one(&session)
-        .await
-        .map_err(|e| {
-            (
-                StatusCode::INTERNAL_SERVER_ERROR,
-                format!("Failed to create session: {e}"),
-            )
-        })?;
-
-    // Set the generated ID back on the session so the orchestrator has it
-    session.id = insert_result.inserted_id.as_object_id();
-
-    let initial_message = req.message.unwrap_or_else(|| {
-        format!(
-            "Begin a {} penetration test against {} ({}). \
-             Identify vulnerabilities and provide evidence for each finding.",
-            session.strategy, target.name, target.base_url,
-        )
-    });
-
-    // Spawn the orchestrator on a background task
-    let llm = agent.llm.clone();
-    let db = agent.db.clone();
-    let session_clone = session.clone();
-    let target_clone = target.clone();
-    tokio::spawn(async move {
-        let orchestrator = PentestOrchestrator::new(llm, db);
-        orchestrator
-            .run_session_guarded(&session_clone, &target_clone, &initial_message)
-            .await;
-    });
-
     Ok(Json(ApiResponse {
-        data: session,
+        data,
         total: None,
         page: None,
     }))
@@ -158,7 +442,7 @@ pub async fn get_session(
 ) -> Result<Json<ApiResponse<PentestSession>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
 
-    let session = agent
+    let mut session = agent
         .db
         .pentest_sessions()
         .find_one(doc! { "_id": oid })
@@ -166,6 +450,16 @@ pub async fn get_session(
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
         .ok_or(StatusCode::NOT_FOUND)?;
 
+    // Redact credentials in response
+    if let Some(ref mut cfg) = session.config {
+        if cfg.auth.username.is_some() {
+            cfg.auth.username = Some("********".to_string());
+        }
+        if cfg.auth.password.is_some() {
+            cfg.auth.password = Some("********".to_string());
+        }
+    }
+
     Ok(Json(ApiResponse {
         data: session,
         total: None,
@@ -241,8 +535,20 @@ pub async fn send_message(
     let llm = agent.llm.clone();
     let db = agent.db.clone();
     let message = req.message.clone();
+
+    // Use existing broadcast sender if available, otherwise create a new one
+    let event_tx = agent
+        .subscribe_session(&session_id)
+        .and_then(|_| {
+            agent
+                .session_streams
+                .get(&session_id)
+                .map(|entry| entry.value().clone())
+        })
+        .unwrap_or_else(|| agent.register_session_stream(&session_id));
+
     tokio::spawn(async move {
-        let orchestrator = PentestOrchestrator::new(llm, db);
+        let orchestrator = PentestOrchestrator::new(llm, db, event_tx, None);
         orchestrator
             .run_session_guarded(&session, &target, &message)
             .await;
@@ -277,10 +583,10 @@ pub async fn stop_session(
         })?
         .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
 
-    if session.status != PentestStatus::Running {
+    if session.status != PentestStatus::Running && session.status != PentestStatus::Paused {
         return Err((
             StatusCode::BAD_REQUEST,
-            format!("Session is {}, not running", session.status),
+            format!("Session is {}, not running or paused", session.status),
         ));
     }
 
@@ -303,6 +609,9 @@ pub async fn stop_session(
             )
         })?;
 
+    // Clean up session resources
+    agent.cleanup_session(&id);
+
     let updated = agent
         .db
         .pentest_sessions()
@@ -328,6 +637,92 @@ pub async fn stop_session(
     }))
 }
 
+/// POST /api/v1/pentest/sessions/:id/pause — Pause a running pentest session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn pause_session(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
+        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Database error: {e}"),
+            )
+        })?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
+
+    if session.status != PentestStatus::Running {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("Session is {}, not running", session.status),
+        ));
+    }
+
+    if !agent.pause_session(&id) {
+        return Err((
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to send pause signal".to_string(),
+        ));
+    }
+
+    Ok(Json(ApiResponse {
+        data: serde_json::json!({ "status": "paused" }),
+        total: None,
+        page: None,
+    }))
+}
+
+/// POST /api/v1/pentest/sessions/:id/resume — Resume a paused pentest session
+#[tracing::instrument(skip_all, fields(session_id = %id))]
+pub async fn resume_session(
+    Extension(agent): AgentExt,
+    Path(id): Path<String>,
+) -> Result<Json<ApiResponse<serde_json::Value>>, (StatusCode, String)> {
+    let oid = mongodb::bson::oid::ObjectId::parse_str(&id)
+        .map_err(|_| (StatusCode::BAD_REQUEST, "Invalid session ID".to_string()))?;
+
+    let session = agent
+        .db
+        .pentest_sessions()
+        .find_one(doc! { "_id": oid })
+        .await
+        .map_err(|e| {
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                format!("Database error: {e}"),
+            )
+        })?
+        .ok_or_else(|| (StatusCode::NOT_FOUND, "Session not found".to_string()))?;
+
+    if session.status != PentestStatus::Paused {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            format!("Session is {}, not paused", session.status),
+        ));
+    }
+
+    if !agent.resume_session(&id) {
+        return Err((
+            StatusCode::INTERNAL_SERVER_ERROR,
+            "Failed to send resume signal".to_string(),
+        ));
+    }
+
+    Ok(Json(ApiResponse {
+        data: serde_json::json!({ "status": "running" }),
+        total: None,
+        page: None,
+    }))
+}
+
 /// GET /api/v1/pentest/sessions/:id/attack-chain — Get attack chain nodes for a session
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn get_attack_chain(

compliance-agent/src/api/handlers/pentest_handlers/stream.rs

@@ -1,10 +1,14 @@
+use std::convert::Infallible;
 use std::sync::Arc;
+use std::time::Duration;
 
 use axum::extract::{Extension, Path};
 use axum::http::StatusCode;
-use axum::response::sse::{Event, Sse};
+use axum::response::sse::{Event, KeepAlive, Sse};
 use futures_util::stream;
 use mongodb::bson::doc;
+use tokio_stream::wrappers::BroadcastStream;
+use tokio_stream::StreamExt;
 
 use compliance_core::models::pentest::*;
 
@@ -16,16 +20,13 @@ type AgentExt = Extension<Arc<ComplianceAgent>>;
 
 /// GET /api/v1/pentest/sessions/:id/stream — SSE endpoint for real-time events
 ///
-/// Returns recent messages as SSE events (polling approach).
-/// True real-time streaming with broadcast channels will be added in a future iteration.
+/// Replays stored messages/nodes as initial burst, then subscribes to the
+/// broadcast channel for live updates. Sends keepalive comments every 15s.
 #[tracing::instrument(skip_all, fields(session_id = %id))]
 pub async fn session_stream(
     Extension(agent): AgentExt,
     Path(id): Path<String>,
-) -> Result<
-    Sse<impl futures_util::Stream<Item = Result<Event, std::convert::Infallible>>>,
-    StatusCode,
-> {
+) -> Result<Sse<impl futures_util::Stream<Item = Result<Event, Infallible>>>, StatusCode> {
     let oid = mongodb::bson::oid::ObjectId::parse_str(&id).map_err(|_| StatusCode::BAD_REQUEST)?;
 
     // Verify session exists
@@ -37,6 +38,10 @@ pub async fn session_stream(
         .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
         .ok_or(StatusCode::NOT_FOUND)?;
 
+    // ── Initial burst: replay stored data ──────────────────────────
+
+    let mut initial_events: Vec<Result<Event, Infallible>> = Vec::new();
+
     // Fetch recent messages for this session
     let messages: Vec<PentestMessage> = match agent
         .db
@@ -63,9 +68,6 @@ pub async fn session_stream(
         Err(_) => Vec::new(),
     };
 
-    // Build SSE events from stored data
-    let mut events: Vec<Result<Event, std::convert::Infallible>> = Vec::new();
-
     for msg in &messages {
         let event_data = serde_json::json!({
             "type": "message",
@@ -74,7 +76,7 @@ pub async fn session_stream(
             "created_at": msg.created_at.to_rfc3339(),
         });
         if let Ok(data) = serde_json::to_string(&event_data) {
-            events.push(Ok(Event::default().event("message").data(data)));
+            initial_events.push(Ok(Event::default().event("message").data(data)));
         }
     }
 
@@ -87,11 +89,11 @@ pub async fn session_stream(
             "findings_produced": node.findings_produced,
         });
         if let Ok(data) = serde_json::to_string(&event_data) {
-            events.push(Ok(Event::default().event("tool").data(data)));
+            initial_events.push(Ok(Event::default().event("tool").data(data)));
         }
     }
 
-    // Add session status event
+    // Add current session status event
     let session = agent
         .db
         .pentest_sessions()
@@ -108,9 +110,49 @@ pub async fn session_stream(
             "tool_invocations": s.tool_invocations,
         });
         if let Ok(data) = serde_json::to_string(&status_data) {
-            events.push(Ok(Event::default().event("status").data(data)));
+            initial_events.push(Ok(Event::default().event("status").data(data)));
         }
     }
 
-    Ok(Sse::new(stream::iter(events)))
+    // ── Live stream: subscribe to broadcast ────────────────────────
+
+    let live_stream = if let Some(rx) = agent.subscribe_session(&id) {
+        let broadcast = BroadcastStream::new(rx).filter_map(|result| match result {
+            Ok(event) => {
+                if let Ok(data) = serde_json::to_string(&event) {
+                    let event_type = match &event {
+                        PentestEvent::ToolStart { .. } => "tool_start",
+                        PentestEvent::ToolComplete { .. } => "tool_complete",
+                        PentestEvent::Finding { .. } => "finding",
+                        PentestEvent::Message { .. } => "message",
+                        PentestEvent::Complete { .. } => "complete",
+                        PentestEvent::Error { .. } => "error",
+                        PentestEvent::Thinking { .. } => "thinking",
+                        PentestEvent::Paused => "paused",
+                        PentestEvent::Resumed => "resumed",
+                    };
+                    Some(Ok(Event::default().event(event_type).data(data)))
+                } else {
+                    None
+                }
+            }
+            Err(_) => None,
+        });
+        // Box to unify types
+        Box::pin(broadcast)
+            as std::pin::Pin<Box<dyn futures_util::Stream<Item = Result<Event, Infallible>> + Send>>
+    } else {
+        // No active broadcast — return empty stream
+        Box::pin(stream::empty())
+            as std::pin::Pin<Box<dyn futures_util::Stream<Item = Result<Event, Infallible>> + Send>>
+    };
+
+    // Chain initial burst + live stream
+    let combined = stream::iter(initial_events).chain(live_stream);
+
+    Ok(Sse::new(combined).keep_alive(
+        KeepAlive::new()
+            .interval(Duration::from_secs(15))
+            .text("keepalive"),
+    ))
 }

compliance-agent/src/api/routes.rs

@@ -100,6 +100,10 @@ pub fn build_router() -> Router {
             get(handlers::chat::embedding_status),
         )
         // Pentest API endpoints
+        .route(
+            "/api/v1/pentest/lookup-repo",
+            get(handlers::pentest::lookup_repo),
+        )
         .route(
             "/api/v1/pentest/sessions",
             get(handlers::pentest::list_sessions).post(handlers::pentest::create_session),
@@ -116,6 +120,14 @@ pub fn build_router() -> Router {
             "/api/v1/pentest/sessions/{id}/stop",
             post(handlers::pentest::stop_session),
         )
+        .route(
+            "/api/v1/pentest/sessions/{id}/pause",
+            post(handlers::pentest::pause_session),
+        )
+        .route(
+            "/api/v1/pentest/sessions/{id}/resume",
+            post(handlers::pentest::resume_session),
+        )
         .route(
             "/api/v1/pentest/sessions/{id}/stream",
             get(handlers::pentest::session_stream),

compliance-agent/src/config.rs

@@ -49,5 +49,12 @@ pub fn load_config() -> Result<AgentConfig, AgentError> {
             .unwrap_or_else(|| "/data/compliance-scanner/ssh/id_ed25519".to_string()),
         keycloak_url: env_var_opt("KEYCLOAK_URL"),
         keycloak_realm: env_var_opt("KEYCLOAK_REALM"),
+        keycloak_admin_username: env_var_opt("KEYCLOAK_ADMIN_USERNAME"),
+        keycloak_admin_password: env_secret_opt("KEYCLOAK_ADMIN_PASSWORD"),
+        pentest_verification_email: env_var_opt("PENTEST_VERIFICATION_EMAIL"),
+        pentest_imap_host: env_var_opt("PENTEST_IMAP_HOST"),
+        pentest_imap_port: env_var_opt("PENTEST_IMAP_PORT").and_then(|p| p.parse().ok()),
+        pentest_imap_username: env_var_opt("PENTEST_IMAP_USERNAME"),
+        pentest_imap_password: env_secret_opt("PENTEST_IMAP_PASSWORD"),
     })
 }

compliance-agent/src/llm/triage.rs

@@ -5,7 +5,10 @@ use compliance_core::models::{Finding, FindingStatus};
 use crate::llm::LlmClient;
 use crate::pipeline::orchestrator::GraphContext;
 
-const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a security finding triage expert. Analyze the following security finding with its code context and determine the appropriate action.
+/// Maximum number of findings to include in a single LLM triage call.
+const TRIAGE_CHUNK_SIZE: usize = 30;
+
+const TRIAGE_SYSTEM_PROMPT: &str = r#"You are a security finding triage expert. Analyze each of the following security findings with its code context and determine the appropriate action.
 
 Actions:
 - "confirm": The finding is a true positive at the reported severity. Keep as-is.
@@ -19,8 +22,8 @@ Consider:
 - Is the finding actionable by a developer?
 - Would a real attacker be able to exploit this?
 
-Respond in JSON format:
-{"action": "confirm|downgrade|upgrade|dismiss", "confidence": 0-10, "rationale": "brief explanation", "remediation": "optional fix suggestion"}"#;
+Respond with a JSON array, one entry per finding in the same order they were presented:
+[{"id": "<fingerprint>", "action": "confirm|downgrade|upgrade|dismiss", "confidence": 0-10, "rationale": "brief explanation", "remediation": "optional fix suggestion"}, ...]"#;
 
 pub async fn triage_findings(
     llm: &Arc<LlmClient>,
@@ -29,60 +32,76 @@ pub async fn triage_findings(
 ) -> usize {
     let mut passed = 0;
 
-    for finding in findings.iter_mut() {
-        let file_classification = classify_file_path(finding.file_path.as_deref());
+    // Process findings in chunks to avoid overflowing the LLM context window.
+    for chunk_start in (0..findings.len()).step_by(TRIAGE_CHUNK_SIZE) {
+        let chunk_end = (chunk_start + TRIAGE_CHUNK_SIZE).min(findings.len());
+        let chunk = &mut findings[chunk_start..chunk_end];
 
-        let mut user_prompt = format!(
-            "Scanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}\nFile classification: {}",
-            finding.scanner,
-            finding.rule_id.as_deref().unwrap_or("N/A"),
-            finding.severity,
-            finding.title,
-            finding.description,
-            finding.file_path.as_deref().unwrap_or("N/A"),
-            finding.line_number.map(|n| n.to_string()).unwrap_or_else(|| "N/A".to_string()),
-            finding.code_snippet.as_deref().unwrap_or("N/A"),
-            file_classification,
-        );
+        // Build a combined prompt for the entire chunk.
+        let mut user_prompt = String::new();
+        let mut file_classifications: Vec<String> = Vec::new();
+
+        for (i, finding) in chunk.iter().enumerate() {
+            let file_classification = classify_file_path(finding.file_path.as_deref());
 
-        // Enrich with surrounding code context if possible
-        if let Some(context) = read_surrounding_context(finding) {
             user_prompt.push_str(&format!(
-                "\n\n--- Surrounding Code (50 lines) ---\n{context}"
+                "\n--- Finding {} (id: {}) ---\nScanner: {}\nRule: {}\nSeverity: {}\nTitle: {}\nDescription: {}\nFile: {}\nLine: {}\nCode: {}\nFile classification: {}",
+                i + 1,
+                finding.fingerprint,
+                finding.scanner,
+                finding.rule_id.as_deref().unwrap_or("N/A"),
+                finding.severity,
+                finding.title,
+                finding.description,
+                finding.file_path.as_deref().unwrap_or("N/A"),
+                finding.line_number.map(|n| n.to_string()).unwrap_or_else(|| "N/A".to_string()),
+                finding.code_snippet.as_deref().unwrap_or("N/A"),
+                file_classification,
             ));
-        }
 
-        // Enrich with graph context if available
-        if let Some(ctx) = graph_context {
-            if let Some(impact) = ctx
-                .impacts
-                .iter()
-                .find(|i| i.finding_id == finding.fingerprint)
-            {
+            // Enrich with surrounding code context if possible
+            if let Some(context) = read_surrounding_context(finding) {
                 user_prompt.push_str(&format!(
-                    "\n\n--- Code Graph Context ---\n\
-                     Blast radius: {} nodes affected\n\
-                     Entry points affected: {}\n\
-                     Direct callers: {}\n\
-                     Communities affected: {}\n\
-                     Call chains: {}",
-                    impact.blast_radius,
-                    if impact.affected_entry_points.is_empty() {
-                        "none".to_string()
-                    } else {
-                        impact.affected_entry_points.join(", ")
-                    },
-                    if impact.direct_callers.is_empty() {
-                        "none".to_string()
-                    } else {
-                        impact.direct_callers.join(", ")
-                    },
-                    impact.affected_communities.len(),
-                    impact.call_chains.len(),
+                    "\n\n--- Surrounding Code (50 lines) ---\n{context}"
                 ));
             }
+
+            // Enrich with graph context if available
+            if let Some(ctx) = graph_context {
+                if let Some(impact) = ctx
+                    .impacts
+                    .iter()
+                    .find(|im| im.finding_id == finding.fingerprint)
+                {
+                    user_prompt.push_str(&format!(
+                        "\n\n--- Code Graph Context ---\n\
+                         Blast radius: {} nodes affected\n\
+                         Entry points affected: {}\n\
+                         Direct callers: {}\n\
+                         Communities affected: {}\n\
+                         Call chains: {}",
+                        impact.blast_radius,
+                        if impact.affected_entry_points.is_empty() {
+                            "none".to_string()
+                        } else {
+                            impact.affected_entry_points.join(", ")
+                        },
+                        if impact.direct_callers.is_empty() {
+                            "none".to_string()
+                        } else {
+                            impact.direct_callers.join(", ")
+                        },
+                        impact.affected_communities.len(),
+                        impact.call_chains.len(),
+                    ));
+                }
+            }
+
+            user_prompt.push('\n');
+            file_classifications.push(file_classification);
         }
 
+        // Send the batch to the LLM.
         match llm
             .chat(TRIAGE_SYSTEM_PROMPT, &user_prompt, Some(0.1))
             .await
@@ -98,58 +117,77 @@ pub async fn triage_findings(
                 } else {
                     cleaned
                 };
-                if let Ok(result) = serde_json::from_str::<TriageResult>(cleaned) {
-                    // Apply file-path confidence adjustment
-                    let adjusted_confidence =
-                        adjust_confidence(result.confidence, &file_classification);
-                    finding.confidence = Some(adjusted_confidence);
-                    finding.triage_action = Some(result.action.clone());
-                    finding.triage_rationale = Some(result.rationale);
 
-                    if let Some(remediation) = result.remediation {
-                        finding.remediation = Some(remediation);
-                    }
-
-                    match result.action.as_str() {
-                        "dismiss" => {
-                            finding.status = FindingStatus::FalsePositive;
-                        }
-                        "downgrade" => {
-                            // Downgrade severity by one level
-                            finding.severity = downgrade_severity(&finding.severity);
-                            finding.status = FindingStatus::Triaged;
-                            passed += 1;
-                        }
-                        "upgrade" => {
-                            finding.severity = upgrade_severity(&finding.severity);
-                            finding.status = FindingStatus::Triaged;
-                            passed += 1;
-                        }
-                        _ => {
-                            // "confirm" or unknown — keep as-is
-                            if adjusted_confidence >= 3.0 {
+                match serde_json::from_str::<Vec<TriageResult>>(cleaned) {
+                    Ok(results) => {
+                        for (idx, finding) in chunk.iter_mut().enumerate() {
+                            // Match result by position; fall back to keeping the finding.
+                            let Some(result) = results.get(idx) else {
                                 finding.status = FindingStatus::Triaged;
                                 passed += 1;
-                            } else {
-                                finding.status = FindingStatus::FalsePositive;
+                                continue;
+                            };
+
+                            let file_classification = file_classifications
+                                .get(idx)
+                                .map(|s| s.as_str())
+                                .unwrap_or("unknown");
+
+                            let adjusted_confidence =
+                                adjust_confidence(result.confidence, file_classification);
+                            finding.confidence = Some(adjusted_confidence);
+                            finding.triage_action = Some(result.action.clone());
+                            finding.triage_rationale = Some(result.rationale.clone());
+
+                            if let Some(ref remediation) = result.remediation {
+                                finding.remediation = Some(remediation.clone());
+                            }
+
+                            match result.action.as_str() {
+                                "dismiss" => {
+                                    finding.status = FindingStatus::FalsePositive;
+                                }
+                                "downgrade" => {
+                                    finding.severity = downgrade_severity(&finding.severity);
+                                    finding.status = FindingStatus::Triaged;
+                                    passed += 1;
+                                }
+                                "upgrade" => {
+                                    finding.severity = upgrade_severity(&finding.severity);
+                                    finding.status = FindingStatus::Triaged;
+                                    passed += 1;
+                                }
+                                _ => {
+                                    // "confirm" or unknown — keep as-is
+                                    if adjusted_confidence >= 3.0 {
+                                        finding.status = FindingStatus::Triaged;
+                                        passed += 1;
+                                    } else {
+                                        finding.status = FindingStatus::FalsePositive;
+                                    }
+                                }
                             }
                         }
                     }
-                } else {
-                    // Parse failure — keep the finding
-                    finding.status = FindingStatus::Triaged;
-                    passed += 1;
-                    tracing::warn!(
-                        "Failed to parse triage response for {}: {response}",
-                        finding.fingerprint
-                    );
+                    Err(_) => {
+                        // Batch parse failure — keep all findings in the chunk.
+                        tracing::warn!(
+                            "Failed to parse batch triage response for chunk starting at {chunk_start}: {cleaned}"
+                        );
+                        for finding in chunk.iter_mut() {
+                            finding.status = FindingStatus::Triaged;
+                            passed += 1;
+                        }
+                    }
                 }
             }
             Err(e) => {
-                // On LLM error, keep the finding
-                tracing::warn!("LLM triage failed for {}: {e}", finding.fingerprint);
-                finding.status = FindingStatus::Triaged;
-                passed += 1;
+                // On LLM error, keep all findings in the chunk.
+                tracing::warn!("LLM batch triage failed for chunk starting at {chunk_start}: {e}");
+                for finding in chunk.iter_mut() {
+                    finding.status = FindingStatus::Triaged;
+                    passed += 1;
+                }
             }
         }
     }
@@ -266,6 +304,10 @@ fn upgrade_severity(
 
 #[derive(serde::Deserialize)]
 struct TriageResult {
+    /// Finding fingerprint echoed back by the LLM (optional).
+    #[serde(default)]
+    #[allow(dead_code)]
+    id: String,
     #[serde(default = "default_action")]
     action: String,
     #[serde(default)]

compliance-agent/src/main.rs

@@ -1,6 +1,6 @@
 mod agent;
 mod api;
-mod config;
+pub(crate) mod config;
 mod database;
 mod error;
 mod llm;
@@ -15,11 +15,20 @@ mod webhooks;
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
-    dotenvy::dotenv().ok();
+    match dotenvy::dotenv() {
+        Ok(path) => eprintln!("[dotenv] Loaded from: {}", path.display()),
+        Err(e) => eprintln!("[dotenv] FAILED: {e}"),
+    }
 
     let _telemetry_guard = compliance_core::telemetry::init_telemetry("compliance-agent");
 
-    tracing::info!("Loading configuration...");
+    // Log critical env vars at startup
+    tracing::info!(
+        chrome_ws_url = std::env::var("CHROME_WS_URL").ok().as_deref(),
+        pentest_email = std::env::var("PENTEST_VERIFICATION_EMAIL").ok().as_deref(),
+        encryption_key_set = std::env::var("PENTEST_ENCRYPTION_KEY").is_ok(),
+        "Loading configuration..."
+    );
     let config = config::load_config()?;
 
     // Ensure SSH key pair exists for cloning private repos

compliance-agent/src/pentest/cleanup.rs

@@ -0,0 +1,483 @@
+use compliance_core::models::pentest::{IdentityProvider, TestUserRecord};
+use compliance_core::AgentConfig;
+use secrecy::ExposeSecret;
+use tracing::{info, warn};
+
+/// Attempt to delete a test user created during a pentest session.
+///
+/// Routes to the appropriate identity provider based on `TestUserRecord.provider`.
+/// Falls back to browser-based cleanup if no API credentials are available.
+///
+/// Returns `Ok(true)` if the user was deleted, `Ok(false)` if skipped, `Err` on failure.
+pub async fn cleanup_test_user(
+    user: &TestUserRecord,
+    config: &AgentConfig,
+    http: &reqwest::Client,
+) -> Result<bool, String> {
+    if user.cleaned_up {
+        return Ok(false);
+    }
+
+    let provider = user.provider.as_ref();
+
+    match provider {
+        Some(IdentityProvider::Keycloak) => cleanup_keycloak(user, config, http).await,
+        Some(IdentityProvider::Auth0) => cleanup_auth0(user, config, http).await,
+        Some(IdentityProvider::Okta) => cleanup_okta(user, config, http).await,
+        Some(IdentityProvider::Firebase) => {
+            warn!("Firebase user cleanup not yet implemented");
+            Ok(false)
+        }
+        Some(IdentityProvider::Custom) | None => {
+            // For custom/unknown providers, try Keycloak if configured, else skip
+            if config.keycloak_url.is_some() && config.keycloak_admin_username.is_some() {
+                cleanup_keycloak(user, config, http).await
+            } else {
+                warn!(
+                    username = user.username.as_deref(),
+                    "No identity provider configured for cleanup — skipping"
+                );
+                Ok(false)
+            }
+        }
+    }
+}
+
+/// Delete a user from Keycloak via the Admin REST API.
+///
+/// Flow: get admin token → search user by username → delete by ID.
+async fn cleanup_keycloak(
+    user: &TestUserRecord,
+    config: &AgentConfig,
+    http: &reqwest::Client,
+) -> Result<bool, String> {
+    let base_url = config
+        .keycloak_url
+        .as_deref()
+        .ok_or("KEYCLOAK_URL not configured")?;
+    let realm = config
+        .keycloak_realm
+        .as_deref()
+        .ok_or("KEYCLOAK_REALM not configured")?;
+    let admin_user = config
+        .keycloak_admin_username
+        .as_deref()
+        .ok_or("KEYCLOAK_ADMIN_USERNAME not configured")?;
+    let admin_pass = config
+        .keycloak_admin_password
+        .as_ref()
+        .ok_or("KEYCLOAK_ADMIN_PASSWORD not configured")?;
+
+    let username = user
+        .username
+        .as_deref()
+        .ok_or("No username in test user record")?;
+
+    info!(username, realm, "Cleaning up Keycloak test user");
+
+    // Step 1: Get admin access token
+    let token_url = format!("{base_url}/realms/master/protocol/openid-connect/token");
+    let token_resp = http
+        .post(&token_url)
+        .form(&[
+            ("grant_type", "password"),
+            ("client_id", "admin-cli"),
+            ("username", admin_user),
+            ("password", admin_pass.expose_secret()),
+        ])
+        .send()
+        .await
+        .map_err(|e| format!("Keycloak token request failed: {e}"))?;
+
+    if !token_resp.status().is_success() {
+        let status = token_resp.status();
+        let body = token_resp.text().await.unwrap_or_default();
+        return Err(format!("Keycloak admin auth failed ({status}): {body}"));
+    }
+
+    let token_body: serde_json::Value = token_resp
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse Keycloak token: {e}"))?;
+    let access_token = token_body
+        .get("access_token")
+        .and_then(|v| v.as_str())
+        .ok_or("No access_token in Keycloak response")?;
+
+    // Step 2: Search for user by username
+    let search_url =
+        format!("{base_url}/admin/realms/{realm}/users?username={username}&exact=true");
+    let search_resp = http
+        .get(&search_url)
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| format!("Keycloak user search failed: {e}"))?;
+
+    if !search_resp.status().is_success() {
+        let status = search_resp.status();
+        let body = search_resp.text().await.unwrap_or_default();
+        return Err(format!("Keycloak user search failed ({status}): {body}"));
+    }
+
+    let users: Vec<serde_json::Value> = search_resp
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse Keycloak users: {e}"))?;
+
+    let user_id = users
+        .first()
+        .and_then(|u| u.get("id"))
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| format!("User '{username}' not found in Keycloak realm '{realm}'"))?;
+
+    // Step 3: Delete the user
+    let delete_url = format!("{base_url}/admin/realms/{realm}/users/{user_id}");
+    let delete_resp = http
+        .delete(&delete_url)
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| format!("Keycloak user delete failed: {e}"))?;
+
+    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
+        info!(username, user_id, "Keycloak test user deleted");
+        Ok(true)
+    } else {
+        let status = delete_resp.status();
+        let body = delete_resp.text().await.unwrap_or_default();
+        Err(format!("Keycloak delete failed ({status}): {body}"))
+    }
+}
+
+/// Delete a user from Auth0 via the Management API.
+///
+/// Requires `AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_CLIENT_SECRET` env vars.
+async fn cleanup_auth0(
+    user: &TestUserRecord,
+    _config: &AgentConfig,
+    http: &reqwest::Client,
+) -> Result<bool, String> {
+    let domain = std::env::var("AUTH0_DOMAIN").map_err(|_| "AUTH0_DOMAIN not set")?;
+    let client_id = std::env::var("AUTH0_CLIENT_ID").map_err(|_| "AUTH0_CLIENT_ID not set")?;
+    let client_secret =
+        std::env::var("AUTH0_CLIENT_SECRET").map_err(|_| "AUTH0_CLIENT_SECRET not set")?;
+
+    let email = user
+        .email
+        .as_deref()
+        .ok_or("No email in test user record for Auth0 lookup")?;
+
+    info!(email, "Cleaning up Auth0 test user");
+
+    // Get management API token
+    let token_resp = http
+        .post(format!("https://{domain}/oauth/token"))
+        .json(&serde_json::json!({
+            "grant_type": "client_credentials",
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "audience": format!("https://{domain}/api/v2/"),
+        }))
+        .send()
+        .await
+        .map_err(|e| format!("Auth0 token request failed: {e}"))?;
+
+    let token_body: serde_json::Value = token_resp
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse Auth0 token: {e}"))?;
+    let access_token = token_body
+        .get("access_token")
+        .and_then(|v| v.as_str())
+        .ok_or("No access_token in Auth0 response")?;
+
+    // Search for user by email
+    let encoded_email = urlencoding::encode(email);
+    let search_url = format!("https://{domain}/api/v2/users-by-email?email={encoded_email}");
+    let search_resp = http
+        .get(&search_url)
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| format!("Auth0 user search failed: {e}"))?;
+
+    let users: Vec<serde_json::Value> = search_resp
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse Auth0 users: {e}"))?;
+
+    let user_id = users
+        .first()
+        .and_then(|u| u.get("user_id"))
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| format!("User with email '{email}' not found in Auth0"))?;
+
+    // Delete
+    let encoded_id = urlencoding::encode(user_id);
+    let delete_resp = http
+        .delete(format!("https://{domain}/api/v2/users/{encoded_id}"))
+        .bearer_auth(access_token)
+        .send()
+        .await
+        .map_err(|e| format!("Auth0 user delete failed: {e}"))?;
+
+    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
+        info!(email, user_id, "Auth0 test user deleted");
+        Ok(true)
+    } else {
+        let status = delete_resp.status();
+        let body = delete_resp.text().await.unwrap_or_default();
+        Err(format!("Auth0 delete failed ({status}): {body}"))
+    }
+}
+
+/// Delete a user from Okta via the Users API.
+///
+/// Requires `OKTA_DOMAIN`, `OKTA_API_TOKEN` env vars.
+async fn cleanup_okta(
+    user: &TestUserRecord,
+    _config: &AgentConfig,
+    http: &reqwest::Client,
+) -> Result<bool, String> {
+    let domain = std::env::var("OKTA_DOMAIN").map_err(|_| "OKTA_DOMAIN not set")?;
+    let api_token = std::env::var("OKTA_API_TOKEN").map_err(|_| "OKTA_API_TOKEN not set")?;
+
+    let username = user
+        .username
+        .as_deref()
+        .or(user.email.as_deref())
+        .ok_or("No username/email in test user record for Okta lookup")?;
+
+    info!(username, "Cleaning up Okta test user");
+
+    // Search user
+    let encoded = urlencoding::encode(username);
+    let search_url = format!("https://{domain}/api/v1/users?search=profile.login+eq+\"{encoded}\"");
+    let search_resp = http
+        .get(&search_url)
+        .header("Authorization", format!("SSWS {api_token}"))
+        .send()
+        .await
+        .map_err(|e| format!("Okta user search failed: {e}"))?;
+
+    let users: Vec<serde_json::Value> = search_resp
+        .json()
+        .await
+        .map_err(|e| format!("Failed to parse Okta users: {e}"))?;
+
+    let user_id = users
+        .first()
+        .and_then(|u| u.get("id"))
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| format!("User '{username}' not found in Okta"))?;
+
+    // Deactivate first (required by Okta before delete)
+    let _ = http
+        .post(format!(
+            "https://{domain}/api/v1/users/{user_id}/lifecycle/deactivate"
+        ))
+        .header("Authorization", format!("SSWS {api_token}"))
+        .send()
+        .await;
+
+    // Delete
+    let delete_resp = http
+        .delete(format!("https://{domain}/api/v1/users/{user_id}"))
+        .header("Authorization", format!("SSWS {api_token}"))
+        .send()
+        .await
+        .map_err(|e| format!("Okta user delete failed: {e}"))?;
+
+    if delete_resp.status().is_success() || delete_resp.status().as_u16() == 204 {
+        info!(username, user_id, "Okta test user deleted");
+        Ok(true)
+    } else {
+        let status = delete_resp.status();
+        let body = delete_resp.text().await.unwrap_or_default();
+        Err(format!("Okta delete failed ({status}): {body}"))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::pentest::{IdentityProvider, TestUserRecord};
+    use secrecy::SecretString;
+
+    fn make_config_no_keycloak() -> AgentConfig {
+        AgentConfig {
+            mongodb_uri: String::new(),
+            mongodb_database: String::new(),
+            litellm_url: String::new(),
+            litellm_api_key: SecretString::from(String::new()),
+            litellm_model: String::new(),
+            litellm_embed_model: String::new(),
+            github_token: None,
+            github_webhook_secret: None,
+            gitlab_url: None,
+            gitlab_token: None,
+            gitlab_webhook_secret: None,
+            jira_url: None,
+            jira_email: None,
+            jira_api_token: None,
+            jira_project_key: None,
+            searxng_url: None,
+            nvd_api_key: None,
+            agent_port: 3001,
+            scan_schedule: String::new(),
+            cve_monitor_schedule: String::new(),
+            git_clone_base_path: String::new(),
+            ssh_key_path: String::new(),
+            keycloak_url: None,
+            keycloak_realm: None,
+            keycloak_admin_username: None,
+            keycloak_admin_password: None,
+            pentest_verification_email: None,
+            pentest_imap_host: None,
+            pentest_imap_port: None,
+            pentest_imap_username: None,
+            pentest_imap_password: None,
+        }
+    }
+
+    #[tokio::test]
+    async fn already_cleaned_up_returns_false() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Keycloak),
+            cleaned_up: true,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert_eq!(result, Ok(false));
+    }
+
+    #[tokio::test]
+    async fn firebase_returns_false_not_implemented() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Firebase),
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert_eq!(result, Ok(false));
+    }
+
+    #[tokio::test]
+    async fn no_provider_no_keycloak_skips() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: None,
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert_eq!(result, Ok(false));
+    }
+
+    #[tokio::test]
+    async fn custom_provider_no_keycloak_skips() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Custom),
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert_eq!(result, Ok(false));
+    }
+
+    #[tokio::test]
+    async fn keycloak_missing_config_returns_error() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Keycloak),
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert!(result.is_err());
+        assert!(result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.contains("KEYCLOAK_URL")));
+    }
+
+    #[tokio::test]
+    async fn keycloak_missing_username_returns_error() {
+        let user = TestUserRecord {
+            username: None,
+            email: Some("test@example.com".into()),
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Keycloak),
+            cleaned_up: false,
+        };
+        let mut config = make_config_no_keycloak();
+        config.keycloak_url = Some("http://localhost:8080".into());
+        config.keycloak_realm = Some("test".into());
+        config.keycloak_admin_username = Some("admin".into());
+        config.keycloak_admin_password = Some(SecretString::from("pass".to_string()));
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert!(result.is_err());
+        assert!(result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.contains("username")));
+    }
+
+    #[tokio::test]
+    async fn auth0_missing_env_returns_error() {
+        let user = TestUserRecord {
+            username: None,
+            email: Some("test@example.com".into()),
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Auth0),
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert!(result.is_err());
+        assert!(result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.contains("AUTH0_DOMAIN")));
+    }
+
+    #[tokio::test]
+    async fn okta_missing_env_returns_error() {
+        let user = TestUserRecord {
+            username: Some("test".into()),
+            email: None,
+            provider_user_id: None,
+            provider: Some(IdentityProvider::Okta),
+            cleaned_up: false,
+        };
+        let config = make_config_no_keycloak();
+        let http = reqwest::Client::new();
+        let result = cleanup_test_user(&user, &config, &http).await;
+        assert!(result.is_err());
+        assert!(result
+            .as_ref()
+            .err()
+            .is_some_and(|e| e.contains("OKTA_DOMAIN")));
+    }
+}

compliance-agent/src/pentest/crypto.rs

@@ -0,0 +1,117 @@
+use aes_gcm::aead::AeadCore;
+use aes_gcm::{
+    aead::{Aead, KeyInit, OsRng},
+    Aes256Gcm, Nonce,
+};
+use base64::Engine;
+
+/// Load the 32-byte encryption key from PENTEST_ENCRYPTION_KEY env var.
+/// Returns None if not set or invalid length.
+pub fn load_encryption_key() -> Option<[u8; 32]> {
+    let hex_key = std::env::var("PENTEST_ENCRYPTION_KEY").ok()?;
+    let bytes = hex::decode(hex_key).ok()?;
+    if bytes.len() != 32 {
+        return None;
+    }
+    let mut key = [0u8; 32];
+    key.copy_from_slice(&bytes);
+    Some(key)
+}
+
+/// Encrypt a plaintext string. Returns base64-encoded nonce+ciphertext.
+/// Returns the original string if no encryption key is available.
+pub fn encrypt(plaintext: &str) -> String {
+    let Some(key_bytes) = load_encryption_key() else {
+        return plaintext.to_string();
+    };
+    let Ok(cipher) = Aes256Gcm::new_from_slice(&key_bytes) else {
+        return plaintext.to_string();
+    };
+    let nonce = Aes256Gcm::generate_nonce(&mut OsRng);
+    let Ok(ciphertext) = cipher.encrypt(&nonce, plaintext.as_bytes()) else {
+        return plaintext.to_string();
+    };
+    let mut combined = nonce.to_vec();
+    combined.extend_from_slice(&ciphertext);
+    base64::engine::general_purpose::STANDARD.encode(&combined)
+}
+
+/// Decrypt a base64-encoded nonce+ciphertext string.
+/// Returns None if decryption fails.
+pub fn decrypt(encrypted: &str) -> Option<String> {
+    let key_bytes = load_encryption_key()?;
+    let cipher = Aes256Gcm::new_from_slice(&key_bytes).ok()?;
+    let combined = base64::engine::general_purpose::STANDARD
+        .decode(encrypted)
+        .ok()?;
+    if combined.len() < 12 {
+        return None;
+    }
+    let (nonce_bytes, ciphertext) = combined.split_at(12);
+    let nonce = Nonce::from_slice(nonce_bytes);
+    let plaintext = cipher.decrypt(nonce, ciphertext).ok()?;
+    String::from_utf8(plaintext).ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    // Guard to serialize tests that touch env vars
+    static ENV_LOCK: Mutex<()> = Mutex::new(());
+
+    fn with_key<F: FnOnce()>(hex_key: &str, f: F) {
+        let _guard = ENV_LOCK.lock();
+        unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", hex_key) };
+        f();
+        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
+    }
+
+    #[test]
+    fn round_trip() {
+        let key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+        with_key(key, || {
+            let plaintext = "my_secret_password";
+            let encrypted = encrypt(plaintext);
+            assert_ne!(encrypted, plaintext);
+            let decrypted = decrypt(&encrypted);
+            assert_eq!(decrypted, Some(plaintext.to_string()));
+        });
+    }
+
+    #[test]
+    fn wrong_key_fails() {
+        let _guard = ENV_LOCK.lock();
+        let key1 = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+        let key2 = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
+        let encrypted = {
+            unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", key1) };
+            let e = encrypt("secret");
+            unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
+            e
+        };
+        unsafe { std::env::set_var("PENTEST_ENCRYPTION_KEY", key2) };
+        assert!(decrypt(&encrypted).is_none());
+        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
+    }
+
+    #[test]
+    fn no_key_passthrough() {
+        let _guard = ENV_LOCK.lock();
+        unsafe { std::env::remove_var("PENTEST_ENCRYPTION_KEY") };
+        let result = encrypt("plain");
+        assert_eq!(result, "plain");
+    }
+
+    #[test]
+    fn corrupted_ciphertext() {
+        let key = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+        with_key(key, || {
+            assert!(decrypt("not-valid-base64!!!").is_none());
+            // Valid base64 but wrong content
+            let garbage = base64::engine::general_purpose::STANDARD.encode(b"tooshort");
+            assert!(decrypt(&garbage).is_none());
+        });
+    }
+}

compliance-agent/src/pentest/mod.rs

@@ -1,4 +1,6 @@
+pub mod cleanup;
 mod context;
+pub mod crypto;
 pub mod orchestrator;
 mod prompt_builder;
 pub mod report;

compliance-agent/src/pentest/orchestrator.rs

@@ -2,7 +2,7 @@ use std::sync::Arc;
 use std::time::Duration;
 
 use mongodb::bson::doc;
-use tokio::sync::broadcast;
+use tokio::sync::{broadcast, watch};
 
 use compliance_core::models::dast::DastTarget;
 use compliance_core::models::pentest::*;
@@ -22,29 +22,27 @@ pub struct PentestOrchestrator {
     pub(crate) llm: Arc<LlmClient>,
     pub(crate) db: Database,
     pub(crate) event_tx: broadcast::Sender<PentestEvent>,
+    pub(crate) pause_rx: Option<watch::Receiver<bool>>,
 }
 
 impl PentestOrchestrator {
-    pub fn new(llm: Arc<LlmClient>, db: Database) -> Self {
-        let (event_tx, _) = broadcast::channel(256);
+    /// Create a new orchestrator with an externally-provided broadcast sender
+    /// and an optional pause receiver.
+    pub fn new(
+        llm: Arc<LlmClient>,
+        db: Database,
+        event_tx: broadcast::Sender<PentestEvent>,
+        pause_rx: Option<watch::Receiver<bool>>,
+    ) -> Self {
         Self {
             tool_registry: ToolRegistry::new(),
             llm,
             db,
             event_tx,
+            pause_rx,
         }
     }
 
-    #[allow(dead_code)]
-    pub fn subscribe(&self) -> broadcast::Receiver<PentestEvent> {
-        self.event_tx.subscribe()
-    }
-
-    #[allow(dead_code)]
-    pub fn event_sender(&self) -> broadcast::Sender<PentestEvent> {
-        self.event_tx.clone()
-    }
-
     /// Run a pentest session with timeout and automatic failure marking on errors.
     pub async fn run_session_guarded(
         &self,
@@ -54,8 +52,18 @@ impl PentestOrchestrator {
     ) {
         let session_id = session.id;
 
+        // Use config-specified timeout or default
+        let timeout_duration = session
+            .config
+            .as_ref()
+            .and_then(|c| c.max_duration_minutes)
+            .map(|m| Duration::from_secs(m as u64 * 60))
+            .unwrap_or(SESSION_TIMEOUT);
+
+        let timeout_minutes = timeout_duration.as_secs() / 60;
+
         match tokio::time::timeout(
-            SESSION_TIMEOUT,
+            timeout_duration,
             self.run_session(session, target, initial_message),
         )
         .await
@@ -72,12 +80,10 @@ impl PentestOrchestrator {
                 });
             }
             Err(_) => {
-                tracing::warn!(?session_id, "Pentest session timed out after 30 minutes");
-                self.mark_session_failed(session_id, "Session timed out after 30 minutes")
-                    .await;
-                let _ = self.event_tx.send(PentestEvent::Error {
-                    message: "Session timed out after 30 minutes".to_string(),
-                });
+                let msg = format!("Session timed out after {timeout_minutes} minutes");
+                tracing::warn!(?session_id, "{msg}");
+                self.mark_session_failed(session_id, &msg).await;
+                let _ = self.event_tx.send(PentestEvent::Error { message: msg });
             }
         }
     }
@@ -103,6 +109,45 @@ impl PentestOrchestrator {
         }
     }
 
+    /// Check if the session is paused; if so, update DB status and wait until resumed.
+    async fn wait_if_paused(&self, session: &PentestSession) {
+        let Some(ref pause_rx) = self.pause_rx else {
+            return;
+        };
+        let mut rx = pause_rx.clone();
+
+        if !*rx.borrow() {
+            return;
+        }
+
+        // We are paused — update DB status
+        if let Some(sid) = session.id {
+            let _ = self
+                .db
+                .pentest_sessions()
+                .update_one(doc! { "_id": sid }, doc! { "$set": { "status": "paused" }})
+                .await;
+        }
+        let _ = self.event_tx.send(PentestEvent::Paused);
+
+        // Wait until unpaused
+        while *rx.borrow() {
+            if rx.changed().await.is_err() {
+                break;
+            }
+        }
+
+        // Resumed — update DB status back to running
+        if let Some(sid) = session.id {
+            let _ = self
+                .db
+                .pentest_sessions()
+                .update_one(doc! { "_id": sid }, doc! { "$set": { "status": "running" }})
+                .await;
+        }
+        let _ = self.event_tx.send(PentestEvent::Resumed);
+    }
+
     async fn run_session(
         &self,
         session: &PentestSession,
@@ -175,6 +220,9 @@ impl PentestOrchestrator {
         let mut prev_node_ids: Vec<String> = Vec::new();
 
         for _iteration in 0..max_iterations {
+            // Check pause state at top of each iteration
+            self.wait_if_paused(session).await;
+
             let response = self
                 .llm
                 .chat_with_tools(messages.clone(), &tool_defs, Some(0.2), Some(8192))
@@ -342,10 +390,13 @@ impl PentestOrchestrator {
                                         )
                                         .await;
 
+                                    // Build LLM-facing summary: strip large fields
+                                    // (screenshots, raw HTML) to save context window
+                                    let llm_data = summarize_tool_output(&result.data);
                                     serde_json::json!({
                                         "summary": result.summary,
                                         "findings_count": findings_count,
-                                        "data": result.data,
+                                        "data": llm_data,
                                     })
                                     .to_string()
                                 }
@@ -417,6 +468,61 @@ impl PentestOrchestrator {
                 .await;
         }
 
+        // Clean up test user via identity provider API if requested
+        if session
+            .config
+            .as_ref()
+            .is_some_and(|c| c.auth.cleanup_test_user)
+        {
+            if let Some(ref test_user) = session.test_user {
+                let http = reqwest::Client::new();
+                // We need the AgentConfig — read from env since orchestrator doesn't hold it
+                let config = crate::config::load_config();
+                match config {
+                    Ok(cfg) => {
+                        match crate::pentest::cleanup::cleanup_test_user(test_user, &cfg, &http)
+                            .await
+                        {
+                            Ok(true) => {
+                                tracing::info!(
+                                    username = test_user.username.as_deref(),
+                                    "Test user cleaned up via provider API"
+                                );
+                                // Mark as cleaned up in DB
+                                if let Some(sid) = session.id {
+                                    let _ = self
+                                        .db
+                                        .pentest_sessions()
+                                        .update_one(
+                                            doc! { "_id": sid },
+                                            doc! { "$set": { "test_user.cleaned_up": true } },
+                                        )
+                                        .await;
+                                }
+                            }
+                            Ok(false) => {
+                                tracing::info!(
+                                    "Test user cleanup skipped (no provider configured)"
+                                );
+                            }
+                            Err(e) => {
+                                tracing::warn!(error = %e, "Test user cleanup failed");
+                                let _ = self.event_tx.send(PentestEvent::Error {
+                                    message: format!("Test user cleanup failed: {e}"),
+                                });
+                            }
+                        }
+                    }
+                    Err(e) => {
+                        tracing::warn!(error = %e, "Could not load config for cleanup");
+                    }
+                }
+            }
+        }
+
+        // Clean up the persistent browser session for this pentest
+        compliance_dast::tools::browser::cleanup_browser_session(&session_id).await;
+
         let _ = self.event_tx.send(PentestEvent::Complete {
             summary: format!(
                 "Pentest complete. {} findings from {} tool invocations.",
@@ -427,3 +533,174 @@ impl PentestOrchestrator {
         Ok(())
     }
 }
+
+/// Strip large fields from tool output before sending to the LLM.
+/// Screenshots, raw HTML, and other bulky data are replaced with short summaries.
+/// The full data is still stored in the DB for the report.
+fn summarize_tool_output(data: &serde_json::Value) -> serde_json::Value {
+    let Some(obj) = data.as_object() else {
+        return data.clone();
+    };
+
+    let mut summarized = serde_json::Map::new();
+    for (key, value) in obj {
+        match key.as_str() {
+            // Replace screenshot base64 with a placeholder
+            "screenshot_base64" => {
+                if let Some(s) = value.as_str() {
+                    if !s.is_empty() {
+                        summarized.insert(
+                            key.clone(),
+                            serde_json::Value::String(
+                                "[screenshot captured and saved to report]".to_string(),
+                            ),
+                        );
+                        continue;
+                    }
+                }
+                summarized.insert(key.clone(), value.clone());
+            }
+            // Truncate raw HTML content
+            "html" => {
+                if let Some(s) = value.as_str() {
+                    if s.len() > 2000 {
+                        summarized.insert(
+                            key.clone(),
+                            serde_json::Value::String(format!(
+                                "{}... [truncated, {} chars total]",
+                                &s[..2000],
+                                s.len()
+                            )),
+                        );
+                        continue;
+                    }
+                }
+                summarized.insert(key.clone(), value.clone());
+            }
+            // Truncate page text
+            "text" if value.as_str().is_some_and(|s| s.len() > 1500) => {
+                let s = value.as_str().unwrap_or_default();
+                summarized.insert(
+                    key.clone(),
+                    serde_json::Value::String(format!("{}... [truncated]", &s[..1500])),
+                );
+            }
+            // Trim large arrays (e.g., "elements", "links", "inputs")
+            "elements" | "links" | "inputs" => {
+                if let Some(arr) = value.as_array() {
+                    if arr.len() > 15 {
+                        let mut trimmed: Vec<serde_json::Value> = arr[..15].to_vec();
+                        trimmed.push(serde_json::json!(format!(
+                            "... and {} more",
+                            arr.len() - 15
+                        )));
+                        summarized.insert(key.clone(), serde_json::Value::Array(trimmed));
+                        continue;
+                    }
+                }
+                summarized.insert(key.clone(), value.clone());
+            }
+            // Recursively summarize nested objects (e.g., "page" in get_content)
+            _ if value.is_object() => {
+                summarized.insert(key.clone(), summarize_tool_output(value));
+            }
+            // Keep everything else as-is
+            _ => {
+                summarized.insert(key.clone(), value.clone());
+            }
+        }
+    }
+    serde_json::Value::Object(summarized)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn test_summarize_strips_screenshot() {
+        let input = json!({
+            "screenshot_base64": "iVBOR...",
+            "url": "https://example.com"
+        });
+        let result = summarize_tool_output(&input);
+        assert_eq!(
+            result["screenshot_base64"],
+            "[screenshot captured and saved to report]"
+        );
+        assert_eq!(result["url"], "https://example.com");
+    }
+
+    #[test]
+    fn test_summarize_truncates_html() {
+        let long_html = "x".repeat(3000);
+        let input = json!({ "html": long_html });
+        let result = summarize_tool_output(&input);
+        let s = result["html"].as_str().unwrap_or_default();
+        assert!(s.contains("[truncated, 3000 chars total]"));
+        assert!(s.starts_with(&"x".repeat(2000)));
+        assert!(s.len() < 3000);
+    }
+
+    #[test]
+    fn test_summarize_truncates_text() {
+        let long_text = "a".repeat(2000);
+        let input = json!({ "text": long_text });
+        let result = summarize_tool_output(&input);
+        let s = result["text"].as_str().unwrap_or_default();
+        assert!(s.contains("[truncated]"));
+        assert!(s.starts_with(&"a".repeat(1500)));
+        assert!(s.len() < 2000);
+    }
+
+    #[test]
+    fn test_summarize_trims_large_arrays() {
+        let elements: Vec<serde_json::Value> = (0..20).map(|i| json!(format!("el-{i}"))).collect();
+        let input = json!({ "elements": elements });
+        let result = summarize_tool_output(&input);
+        let arr = result["elements"].as_array();
+        assert!(arr.is_some());
+        if let Some(arr) = arr {
+            // 15 kept + 1 summary entry
+            assert_eq!(arr.len(), 16);
+            assert_eq!(arr[15], json!("... and 5 more"));
+        }
+    }
+
+    #[test]
+    fn test_summarize_preserves_small_data() {
+        let input = json!({
+            "url": "https://example.com",
+            "status": 200,
+            "title": "Example"
+        });
+        let result = summarize_tool_output(&input);
+        assert_eq!(result, input);
+    }
+
+    #[test]
+    fn test_summarize_recursive() {
+        let input = json!({
+            "page": {
+                "screenshot_base64": "iVBORw0KGgoAAAA...",
+                "url": "https://example.com"
+            }
+        });
+        let result = summarize_tool_output(&input);
+        assert_eq!(
+            result["page"]["screenshot_base64"],
+            "[screenshot captured and saved to report]"
+        );
+        assert_eq!(result["page"]["url"], "https://example.com");
+    }
+
+    #[test]
+    fn test_summarize_non_object() {
+        let string_val = json!("just a string");
+        assert_eq!(summarize_tool_output(&string_val), string_val);
+
+        let num_val = json!(42);
+        assert_eq!(summarize_tool_output(&num_val), num_val);
+    }
+}

compliance-agent/src/pentest/prompt_builder.rs

@@ -5,6 +5,100 @@ use compliance_core::models::sbom::SbomEntry;
 
 use super::orchestrator::PentestOrchestrator;
 
+/// Attempt to decrypt a field; if decryption fails, return the original value
+/// (which may be plaintext from before encryption was enabled).
+fn decrypt_field(value: &str) -> String {
+    super::crypto::decrypt(value).unwrap_or_else(|| value.to_string())
+}
+
+/// Build additional prompt sections from PentestConfig when present.
+fn build_config_sections(config: &PentestConfig) -> String {
+    let mut sections = String::new();
+
+    // Authentication section
+    match config.auth.mode {
+        AuthMode::Manual => {
+            sections.push_str("\n## Authentication\n");
+            sections.push_str("- **Mode**: Manual credentials\n");
+            if let Some(ref u) = config.auth.username {
+                let decrypted = decrypt_field(u);
+                sections.push_str(&format!("- **Username**: {decrypted}\n"));
+            }
+            if let Some(ref p) = config.auth.password {
+                let decrypted = decrypt_field(p);
+                sections.push_str(&format!("- **Password**: {decrypted}\n"));
+            }
+            sections.push_str(
+                "Use these credentials to log in before testing authenticated endpoints.\n",
+            );
+        }
+        AuthMode::AutoRegister => {
+            sections.push_str("\n## Authentication\n");
+            sections.push_str("- **Mode**: Auto-register\n");
+            if let Some(ref url) = config.auth.registration_url {
+                sections.push_str(&format!("- **Registration URL**: {url}\n"));
+            } else {
+                sections.push_str(
+                    "- **Registration URL**: Not provided — use Playwright to discover the registration page.\n",
+                );
+            }
+            if let Some(ref email) = config.auth.verification_email {
+                sections.push_str(&format!(
+                    "- **Verification Email**: Use plus-addressing from `{email}` \
+                     (e.g. `{base}+{{session_id}}@{domain}`) for email verification. \
+                     The system will poll the IMAP mailbox for verification links.\n",
+                    base = email.split('@').next().unwrap_or(email),
+                    domain = email.split('@').nth(1).unwrap_or("example.com"),
+                ));
+            }
+            sections.push_str(
+                "Register a new test account using the registration page, then use it for testing.\n",
+            );
+        }
+        AuthMode::None => {}
+    }
+
+    // Custom headers
+    if !config.custom_headers.is_empty() {
+        sections.push_str("\n## Custom HTTP Headers\n");
+        sections.push_str("Include these headers in all HTTP requests:\n");
+        for (k, v) in &config.custom_headers {
+            sections.push_str(&format!("- `{k}: {v}`\n"));
+        }
+    }
+
+    // Scope exclusions
+    if !config.scope_exclusions.is_empty() {
+        sections.push_str("\n## Scope Exclusions\n");
+        sections.push_str("Do NOT test the following paths:\n");
+        for path in &config.scope_exclusions {
+            sections.push_str(&format!("- `{path}`\n"));
+        }
+    }
+
+    // Git context
+    if config.git_repo_url.is_some() || config.branch.is_some() || config.commit_hash.is_some() {
+        sections.push_str("\n## Git Context\n");
+        if let Some(ref url) = config.git_repo_url {
+            sections.push_str(&format!("- **Repository**: {url}\n"));
+        }
+        if let Some(ref branch) = config.branch {
+            sections.push_str(&format!("- **Branch**: {branch}\n"));
+        }
+        if let Some(ref commit) = config.commit_hash {
+            sections.push_str(&format!("- **Commit**: {commit}\n"));
+        }
+    }
+
+    // Environment
+    sections.push_str(&format!(
+        "\n## Environment\n- **Target environment**: {}\n",
+        config.environment
+    ));
+
+    sections
+}
+
 /// Return strategy guidance text for the given strategy.
 fn strategy_guidance(strategy: &PentestStrategy) -> &'static str {
     match strategy {
@@ -155,6 +249,11 @@ impl PentestOrchestrator {
         let sast_section = build_sast_section(sast_findings);
         let sbom_section = build_sbom_section(sbom_entries);
         let code_section = build_code_section(code_context);
+        let config_sections = session
+            .config
+            .as_ref()
+            .map(build_config_sections)
+            .unwrap_or_default();
 
         format!(
             r#"You are an expert penetration tester conducting an authorized security assessment.
@@ -178,7 +277,7 @@ impl PentestOrchestrator {
 
 ## Code Entry Points (Knowledge Graph)
 {code_section}
-
+{config_sections}
 ## Available Tools
 {tool_names}
 
@@ -186,15 +285,34 @@ impl PentestOrchestrator {
 1. Start by running reconnaissance (recon tool) to fingerprint the target and discover technologies.
 2. Run the OpenAPI parser to discover API endpoints from specs.
 3. Check infrastructure: DNS, DMARC, TLS, security headers, cookies, CSP, CORS.
-4. Based on SAST findings, prioritize testing endpoints where vulnerabilities were found in code.
-5. For each vulnerability type found in SAST, use the corresponding DAST tool to verify exploitability.
-6. If vulnerable dependencies are listed, try to trigger known CVE conditions against the running application.
-7. Test rate limiting on critical endpoints (login, API).
-8. Check for console.log leakage in frontend JavaScript.
-9. Analyze tool results and chain findings — if one vulnerability enables others, explore the chain.
-10. When testing is complete, provide a structured summary with severity and remediation.
-11. Always explain your reasoning before invoking each tool.
-12. When done, say "Testing complete" followed by a final summary.
+4. If the target requires authentication (auto-register mode), use the browser tool to:
+   a. Navigate to the target — it will redirect to the login page.
+   b. Click the "Register" link to reach the registration form.
+   c. Fill all form fields (username, email with plus-addressing, password, name) one by one.
+   d. Click submit. If a Terms & Conditions page appears, accept it.
+   e. After registration, use the browser to navigate through the application pages.
+   f. **Take a screenshot after each major page** for evidence in the report.
+5. Use the browser tool to explore the authenticated application — navigate to each section,
+   use get_content to understand the page structure, and take screenshots.
+6. Based on SAST findings, prioritize testing endpoints where vulnerabilities were found in code.
+7. For each vulnerability type found in SAST, use the corresponding DAST tool to verify exploitability.
+8. If vulnerable dependencies are listed, try to trigger known CVE conditions against the running application.
+9. Test rate limiting on critical endpoints (login, API).
+10. Check for console.log leakage in frontend JavaScript.
+11. Analyze tool results and chain findings — if one vulnerability enables others, explore the chain.
+12. When testing is complete, provide a structured summary with severity and remediation.
+13. Always explain your reasoning before invoking each tool.
+14. When done, say "Testing complete" followed by a final summary.
+
+## Browser Tool Usage
+- The browser tab **persists** between calls — cookies and login state are preserved.
+- After navigate, the response includes `elements` (links, inputs, buttons on the page).
+- Use `get_content` to see forms, links, buttons, headings, and page text.
+- Use `click` with CSS selectors to interact (e.g., `a:text('Register')`, `input[type='submit']`).
+- Use `fill` with selector + value to fill form fields (e.g., `input[name='email']`).
+- **Take screenshots** (`action: screenshot`) after important actions for evidence.
+- For SPA apps: a 200 HTTP status does NOT mean the page is accessible — check the actual
+  page content with the browser tool to verify if it shows real data or a login redirect.
 
 ## Important
 - This is an authorized penetration test. All testing is permitted within the target scope.

compliance-agent/src/pentest/report/html/appendix.rs

@@ -0,0 +1,40 @@
+use super::html_escape;
+
+pub(super) fn appendix(session_id: &str) -> String {
+    format!(
+        r##"<!-- ═══════════════ 5. APPENDIX ═══════════════ -->
+<div class="page-break"></div>
+<h2><span class="section-num">5.</span> Appendix</h2>
+
+<h3>Severity Definitions</h3>
+<table class="info">
+    <tr><td style="color: var(--sev-critical); font-weight: 700;">Critical</td><td>Vulnerabilities that can be exploited remotely without authentication to execute arbitrary code, exfiltrate sensitive data, or fully compromise the system.</td></tr>
+    <tr><td style="color: var(--sev-high); font-weight: 700;">High</td><td>Vulnerabilities that allow significant unauthorized access or data exposure, typically requiring minimal user interaction or privileges.</td></tr>
+    <tr><td style="color: var(--sev-medium); font-weight: 700;">Medium</td><td>Vulnerabilities that may lead to limited data exposure or require specific conditions to exploit, but still represent meaningful risk.</td></tr>
+    <tr><td style="color: var(--sev-low); font-weight: 700;">Low</td><td>Minor issues with limited direct impact. May contribute to broader attack chains or indicate defense-in-depth weaknesses.</td></tr>
+    <tr><td style="color: var(--sev-info); font-weight: 700;">Info</td><td>Observations and best-practice recommendations that do not represent direct security vulnerabilities.</td></tr>
+</table>
+
+<h3>Disclaimer</h3>
+<p style="font-size: 9pt; color: var(--text-secondary);">
+    This report was generated by an automated AI-powered penetration testing engine. While the system
+    employs advanced techniques to identify vulnerabilities, no automated assessment can guarantee
+    complete coverage. The results should be reviewed by qualified security professionals and validated
+    in the context of the target application's threat model. Findings are point-in-time observations
+    and may change as the application evolves.
+</p>
+
+<!-- ═══════════════ FOOTER ═══════════════ -->
+<div class="report-footer">
+    <div class="footer-company">Compliance Scanner</div>
+    <div>AI-Powered Security Assessment Platform</div>
+    <div style="margin-top: 6px;">This document is confidential and intended solely for the named recipient.</div>
+    <div>Report ID: {session_id}</div>
+</div>
+
+</div><!-- .report-body -->
+</body>
+</html>"##,
+        session_id = html_escape(session_id),
+    )
+}

compliance-agent/src/pentest/report/html/attack_chain.rs

@@ -0,0 +1,193 @@
+use super::html_escape;
+use compliance_core::models::pentest::AttackChainNode;
+
+pub(super) fn attack_chain(chain: &[AttackChainNode]) -> String {
+    let chain_section = if chain.is_empty() {
+        r#"<p style="color: var(--text-muted);">No attack chain steps recorded.</p>"#.to_string()
+    } else {
+        build_chain_html(chain)
+    };
+
+    format!(
+        r##"<!-- ═══════════════ 4. ATTACK CHAIN ═══════════════ -->
+<div class="page-break"></div>
+<h2><span class="section-num">4.</span> Attack Chain Timeline</h2>
+
+<p>
+    The following sequence shows each tool invocation made by the AI orchestrator during the assessment,
+    grouped by phase. Each step includes the tool's name, execution status, and the AI's reasoning
+    for choosing that action.
+</p>
+
+<div style="margin-top: 16px;">
+    {chain_section}
+</div>"##
+    )
+}
+
+fn build_chain_html(chain: &[AttackChainNode]) -> String {
+    let mut chain_html = String::new();
+
+    // Compute phases via BFS from root nodes
+    let mut phase_map: std::collections::HashMap<String, usize> = std::collections::HashMap::new();
+    let mut queue: std::collections::VecDeque<String> = std::collections::VecDeque::new();
+
+    for node in chain {
+        if node.parent_node_ids.is_empty() {
+            let nid = node.node_id.clone();
+            if !nid.is_empty() {
+                phase_map.insert(nid.clone(), 0);
+                queue.push_back(nid);
+            }
+        }
+    }
+
+    while let Some(nid) = queue.pop_front() {
+        let parent_phase = phase_map.get(&nid).copied().unwrap_or(0);
+        for node in chain {
+            if node.parent_node_ids.contains(&nid) {
+                let child_id = node.node_id.clone();
+                if !child_id.is_empty() && !phase_map.contains_key(&child_id) {
+                    phase_map.insert(child_id.clone(), parent_phase + 1);
+                    queue.push_back(child_id);
+                }
+            }
+        }
+    }
+
+    // Assign phase 0 to any unassigned nodes
+    for node in chain {
+        let nid = node.node_id.clone();
+        if !nid.is_empty() && !phase_map.contains_key(&nid) {
+            phase_map.insert(nid, 0);
+        }
+    }
+
+    // Group nodes by phase
+    let max_phase = phase_map.values().copied().max().unwrap_or(0);
+    let phase_labels = [
+        "Reconnaissance",
+        "Enumeration",
+        "Exploitation",
+        "Validation",
+        "Post-Exploitation",
+    ];
+
+    for phase_idx in 0..=max_phase {
+        let phase_nodes: Vec<&AttackChainNode> = chain
+            .iter()
+            .filter(|n| {
+                let nid = n.node_id.clone();
+                phase_map.get(&nid).copied().unwrap_or(0) == phase_idx
+            })
+            .collect();
+
+        if phase_nodes.is_empty() {
+            continue;
+        }
+
+        let label = if phase_idx < phase_labels.len() {
+            phase_labels[phase_idx]
+        } else {
+            "Additional Testing"
+        };
+
+        chain_html.push_str(&format!(
+            r#"<div class="phase-block">
+                    <div class="phase-header">
+                        <span class="phase-num">Phase {}</span>
+                        <span class="phase-label">{}</span>
+                        <span class="phase-count">{} step{}</span>
+                    </div>
+                    <div class="phase-steps">"#,
+            phase_idx + 1,
+            label,
+            phase_nodes.len(),
+            if phase_nodes.len() == 1 { "" } else { "s" },
+        ));
+
+        for (i, node) in phase_nodes.iter().enumerate() {
+            let status_label = format!("{:?}", node.status);
+            let status_class = match status_label.to_lowercase().as_str() {
+                "completed" => "step-completed",
+                "failed" => "step-failed",
+                _ => "step-running",
+            };
+            let findings_badge = if !node.findings_produced.is_empty() {
+                format!(
+                    r#"<span class="step-findings">{} finding{}</span>"#,
+                    node.findings_produced.len(),
+                    if node.findings_produced.len() == 1 {
+                        ""
+                    } else {
+                        "s"
+                    },
+                )
+            } else {
+                String::new()
+            };
+            let risk_badge = node
+                .risk_score
+                .map(|r| {
+                    let risk_class = if r >= 70 {
+                        "risk-high"
+                    } else if r >= 40 {
+                        "risk-med"
+                    } else {
+                        "risk-low"
+                    };
+                    format!(r#"<span class="step-risk {risk_class}">Risk: {r}</span>"#)
+                })
+                .unwrap_or_default();
+
+            let reasoning_html = if node.llm_reasoning.is_empty() {
+                String::new()
+            } else {
+                format!(
+                    r#"<div class="step-reasoning">{}</div>"#,
+                    html_escape(&node.llm_reasoning)
+                )
+            };
+
+            // Render inline screenshot if this is a browser screenshot action
+            let screenshot_html = if node.tool_name == "browser" {
+                node.tool_output
+                    .as_ref()
+                    .and_then(|out| out.get("screenshot_base64"))
+                    .and_then(|v| v.as_str())
+                    .filter(|s| !s.is_empty())
+                    .map(|b64| {
+                        format!(
+                            r#"<div class="step-screenshot"><img src="data:image/png;base64,{b64}" alt="Browser screenshot" style="max-width:100%;border:1px solid #e2e8f0;border-radius:6px;margin-top:8px;"/></div>"#
+                        )
+                    })
+                    .unwrap_or_default()
+            } else {
+                String::new()
+            };
+
+            chain_html.push_str(&format!(
+                r#"<div class="step-row">
+                        <div class="step-num">{num}</div>
+                        <div class="step-connector"></div>
+                        <div class="step-content">
+                            <div class="step-header">
+                                <span class="step-tool">{tool_name}</span>
+                                <span class="step-status {status_class}">{status_label}</span>
+                                {findings_badge}
+                                {risk_badge}
+                            </div>
+                            {reasoning_html}
+                            {screenshot_html}
+                        </div>
+                    </div>"#,
+                num = i + 1,
+                tool_name = html_escape(&node.tool_name),
+            ));
+        }
+
+        chain_html.push_str("</div></div>");
+    }
+
+    chain_html
+}

compliance-agent/src/pentest/report/html/cover.rs

@@ -0,0 +1,69 @@
+use super::html_escape;
+
+pub(super) fn cover(
+    target_name: &str,
+    session_id: &str,
+    date_short: &str,
+    target_url: &str,
+    requester_name: &str,
+    requester_email: &str,
+    app_screenshot_b64: Option<&str>,
+) -> String {
+    let screenshot_html = app_screenshot_b64
+        .filter(|s| !s.is_empty())
+        .map(|b64| {
+            format!(
+                r#"<div style="margin: 20px auto; max-width: 560px; border: 1px solid #cbd5e1; border-radius: 8px; overflow: hidden; box-shadow: 0 4px 12px rgba(0,0,0,0.08);">
+    <img src="data:image/png;base64,{b64}" alt="Application screenshot" style="width:100%;display:block;"/>
+</div>"#
+            )
+        })
+        .unwrap_or_default();
+    format!(
+        r##"<!-- ═══════════════ COVER PAGE ═══════════════ -->
+<div class="cover">
+    <svg class="cover-shield" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96">
+        <defs>
+            <linearGradient id="sg" x1="0%" y1="0%" x2="100%" y2="100%">
+                <stop offset="0%" stop-color="#0d2137"/>
+                <stop offset="100%" stop-color="#1a56db"/>
+            </linearGradient>
+        </defs>
+        <path d="M48 6 L22 22 L22 48 C22 66 34 80 48 86 C62 80 74 66 74 48 L74 22 Z"
+              fill="none" stroke="url(#sg)" stroke-width="3.5" stroke-linejoin="round"/>
+        <path d="M48 12 L26 26 L26 47 C26 63 36 76 48 82 C60 76 70 63 70 47 L70 26 Z"
+              fill="url(#sg)" opacity="0.07"/>
+        <circle cx="44" cy="44" r="11" fill="none" stroke="#0d2137" stroke-width="2.5"/>
+        <line x1="52" y1="52" x2="62" y2="62" stroke="#0d2137" stroke-width="2.5" stroke-linecap="round"/>
+        <path d="M39 44 L42.5 47.5 L49 41" fill="none" stroke="#166534" stroke-width="2.5"
+              stroke-linecap="round" stroke-linejoin="round"/>
+    </svg>
+
+    <div class="cover-tag">CONFIDENTIAL</div>
+
+    <div class="cover-title">Penetration Test Report</div>
+    <div class="cover-subtitle">{target_name}</div>
+
+    <div class="cover-divider"></div>
+
+    <div class="cover-meta">
+        <strong>Report ID:</strong> {session_id}<br>
+        <strong>Date:</strong> {date_short}<br>
+        <strong>Target:</strong> {target_url}<br>
+        <strong>Prepared for:</strong> {requester_name} ({requester_email})
+    </div>
+
+    {screenshot_html}
+
+    <div class="cover-footer">
+        Compliance Scanner &mdash; AI-Powered Security Assessment Platform
+    </div>
+</div>"##,
+        target_name = html_escape(target_name),
+        session_id = html_escape(session_id),
+        date_short = date_short,
+        target_url = html_escape(target_url),
+        requester_name = html_escape(requester_name),
+        requester_email = html_escape(requester_email),
+    )
+}

compliance-agent/src/pentest/report/html/executive_summary.rs

@@ -0,0 +1,238 @@
+use super::html_escape;
+use compliance_core::models::dast::DastFinding;
+
+pub(super) fn executive_summary(
+    findings: &[DastFinding],
+    target_name: &str,
+    target_url: &str,
+    tool_count: usize,
+    tool_invocations: u32,
+    success_rate: f64,
+) -> String {
+    let critical = findings
+        .iter()
+        .filter(|f| f.severity.to_string() == "critical")
+        .count();
+    let high = findings
+        .iter()
+        .filter(|f| f.severity.to_string() == "high")
+        .count();
+    let medium = findings
+        .iter()
+        .filter(|f| f.severity.to_string() == "medium")
+        .count();
+    let low = findings
+        .iter()
+        .filter(|f| f.severity.to_string() == "low")
+        .count();
+    let info = findings
+        .iter()
+        .filter(|f| f.severity.to_string() == "info")
+        .count();
+    let exploitable = findings.iter().filter(|f| f.exploitable).count();
+    let total = findings.len();
+
+    let overall_risk = if critical > 0 {
+        "CRITICAL"
+    } else if high > 0 {
+        "HIGH"
+    } else if medium > 0 {
+        "MEDIUM"
+    } else if low > 0 {
+        "LOW"
+    } else {
+        "INFORMATIONAL"
+    };
+
+    let risk_color = match overall_risk {
+        "CRITICAL" => "#991b1b",
+        "HIGH" => "#c2410c",
+        "MEDIUM" => "#a16207",
+        "LOW" => "#1d4ed8",
+        _ => "#4b5563",
+    };
+
+    let risk_score: usize =
+        std::cmp::min(100, critical * 25 + high * 15 + medium * 8 + low * 3 + info);
+
+    let severity_bar = build_severity_bar(critical, high, medium, low, info, total);
+
+    // Table of contents finding sub-entries
+    let severity_order = ["critical", "high", "medium", "low", "info"];
+    let toc_findings_sub = if !findings.is_empty() {
+        let mut sub = String::new();
+        let mut fnum = 0usize;
+        for &sev_key in severity_order.iter() {
+            let count = findings
+                .iter()
+                .filter(|f| f.severity.to_string() == sev_key)
+                .count();
+            if count == 0 {
+                continue;
+            }
+            for f in findings
+                .iter()
+                .filter(|f| f.severity.to_string() == sev_key)
+            {
+                fnum += 1;
+                sub.push_str(&format!(
+                    r#"<div class="toc-sub">F-{:03} — {}</div>"#,
+                    fnum,
+                    html_escape(&f.title),
+                ));
+            }
+        }
+        sub
+    } else {
+        String::new()
+    };
+
+    let critical_high_str = format!("{} / {}", critical, high);
+    let escaped_target_name = html_escape(target_name);
+    let escaped_target_url = html_escape(target_url);
+
+    format!(
+        r##"<!-- ═══════════════ TABLE OF CONTENTS ═══════════════ -->
+<div class="report-body">
+
+<div class="toc">
+    <h2>Table of Contents</h2>
+    <div class="toc-entry"><span class="toc-num">1</span><span class="toc-label">Executive Summary</span></div>
+    <div class="toc-entry"><span class="toc-num">2</span><span class="toc-label">Scope &amp; Methodology</span></div>
+    <div class="toc-entry"><span class="toc-num">3</span><span class="toc-label">Findings ({total_findings})</span></div>
+    {toc_findings_sub}
+    <div class="toc-entry"><span class="toc-num">4</span><span class="toc-label">Attack Chain Timeline</span></div>
+    <div class="toc-entry"><span class="toc-num">5</span><span class="toc-label">Appendix</span></div>
+</div>
+
+<!-- ═══════════════ 1. EXECUTIVE SUMMARY ═══════════════ -->
+<h2><span class="section-num">1.</span> Executive Summary</h2>
+
+<div class="risk-gauge">
+    <div class="risk-gauge-meter">
+        <div class="risk-gauge-track">
+            <div class="risk-gauge-fill" style="width: {risk_score}%; background: {risk_color};"></div>
+        </div>
+        <div class="risk-gauge-score" style="color: {risk_color};">{risk_score} / 100</div>
+    </div>
+    <div class="risk-gauge-text">
+        <div class="risk-gauge-label" style="color: {risk_color};">Overall Risk: {overall_risk}</div>
+        <div class="risk-gauge-desc">
+            Based on {total_findings} finding{findings_plural} identified across the target application.
+        </div>
+    </div>
+</div>
+
+<div class="exec-grid">
+    <div class="kpi-card">
+        <div class="kpi-value">{total_findings}</div>
+        <div class="kpi-label">Total Findings</div>
+    </div>
+    <div class="kpi-card">
+        <div class="kpi-value" style="color: var(--sev-critical);">{critical_high}</div>
+        <div class="kpi-label">Critical / High</div>
+    </div>
+    <div class="kpi-card">
+        <div class="kpi-value" style="color: var(--sev-critical);">{exploitable_count}</div>
+        <div class="kpi-label">Exploitable</div>
+    </div>
+    <div class="kpi-card">
+        <div class="kpi-value">{tool_count}</div>
+        <div class="kpi-label">Tools Used</div>
+    </div>
+</div>
+
+<h3>Severity Distribution</h3>
+{severity_bar}
+
+<p>
+    This report presents the results of an automated penetration test conducted against
+    <strong>{target_name}</strong> (<code>{target_url}</code>) using the Compliance Scanner
+    AI-powered testing engine. A total of <strong>{total_findings} vulnerabilities</strong> were
+    identified, of which <strong>{exploitable_count}</strong> were confirmed exploitable with
+    working proof-of-concept payloads. The assessment employed <strong>{tool_count} security tools</strong>
+    across <strong>{tool_invocations} invocations</strong> ({success_rate:.0}% success rate).
+</p>"##,
+        total_findings = total,
+        findings_plural = if total == 1 { "" } else { "s" },
+        critical_high = critical_high_str,
+        exploitable_count = exploitable,
+        target_name = escaped_target_name,
+        target_url = escaped_target_url,
+    )
+}
+
+fn build_severity_bar(
+    critical: usize,
+    high: usize,
+    medium: usize,
+    low: usize,
+    info: usize,
+    total: usize,
+) -> String {
+    if total == 0 {
+        return String::new();
+    }
+
+    let crit_pct = (critical as f64 / total as f64 * 100.0) as usize;
+    let high_pct = (high as f64 / total as f64 * 100.0) as usize;
+    let med_pct = (medium as f64 / total as f64 * 100.0) as usize;
+    let low_pct = (low as f64 / total as f64 * 100.0) as usize;
+    let info_pct = 100_usize.saturating_sub(crit_pct + high_pct + med_pct + low_pct);
+
+    let mut bar = String::from(r#"<div class="sev-bar">"#);
+    if critical > 0 {
+        bar.push_str(&format!(
+            r#"<div class="sev-bar-seg sev-bar-critical" style="width:{}%"><span>{}</span></div>"#,
+            std::cmp::max(crit_pct, 4),
+            critical
+        ));
+    }
+    if high > 0 {
+        bar.push_str(&format!(
+            r#"<div class="sev-bar-seg sev-bar-high" style="width:{}%"><span>{}</span></div>"#,
+            std::cmp::max(high_pct, 4),
+            high
+        ));
+    }
+    if medium > 0 {
+        bar.push_str(&format!(
+            r#"<div class="sev-bar-seg sev-bar-medium" style="width:{}%"><span>{}</span></div>"#,
+            std::cmp::max(med_pct, 4),
+            medium
+        ));
+    }
+    if low > 0 {
+        bar.push_str(&format!(
+            r#"<div class="sev-bar-seg sev-bar-low" style="width:{}%"><span>{}</span></div>"#,
+            std::cmp::max(low_pct, 4),
+            low
+        ));
+    }
+    if info > 0 {
+        bar.push_str(&format!(
+            r#"<div class="sev-bar-seg sev-bar-info" style="width:{}%"><span>{}</span></div>"#,
+            std::cmp::max(info_pct, 4),
+            info
+        ));
+    }
+    bar.push_str("</div>");
+    bar.push_str(r#"<div class="sev-bar-legend">"#);
+    if critical > 0 {
+        bar.push_str(r#"<span><i class="sev-dot" style="background:#991b1b"></i> Critical</span>"#);
+    }
+    if high > 0 {
+        bar.push_str(r#"<span><i class="sev-dot" style="background:#c2410c"></i> High</span>"#);
+    }
+    if medium > 0 {
+        bar.push_str(r#"<span><i class="sev-dot" style="background:#a16207"></i> Medium</span>"#);
+    }
+    if low > 0 {
+        bar.push_str(r#"<span><i class="sev-dot" style="background:#1d4ed8"></i> Low</span>"#);
+    }
+    if info > 0 {
+        bar.push_str(r#"<span><i class="sev-dot" style="background:#4b5563"></i> Info</span>"#);
+    }
+    bar.push_str("</div>");
+    bar
+}

compliance-agent/src/pentest/report/html/findings.rs

@@ -0,0 +1,522 @@
+use super::html_escape;
+use compliance_core::models::dast::DastFinding;
+use compliance_core::models::finding::Finding;
+use compliance_core::models::pentest::CodeContextHint;
+use compliance_core::models::sbom::SbomEntry;
+
+/// Render the findings section with code-level correlation.
+///
+/// For each DAST finding, if a linked SAST finding exists (via `linked_sast_finding_id`)
+/// or if we can match the endpoint to a code entry point, we render a "Code-Level
+/// Remediation" block showing the exact file, line, code snippet, and suggested fix.
+pub(super) fn findings(
+    findings_list: &[DastFinding],
+    sast_findings: &[Finding],
+    code_context: &[CodeContextHint],
+    sbom_entries: &[SbomEntry],
+) -> String {
+    if findings_list.is_empty() {
+        return r#"<!-- ═══════════════ 3. FINDINGS ═══════════════ -->
+<div class="page-break"></div>
+<h2><span class="section-num">3.</span> Findings</h2>
+
+<p style="color: var(--text-muted);">No vulnerabilities were identified during this assessment.</p>"#.to_string();
+    }
+
+    let severity_order = ["critical", "high", "medium", "low", "info"];
+    let severity_labels = ["Critical", "High", "Medium", "Low", "Informational"];
+    let severity_colors = ["#991b1b", "#c2410c", "#a16207", "#1d4ed8", "#4b5563"];
+
+    // Build SAST lookup by ObjectId hex string
+    let sast_by_id: std::collections::HashMap<String, &Finding> = sast_findings
+        .iter()
+        .filter_map(|f| {
+            let id = f.id.as_ref()?.to_hex();
+            Some((id, f))
+        })
+        .collect();
+
+    let mut findings_html = String::new();
+    let mut finding_num = 0usize;
+
+    for (si, &sev_key) in severity_order.iter().enumerate() {
+        let sev_findings: Vec<&DastFinding> = findings_list
+            .iter()
+            .filter(|f| f.severity.to_string() == sev_key)
+            .collect();
+        if sev_findings.is_empty() {
+            continue;
+        }
+
+        findings_html.push_str(&format!(
+            r#"<h4 class="sev-group-title" style="border-color: {color}">{label} ({count})</h4>"#,
+            color = severity_colors[si],
+            label = severity_labels[si],
+            count = sev_findings.len(),
+        ));
+
+        for f in sev_findings {
+            finding_num += 1;
+            let sev_color = severity_colors[si];
+            let exploitable_badge = if f.exploitable {
+                r#"<span class="badge badge-exploit">EXPLOITABLE</span>"#
+            } else {
+                ""
+            };
+            let cwe_cell = f
+                .cwe
+                .as_deref()
+                .map(|c| format!("<tr><td>CWE</td><td>{}</td></tr>", html_escape(c)))
+                .unwrap_or_default();
+            let param_row = f
+                .parameter
+                .as_deref()
+                .map(|p| {
+                    format!(
+                        "<tr><td>Parameter</td><td><code>{}</code></td></tr>",
+                        html_escape(p)
+                    )
+                })
+                .unwrap_or_default();
+            let remediation = f
+                .remediation
+                .as_deref()
+                .unwrap_or("Refer to industry best practices for this vulnerability class.");
+
+            let evidence_html = build_evidence_html(f);
+
+            // ── Code-level correlation ──────────────────────────────
+            let code_correlation =
+                build_code_correlation(f, &sast_by_id, code_context, sbom_entries);
+
+            findings_html.push_str(&format!(
+                r#"
+                <div class="finding" style="border-left-color: {sev_color}">
+                    <div class="finding-header">
+                        <span class="finding-id">F-{num:03}</span>
+                        <span class="finding-title">{title}</span>
+                        {exploitable_badge}
+                    </div>
+                    <table class="finding-meta">
+                        <tr><td>Type</td><td>{vuln_type}</td></tr>
+                        <tr><td>Endpoint</td><td><code>{method} {endpoint}</code></td></tr>
+                        {param_row}
+                        {cwe_cell}
+                    </table>
+                    <div class="finding-desc">{description}</div>
+                    {evidence_html}
+                    {code_correlation}
+                    <div class="remediation">
+                        <div class="remediation-label">Recommendation</div>
+                        {remediation}
+                    </div>
+                </div>
+                "#,
+                num = finding_num,
+                title = html_escape(&f.title),
+                vuln_type = f.vuln_type,
+                method = f.method,
+                endpoint = html_escape(&f.endpoint),
+                description = html_escape(&f.description),
+            ));
+        }
+    }
+
+    format!(
+        r##"<!-- ═══════════════ 3. FINDINGS ═══════════════ -->
+<div class="page-break"></div>
+<h2><span class="section-num">3.</span> Findings</h2>
+
+{findings_html}"##
+    )
+}
+
+/// Build the evidence table HTML for a finding.
+fn build_evidence_html(f: &DastFinding) -> String {
+    if f.evidence.is_empty() {
+        return String::new();
+    }
+
+    let mut eh = String::from(
+        r#"<div class="evidence-block"><div class="evidence-title">Evidence</div><table class="evidence-table"><thead><tr><th>Request</th><th>Status</th><th>Details</th></tr></thead><tbody>"#,
+    );
+    for ev in &f.evidence {
+        let payload_info = ev
+            .payload
+            .as_deref()
+            .map(|p| {
+                format!(
+                    "<br><span class=\"evidence-payload\">Payload: <code>{}</code></span>",
+                    html_escape(p)
+                )
+            })
+            .unwrap_or_default();
+        eh.push_str(&format!(
+            "<tr><td><code>{} {}</code></td><td>{}</td><td>{}{}</td></tr>",
+            html_escape(&ev.request_method),
+            html_escape(&ev.request_url),
+            ev.response_status,
+            ev.response_snippet
+                .as_deref()
+                .map(html_escape)
+                .unwrap_or_default(),
+            payload_info,
+        ));
+    }
+    eh.push_str("</tbody></table></div>");
+    eh
+}
+
+/// Build the code-level correlation block for a DAST finding.
+///
+/// Attempts correlation in priority order:
+/// 1. Direct link via `linked_sast_finding_id` → shows exact file, line, snippet, suggested fix
+/// 2. Endpoint match via code context → shows handler function, file, known SAST vulns
+/// 3. CWE/CVE match to SBOM → shows vulnerable dependency + version to upgrade
+fn build_code_correlation(
+    dast_finding: &DastFinding,
+    sast_by_id: &std::collections::HashMap<String, &Finding>,
+    code_context: &[CodeContextHint],
+    sbom_entries: &[SbomEntry],
+) -> String {
+    let mut sections: Vec<String> = Vec::new();
+
+    // 1. Direct SAST link
+    if let Some(ref sast_id) = dast_finding.linked_sast_finding_id {
+        if let Some(sast) = sast_by_id.get(sast_id) {
+            let mut s = String::new();
+            s.push_str(r#"<div class="code-correlation-item">"#);
+            s.push_str(r#"<div class="code-correlation-badge">SAST Correlation</div>"#);
+            s.push_str("<table class=\"code-meta\">");
+
+            if let Some(ref fp) = sast.file_path {
+                let line_info = sast
+                    .line_number
+                    .map(|l| format!(":{l}"))
+                    .unwrap_or_default();
+                s.push_str(&format!(
+                    "<tr><td>Location</td><td><code>{}{}</code></td></tr>",
+                    html_escape(fp),
+                    line_info,
+                ));
+            }
+            s.push_str(&format!(
+                "<tr><td>Scanner</td><td>{} &mdash; {}</td></tr>",
+                html_escape(&sast.scanner),
+                html_escape(&sast.title),
+            ));
+            if let Some(ref cwe) = sast.cwe {
+                s.push_str(&format!(
+                    "<tr><td>CWE</td><td>{}</td></tr>",
+                    html_escape(cwe)
+                ));
+            }
+            if let Some(ref rule) = sast.rule_id {
+                s.push_str(&format!(
+                    "<tr><td>Rule</td><td><code>{}</code></td></tr>",
+                    html_escape(rule)
+                ));
+            }
+            s.push_str("</table>");
+
+            // Code snippet
+            if let Some(ref snippet) = sast.code_snippet {
+                if !snippet.is_empty() {
+                    s.push_str(&format!(
+                        "<div class=\"code-snippet-block\"><div class=\"code-snippet-label\">Vulnerable Code</div><pre class=\"code-snippet\">{}</pre></div>",
+                        html_escape(snippet)
+                    ));
+                }
+            }
+
+            // Suggested fix
+            if let Some(ref fix) = sast.suggested_fix {
+                if !fix.is_empty() {
+                    s.push_str(&format!(
+                        "<div class=\"code-fix-block\"><div class=\"code-fix-label\">Suggested Fix</div><pre class=\"code-fix\">{}</pre></div>",
+                        html_escape(fix)
+                    ));
+                }
+            }
+
+            // Remediation from SAST
+            if let Some(ref rem) = sast.remediation {
+                if !rem.is_empty() {
+                    s.push_str(&format!(
+                        "<div class=\"code-remediation\">{}</div>",
+                        html_escape(rem)
+                    ));
+                }
+            }
+
+            s.push_str("</div>");
+            sections.push(s);
+        }
+    }
+
+    // 2. Endpoint match via code context
+    let endpoint_lower = dast_finding.endpoint.to_lowercase();
+    let matching_hints: Vec<&CodeContextHint> = code_context
+        .iter()
+        .filter(|hint| {
+            // Match by endpoint pattern overlap
+            let pattern_lower = hint.endpoint_pattern.to_lowercase();
+            endpoint_lower.contains(&pattern_lower)
+                || pattern_lower.contains(&endpoint_lower)
+                || hint.file_path.to_lowercase().contains(
+                    &endpoint_lower
+                        .split('/')
+                        .next_back()
+                        .unwrap_or("")
+                        .replace(".html", "")
+                        .replace(".php", ""),
+                )
+        })
+        .collect();
+
+    for hint in &matching_hints {
+        let mut s = String::new();
+        s.push_str(r#"<div class="code-correlation-item">"#);
+        s.push_str(r#"<div class="code-correlation-badge">Code Entry Point</div>"#);
+        s.push_str("<table class=\"code-meta\">");
+        s.push_str(&format!(
+            "<tr><td>Handler</td><td><code>{}</code></td></tr>",
+            html_escape(&hint.handler_function),
+        ));
+        s.push_str(&format!(
+            "<tr><td>File</td><td><code>{}</code></td></tr>",
+            html_escape(&hint.file_path),
+        ));
+        s.push_str(&format!(
+            "<tr><td>Route</td><td><code>{}</code></td></tr>",
+            html_escape(&hint.endpoint_pattern),
+        ));
+        s.push_str("</table>");
+
+        if !hint.known_vulnerabilities.is_empty() {
+            s.push_str("<div class=\"code-linked-vulns\"><strong>Known SAST issues in this file:</strong><ul>");
+            for vuln in &hint.known_vulnerabilities {
+                s.push_str(&format!("<li>{}</li>", html_escape(vuln)));
+            }
+            s.push_str("</ul></div>");
+        }
+
+        s.push_str("</div>");
+        sections.push(s);
+    }
+
+    // 3. SBOM match — if a linked SAST finding has a CVE, or we can match by CWE
+    let linked_cve = dast_finding
+        .linked_sast_finding_id
+        .as_deref()
+        .and_then(|id| sast_by_id.get(id))
+        .and_then(|f| f.cve.as_deref());
+
+    if let Some(cve_id) = linked_cve {
+        let matching_deps: Vec<&SbomEntry> = sbom_entries
+            .iter()
+            .filter(|e| e.known_vulnerabilities.iter().any(|v| v.id == cve_id))
+            .collect();
+
+        for dep in &matching_deps {
+            let mut s = String::new();
+            s.push_str(r#"<div class="code-correlation-item">"#);
+            s.push_str(r#"<div class="code-correlation-badge">Vulnerable Dependency</div>"#);
+            s.push_str("<table class=\"code-meta\">");
+            s.push_str(&format!(
+                "<tr><td>Package</td><td><code>{} {}</code> ({})</td></tr>",
+                html_escape(&dep.name),
+                html_escape(&dep.version),
+                html_escape(&dep.package_manager),
+            ));
+            let cve_ids: Vec<&str> = dep
+                .known_vulnerabilities
+                .iter()
+                .map(|v| v.id.as_str())
+                .collect();
+            s.push_str(&format!(
+                "<tr><td>CVEs</td><td>{}</td></tr>",
+                cve_ids.join(", "),
+            ));
+            if let Some(ref purl) = dep.purl {
+                s.push_str(&format!(
+                    "<tr><td>PURL</td><td><code>{}</code></td></tr>",
+                    html_escape(purl),
+                ));
+            }
+            s.push_str("</table>");
+            s.push_str(&format!(
+                "<div class=\"code-remediation\">Upgrade <code>{}</code> to the latest patched version to resolve {}.</div>",
+                html_escape(&dep.name),
+                html_escape(cve_id),
+            ));
+            s.push_str("</div>");
+            sections.push(s);
+        }
+    }
+
+    if sections.is_empty() {
+        return String::new();
+    }
+
+    format!(
+        r#"<div class="code-correlation">
+    <div class="code-correlation-title">Code-Level Remediation</div>
+    {}
+</div>"#,
+        sections.join("\n")
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::dast::{DastEvidence, DastVulnType};
+    use compliance_core::models::finding::Severity;
+    use compliance_core::models::scan::ScanType;
+
+    /// Helper: create a minimal `DastFinding`.
+    fn make_dast(title: &str, severity: Severity, endpoint: &str) -> DastFinding {
+        DastFinding::new(
+            "run1".into(),
+            "target1".into(),
+            DastVulnType::Xss,
+            title.into(),
+            "desc".into(),
+            severity,
+            endpoint.into(),
+            "GET".into(),
+        )
+    }
+
+    /// Helper: create a minimal SAST `Finding` with an ObjectId.
+    fn make_sast(title: &str) -> Finding {
+        let mut f = Finding::new(
+            "repo1".into(),
+            "fp1".into(),
+            "semgrep".into(),
+            ScanType::Sast,
+            title.into(),
+            "sast desc".into(),
+            Severity::High,
+        );
+        f.id = Some(mongodb::bson::oid::ObjectId::new());
+        f
+    }
+
+    #[test]
+    fn test_findings_empty() {
+        let result = findings(&[], &[], &[], &[]);
+        assert!(
+            result.contains("No vulnerabilities were identified"),
+            "Empty findings should contain the no-vulns message"
+        );
+    }
+
+    #[test]
+    fn test_findings_grouped_by_severity() {
+        let f_high = make_dast("High vuln", Severity::High, "/a");
+        let f_low = make_dast("Low vuln", Severity::Low, "/b");
+        let f_critical = make_dast("Crit vuln", Severity::Critical, "/c");
+
+        let result = findings(&[f_high, f_low, f_critical], &[], &[], &[]);
+
+        // All severity group headers should appear
+        assert!(
+            result.contains("Critical (1)"),
+            "should have Critical header"
+        );
+        assert!(result.contains("High (1)"), "should have High header");
+        assert!(result.contains("Low (1)"), "should have Low header");
+
+        // Critical should appear before High, High before Low
+        let crit_pos = result.find("Critical (1)");
+        let high_pos = result.find("High (1)");
+        let low_pos = result.find("Low (1)");
+        assert!(crit_pos < high_pos, "Critical should come before High");
+        assert!(high_pos < low_pos, "High should come before Low");
+    }
+
+    #[test]
+    fn test_code_correlation_sast_link() {
+        let mut sast = make_sast("SQL Injection in query");
+        sast.file_path = Some("src/db/query.rs".into());
+        sast.line_number = Some(42);
+        sast.code_snippet =
+            Some("let q = format!(\"SELECT * FROM {} WHERE id={}\", table, id);".into());
+
+        let sast_id = sast.id.as_ref().map(|oid| oid.to_hex()).unwrap_or_default();
+
+        let mut dast = make_dast("SQLi on /api/users", Severity::High, "/api/users");
+        dast.linked_sast_finding_id = Some(sast_id);
+
+        let result = findings(&[dast], &[sast], &[], &[]);
+
+        assert!(
+            result.contains("SAST Correlation"),
+            "should render SAST Correlation badge"
+        );
+        assert!(
+            result.contains("src/db/query.rs"),
+            "should contain the file path"
+        );
+        assert!(result.contains(":42"), "should contain the line number");
+        assert!(
+            result.contains("Vulnerable Code"),
+            "should render code snippet block"
+        );
+    }
+
+    #[test]
+    fn test_code_correlation_no_match() {
+        let dast = make_dast("XSS in search", Severity::Medium, "/search");
+        // No linked_sast_finding_id, no code context, no sbom
+        let result = findings(&[dast], &[], &[], &[]);
+
+        assert!(
+            !result.contains("code-correlation"),
+            "should not contain any code-correlation div"
+        );
+    }
+
+    #[test]
+    fn test_evidence_html_empty() {
+        let f = make_dast("No evidence", Severity::Low, "/x");
+        let result = build_evidence_html(&f);
+        assert!(result.is_empty(), "no evidence should yield empty string");
+    }
+
+    #[test]
+    fn test_evidence_html_with_entries() {
+        let mut f = make_dast("Has evidence", Severity::High, "/y");
+        f.evidence.push(DastEvidence {
+            request_method: "POST".into(),
+            request_url: "https://example.com/login".into(),
+            request_headers: None,
+            request_body: None,
+            response_status: 200,
+            response_headers: None,
+            response_snippet: Some("OK".into()),
+            screenshot_path: None,
+            payload: Some("<script>alert(1)</script>".into()),
+            response_time_ms: None,
+        });
+
+        let result = build_evidence_html(&f);
+
+        assert!(
+            result.contains("evidence-table"),
+            "should render the evidence table"
+        );
+        assert!(result.contains("POST"), "should contain request method");
+        assert!(
+            result.contains("https://example.com/login"),
+            "should contain request URL"
+        );
+        assert!(result.contains("200"), "should contain response status");
+        assert!(
+            result.contains("&lt;script&gt;alert(1)&lt;/script&gt;"),
+            "payload should be HTML-escaped"
+        );
+    }
+}

compliance-agent/src/pentest/report/html/mod.rs

@@ -0,0 +1,518 @@
+mod appendix;
+mod attack_chain;
+mod cover;
+mod executive_summary;
+mod findings;
+mod scope;
+mod styles;
+
+use super::ReportContext;
+
+#[allow(clippy::format_in_format_args)]
+pub(super) fn build_html_report(ctx: &ReportContext) -> String {
+    let session = &ctx.session;
+    let session_id = session
+        .id
+        .map(|oid| oid.to_hex())
+        .unwrap_or_else(|| "-".to_string());
+    let date_str = session
+        .started_at
+        .format("%B %d, %Y at %H:%M UTC")
+        .to_string();
+    let date_short = session.started_at.format("%B %d, %Y").to_string();
+    let completed_str = session
+        .completed_at
+        .map(|d| d.format("%B %d, %Y at %H:%M UTC").to_string())
+        .unwrap_or_else(|| "In Progress".to_string());
+
+    // Collect unique tool names used
+    let tool_names: Vec<String> = {
+        let mut names: Vec<String> = ctx
+            .attack_chain
+            .iter()
+            .map(|n| n.tool_name.clone())
+            .collect();
+        names.sort();
+        names.dedup();
+        names
+    };
+
+    // Find the best app screenshot for the cover page:
+    // prefer the first navigate to the target URL that has a screenshot,
+    // falling back to any navigate with a screenshot
+    let app_screenshot: Option<String> = ctx
+        .attack_chain
+        .iter()
+        .filter(|n| n.tool_name == "browser")
+        .filter_map(|n| {
+            n.tool_output
+                .as_ref()?
+                .get("screenshot_base64")?
+                .as_str()
+                .filter(|s| !s.is_empty())
+                .map(|s| s.to_string())
+        })
+        // Skip the Keycloak login page screenshots — prefer one that shows the actual app
+        .find(|_| {
+            ctx.attack_chain
+                .iter()
+                .filter(|n| n.tool_name == "browser")
+                .any(|n| {
+                    n.tool_output
+                        .as_ref()
+                        .and_then(|o| o.get("title"))
+                        .and_then(|t| t.as_str())
+                        .is_some_and(|t| t.contains("Compliance") || t.contains("Dashboard"))
+                })
+        })
+        .or_else(|| {
+            // Fallback: any screenshot
+            ctx.attack_chain
+                .iter()
+                .filter(|n| n.tool_name == "browser")
+                .filter_map(|n| {
+                    n.tool_output
+                        .as_ref()?
+                        .get("screenshot_base64")?
+                        .as_str()
+                        .filter(|s| !s.is_empty())
+                        .map(|s| s.to_string())
+                })
+                .next()
+        });
+
+    let styles_html = styles::styles();
+    let cover_html = cover::cover(
+        &ctx.target_name,
+        &session_id,
+        &date_short,
+        &ctx.target_url,
+        &ctx.requester_name,
+        &ctx.requester_email,
+        app_screenshot.as_deref(),
+    );
+    let exec_html = executive_summary::executive_summary(
+        &ctx.findings,
+        &ctx.target_name,
+        &ctx.target_url,
+        tool_names.len(),
+        session.tool_invocations,
+        session.success_rate(),
+    );
+    let scope_html = scope::scope(
+        session,
+        &ctx.target_name,
+        &ctx.target_url,
+        &date_str,
+        &completed_str,
+        &tool_names,
+        ctx.config.as_ref(),
+    );
+    let findings_html = findings::findings(
+        &ctx.findings,
+        &ctx.sast_findings,
+        &ctx.code_context,
+        &ctx.sbom_entries,
+    );
+    let chain_html = attack_chain::attack_chain(&ctx.attack_chain);
+    let appendix_html = appendix::appendix(&session_id);
+
+    format!(
+        r#"<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Penetration Test Report — {target_name}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Libre+Baskerville:ital,wght@0,400;0,700;1,400&family=Source+Sans+3:ital,wght@0,300;0,400;0,600;0,700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
+{styles_html}
+</head>
+<body>
+
+{cover_html}
+
+{exec_html}
+
+{scope_html}
+
+{findings_html}
+
+{chain_html}
+
+{appendix_html}
+"#,
+        target_name = html_escape(&ctx.target_name),
+    )
+}
+
+fn tool_category(tool_name: &str) -> &'static str {
+    let name = tool_name.to_lowercase();
+    if name.contains("nmap") || name.contains("port") {
+        return "Network Reconnaissance";
+    }
+    if name.contains("nikto") || name.contains("header") {
+        return "Web Server Analysis";
+    }
+    if name.contains("zap") || name.contains("spider") || name.contains("crawl") {
+        return "Web Application Scanning";
+    }
+    if name.contains("sqlmap") || name.contains("sqli") || name.contains("sql") {
+        return "SQL Injection Testing";
+    }
+    if name.contains("xss") || name.contains("cross-site") {
+        return "Cross-Site Scripting Testing";
+    }
+    if name.contains("dir")
+        || name.contains("brute")
+        || name.contains("fuzz")
+        || name.contains("gobuster")
+    {
+        return "Directory Enumeration";
+    }
+    if name.contains("ssl") || name.contains("tls") || name.contains("cert") {
+        return "SSL/TLS Analysis";
+    }
+    if name.contains("api") || name.contains("endpoint") {
+        return "API Security Testing";
+    }
+    if name.contains("auth") || name.contains("login") || name.contains("credential") {
+        return "Authentication Testing";
+    }
+    if name.contains("cors") {
+        return "CORS Testing";
+    }
+    if name.contains("csrf") {
+        return "CSRF Testing";
+    }
+    if name.contains("nuclei") || name.contains("template") {
+        return "Vulnerability Scanning";
+    }
+    if name.contains("whatweb") || name.contains("tech") || name.contains("wappalyzer") {
+        return "Technology Fingerprinting";
+    }
+    "Security Testing"
+}
+
+fn html_escape(s: &str) -> String {
+    s.replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use compliance_core::models::dast::{DastFinding, DastVulnType};
+    use compliance_core::models::finding::Severity;
+    use compliance_core::models::pentest::{
+        AttackChainNode, AttackNodeStatus, PentestSession, PentestStrategy,
+    };
+
+    // ── html_escape ──────────────────────────────────────────────────
+
+    #[test]
+    fn html_escape_handles_ampersand() {
+        assert_eq!(html_escape("a & b"), "a &amp; b");
+    }
+
+    #[test]
+    fn html_escape_handles_angle_brackets() {
+        assert_eq!(html_escape("<script>"), "&lt;script&gt;");
+    }
+
+    #[test]
+    fn html_escape_handles_quotes() {
+        assert_eq!(html_escape(r#"key="val""#), "key=&quot;val&quot;");
+    }
+
+    #[test]
+    fn html_escape_handles_all_special_chars() {
+        assert_eq!(
+            html_escape(r#"<a href="x">&y</a>"#),
+            "&lt;a href=&quot;x&quot;&gt;&amp;y&lt;/a&gt;"
+        );
+    }
+
+    #[test]
+    fn html_escape_no_change_for_plain_text() {
+        assert_eq!(html_escape("hello world"), "hello world");
+    }
+
+    #[test]
+    fn html_escape_empty_string() {
+        assert_eq!(html_escape(""), "");
+    }
+
+    // ── tool_category ────────────────────────────────────────────────
+
+    #[test]
+    fn tool_category_nmap() {
+        assert_eq!(tool_category("nmap_scan"), "Network Reconnaissance");
+    }
+
+    #[test]
+    fn tool_category_port_scanner() {
+        assert_eq!(tool_category("port_scanner"), "Network Reconnaissance");
+    }
+
+    #[test]
+    fn tool_category_nikto() {
+        assert_eq!(tool_category("nikto"), "Web Server Analysis");
+    }
+
+    #[test]
+    fn tool_category_header_check() {
+        assert_eq!(
+            tool_category("security_header_check"),
+            "Web Server Analysis"
+        );
+    }
+
+    #[test]
+    fn tool_category_zap_spider() {
+        assert_eq!(tool_category("zap_spider"), "Web Application Scanning");
+    }
+
+    #[test]
+    fn tool_category_sqlmap() {
+        assert_eq!(tool_category("sqlmap"), "SQL Injection Testing");
+    }
+
+    #[test]
+    fn tool_category_xss_scanner() {
+        assert_eq!(tool_category("xss_scanner"), "Cross-Site Scripting Testing");
+    }
+
+    #[test]
+    fn tool_category_dir_bruteforce() {
+        assert_eq!(tool_category("dir_bruteforce"), "Directory Enumeration");
+    }
+
+    #[test]
+    fn tool_category_gobuster() {
+        assert_eq!(tool_category("gobuster"), "Directory Enumeration");
+    }
+
+    #[test]
+    fn tool_category_ssl_check() {
+        assert_eq!(tool_category("ssl_check"), "SSL/TLS Analysis");
+    }
+
+    #[test]
+    fn tool_category_tls_scan() {
+        assert_eq!(tool_category("tls_scan"), "SSL/TLS Analysis");
+    }
+
+    #[test]
+    fn tool_category_api_test() {
+        assert_eq!(tool_category("api_endpoint_test"), "API Security Testing");
+    }
+
+    #[test]
+    fn tool_category_auth_bypass() {
+        assert_eq!(tool_category("auth_bypass_check"), "Authentication Testing");
+    }
+
+    #[test]
+    fn tool_category_cors() {
+        assert_eq!(tool_category("cors_check"), "CORS Testing");
+    }
+
+    #[test]
+    fn tool_category_csrf() {
+        assert_eq!(tool_category("csrf_scanner"), "CSRF Testing");
+    }
+
+    #[test]
+    fn tool_category_nuclei() {
+        assert_eq!(tool_category("nuclei"), "Vulnerability Scanning");
+    }
+
+    #[test]
+    fn tool_category_whatweb() {
+        assert_eq!(tool_category("whatweb"), "Technology Fingerprinting");
+    }
+
+    #[test]
+    fn tool_category_unknown_defaults_to_security_testing() {
+        assert_eq!(tool_category("custom_tool"), "Security Testing");
+    }
+
+    #[test]
+    fn tool_category_is_case_insensitive() {
+        assert_eq!(tool_category("NMAP_Scanner"), "Network Reconnaissance");
+        assert_eq!(tool_category("SQLMap"), "SQL Injection Testing");
+    }
+
+    // ── build_html_report ────────────────────────────────────────────
+
+    fn make_session(strategy: PentestStrategy) -> PentestSession {
+        let mut s = PentestSession::new("target-1".into(), strategy);
+        s.tool_invocations = 5;
+        s.tool_successes = 4;
+        s.findings_count = 2;
+        s.exploitable_count = 1;
+        s
+    }
+
+    fn make_finding(severity: Severity, title: &str, exploitable: bool) -> DastFinding {
+        let mut f = DastFinding::new(
+            "run-1".into(),
+            "target-1".into(),
+            DastVulnType::Xss,
+            title.into(),
+            "description".into(),
+            severity,
+            "https://example.com/test".into(),
+            "GET".into(),
+        );
+        f.exploitable = exploitable;
+        f
+    }
+
+    fn make_attack_node(tool_name: &str) -> AttackChainNode {
+        let mut node = AttackChainNode::new(
+            "session-1".into(),
+            "node-1".into(),
+            tool_name.into(),
+            serde_json::json!({}),
+            "Testing this tool".into(),
+        );
+        node.status = AttackNodeStatus::Completed;
+        node
+    }
+
+    fn make_report_context(
+        findings: Vec<DastFinding>,
+        chain: Vec<AttackChainNode>,
+    ) -> ReportContext {
+        ReportContext {
+            session: make_session(PentestStrategy::Comprehensive),
+            target_name: "Test App".into(),
+            target_url: "https://example.com".into(),
+            findings,
+            attack_chain: chain,
+            requester_name: "Alice".into(),
+            requester_email: "alice@example.com".into(),
+            config: None,
+            sast_findings: Vec::new(),
+            sbom_entries: Vec::new(),
+            code_context: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn report_contains_target_info() {
+        let ctx = make_report_context(vec![], vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("Test App"));
+        assert!(html.contains("https://example.com"));
+    }
+
+    #[test]
+    fn report_contains_requester_info() {
+        let ctx = make_report_context(vec![], vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("Alice"));
+        assert!(html.contains("alice@example.com"));
+    }
+
+    #[test]
+    fn report_shows_informational_risk_when_no_findings() {
+        let ctx = make_report_context(vec![], vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("INFORMATIONAL"));
+    }
+
+    #[test]
+    fn report_shows_critical_risk_with_critical_finding() {
+        let findings = vec![make_finding(Severity::Critical, "Critical XSS", true)];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("CRITICAL"));
+    }
+
+    #[test]
+    fn report_shows_high_risk_without_critical() {
+        let findings = vec![make_finding(Severity::High, "High SQLi", false)];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        // Should show HIGH, not CRITICAL
+        assert!(html.contains("HIGH"));
+    }
+
+    #[test]
+    fn report_shows_medium_risk_level() {
+        let findings = vec![make_finding(Severity::Medium, "Medium Issue", false)];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("MEDIUM"));
+    }
+
+    #[test]
+    fn report_includes_finding_title() {
+        let findings = vec![make_finding(
+            Severity::High,
+            "Reflected XSS in /search",
+            true,
+        )];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("Reflected XSS in /search"));
+    }
+
+    #[test]
+    fn report_shows_exploitable_badge() {
+        let findings = vec![make_finding(Severity::Critical, "SQLi", true)];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        // The report should mark exploitable findings
+        assert!(html.contains("EXPLOITABLE"));
+    }
+
+    #[test]
+    fn report_includes_attack_chain_tool_names() {
+        let chain = vec![make_attack_node("nmap_scan"), make_attack_node("sqlmap")];
+        let ctx = make_report_context(vec![], chain);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("nmap_scan"));
+        assert!(html.contains("sqlmap"));
+    }
+
+    #[test]
+    fn report_is_valid_html_structure() {
+        let ctx = make_report_context(vec![], vec![]);
+        let html = build_html_report(&ctx);
+        assert!(html.contains("<!DOCTYPE html>") || html.contains("<html"));
+        assert!(html.contains("</html>"));
+    }
+
+    #[test]
+    fn report_strategy_appears() {
+        let ctx = make_report_context(vec![], vec![]);
+        let html = build_html_report(&ctx);
+        // PentestStrategy::Comprehensive => "comprehensive"
+        assert!(html.contains("comprehensive") || html.contains("Comprehensive"));
+    }
+
+    #[test]
+    fn report_finding_count_is_correct() {
+        let findings = vec![
+            make_finding(Severity::Critical, "F1", true),
+            make_finding(Severity::High, "F2", false),
+            make_finding(Severity::Low, "F3", false),
+        ];
+        let ctx = make_report_context(findings, vec![]);
+        let html = build_html_report(&ctx);
+        // The total count "3" should appear somewhere
+        assert!(
+            html.contains(">3<")
+                || html.contains(">3 ")
+                || html.contains("3 findings")
+                || html.contains("3 Total")
+        );
+    }
+}

compliance-agent/src/pentest/report/html/scope.rs

@@ -0,0 +1,127 @@
+use super::{html_escape, tool_category};
+use compliance_core::models::pentest::{AuthMode, PentestConfig, PentestSession};
+
+pub(super) fn scope(
+    session: &PentestSession,
+    target_name: &str,
+    target_url: &str,
+    date_str: &str,
+    completed_str: &str,
+    tool_names: &[String],
+    config: Option<&PentestConfig>,
+) -> String {
+    let tools_table: String = tool_names
+        .iter()
+        .enumerate()
+        .map(|(i, t)| {
+            let category = tool_category(t);
+            format!(
+                "<tr><td>{}</td><td><code>{}</code></td><td>{}</td></tr>",
+                i + 1,
+                html_escape(t),
+                category,
+            )
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+
+    let engagement_config_section = if let Some(cfg) = config {
+        let mut rows = String::new();
+        rows.push_str(&format!(
+            "<tr><td>Environment</td><td>{}</td></tr>",
+            html_escape(&cfg.environment.to_string())
+        ));
+        if let Some(ref app_type) = cfg.app_type {
+            rows.push_str(&format!(
+                "<tr><td>Application Type</td><td>{}</td></tr>",
+                html_escape(app_type)
+            ));
+        }
+        let auth_mode = match cfg.auth.mode {
+            AuthMode::None => "No authentication",
+            AuthMode::Manual => "Manual credentials",
+            AuthMode::AutoRegister => "Auto-register",
+        };
+        rows.push_str(&format!("<tr><td>Auth Mode</td><td>{auth_mode}</td></tr>"));
+        if !cfg.scope_exclusions.is_empty() {
+            let excl = cfg
+                .scope_exclusions
+                .iter()
+                .map(|s| html_escape(s))
+                .collect::<Vec<_>>()
+                .join(", ");
+            rows.push_str(&format!(
+                "<tr><td>Scope Exclusions</td><td><code>{excl}</code></td></tr>"
+            ));
+        }
+        if !cfg.tester.name.is_empty() {
+            rows.push_str(&format!(
+                "<tr><td>Tester</td><td>{} ({})</td></tr>",
+                html_escape(&cfg.tester.name),
+                html_escape(&cfg.tester.email)
+            ));
+        }
+        if let Some(ref ts) = cfg.disclaimer_accepted_at {
+            rows.push_str(&format!(
+                "<tr><td>Disclaimer Accepted</td><td>{}</td></tr>",
+                ts.format("%B %d, %Y at %H:%M UTC")
+            ));
+        }
+        if let Some(ref branch) = cfg.branch {
+            rows.push_str(&format!(
+                "<tr><td>Git Branch</td><td>{}</td></tr>",
+                html_escape(branch)
+            ));
+        }
+        if let Some(ref commit) = cfg.commit_hash {
+            rows.push_str(&format!(
+                "<tr><td>Git Commit</td><td><code>{}</code></td></tr>",
+                html_escape(commit)
+            ));
+        }
+        format!("<h3>Engagement Configuration</h3>\n<table class=\"info\">\n{rows}\n</table>")
+    } else {
+        String::new()
+    };
+
+    format!(
+        r##"
+<!-- ═══════════════ 2. SCOPE & METHODOLOGY ═══════════════ -->
+<div class="page-break"></div>
+<h2><span class="section-num">2.</span> Scope &amp; Methodology</h2>
+
+<p>
+    The assessment was performed using an AI-driven orchestrator that autonomously selects and
+    executes security testing tools based on the target's attack surface, technology stack, and
+    any available static analysis (SAST) findings and SBOM data.
+</p>
+
+<h3>Engagement Details</h3>
+<table class="info">
+    <tr><td>Target</td><td><strong>{target_name}</strong></td></tr>
+    <tr><td>URL</td><td><code>{target_url}</code></td></tr>
+    <tr><td>Strategy</td><td>{strategy}</td></tr>
+    <tr><td>Status</td><td>{status}</td></tr>
+    <tr><td>Started</td><td>{date_str}</td></tr>
+    <tr><td>Completed</td><td>{completed_str}</td></tr>
+    <tr><td>Tool Invocations</td><td>{tool_invocations} ({tool_successes} successful, {success_rate:.1}% success rate)</td></tr>
+</table>
+
+{engagement_config_section}
+
+<h3>Tools Employed</h3>
+<table class="tools-table">
+    <thead><tr><th>#</th><th>Tool</th><th>Category</th></tr></thead>
+    <tbody>{tools_table}</tbody>
+</table>"##,
+        target_name = html_escape(target_name),
+        target_url = html_escape(target_url),
+        strategy = session.strategy,
+        status = session.status,
+        date_str = date_str,
+        completed_str = completed_str,
+        tool_invocations = session.tool_invocations,
+        tool_successes = session.tool_successes,
+        success_rate = session.success_rate(),
+    )
+}

compliance-agent/src/pentest/report/html/styles.rs

@@ -0,0 +1,889 @@
+pub(super) fn styles() -> String {
+    r##"<style>
+/* ──────────────── Base / Print-first ──────────────── */
+@page {
+    size: A4;
+    margin: 20mm 18mm 25mm 18mm;
+}
+@page :first {
+    margin: 0;
+}
+
+*, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }
+
+:root {
+    --text: #1a1a2e;
+    --text-secondary: #475569;
+    --text-muted: #64748b;
+    --heading: #0d2137;
+    --accent: #1a56db;
+    --accent-light: #dbeafe;
+    --border: #d1d5db;
+    --border-light: #e5e7eb;
+    --bg-subtle: #f8fafc;
+    --bg-section: #f1f5f9;
+    --sev-critical: #991b1b;
+    --sev-high: #c2410c;
+    --sev-medium: #a16207;
+    --sev-low: #1d4ed8;
+    --sev-info: #4b5563;
+    --font-serif: 'Libre Baskerville', 'Georgia', serif;
+    --font-sans: 'Source Sans 3', 'Helvetica Neue', sans-serif;
+    --font-mono: 'JetBrains Mono', 'Consolas', monospace;
+}
+
+body {
+    font-family: var(--font-sans);
+    color: var(--text);
+    background: #fff;
+    line-height: 1.65;
+    font-size: 10.5pt;
+    -webkit-print-color-adjust: exact;
+    print-color-adjust: exact;
+}
+
+.report-body {
+    max-width: 190mm;
+    margin: 0 auto;
+    padding: 0 16px;
+}
+
+/* ──────────────── Cover Page ──────────────── */
+.cover {
+    height: 100vh;
+    min-height: 297mm;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    text-align: center;
+    padding: 40mm 30mm;
+    page-break-after: always;
+    break-after: page;
+    position: relative;
+    background: #fff;
+}
+
+.cover-shield {
+    width: 72px;
+    height: 72px;
+    margin-bottom: 32px;
+}
+
+.cover-tag {
+    display: inline-block;
+    background: var(--sev-critical);
+    color: #fff;
+    font-family: var(--font-sans);
+    font-size: 8pt;
+    font-weight: 700;
+    letter-spacing: 0.15em;
+    text-transform: uppercase;
+    padding: 4px 16px;
+    border-radius: 2px;
+    margin-bottom: 28px;
+}
+
+.cover-title {
+    font-family: var(--font-serif);
+    font-size: 28pt;
+    font-weight: 700;
+    color: var(--heading);
+    line-height: 1.2;
+    margin-bottom: 8px;
+}
+
+.cover-subtitle {
+    font-family: var(--font-serif);
+    font-size: 14pt;
+    color: var(--text-secondary);
+    font-weight: 400;
+    font-style: italic;
+    margin-bottom: 48px;
+}
+
+.cover-meta {
+    font-size: 10pt;
+    color: var(--text-secondary);
+    line-height: 2;
+}
+
+.cover-meta strong {
+    color: var(--text);
+}
+
+.cover-divider {
+    width: 60px;
+    height: 2px;
+    background: var(--accent);
+    margin: 24px auto;
+}
+
+.cover-footer {
+    position: absolute;
+    bottom: 30mm;
+    left: 0;
+    right: 0;
+    text-align: center;
+    font-size: 8pt;
+    color: var(--text-muted);
+    letter-spacing: 0.05em;
+}
+
+/* ──────────────── Typography ──────────────── */
+h2 {
+    font-family: var(--font-serif);
+    font-size: 16pt;
+    font-weight: 700;
+    color: var(--heading);
+    margin: 36px 0 16px;
+    padding-bottom: 8px;
+    border-bottom: 2px solid var(--heading);
+    page-break-after: avoid;
+    break-after: avoid;
+}
+
+h3 {
+    font-family: var(--font-serif);
+    font-size: 12pt;
+    font-weight: 700;
+    color: var(--heading);
+    margin: 24px 0 10px;
+    page-break-after: avoid;
+    break-after: avoid;
+}
+
+h4 {
+    font-family: var(--font-sans);
+    font-size: 10pt;
+    font-weight: 700;
+    color: var(--text-secondary);
+    margin: 16px 0 8px;
+}
+
+p {
+    margin: 8px 0;
+    font-size: 10.5pt;
+}
+
+code {
+    font-family: var(--font-mono);
+    font-size: 9pt;
+    background: var(--bg-section);
+    padding: 1px 5px;
+    border-radius: 3px;
+    border: 1px solid var(--border-light);
+    word-break: break-all;
+}
+
+/* ──────────────── Section Numbers ──────────────── */
+.section-num {
+    color: var(--accent);
+    margin-right: 8px;
+}
+
+/* ──────────────── Table of Contents ──────────────── */
+.toc {
+    page-break-after: always;
+    break-after: page;
+    padding-top: 24px;
+}
+
+.toc h2 {
+    border-bottom-color: var(--accent);
+    margin-top: 0;
+}
+
+.toc-entry {
+    display: flex;
+    justify-content: space-between;
+    align-items: baseline;
+    padding: 6px 0;
+    border-bottom: 1px dotted var(--border);
+    font-size: 11pt;
+}
+
+.toc-entry .toc-num {
+    font-weight: 700;
+    color: var(--accent);
+    min-width: 24px;
+    margin-right: 10px;
+}
+
+.toc-entry .toc-label {
+    flex: 1;
+    font-weight: 600;
+    color: var(--heading);
+}
+
+.toc-sub {
+    padding: 3px 0 3px 34px;
+    font-size: 9.5pt;
+    color: var(--text-secondary);
+}
+
+/* ──────────────── Executive Summary ──────────────── */
+.exec-grid {
+    display: grid;
+    grid-template-columns: 1fr 1fr 1fr 1fr;
+    gap: 12px;
+    margin: 16px 0 20px;
+}
+
+.kpi-card {
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    padding: 14px 12px;
+    text-align: center;
+    background: var(--bg-subtle);
+}
+
+.kpi-value {
+    font-family: var(--font-serif);
+    font-size: 22pt;
+    font-weight: 700;
+    line-height: 1.1;
+}
+
+.kpi-label {
+    font-size: 8pt;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    color: var(--text-muted);
+    margin-top: 4px;
+    font-weight: 600;
+}
+
+/* Risk gauge */
+.risk-gauge {
+    display: flex;
+    align-items: center;
+    gap: 16px;
+    padding: 16px 20px;
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    background: var(--bg-subtle);
+    margin: 16px 0;
+}
+
+.risk-gauge-meter {
+    width: 140px;
+    flex-shrink: 0;
+}
+
+.risk-gauge-track {
+    height: 10px;
+    background: var(--border-light);
+    border-radius: 5px;
+    overflow: hidden;
+    position: relative;
+}
+
+.risk-gauge-fill {
+    height: 100%;
+    border-radius: 5px;
+    transition: width 0.3s;
+}
+
+.risk-gauge-score {
+    font-family: var(--font-serif);
+    font-size: 9pt;
+    font-weight: 700;
+    text-align: center;
+    margin-top: 3px;
+}
+
+.risk-gauge-text {
+    flex: 1;
+}
+
+.risk-gauge-label {
+    font-family: var(--font-serif);
+    font-size: 14pt;
+    font-weight: 700;
+}
+
+.risk-gauge-desc {
+    font-size: 9.5pt;
+    color: var(--text-secondary);
+    margin-top: 2px;
+}
+
+/* Severity bar */
+.sev-bar {
+    display: flex;
+    height: 28px;
+    border-radius: 4px;
+    overflow: hidden;
+    margin: 12px 0 6px;
+    border: 1px solid var(--border);
+}
+
+.sev-bar-seg {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    color: #fff;
+    font-size: 8.5pt;
+    font-weight: 700;
+    min-width: 24px;
+}
+
+.sev-bar-critical { background: var(--sev-critical); }
+.sev-bar-high { background: var(--sev-high); }
+.sev-bar-medium { background: var(--sev-medium); }
+.sev-bar-low { background: var(--sev-low); }
+.sev-bar-info { background: var(--sev-info); }
+
+.sev-bar-legend {
+    display: flex;
+    gap: 16px;
+    font-size: 8.5pt;
+    color: var(--text-secondary);
+    margin-bottom: 16px;
+}
+
+.sev-dot {
+    display: inline-block;
+    width: 8px;
+    height: 8px;
+    border-radius: 2px;
+    margin-right: 4px;
+    vertical-align: middle;
+}
+
+/* ──────────────── Info Tables ──────────────── */
+table.info {
+    width: 100%;
+    border-collapse: collapse;
+    margin: 10px 0;
+    font-size: 10pt;
+}
+
+table.info td,
+table.info th {
+    padding: 7px 12px;
+    border: 1px solid var(--border);
+    text-align: left;
+    vertical-align: top;
+}
+
+table.info td:first-child,
+table.info th:first-child {
+    width: 160px;
+    font-weight: 600;
+    color: var(--text-secondary);
+    background: var(--bg-subtle);
+}
+
+/* Methodology tools table */
+table.tools-table {
+    width: 100%;
+    border-collapse: collapse;
+    margin: 10px 0;
+    font-size: 10pt;
+}
+
+table.tools-table th {
+    background: var(--heading);
+    color: #fff;
+    padding: 8px 12px;
+    text-align: left;
+    font-weight: 600;
+    font-size: 9pt;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+}
+
+table.tools-table td {
+    padding: 6px 12px;
+    border-bottom: 1px solid var(--border-light);
+}
+
+table.tools-table tr:nth-child(even) td {
+    background: var(--bg-subtle);
+}
+
+table.tools-table td:first-child {
+    width: 32px;
+    text-align: center;
+    color: var(--text-muted);
+    font-weight: 600;
+}
+
+/* ──────────────── Badges ──────────────── */
+.badge {
+    display: inline-block;
+    padding: 2px 8px;
+    border-radius: 3px;
+    font-size: 7.5pt;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+    vertical-align: middle;
+}
+
+.badge-exploit {
+    background: var(--sev-critical);
+    color: #fff;
+}
+
+/* ──────────────── Findings ──────────────── */
+.sev-group-title {
+    font-family: var(--font-sans);
+    font-size: 11pt;
+    font-weight: 700;
+    color: var(--heading);
+    padding: 8px 0 6px 12px;
+    margin: 20px 0 8px;
+    border-left: 4px solid;
+    page-break-after: avoid;
+    break-after: avoid;
+}
+
+.finding {
+    border: 1px solid var(--border);
+    border-left: 4px solid;
+    border-radius: 0 4px 4px 0;
+    padding: 14px 16px;
+    margin-bottom: 12px;
+    background: #fff;
+    page-break-inside: avoid;
+    break-inside: avoid;
+}
+
+.finding-header {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    margin-bottom: 8px;
+}
+
+.finding-id {
+    font-family: var(--font-mono);
+    font-size: 9pt;
+    font-weight: 500;
+    color: var(--text-muted);
+    background: var(--bg-section);
+    padding: 2px 6px;
+    border-radius: 3px;
+    border: 1px solid var(--border-light);
+}
+
+.finding-title {
+    font-family: var(--font-serif);
+    font-weight: 700;
+    font-size: 11pt;
+    flex: 1;
+    color: var(--heading);
+}
+
+.finding-meta {
+    border-collapse: collapse;
+    margin: 6px 0;
+    font-size: 9.5pt;
+    width: 100%;
+}
+
+.finding-meta td {
+    padding: 3px 10px 3px 0;
+    vertical-align: top;
+}
+
+.finding-meta td:first-child {
+    color: var(--text-muted);
+    font-weight: 600;
+    width: 90px;
+    white-space: nowrap;
+}
+
+.finding-desc {
+    margin: 8px 0;
+    font-size: 10pt;
+    color: var(--text);
+    line-height: 1.6;
+}
+
+.remediation {
+    margin-top: 10px;
+    padding: 10px 14px;
+    background: var(--accent-light);
+    border-left: 3px solid var(--accent);
+    border-radius: 0 4px 4px 0;
+    font-size: 9.5pt;
+    line-height: 1.55;
+}
+
+.remediation-label {
+    font-weight: 700;
+    font-size: 8.5pt;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    color: var(--accent);
+    margin-bottom: 3px;
+}
+
+.evidence-block {
+    margin: 10px 0;
+    page-break-inside: avoid;
+    break-inside: avoid;
+}
+
+.evidence-title {
+    font-weight: 700;
+    font-size: 8.5pt;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    color: var(--text-muted);
+    margin-bottom: 4px;
+}
+
+.evidence-table {
+    width: 100%;
+    border-collapse: collapse;
+    font-size: 9pt;
+}
+
+.evidence-table th {
+    background: var(--bg-section);
+    padding: 5px 8px;
+    text-align: left;
+    font-weight: 600;
+    font-size: 8.5pt;
+    text-transform: uppercase;
+    letter-spacing: 0.03em;
+    color: var(--text-secondary);
+    border: 1px solid var(--border-light);
+}
+
+.evidence-table td {
+    padding: 5px 8px;
+    border: 1px solid var(--border-light);
+    vertical-align: top;
+    word-break: break-word;
+}
+
+.evidence-payload {
+    font-size: 8.5pt;
+    color: var(--sev-critical);
+}
+
+.linked-sast {
+    font-size: 9pt;
+    color: var(--text-muted);
+    margin: 6px 0;
+    font-style: italic;
+}
+
+/* ──────────────── Code-Level Correlation ──────────────── */
+.code-correlation {
+    margin: 12px 0;
+    border: 1px solid #e2e8f0;
+    border-radius: 6px;
+    overflow: hidden;
+}
+.code-correlation-title {
+    background: #1e293b;
+    color: #f8fafc;
+    padding: 6px 12px;
+    font-size: 9pt;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+}
+.code-correlation-item {
+    padding: 10px 12px;
+    border-bottom: 1px solid #e2e8f0;
+}
+.code-correlation-item:last-child { border-bottom: none; }
+.code-correlation-badge {
+    display: inline-block;
+    background: #3b82f6;
+    color: #fff;
+    font-size: 7pt;
+    font-weight: 600;
+    padding: 2px 8px;
+    border-radius: 3px;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    margin-bottom: 6px;
+}
+.code-meta {
+    width: 100%;
+    font-size: 8.5pt;
+    border-collapse: collapse;
+    margin-bottom: 6px;
+}
+.code-meta td:first-child {
+    width: 80px;
+    font-weight: 600;
+    color: var(--text-muted);
+    padding: 2px 8px 2px 0;
+    vertical-align: top;
+}
+.code-meta td:last-child {
+    padding: 2px 0;
+}
+.code-snippet-block, .code-fix-block {
+    margin: 6px 0;
+}
+.code-snippet-label, .code-fix-label {
+    font-size: 7.5pt;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    color: var(--text-muted);
+    margin-bottom: 3px;
+}
+.code-snippet-label { color: #dc2626; }
+.code-fix-label { color: #16a34a; }
+.code-snippet {
+    background: #fef2f2;
+    border: 1px solid #fecaca;
+    border-left: 3px solid #dc2626;
+    padding: 8px 10px;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 8pt;
+    line-height: 1.5;
+    white-space: pre-wrap;
+    word-break: break-word;
+    border-radius: 0 4px 4px 0;
+    margin: 0;
+}
+.code-fix {
+    background: #f0fdf4;
+    border: 1px solid #bbf7d0;
+    border-left: 3px solid #16a34a;
+    padding: 8px 10px;
+    font-family: 'JetBrains Mono', monospace;
+    font-size: 8pt;
+    line-height: 1.5;
+    white-space: pre-wrap;
+    word-break: break-word;
+    border-radius: 0 4px 4px 0;
+    margin: 0;
+}
+.code-remediation {
+    font-size: 8.5pt;
+    color: var(--text-secondary);
+    margin-top: 4px;
+    padding: 4px 0;
+}
+.code-linked-vulns {
+    font-size: 8.5pt;
+    margin-top: 4px;
+}
+.code-linked-vulns ul {
+    margin: 2px 0 0 16px;
+    padding: 0;
+}
+.code-linked-vulns li {
+    margin-bottom: 2px;
+}
+
+/* ──────────────── Attack Chain ──────────────── */
+.phase-block {
+    margin-bottom: 20px;
+    page-break-inside: avoid;
+    break-inside: avoid;
+}
+
+.phase-header {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding: 8px 14px;
+    background: var(--heading);
+    color: #fff;
+    border-radius: 4px 4px 0 0;
+    font-size: 9.5pt;
+}
+
+.phase-num {
+    font-weight: 700;
+    font-size: 8pt;
+    text-transform: uppercase;
+    letter-spacing: 0.1em;
+    background: rgba(255,255,255,0.15);
+    padding: 2px 8px;
+    border-radius: 3px;
+}
+
+.phase-label {
+    font-weight: 600;
+    flex: 1;
+}
+
+.phase-count {
+    font-size: 8.5pt;
+    opacity: 0.7;
+}
+
+.phase-steps {
+    border: 1px solid var(--border);
+    border-top: none;
+    border-radius: 0 0 4px 4px;
+}
+
+.step-row {
+    display: flex;
+    align-items: flex-start;
+    gap: 10px;
+    padding: 8px 14px;
+    border-bottom: 1px solid var(--border-light);
+    position: relative;
+}
+
+.step-row:last-child {
+    border-bottom: none;
+}
+
+.step-num {
+    width: 22px;
+    height: 22px;
+    border-radius: 50%;
+    background: var(--bg-section);
+    border: 1px solid var(--border);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 8pt;
+    font-weight: 700;
+    color: var(--text-secondary);
+    flex-shrink: 0;
+    margin-top: 1px;
+}
+
+.step-connector {
+    display: none;
+}
+
+.step-content {
+    flex: 1;
+    min-width: 0;
+}
+
+.step-header {
+    display: flex;
+    align-items: center;
+    gap: 8px;
+    flex-wrap: wrap;
+}
+
+.step-tool {
+    font-family: var(--font-mono);
+    font-size: 9.5pt;
+    font-weight: 500;
+    color: var(--heading);
+}
+
+.step-status {
+    font-size: 7.5pt;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+    padding: 1px 7px;
+    border-radius: 3px;
+}
+
+.step-completed { background: #dcfce7; color: #166534; }
+.step-failed { background: #fef2f2; color: #991b1b; }
+.step-running { background: #fef9c3; color: #854d0e; }
+
+.step-findings {
+    font-size: 8pt;
+    font-weight: 600;
+    color: var(--sev-high);
+    background: #fff7ed;
+    padding: 1px 7px;
+    border-radius: 3px;
+    border: 1px solid #fed7aa;
+}
+
+.step-risk {
+    font-size: 7.5pt;
+    font-weight: 700;
+    padding: 1px 6px;
+    border-radius: 3px;
+}
+
+.risk-high { background: #fef2f2; color: var(--sev-critical); border: 1px solid #fecaca; }
+.risk-med { background: #fffbeb; color: var(--sev-medium); border: 1px solid #fde68a; }
+.risk-low { background: #f0fdf4; color: #166534; border: 1px solid #bbf7d0; }
+
+.step-reasoning {
+    font-size: 9pt;
+    color: var(--text-muted);
+    margin-top: 3px;
+    line-height: 1.5;
+    font-style: italic;
+}
+
+/* ──────────────── Footer ──────────────── */
+.report-footer {
+    margin-top: 48px;
+    padding-top: 14px;
+    border-top: 2px solid var(--heading);
+    font-size: 8pt;
+    color: var(--text-muted);
+    text-align: center;
+    line-height: 1.8;
+}
+
+.report-footer .footer-company {
+    font-weight: 700;
+    color: var(--text-secondary);
+}
+
+/* ──────────────── Page Break Utilities ──────────────── */
+.page-break {
+    page-break-before: always;
+    break-before: page;
+}
+
+.avoid-break {
+    page-break-inside: avoid;
+    break-inside: avoid;
+}
+
+/* ──────────────── Print Overrides ──────────────── */
+@media print {
+    body {
+        font-size: 10pt;
+    }
+    .cover {
+        height: auto;
+        min-height: 250mm;
+        padding: 50mm 20mm;
+    }
+    .report-body {
+        padding: 0;
+    }
+    .no-print {
+        display: none !important;
+    }
+    a {
+        color: var(--accent);
+        text-decoration: none;
+    }
+}
+
+/* ──────────────── Screen Enhancements ──────────────── */
+@media screen {
+    body {
+        background: #e2e8f0;
+    }
+    .cover {
+        background: #fff;
+        box-shadow: 0 1px 4px rgba(0,0,0,0.08);
+    }
+    .report-body {
+        background: #fff;
+        padding: 20px 32px 40px;
+        box-shadow: 0 1px 4px rgba(0,0,0,0.08);
+        margin-bottom: 40px;
+    }
+}
+</style>"##
+        .to_string()
+}

compliance-agent/src/pentest/report/mod.rs

@@ -3,7 +3,11 @@ mod html;
 mod pdf;
 
 use compliance_core::models::dast::DastFinding;
-use compliance_core::models::pentest::{AttackChainNode, PentestSession};
+use compliance_core::models::finding::Finding;
+use compliance_core::models::pentest::{
+    AttackChainNode, CodeContextHint, PentestConfig, PentestSession,
+};
+use compliance_core::models::sbom::SbomEntry;
 use sha2::{Digest, Sha256};
 
 /// Report archive with metadata
@@ -23,6 +27,13 @@ pub struct ReportContext {
     pub attack_chain: Vec<AttackChainNode>,
     pub requester_name: String,
     pub requester_email: String,
+    pub config: Option<PentestConfig>,
+    /// SAST findings for the linked repository (for code-level correlation)
+    pub sast_findings: Vec<Finding>,
+    /// Vulnerable dependencies from SBOM
+    pub sbom_entries: Vec<SbomEntry>,
+    /// Code knowledge graph entry points linked to SAST findings
+    pub code_context: Vec<CodeContextHint>,
 }
 
 /// Generate a password-protected ZIP archive containing the pentest report.

compliance-core/src/config.rs

@@ -27,6 +27,14 @@ pub struct AgentConfig {
     pub ssh_key_path: String,
     pub keycloak_url: Option<String>,
     pub keycloak_realm: Option<String>,
+    pub keycloak_admin_username: Option<String>,
+    pub keycloak_admin_password: Option<SecretString>,
+    // Pentest defaults
+    pub pentest_verification_email: Option<String>,
+    pub pentest_imap_host: Option<String>,
+    pub pentest_imap_port: Option<u16>,
+    pub pentest_imap_username: Option<String>,
+    pub pentest_imap_password: Option<SecretString>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize)]

compliance-core/src/models/mod.rs

@@ -28,8 +28,9 @@ pub use graph::{
 pub use issue::{IssueStatus, TrackerIssue, TrackerType};
 pub use mcp::{McpServerConfig, McpServerStatus, McpTransport};
 pub use pentest::{
-    AttackChainNode, AttackNodeStatus, CodeContextHint, PentestEvent, PentestMessage,
-    PentestSession, PentestStats, PentestStatus, PentestStrategy, SeverityDistribution,
+    AttackChainNode, AttackNodeStatus, AuthMode, CodeContextHint, Environment, IdentityProvider,
+    PentestAuthConfig, PentestConfig, PentestEvent, PentestMessage, PentestSession, PentestStats,
+    PentestStatus, PentestStrategy, SeverityDistribution, TestUserRecord, TesterInfo,
     ToolCallRecord,
 };
 pub use repository::{ScanTrigger, TrackedRepository};

compliance-core/src/models/pentest.rs

@@ -1,3 +1,5 @@
+use std::collections::HashMap;
+
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 
@@ -50,6 +52,132 @@ impl std::fmt::Display for PentestStrategy {
     }
 }
 
+/// Authentication mode for the pentest target
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum AuthMode {
+    #[default]
+    None,
+    Manual,
+    AutoRegister,
+}
+
+/// Target environment classification
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum Environment {
+    #[default]
+    Development,
+    Staging,
+    Production,
+}
+
+impl std::fmt::Display for Environment {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Development => write!(f, "Development"),
+            Self::Staging => write!(f, "Staging"),
+            Self::Production => write!(f, "Production"),
+        }
+    }
+}
+
+/// Tester identity for the engagement record
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TesterInfo {
+    pub name: String,
+    pub email: String,
+}
+
+/// Authentication configuration for the pentest session
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct PentestAuthConfig {
+    pub mode: AuthMode,
+    pub username: Option<String>,
+    pub password: Option<String>,
+    /// Optional — if omitted the orchestrator uses Playwright to discover it.
+    pub registration_url: Option<String>,
+    /// Base email for plus-addressing (e.g. `pentest@scanner.example.com`).
+    /// The orchestrator generates `base+{session_id}@domain` per session.
+    pub verification_email: Option<String>,
+    /// IMAP server to poll for verification emails (e.g. `imap.example.com`).
+    pub imap_host: Option<String>,
+    /// IMAP port (default 993 for TLS).
+    pub imap_port: Option<u16>,
+    /// IMAP username (defaults to `verification_email` if omitted).
+    pub imap_username: Option<String>,
+    /// IMAP password / app-specific password.
+    pub imap_password: Option<String>,
+    #[serde(default)]
+    pub cleanup_test_user: bool,
+}
+
+/// Full wizard configuration for a pentest session
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PentestConfig {
+    // Step 1: Target & Scope
+    pub app_url: String,
+    pub git_repo_url: Option<String>,
+    pub branch: Option<String>,
+    pub commit_hash: Option<String>,
+    pub app_type: Option<String>,
+    pub rate_limit: Option<u32>,
+
+    // Step 2: Authentication
+    #[serde(default)]
+    pub auth: PentestAuthConfig,
+    #[serde(default)]
+    pub custom_headers: HashMap<String, String>,
+
+    // Step 3: Strategy & Instructions
+    pub strategy: Option<String>,
+    #[serde(default)]
+    pub allow_destructive: bool,
+    pub initial_instructions: Option<String>,
+    #[serde(default)]
+    pub scope_exclusions: Vec<String>,
+
+    // Step 4: Disclaimer & Confirm
+    #[serde(default)]
+    pub disclaimer_accepted: bool,
+    pub disclaimer_accepted_at: Option<DateTime<Utc>>,
+    #[serde(default)]
+    pub environment: Environment,
+    #[serde(default)]
+    pub tester: TesterInfo,
+    pub max_duration_minutes: Option<u32>,
+    #[serde(default)]
+    pub skip_mode: bool,
+}
+
+/// Identity provider type for cleanup routing
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum IdentityProvider {
+    Keycloak,
+    Auth0,
+    Okta,
+    Firebase,
+    Custom,
+}
+
+/// Details of a test user created during a pentest session.
+/// Stored so the cleanup step knows exactly what to delete and where.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TestUserRecord {
+    /// Username used to register
+    pub username: Option<String>,
+    /// Email used to register
+    pub email: Option<String>,
+    /// User ID returned by the identity provider (if known)
+    pub provider_user_id: Option<String>,
+    /// Which identity provider holds this user
+    pub provider: Option<IdentityProvider>,
+    /// Whether cleanup has been completed
+    #[serde(default)]
+    pub cleaned_up: bool,
+}
+
 /// A pentest session initiated via the chat interface
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct PentestSession {
@@ -60,7 +188,12 @@ pub struct PentestSession {
     pub repo_id: Option<String>,
     pub status: PentestStatus,
     pub strategy: PentestStrategy,
+    /// Wizard configuration (None for legacy sessions)
+    pub config: Option<PentestConfig>,
     pub created_by: Option<String>,
+    /// Test user created during auto-register (for cleanup)
+    #[serde(default)]
+    pub test_user: Option<TestUserRecord>,
     /// Total number of tool invocations in this session
     pub tool_invocations: u32,
     /// Total successful tool invocations
@@ -83,7 +216,9 @@ impl PentestSession {
             repo_id: None,
             status: PentestStatus::Running,
             strategy,
+            config: None,
             created_by: None,
+            test_user: None,
             tool_invocations: 0,
             tool_successes: 0,
             findings_count: 0,
@@ -261,6 +396,10 @@ pub enum PentestEvent {
     Complete { summary: String },
     /// Error occurred
     Error { message: String },
+    /// Session paused
+    Paused,
+    /// Session resumed
+    Resumed,
 }
 
 /// Aggregated stats for the pentest dashboard

compliance-core/tests/models.rs

@@ -436,6 +436,150 @@ fn pentest_event_serde_finding() {
     }
 }
 
+// ─── PentestEvent Paused/Resumed ───
+
+#[test]
+fn pentest_event_serde_paused() {
+    let event = pentest::PentestEvent::Paused;
+    let json = serde_json::to_string(&event).unwrap();
+    assert!(json.contains(r#""type":"paused""#));
+    let back: pentest::PentestEvent = serde_json::from_str(&json).unwrap();
+    assert!(matches!(back, pentest::PentestEvent::Paused));
+}
+
+#[test]
+fn pentest_event_serde_resumed() {
+    let event = pentest::PentestEvent::Resumed;
+    let json = serde_json::to_string(&event).unwrap();
+    assert!(json.contains(r#""type":"resumed""#));
+    let back: pentest::PentestEvent = serde_json::from_str(&json).unwrap();
+    assert!(matches!(back, pentest::PentestEvent::Resumed));
+}
+
+// ─── PentestConfig serde ───
+
+#[test]
+fn pentest_config_serde_roundtrip() {
+    let config = pentest::PentestConfig {
+        app_url: "https://example.com".into(),
+        git_repo_url: Some("https://github.com/org/repo".into()),
+        branch: Some("main".into()),
+        commit_hash: None,
+        app_type: Some("web".into()),
+        rate_limit: Some(10),
+        auth: pentest::PentestAuthConfig {
+            mode: pentest::AuthMode::Manual,
+            username: Some("admin".into()),
+            password: Some("pass123".into()),
+            registration_url: None,
+            verification_email: None,
+            imap_host: None,
+            imap_port: None,
+            imap_username: None,
+            imap_password: None,
+            cleanup_test_user: true,
+        },
+        custom_headers: [("X-Token".to_string(), "abc".to_string())]
+            .into_iter()
+            .collect(),
+        strategy: Some("comprehensive".into()),
+        allow_destructive: false,
+        initial_instructions: Some("Test the login flow".into()),
+        scope_exclusions: vec!["/admin".into()],
+        disclaimer_accepted: true,
+        disclaimer_accepted_at: Some(chrono::Utc::now()),
+        environment: pentest::Environment::Staging,
+        tester: pentest::TesterInfo {
+            name: "Alice".into(),
+            email: "alice@example.com".into(),
+        },
+        max_duration_minutes: Some(30),
+        skip_mode: false,
+    };
+    let json = serde_json::to_string(&config).unwrap();
+    let back: pentest::PentestConfig = serde_json::from_str(&json).unwrap();
+    assert_eq!(back.app_url, "https://example.com");
+    assert_eq!(back.auth.mode, pentest::AuthMode::Manual);
+    assert_eq!(back.auth.username, Some("admin".into()));
+    assert!(back.auth.cleanup_test_user);
+    assert_eq!(back.scope_exclusions, vec!["/admin".to_string()]);
+    assert_eq!(back.environment, pentest::Environment::Staging);
+}
+
+#[test]
+fn pentest_auth_config_default() {
+    let auth = pentest::PentestAuthConfig::default();
+    assert_eq!(auth.mode, pentest::AuthMode::None);
+    assert!(auth.username.is_none());
+    assert!(auth.password.is_none());
+    assert!(auth.verification_email.is_none());
+    assert!(auth.imap_host.is_none());
+    assert!(!auth.cleanup_test_user);
+}
+
+// ─── TestUserRecord ───
+
+#[test]
+fn test_user_record_default() {
+    let r = pentest::TestUserRecord::default();
+    assert!(r.username.is_none());
+    assert!(r.email.is_none());
+    assert!(r.provider_user_id.is_none());
+    assert!(r.provider.is_none());
+    assert!(!r.cleaned_up);
+}
+
+#[test]
+fn test_user_record_serde_roundtrip() {
+    let r = pentest::TestUserRecord {
+        username: Some("pentestuser".into()),
+        email: Some("pentest+abc@scanner.example.com".into()),
+        provider_user_id: Some("kc-uuid-123".into()),
+        provider: Some(pentest::IdentityProvider::Keycloak),
+        cleaned_up: false,
+    };
+    let json = serde_json::to_string(&r).unwrap();
+    let back: pentest::TestUserRecord = serde_json::from_str(&json).unwrap();
+    assert_eq!(back.username, Some("pentestuser".into()));
+    assert_eq!(back.provider, Some(pentest::IdentityProvider::Keycloak));
+    assert!(!back.cleaned_up);
+}
+
+#[test]
+fn identity_provider_serde_all_variants() {
+    for (variant, expected) in [
+        (pentest::IdentityProvider::Keycloak, "\"keycloak\""),
+        (pentest::IdentityProvider::Auth0, "\"auth0\""),
+        (pentest::IdentityProvider::Okta, "\"okta\""),
+        (pentest::IdentityProvider::Firebase, "\"firebase\""),
+        (pentest::IdentityProvider::Custom, "\"custom\""),
+    ] {
+        let json = serde_json::to_string(&variant).unwrap();
+        assert_eq!(json, expected);
+        let back: pentest::IdentityProvider = serde_json::from_str(&json).unwrap();
+        assert_eq!(back, variant);
+    }
+}
+
+#[test]
+fn pentest_session_with_test_user() {
+    let mut s = pentest::PentestSession::new("t".into(), pentest::PentestStrategy::Quick);
+    assert!(s.test_user.is_none());
+    s.test_user = Some(pentest::TestUserRecord {
+        username: Some("pentester".into()),
+        email: Some("pentest+123@example.com".into()),
+        provider_user_id: None,
+        provider: Some(pentest::IdentityProvider::Auth0),
+        cleaned_up: false,
+    });
+    let bson_doc = bson::to_document(&s).unwrap();
+    let back: pentest::PentestSession = bson::from_document(bson_doc).unwrap();
+    assert!(back.test_user.is_some());
+    let tu = back.test_user.as_ref().unwrap();
+    assert_eq!(tu.username, Some("pentester".into()));
+    assert_eq!(tu.provider, Some(pentest::IdentityProvider::Auth0));
+}
+
 // ─── Serde helpers (BSON datetime) ───
 
 #[test]

compliance-dashboard/assets/main.css

@@ -3305,7 +3305,7 @@ tbody tr:last-child td {
     transition: max-height 0.28s cubic-bezier(0.16,1,0.3,1);
 }
 .ac-tool-detail.open {
-    max-height: 300px;
+    max-height: 800px;
 }
 .ac-tool-detail-inner {
     padding: 6px 10px 10px 49px;
@@ -3338,3 +3338,310 @@ tbody tr:last-child td {
 .ac-detail-value {
     color: var(--text-secondary);
 }
+
+/* Running node pulse animation */
+.ac-node-running {
+    animation: ac-pulse 2s ease-in-out infinite;
+}
+@keyframes ac-pulse {
+    0%, 100% { box-shadow: inset 0 0 0 transparent; }
+    50% { box-shadow: inset 0 0 12px rgba(217, 119, 6, 0.15); }
+}
+
+/* Tool input/output data blocks */
+.ac-data-section {
+    margin-top: 8px;
+}
+.ac-data-label {
+    color: var(--text-tertiary, #6b7280);
+    text-transform: uppercase;
+    font-size: 9px;
+    letter-spacing: 0.04em;
+    margin-bottom: 3px;
+}
+.ac-data-block {
+    background: rgba(0, 0, 0, 0.25);
+    border: 1px solid var(--border, #162038);
+    border-radius: 6px;
+    padding: 8px 10px;
+    font-family: var(--font-mono, monospace);
+    font-size: 10px;
+    line-height: 1.5;
+    color: var(--text-secondary);
+    white-space: pre-wrap;
+    word-break: break-all;
+    max-height: 200px;
+    overflow-y: auto;
+    margin: 0;
+}
+
+/* ═══════════════════════════════════════════════════
+   Pentest Wizard
+   ═══════════════════════════════════════════════════ */
+
+.wizard-backdrop {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.6);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    z-index: 1000;
+}
+
+.wizard-dialog {
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-lg);
+    width: 600px;
+    max-width: 92vw;
+    max-height: 90vh;
+    display: flex;
+    flex-direction: column;
+    overflow: hidden;
+    position: relative;
+}
+
+/* Close button (top-right corner, always visible) */
+.wizard-close-btn {
+    position: absolute;
+    top: 12px;
+    right: 12px;
+    z-index: 10;
+    background: none;
+    border: 1px solid transparent;
+    border-radius: 6px;
+    color: var(--text-secondary);
+    cursor: pointer;
+    padding: 4px 6px;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    transition: color 0.15s, border-color 0.15s;
+}
+.wizard-close-btn:hover {
+    color: var(--text-primary);
+    border-color: var(--border-color);
+}
+
+/* Dropdown for existing targets/repos */
+.wizard-dropdown {
+    position: absolute;
+    top: 100%;
+    left: 0;
+    right: 0;
+    z-index: 20;
+    background: var(--bg-elevated, var(--bg-secondary));
+    border: 1px solid var(--border-color);
+    border-radius: 0 0 8px 8px;
+    max-height: 200px;
+    overflow-y: auto;
+    box-shadow: 0 8px 24px rgba(0, 0, 0, 0.25);
+}
+.wizard-dropdown-item {
+    padding: 8px 12px;
+    cursor: pointer;
+    transition: background 0.1s;
+    border-bottom: 1px solid var(--border-color);
+}
+.wizard-dropdown-item:last-child {
+    border-bottom: none;
+}
+.wizard-dropdown-item:hover {
+    background: var(--bg-card-hover, rgba(255,255,255,0.04));
+}
+
+/* SSH key display */
+.wizard-ssh-key {
+    margin-top: 8px;
+    padding: 10px 12px;
+    background: rgba(0, 200, 255, 0.04);
+    border: 1px solid var(--border-accent, rgba(0,200,255,0.15));
+    border-radius: 8px;
+}
+.wizard-ssh-key-box {
+    padding: 8px 10px;
+    background: var(--bg-primary);
+    border-radius: 4px;
+    font-family: var(--font-mono, monospace);
+    font-size: 10px;
+    word-break: break-all;
+    user-select: all;
+    color: var(--text-secondary);
+    line-height: 1.4;
+}
+
+.wizard-steps {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 8px;
+    padding: 16px 24px;
+    border-bottom: 1px solid var(--border-color);
+    background: var(--bg-primary);
+}
+
+.wizard-step {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 0.8rem;
+    color: var(--text-tertiary);
+    position: relative;
+}
+
+.wizard-step + .wizard-step::before {
+    content: '';
+    display: block;
+    width: 24px;
+    height: 1px;
+    background: var(--border-color);
+    margin-right: 4px;
+}
+
+.wizard-step.active {
+    color: var(--accent);
+}
+
+.wizard-step.completed {
+    color: var(--status-success);
+}
+
+.wizard-step-dot {
+    width: 22px;
+    height: 22px;
+    border-radius: 50%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 0.7rem;
+    font-weight: 700;
+    background: var(--bg-tertiary);
+    color: var(--text-tertiary);
+    flex-shrink: 0;
+}
+
+.wizard-step.active .wizard-step-dot {
+    background: var(--accent);
+    color: var(--bg-primary);
+}
+
+.wizard-step.completed .wizard-step-dot {
+    background: var(--status-success);
+    color: var(--bg-primary);
+}
+
+.wizard-step-label {
+    display: none;
+}
+
+@media (min-width: 480px) {
+    .wizard-step-label {
+        display: inline;
+    }
+}
+
+.wizard-body {
+    padding: 20px 24px;
+    min-height: 300px;
+    overflow-y: auto;
+    flex: 1;
+}
+
+.wizard-body h3 {
+    font-size: 1.05rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.wizard-field {
+    margin-bottom: 12px;
+}
+
+.wizard-field label {
+    display: block;
+    font-size: 0.82rem;
+    color: var(--text-secondary);
+    margin-bottom: 4px;
+    font-weight: 500;
+}
+
+.wizard-field .chat-input,
+.wizard-field select {
+    width: 100%;
+}
+
+.wizard-footer {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    padding: 12px 24px;
+    border-top: 1px solid var(--border-color);
+    background: var(--bg-primary);
+}
+
+.wizard-disclaimer {
+    background: rgba(255, 176, 32, 0.08);
+    border: 1px solid rgba(255, 176, 32, 0.25);
+    border-radius: var(--radius);
+    padding: 16px;
+    margin-top: 16px;
+    color: var(--text-primary);
+    font-size: 0.85rem;
+    line-height: 1.55;
+}
+
+.wizard-summary {
+    background: var(--bg-primary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius);
+    padding: 16px;
+}
+
+.wizard-summary dl {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    gap: 6px 16px;
+    margin: 0;
+    font-size: 0.85rem;
+}
+
+.wizard-summary dt {
+    color: var(--text-secondary);
+    font-weight: 500;
+}
+
+.wizard-summary dd {
+    color: var(--text-primary);
+    margin: 0;
+}
+
+.wizard-toggle {
+    width: 36px;
+    height: 20px;
+    background: var(--bg-tertiary);
+    border-radius: 10px;
+    cursor: pointer;
+    position: relative;
+    transition: background 0.2s;
+    flex-shrink: 0;
+}
+
+.wizard-toggle.active {
+    background: var(--accent);
+}
+
+.wizard-toggle-knob {
+    width: 16px;
+    height: 16px;
+    background: #fff;
+    border-radius: 50%;
+    position: absolute;
+    top: 2px;
+    left: 2px;
+    transition: transform 0.2s;
+}
+
+.wizard-toggle.active .wizard-toggle-knob {
+    transform: translateX(16px);
+}

compliance-dashboard/src/components/attack_chain/helpers.rs

@@ -118,9 +118,12 @@ pub(crate) fn cat_label(cat: &str) -> &'static str {
     }
 }
 
-/// Phase name heuristic based on depth
-pub(crate) fn phase_name(depth: usize) -> &'static str {
-    match depth {
+/// Maximum number of display phases — deeper iterations are merged into the last.
+const MAX_PHASES: usize = 8;
+
+/// Phase name heuristic based on phase index (not raw BFS depth)
+pub(crate) fn phase_name(phase_idx: usize) -> &'static str {
+    match phase_idx {
         0 => "Reconnaissance",
         1 => "Analysis",
         2 => "Boundary Testing",
@@ -133,8 +136,8 @@ pub(crate) fn phase_name(depth: usize) -> &'static str {
 }
 
 /// Short label for phase rail
-pub(crate) fn phase_short_name(depth: usize) -> &'static str {
-    match depth {
+pub(crate) fn phase_short_name(phase_idx: usize) -> &'static str {
+    match phase_idx {
         0 => "Recon",
         1 => "Analysis",
         2 => "Boundary",
@@ -214,7 +217,14 @@ pub(crate) fn compute_phases(steps: &[serde_json::Value]) -> Vec<Vec<usize>> {
         }
     }
 
-    // Group by depth
+    // Cap depths at MAX_PHASES - 1 so deeper iterations merge into the last phase
+    for d in depths.iter_mut() {
+        if *d >= MAX_PHASES {
+            *d = MAX_PHASES - 1;
+        }
+    }
+
+    // Group by (capped) depth
     let max_depth = depths.iter().copied().max().unwrap_or(0);
     let mut phases: Vec<Vec<usize>> = Vec::new();
     for d in 0..=max_depth {

compliance-dashboard/src/components/attack_chain/view.rs

@@ -270,8 +270,17 @@ pub fn AttackChainView(
                                             let duration = compute_duration(step);
                                             let started = step.get("started_at").map(format_bson_time).unwrap_or_default();
 
+                                            let tool_input_json = step.get("tool_input")
+                                                .map(|v| serde_json::to_string_pretty(v).unwrap_or_default())
+                                                .unwrap_or_default();
+                                            let tool_output_json = step.get("tool_output")
+                                                .map(|v| serde_json::to_string_pretty(v).unwrap_or_default())
+                                                .unwrap_or_default();
+
                                             let is_pending = status == "pending";
+                                            let is_node_running = status == "running";
                                             let pending_cls = if is_pending { " is-pending" } else { "" };
+                                            let running_cls = if is_node_running { " ac-node-running" } else { "" };
 
                                             let duration_cls = if status == "running" { "ac-tool-duration running-text" } else { "ac-tool-duration" };
                                             let duration_text = if status == "running" {
@@ -299,7 +308,7 @@ pub fn AttackChainView(
 
                                             rsx! {
                                                 div {
-                                                    class: "ac-tool-row{pending_cls}",
+                                                    class: "ac-tool-row{pending_cls}{running_cls}",
                                                     id: "{row_id}",
                                                     onclick: move |_| {
                                                         if is_pending { return; }
@@ -321,30 +330,40 @@ pub fn AttackChainView(
                                                 div {
                                                     class: "ac-tool-detail",
                                                     id: "{detail_id_clone}",
-                                                    if !reasoning.is_empty() || !started.is_empty() {
-                                                        div { class: "ac-tool-detail-inner",
-                                                            if !reasoning.is_empty() {
-                                                                div { class: "ac-reasoning-block", "{reasoning}" }
-                                                            }
-                                                            if !started.is_empty() {
-                                                                div { class: "ac-detail-grid",
-                                                                    span { class: "ac-detail-label", "Started" }
-                                                                    span { class: "ac-detail-value", "{started}" }
-                                                                    if !duration_text.is_empty() && status != "running" && duration_text != "\u{2014}" {
-                                                                        span { class: "ac-detail-label", "Duration" }
-                                                                        span { class: "ac-detail-value", "{duration_text}" }
-                                                                    }
-                                                                    span { class: "ac-detail-label", "Status" }
-                                                                    if status == "completed" {
-                                                                        span { class: "ac-detail-value", style: "color: var(--success, #16a34a);", "Completed" }
-                                                                    } else if status == "failed" {
-                                                                        span { class: "ac-detail-value", style: "color: var(--danger, #dc2626);", "Failed" }
-                                                                    } else if status == "running" {
-                                                                        span { class: "ac-detail-value", style: "color: var(--warning, #d97706);", "Running" }
-                                                                    } else {
-                                                                        span { class: "ac-detail-value", "{status}" }
-                                                                    }
+                                                    div { class: "ac-tool-detail-inner",
+                                                        if !reasoning.is_empty() {
+                                                            div { class: "ac-reasoning-block", "{reasoning}" }
+                                                        }
+                                                        if !started.is_empty() {
+                                                            div { class: "ac-detail-grid",
+                                                                span { class: "ac-detail-label", "Started" }
+                                                                span { class: "ac-detail-value", "{started}" }
+                                                                if !duration_text.is_empty() && status != "running" && duration_text != "\u{2014}" {
+                                                                    span { class: "ac-detail-label", "Duration" }
+                                                                    span { class: "ac-detail-value", "{duration_text}" }
                                                                 }
+                                                                span { class: "ac-detail-label", "Status" }
+                                                                if status == "completed" {
+                                                                    span { class: "ac-detail-value", style: "color: var(--success, #16a34a);", "Completed" }
+                                                                } else if status == "failed" {
+                                                                    span { class: "ac-detail-value", style: "color: var(--danger, #dc2626);", "Failed" }
+                                                                } else if status == "running" {
+                                                                    span { class: "ac-detail-value", style: "color: var(--warning, #d97706);", "Running" }
+                                                                } else {
+                                                                    span { class: "ac-detail-value", "{status}" }
+                                                                }
+                                                            }
+                                                        }
+                                                        if !tool_input_json.is_empty() && tool_input_json != "null" {
+                                                            div { class: "ac-data-section",
+                                                                div { class: "ac-data-label", "Input" }
+                                                                pre { class: "ac-data-block", "{tool_input_json}" }
+                                                            }
+                                                        }
+                                                        if !tool_output_json.is_empty() && tool_output_json != "null" {
+                                                            div { class: "ac-data-section",
+                                                                div { class: "ac-data-label", "Output" }
+                                                                pre { class: "ac-data-block", "{tool_output_json}" }
                                                             }
                                                         }
                                                     }

compliance-dashboard/src/components/mod.rs

@@ -5,6 +5,7 @@ pub mod code_snippet;
 pub mod file_tree;
 pub mod page_header;
 pub mod pagination;
+pub mod pentest_wizard;
 pub mod severity_badge;
 pub mod sidebar;
 pub mod stat_card;

compliance-dashboard/src/components/pentest_wizard.rs

@@ -0,0 +1,925 @@
+use dioxus::prelude::*;
+use dioxus_free_icons::icons::bs_icons::*;
+use dioxus_free_icons::Icon;
+
+use crate::app::Route;
+use crate::infrastructure::dast::fetch_dast_targets;
+use crate::infrastructure::pentest::{create_pentest_session_wizard, lookup_repo_by_url};
+use crate::infrastructure::repositories::{fetch_repositories, fetch_ssh_public_key};
+
+const DISCLAIMER_TEXT: &str = "I confirm that I have authorization to perform security testing \
+against the specified target. I understand that penetration testing may cause disruption to the \
+target application. I accept full responsibility for ensuring this test is conducted within \
+legal boundaries and with proper authorization from the system owner.";
+
+/// Returns true if a git URL looks like an SSH URL (git@ or ssh://)
+fn is_ssh_url(url: &str) -> bool {
+    let trimmed = url.trim();
+    trimmed.starts_with("git@") || trimmed.starts_with("ssh://")
+}
+
+#[component]
+pub fn PentestWizard(show: Signal<bool>) -> Element {
+    let mut step = use_signal(|| 1u8);
+    let mut creating = use_signal(|| false);
+
+    // Step 1: Target & Scope
+    let mut app_url = use_signal(String::new);
+    let mut git_repo_url = use_signal(String::new);
+    let mut branch = use_signal(String::new);
+    let mut commit_hash = use_signal(String::new);
+    let mut app_type = use_signal(|| "web_app".to_string());
+    let mut rate_limit = use_signal(|| "10".to_string());
+
+    // Repo lookup state
+    let mut repo_looked_up = use_signal(|| false);
+    let mut repo_name = use_signal(String::new);
+
+    // Dropdown state: existing targets and repos
+    let mut show_target_dropdown = use_signal(|| false);
+    let mut show_repo_dropdown = use_signal(|| false);
+    let existing_targets = use_resource(|| async { fetch_dast_targets().await.ok() });
+    let existing_repos = use_resource(|| async { fetch_repositories(1).await.ok() });
+
+    // SSH key state for private repos
+    let mut ssh_public_key = use_signal(String::new);
+    let mut ssh_key_loaded = use_signal(|| false);
+
+    // Step 2: Authentication
+    let mut requires_auth = use_signal(|| false);
+    let mut auth_mode = use_signal(|| "manual".to_string()); // "manual" | "auto_register"
+    let mut auth_username = use_signal(String::new);
+    let mut auth_password = use_signal(String::new);
+    let mut registration_url = use_signal(String::new);
+    let mut verification_email = use_signal(String::new);
+    let mut imap_host = use_signal(String::new);
+    let mut imap_port = use_signal(|| "993".to_string());
+    let mut imap_username = use_signal(String::new);
+    let mut imap_password = use_signal(String::new);
+    let mut show_imap_settings = use_signal(|| false);
+    let mut cleanup_test_user = use_signal(|| false);
+    let mut custom_headers = use_signal(Vec::<(String, String)>::new);
+
+    // Step 3: Strategy & Instructions
+    let mut strategy = use_signal(|| "comprehensive".to_string());
+    let mut allow_destructive = use_signal(|| false);
+    let mut initial_instructions = use_signal(String::new);
+    let mut scope_exclusions = use_signal(String::new);
+    let mut environment = use_signal(|| "development".to_string());
+    let mut max_duration = use_signal(|| "30".to_string());
+    let mut tester_name = use_signal(String::new);
+    let mut tester_email = use_signal(String::new);
+
+    // Step 4: Disclaimer
+    let mut disclaimer_accepted = use_signal(|| false);
+
+    let close = move |_| {
+        show.set(false);
+        step.set(1);
+    };
+
+    let on_skip_to_blackbox = move |_| {
+        // Jump to step 4 with skip mode
+        step.set(4);
+    };
+
+    let can_skip = !app_url.read().is_empty();
+
+    let on_submit = move |_| {
+        creating.set(true);
+        let url = app_url.read().clone();
+        let git = git_repo_url.read().clone();
+        let br = branch.read().clone();
+        let ch = commit_hash.read().clone();
+        let at = app_type.read().clone();
+        let rl = rate_limit.read().parse::<u32>().unwrap_or(10);
+        let req_auth = *requires_auth.read();
+        let am = auth_mode.read().clone();
+        let au = auth_username.read().clone();
+        let ap = auth_password.read().clone();
+        let ru = registration_url.read().clone();
+        let ve = verification_email.read().clone();
+        let ih = imap_host.read().clone();
+        let ip = imap_port.read().parse::<u16>().unwrap_or(993);
+        let iu = imap_username.read().clone();
+        let iw = imap_password.read().clone();
+        let cu = *cleanup_test_user.read();
+        let hdrs = custom_headers.read().clone();
+        let strat = strategy.read().clone();
+        let ad = *allow_destructive.read();
+        let ii = initial_instructions.read().clone();
+        let se = scope_exclusions.read().clone();
+        let env = environment.read().clone();
+        let md = max_duration.read().parse::<u32>().unwrap_or(30);
+        let tn = tester_name.read().clone();
+        let te = tester_email.read().clone();
+        let skip = *step.read() == 4 && !req_auth; // simplified skip check
+
+        let mut show = show;
+        spawn(async move {
+            let headers_map: std::collections::HashMap<String, String> = hdrs
+                .into_iter()
+                .filter(|(k, v)| !k.is_empty() && !v.is_empty())
+                .collect();
+            let scope_excl: Vec<String> = se
+                .lines()
+                .map(|l| l.trim().to_string())
+                .filter(|l| !l.is_empty())
+                .collect();
+
+            let config = serde_json::json!({
+                "app_url": url,
+                "git_repo_url": if git.is_empty() { None } else { Some(git) },
+                "branch": if br.is_empty() { None } else { Some(br) },
+                "commit_hash": if ch.is_empty() { None } else { Some(ch) },
+                "app_type": if at.is_empty() { None } else { Some(at) },
+                "rate_limit": rl,
+                "auth": {
+                    "mode": if !req_auth { "none" } else { &am },
+                    "username": if au.is_empty() { None } else { Some(&au) },
+                    "password": if ap.is_empty() { None } else { Some(&ap) },
+                    "registration_url": if ru.is_empty() { None } else { Some(&ru) },
+                    "verification_email": if ve.is_empty() { None } else { Some(&ve) },
+                    "imap_host": if ih.is_empty() { None } else { Some(&ih) },
+                    "imap_port": ip,
+                    "imap_username": if iu.is_empty() { None } else { Some(&iu) },
+                    "imap_password": if iw.is_empty() { None } else { Some(&iw) },
+                    "cleanup_test_user": cu,
+                },
+                "custom_headers": headers_map,
+                "strategy": strat,
+                "allow_destructive": ad,
+                "initial_instructions": if ii.is_empty() { None } else { Some(&ii) },
+                "scope_exclusions": scope_excl,
+                "disclaimer_accepted": true,
+                "disclaimer_accepted_at": chrono::Utc::now().to_rfc3339(),
+                "environment": env,
+                "tester": { "name": tn, "email": te },
+                "max_duration_minutes": md,
+                "skip_mode": skip,
+            });
+
+            match create_pentest_session_wizard(config.to_string()).await {
+                Ok(resp) => {
+                    let session_id = resp
+                        .data
+                        .get("_id")
+                        .and_then(|v| v.get("$oid"))
+                        .and_then(|v| v.as_str())
+                        .unwrap_or("")
+                        .to_string();
+                    creating.set(false);
+                    show.set(false);
+                    if !session_id.is_empty() {
+                        navigator().push(Route::PentestSessionPage {
+                            session_id: session_id.clone(),
+                        });
+                    }
+                }
+                Err(_) => {
+                    creating.set(false);
+                }
+            }
+        });
+    };
+
+    // Build filtered target list for dropdown
+    let target_options: Vec<(String, String)> = {
+        let t = existing_targets.read();
+        match &*t {
+            Some(Some(data)) => data
+                .data
+                .iter()
+                .filter_map(|t| {
+                    let url = t.get("base_url").and_then(|v| v.as_str())?.to_string();
+                    let name = t
+                        .get("name")
+                        .and_then(|v| v.as_str())
+                        .unwrap_or(&url)
+                        .to_string();
+                    Some((url, name))
+                })
+                .collect(),
+            _ => Vec::new(),
+        }
+    };
+
+    // Build filtered repo list for dropdown
+    let repo_options: Vec<(String, String)> = {
+        let r = existing_repos.read();
+        match &*r {
+            Some(Some(data)) => data
+                .data
+                .iter()
+                .map(|r| (r.git_url.clone(), r.name.clone()))
+                .collect(),
+            _ => Vec::new(),
+        }
+    };
+
+    // Filter targets based on current input
+    let app_url_val = app_url.read().clone();
+    let filtered_targets: Vec<(String, String)> = if app_url_val.is_empty() {
+        target_options.clone()
+    } else {
+        let lower = app_url_val.to_lowercase();
+        target_options
+            .iter()
+            .filter(|(url, name)| {
+                url.to_lowercase().contains(&lower) || name.to_lowercase().contains(&lower)
+            })
+            .cloned()
+            .collect()
+    };
+
+    // Filter repos based on current input
+    let git_url_val = git_repo_url.read().clone();
+    let filtered_repos: Vec<(String, String)> = if git_url_val.is_empty() {
+        repo_options.clone()
+    } else {
+        let lower = git_url_val.to_lowercase();
+        repo_options
+            .iter()
+            .filter(|(url, name)| {
+                url.to_lowercase().contains(&lower) || name.to_lowercase().contains(&lower)
+            })
+            .cloned()
+            .collect()
+    };
+
+    let current_step = *step.read();
+    let show_ssh_section = is_ssh_url(&git_repo_url.read());
+
+    rsx! {
+        div {
+            class: "wizard-backdrop",
+            onclick: close,
+            div {
+                class: "wizard-dialog",
+                onclick: move |e| e.stop_propagation(),
+
+                // Close button (always visible)
+                button {
+                    class: "wizard-close-btn",
+                    onclick: close,
+                    Icon { icon: BsXLg, width: 16, height: 16 }
+                }
+
+                // Step indicator
+                div { class: "wizard-steps",
+                    for (i, label) in [(1, "Target"), (2, "Auth"), (3, "Strategy"), (4, "Confirm")].iter() {
+                        {
+                            let step_class = if current_step == *i {
+                                "wizard-step active"
+                            } else if current_step > *i {
+                                "wizard-step completed"
+                            } else {
+                                "wizard-step"
+                            };
+                            rsx! {
+                                div { class: "{step_class}",
+                                    div { class: "wizard-step-dot", "{i}" }
+                                    span { class: "wizard-step-label", "{label}" }
+                                }
+                            }
+                        }
+                    }
+                }
+
+                // Body
+                div { class: "wizard-body",
+                    match current_step {
+                        1 => rsx! {
+                            h3 { style: "margin: 0 0 16px 0;", "Target & Scope" }
+
+                            // App URL with dropdown
+                            div { class: "wizard-field", style: "position: relative;",
+                                label { "App URL " span { style: "color: #dc2626;", "*" } }
+                                input {
+                                    class: "chat-input",
+                                    r#type: "url",
+                                    placeholder: "https://example.com",
+                                    value: "{app_url}",
+                                    oninput: move |e| {
+                                        app_url.set(e.value());
+                                        show_target_dropdown.set(true);
+                                    },
+                                    onfocus: move |_| show_target_dropdown.set(true),
+                                }
+                                // Dropdown of existing targets
+                                if *show_target_dropdown.read() && !filtered_targets.is_empty() {
+                                    div { class: "wizard-dropdown",
+                                        for (url, name) in filtered_targets.iter() {
+                                            {
+                                                let url_clone = url.clone();
+                                                let display_name = name.clone();
+                                                let display_url = url.clone();
+                                                rsx! {
+                                                    div {
+                                                        class: "wizard-dropdown-item",
+                                                        onclick: move |_| {
+                                                            app_url.set(url_clone.clone());
+                                                            show_target_dropdown.set(false);
+                                                        },
+                                                        div { style: "font-weight: 500;", "{display_name}" }
+                                                        div { style: "font-size: 0.75rem; color: var(--text-secondary); font-family: monospace;", "{display_url}" }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+
+                            // Git Repo URL with dropdown
+                            div { class: "wizard-field", style: "position: relative;",
+                                label { "Git Repository URL" }
+                                div { style: "display: flex; gap: 8px;",
+                                    div { style: "flex: 1; position: relative;",
+                                        input {
+                                            class: "chat-input",
+                                            style: "width: 100%;",
+                                            placeholder: "https://github.com/org/repo.git",
+                                            value: "{git_repo_url}",
+                                            oninput: move |e| {
+                                                git_repo_url.set(e.value());
+                                                repo_looked_up.set(false);
+                                                show_repo_dropdown.set(true);
+                                                // Fetch SSH key if it looks like an SSH URL
+                                                if is_ssh_url(&e.value()) && !*ssh_key_loaded.read() {
+                                                    spawn(async move {
+                                                        match fetch_ssh_public_key().await {
+                                                            Ok(key) => {
+                                                                ssh_public_key.set(key);
+                                                                ssh_key_loaded.set(true);
+                                                            }
+                                                            Err(_) => {
+                                                                ssh_public_key.set("(not available)".to_string());
+                                                                ssh_key_loaded.set(true);
+                                                            }
+                                                        }
+                                                    });
+                                                }
+                                            },
+                                            onfocus: move |_| show_repo_dropdown.set(true),
+                                        }
+                                        // Dropdown of existing repos
+                                        if *show_repo_dropdown.read() && !filtered_repos.is_empty() {
+                                            div { class: "wizard-dropdown",
+                                                for (url, name) in filtered_repos.iter() {
+                                                    {
+                                                        let url_clone = url.clone();
+                                                        let display_name = name.clone();
+                                                        let display_url = url.clone();
+                                                        let is_ssh = is_ssh_url(&url_clone);
+                                                        rsx! {
+                                                            div {
+                                                                class: "wizard-dropdown-item",
+                                                                onclick: move |_| {
+                                                                    git_repo_url.set(url_clone.clone());
+                                                                    show_repo_dropdown.set(false);
+                                                                    repo_looked_up.set(false);
+                                                                    // Auto-fetch SSH key if SSH URL selected
+                                                                    if is_ssh && !*ssh_key_loaded.read() {
+                                                                        spawn(async move {
+                                                                            match fetch_ssh_public_key().await {
+                                                                                Ok(key) => {
+                                                                                    ssh_public_key.set(key);
+                                                                                    ssh_key_loaded.set(true);
+                                                                                }
+                                                                                Err(_) => {
+                                                                                    ssh_public_key.set("(not available)".to_string());
+                                                                                    ssh_key_loaded.set(true);
+                                                                                }
+                                                                            }
+                                                                        });
+                                                                    }
+                                                                },
+                                                                div { style: "font-weight: 500;", "{display_name}" }
+                                                                div { style: "font-size: 0.75rem; color: var(--text-secondary); font-family: monospace;", "{display_url}" }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                    button {
+                                        class: "btn btn-ghost btn-sm",
+                                        disabled: git_repo_url.read().is_empty(),
+                                        onclick: move |_| {
+                                            let url = git_repo_url.read().clone();
+                                            spawn(async move {
+                                                if let Ok(resp) = lookup_repo_by_url(url).await {
+                                                    if let Some(name) = resp.get("name").and_then(|v| v.as_str()) {
+                                                        repo_name.set(name.to_string());
+                                                        if let Some(b) = resp.get("default_branch").and_then(|v| v.as_str()) {
+                                                            branch.set(b.to_string());
+                                                        }
+                                                        if let Some(c) = resp.get("last_scanned_commit").and_then(|v| v.as_str()) {
+                                                            commit_hash.set(c.to_string());
+                                                        }
+                                                    }
+                                                    repo_looked_up.set(true);
+                                                }
+                                            });
+                                        },
+                                        "Lookup"
+                                    }
+                                }
+                                if *repo_looked_up.read() && !repo_name.read().is_empty() {
+                                    div { style: "font-size: 0.8rem; color: var(--accent); margin-top: 4px;",
+                                        Icon { icon: BsCheckCircle, width: 12, height: 12 }
+                                        " Found: {repo_name}"
+                                    }
+                                }
+                            }
+
+                            // SSH deploy key section (shown for SSH URLs)
+                            if show_ssh_section {
+                                div { class: "wizard-ssh-key",
+                                    div { style: "display: flex; align-items: center; gap: 6px; margin-bottom: 6px;",
+                                        Icon { icon: BsKeyFill, width: 14, height: 14 }
+                                        span { style: "font-size: 0.8rem; font-weight: 600;", "SSH Deploy Key" }
+                                    }
+                                    p { style: "font-size: 0.75rem; color: var(--text-secondary); margin: 0 0 6px 0;",
+                                        "Add this read-only deploy key to your repository settings:"
+                                    }
+                                    div { class: "wizard-ssh-key-box",
+                                        if ssh_public_key.read().is_empty() {
+                                            "Loading..."
+                                        } else {
+                                            "{ssh_public_key}"
+                                        }
+                                    }
+                                }
+                            }
+
+                            div { style: "display: grid; grid-template-columns: 1fr 1fr; gap: 12px;",
+                                div { class: "wizard-field",
+                                    label { "Branch" }
+                                    input {
+                                        class: "chat-input",
+                                        placeholder: "main",
+                                        value: "{branch}",
+                                        oninput: move |e| branch.set(e.value()),
+                                    }
+                                }
+                                div { class: "wizard-field",
+                                    label { "Commit" }
+                                    input {
+                                        class: "chat-input",
+                                        placeholder: "HEAD",
+                                        value: "{commit_hash}",
+                                        oninput: move |e| commit_hash.set(e.value()),
+                                    }
+                                }
+                            }
+
+                            div { style: "display: grid; grid-template-columns: 1fr 1fr; gap: 12px;",
+                                div { class: "wizard-field",
+                                    label { "App Type" }
+                                    select {
+                                        class: "chat-input",
+                                        value: "{app_type}",
+                                        onchange: move |e| app_type.set(e.value()),
+                                        option { value: "web_app", "Web Application" }
+                                        option { value: "api", "API" }
+                                        option { value: "spa", "Single-Page App" }
+                                        option { value: "mobile_backend", "Mobile Backend" }
+                                    }
+                                }
+                                div { class: "wizard-field",
+                                    label { "Rate Limit (req/s)" }
+                                    input {
+                                        class: "chat-input",
+                                        r#type: "number",
+                                        value: "{rate_limit}",
+                                        oninput: move |e| rate_limit.set(e.value()),
+                                    }
+                                }
+                            }
+                        },
+                        2 => rsx! {
+                            h3 { style: "margin: 0 0 16px 0;", "Authentication" }
+
+                            div { class: "wizard-field",
+                                label { style: "display: flex; align-items: center; gap: 8px;",
+                                    "Requires authentication?"
+                                    div {
+                                        class: if *requires_auth.read() { "wizard-toggle active" } else { "wizard-toggle" },
+                                        onclick: move |_| { let v = *requires_auth.read(); requires_auth.set(!v); },
+                                        div { class: "wizard-toggle-knob" }
+                                    }
+                                }
+                            }
+
+                            if *requires_auth.read() {
+                                div { class: "wizard-field",
+                                    div { style: "display: flex; gap: 12px; margin-bottom: 12px;",
+                                        label { style: "display: flex; align-items: center; gap: 4px; cursor: pointer;",
+                                            input {
+                                                r#type: "radio",
+                                                name: "auth_mode",
+                                                value: "manual",
+                                                checked: auth_mode.read().as_str() == "manual",
+                                                onchange: move |_| auth_mode.set("manual".to_string()),
+                                            }
+                                            "Manual Credentials"
+                                        }
+                                        label { style: "display: flex; align-items: center; gap: 4px; cursor: pointer;",
+                                            input {
+                                                r#type: "radio",
+                                                name: "auth_mode",
+                                                value: "auto_register",
+                                                checked: auth_mode.read().as_str() == "auto_register",
+                                                onchange: move |_| auth_mode.set("auto_register".to_string()),
+                                            }
+                                            "Auto-Register"
+                                        }
+                                    }
+                                }
+
+                                if auth_mode.read().as_str() == "manual" {
+                                    div { style: "display: grid; grid-template-columns: 1fr 1fr; gap: 12px;",
+                                        div { class: "wizard-field",
+                                            label { "Username" }
+                                            input {
+                                                class: "chat-input",
+                                                value: "{auth_username}",
+                                                oninput: move |e| auth_username.set(e.value()),
+                                            }
+                                        }
+                                        div { class: "wizard-field",
+                                            label { "Password" }
+                                            input {
+                                                class: "chat-input",
+                                                r#type: "password",
+                                                value: "{auth_password}",
+                                                oninput: move |e| auth_password.set(e.value()),
+                                            }
+                                        }
+                                    }
+                                }
+
+                                if auth_mode.read().as_str() == "auto_register" {
+                                    div { class: "wizard-field",
+                                        label { "Registration URL"
+                                            span { style: "font-weight: 400; color: var(--text-tertiary); font-size: 0.75rem; margin-left: 6px;", "(optional)" }
+                                        }
+                                        input {
+                                            class: "chat-input",
+                                            placeholder: "https://example.com/register",
+                                            value: "{registration_url}",
+                                            oninput: move |e| registration_url.set(e.value()),
+                                        }
+                                        div { style: "font-size: 0.75rem; color: var(--text-tertiary); margin-top: 3px;",
+                                            "If omitted, the orchestrator will use Playwright to discover the registration page automatically."
+                                        }
+                                    }
+
+                                    // Verification email (plus-addressing) — optional override
+                                    div { class: "wizard-field",
+                                        label { "Verification Email"
+                                            span { style: "font-weight: 400; color: var(--text-tertiary); font-size: 0.75rem; margin-left: 6px;", "(optional override)" }
+                                        }
+                                        input {
+                                            class: "chat-input",
+                                            placeholder: "pentest@scanner.example.com",
+                                            value: "{verification_email}",
+                                            oninput: move |e| verification_email.set(e.value()),
+                                        }
+                                        div { style: "font-size: 0.75rem; color: var(--text-tertiary); margin-top: 3px;",
+                                            "Overrides the agent's default mailbox. Uses plus-addressing: "
+                                            code { style: "font-size: 0.7rem;", "base+sessionid@domain" }
+                                            ". Leave blank to use the server default."
+                                        }
+                                    }
+
+                                    // IMAP settings (collapsible)
+                                    div { class: "wizard-field",
+                                        button {
+                                            class: "btn btn-ghost btn-sm",
+                                            style: "font-size: 0.8rem; padding: 2px 8px;",
+                                            onclick: move |_| { let v = *show_imap_settings.read(); show_imap_settings.set(!v); },
+                                            if *show_imap_settings.read() {
+                                                Icon { icon: BsChevronDown, width: 10, height: 10 }
+                                            } else {
+                                                Icon { icon: BsChevronRight, width: 10, height: 10 }
+                                            }
+                                            " IMAP Settings"
+                                        }
+                                    }
+                                    if *show_imap_settings.read() {
+                                        div { style: "display: grid; grid-template-columns: 2fr 1fr; gap: 12px;",
+                                            div { class: "wizard-field",
+                                                label { "IMAP Host" }
+                                                input {
+                                                    class: "chat-input",
+                                                    placeholder: "imap.example.com",
+                                                    value: "{imap_host}",
+                                                    oninput: move |e| imap_host.set(e.value()),
+                                                }
+                                            }
+                                            div { class: "wizard-field",
+                                                label { "Port" }
+                                                input {
+                                                    class: "chat-input",
+                                                    r#type: "number",
+                                                    value: "{imap_port}",
+                                                    oninput: move |e| imap_port.set(e.value()),
+                                                }
+                                            }
+                                        }
+                                        div { style: "display: grid; grid-template-columns: 1fr 1fr; gap: 12px;",
+                                            div { class: "wizard-field",
+                                                label { "IMAP Username"
+                                                    span { style: "font-weight: 400; color: var(--text-tertiary); font-size: 0.75rem; margin-left: 6px;", "(defaults to email)" }
+                                                }
+                                                input {
+                                                    class: "chat-input",
+                                                    placeholder: "pentest@scanner.example.com",
+                                                    value: "{imap_username}",
+                                                    oninput: move |e| imap_username.set(e.value()),
+                                                }
+                                            }
+                                            div { class: "wizard-field",
+                                                label { "IMAP Password" }
+                                                input {
+                                                    class: "chat-input",
+                                                    r#type: "password",
+                                                    placeholder: "App password",
+                                                    value: "{imap_password}",
+                                                    oninput: move |e| imap_password.set(e.value()),
+                                                }
+                                            }
+                                        }
+                                    }
+
+                                    // Cleanup option
+                                    div { style: "margin-top: 8px;",
+                                        label { style: "display: flex; align-items: center; gap: 6px; font-size: 0.85rem; cursor: pointer;",
+                                            input {
+                                                r#type: "checkbox",
+                                                checked: *cleanup_test_user.read(),
+                                                onchange: move |_| { let v = *cleanup_test_user.read(); cleanup_test_user.set(!v); },
+                                            }
+                                            "Cleanup test user after"
+                                        }
+                                    }
+                                }
+                            }
+
+                            // Custom headers
+                            div { class: "wizard-field", style: "margin-top: 16px;",
+                                label { "Custom HTTP Headers" }
+                                for (idx, _) in custom_headers.read().iter().enumerate() {
+                                    {
+                                        let key = custom_headers.read().get(idx).map(|(k, _)| k.clone()).unwrap_or_default();
+                                        let val = custom_headers.read().get(idx).map(|(_, v)| v.clone()).unwrap_or_default();
+                                        rsx! {
+                                            div { style: "display: flex; gap: 8px; margin-bottom: 4px;",
+                                                input {
+                                                    class: "chat-input",
+                                                    style: "flex: 1;",
+                                                    placeholder: "Header name",
+                                                    value: "{key}",
+                                                    oninput: move |e| {
+                                                        let mut h = custom_headers.write();
+                                                        if let Some(pair) = h.get_mut(idx) {
+                                                            pair.0 = e.value();
+                                                        }
+                                                    },
+                                                }
+                                                input {
+                                                    class: "chat-input",
+                                                    style: "flex: 1;",
+                                                    placeholder: "Value",
+                                                    value: "{val}",
+                                                    oninput: move |e| {
+                                                        let mut h = custom_headers.write();
+                                                        if let Some(pair) = h.get_mut(idx) {
+                                                            pair.1 = e.value();
+                                                        }
+                                                    },
+                                                }
+                                                button {
+                                                    class: "btn btn-ghost btn-sm",
+                                                    style: "color: #dc2626;",
+                                                    onclick: move |_| {
+                                                        custom_headers.write().remove(idx);
+                                                    },
+                                                    Icon { icon: BsXCircle, width: 14, height: 14 }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                                button {
+                                    class: "btn btn-ghost btn-sm",
+                                    onclick: move |_| {
+                                        custom_headers.write().push((String::new(), String::new()));
+                                    },
+                                    Icon { icon: BsPlusCircle, width: 12, height: 12 }
+                                    " Add Header"
+                                }
+                            }
+                        },
+                        3 => rsx! {
+                            h3 { style: "margin: 0 0 16px 0;", "Strategy & Instructions" }
+
+                            div { style: "display: grid; grid-template-columns: 1fr 1fr; gap: 12px;",
+                                div { class: "wizard-field",
+                                    label { "Strategy" }
+                                    select {
+                                        class: "chat-input",
+                                        value: "{strategy}",
+                                        onchange: move |e| strategy.set(e.value()),
+                                        option { value: "comprehensive", "Comprehensive" }
+                                        option { value: "quick", "Quick Scan" }
+                                        option { value: "targeted", "Targeted (SAST-guided)" }
+                                        option { value: "aggressive", "Aggressive" }
+                                        option { value: "stealth", "Stealth" }
+                                    }
+                                }
+                                div { class: "wizard-field",
+                                    label { "Environment" }
+                                    select {
+                                        class: "chat-input",
+                                        value: "{environment}",
+                                        onchange: move |e| environment.set(e.value()),
+                                        option { value: "development", "Development" }
+                                        option { value: "staging", "Staging" }
+                                        option { value: "production", "Production" }
+                                    }
+                                }
+                            }
+
+                            div { class: "wizard-field",
+                                label { style: "display: flex; align-items: center; gap: 8px;",
+                                    input {
+                                        r#type: "checkbox",
+                                        checked: *allow_destructive.read(),
+                                        onchange: move |_| { let v = *allow_destructive.read(); allow_destructive.set(!v); },
+                                    }
+                                    "Allow destructive tests (DELETE, PUT, data modification)"
+                                }
+                            }
+
+                            div { class: "wizard-field",
+                                label { "Initial Instructions" }
+                                textarea {
+                                    class: "chat-input",
+                                    style: "width: 100%; min-height: 80px;",
+                                    placeholder: "Describe focus areas, known issues, or specific test scenarios...",
+                                    value: "{initial_instructions}",
+                                    oninput: move |e| initial_instructions.set(e.value()),
+                                }
+                            }
+
+                            div { class: "wizard-field",
+                                label { "Scope Exclusions (one path per line)" }
+                                textarea {
+                                    class: "chat-input",
+                                    style: "width: 100%; min-height: 60px;",
+                                    placeholder: "/admin\n/health\n/api/v1/internal",
+                                    value: "{scope_exclusions}",
+                                    oninput: move |e| scope_exclusions.set(e.value()),
+                                }
+                            }
+
+                            div { style: "display: grid; grid-template-columns: 1fr 1fr 1fr; gap: 12px;",
+                                div { class: "wizard-field",
+                                    label { "Max Duration (min)" }
+                                    input {
+                                        class: "chat-input",
+                                        r#type: "number",
+                                        value: "{max_duration}",
+                                        oninput: move |e| max_duration.set(e.value()),
+                                    }
+                                }
+                                div { class: "wizard-field",
+                                    label { "Tester Name" }
+                                    input {
+                                        class: "chat-input",
+                                        value: "{tester_name}",
+                                        oninput: move |e| tester_name.set(e.value()),
+                                    }
+                                }
+                                div { class: "wizard-field",
+                                    label { "Tester Email" }
+                                    input {
+                                        class: "chat-input",
+                                        r#type: "email",
+                                        value: "{tester_email}",
+                                        oninput: move |e| tester_email.set(e.value()),
+                                    }
+                                }
+                            }
+                        },
+                        4 => rsx! {
+                            h3 { style: "margin: 0 0 16px 0;", "Review & Confirm" }
+
+                            // Summary
+                            div { class: "wizard-summary",
+                                dl {
+                                    dt { "Target URL" }
+                                    dd { code { "{app_url}" } }
+
+                                    if !git_repo_url.read().is_empty() {
+                                        dt { "Git Repository" }
+                                        dd { "{git_repo_url}" }
+                                    }
+
+                                    dt { "Strategy" }
+                                    dd { "{strategy}" }
+
+                                    dt { "Environment" }
+                                    dd { "{environment}" }
+
+                                    dt { "Auth Mode" }
+                                    dd { if *requires_auth.read() { "{auth_mode}" } else { "None" } }
+
+                                    dt { "Max Duration" }
+                                    dd { "{max_duration} minutes" }
+
+                                    if *allow_destructive.read() {
+                                        dt { "Destructive Tests" }
+                                        dd { "Allowed" }
+                                    }
+
+                                    if !tester_name.read().is_empty() {
+                                        dt { "Tester" }
+                                        dd { "{tester_name} ({tester_email})" }
+                                    }
+                                }
+                            }
+
+                            // Disclaimer
+                            div { class: "wizard-disclaimer",
+                                Icon { icon: BsExclamationTriangle, width: 16, height: 16 }
+                                p { style: "margin: 8px 0;", "{DISCLAIMER_TEXT}" }
+                                label { style: "display: flex; align-items: center; gap: 8px; cursor: pointer; font-weight: 600;",
+                                    input {
+                                        r#type: "checkbox",
+                                        checked: *disclaimer_accepted.read(),
+                                        onchange: move |_| { let v = *disclaimer_accepted.read(); disclaimer_accepted.set(!v); },
+                                    }
+                                    "I accept this disclaimer"
+                                }
+                            }
+                        },
+                        _ => rsx! {},
+                    }
+                }
+
+                // Footer
+                div { class: "wizard-footer",
+                    // Left side: skip button
+                    div {
+                        if current_step == 1 && can_skip {
+                            button {
+                                class: "btn btn-ghost btn-sm",
+                                onclick: on_skip_to_blackbox,
+                                Icon { icon: BsLightning, width: 12, height: 12 }
+                                " Skip to Black Box"
+                            }
+                        }
+                    }
+                    // Right side: navigation
+                    div { style: "display: flex; gap: 8px;",
+                        if current_step == 1 {
+                            button {
+                                class: "btn btn-ghost",
+                                onclick: close,
+                                "Cancel"
+                            }
+                        } else {
+                            button {
+                                class: "btn btn-ghost",
+                                onclick: move |_| step.set(current_step - 1),
+                                "Back"
+                            }
+                        }
+                        if current_step < 4 {
+                            button {
+                                class: "btn btn-primary",
+                                disabled: current_step == 1 && app_url.read().is_empty(),
+                                onclick: move |_| step.set(current_step + 1),
+                                "Next"
+                            }
+                        }
+                        if current_step == 4 {
+                            button {
+                                class: "btn btn-primary",
+                                disabled: !*disclaimer_accepted.read() || *creating.read(),
+                                onclick: on_submit,
+                                if *creating.read() { "Starting..." } else { "Start Pentest" }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

compliance-dashboard/src/infrastructure/pentest.rs

@@ -206,6 +206,65 @@ pub async fn create_pentest_session(
     Ok(body)
 }
 
+/// Create a pentest session using the wizard configuration
+#[server]
+pub async fn create_pentest_session_wizard(
+    config_json: String,
+) -> Result<PentestSessionResponse, ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!("{}/api/v1/pentest/sessions", state.agent_api_url);
+    let config: serde_json::Value =
+        serde_json::from_str(&config_json).map_err(|e| ServerFnError::new(e.to_string()))?;
+    let client = reqwest::Client::new();
+    let resp = client
+        .post(&url)
+        .json(&serde_json::json!({ "config": config }))
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let text = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!(
+            "Failed to create session: {text}"
+        )));
+    }
+    let body: PentestSessionResponse = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body)
+}
+
+/// Look up a tracked repository by its git URL
+#[server]
+pub async fn lookup_repo_by_url(url: String) -> Result<serde_json::Value, ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let encoded_url: String = url
+        .bytes()
+        .flat_map(|b| {
+            if b.is_ascii_alphanumeric() || b == b'-' || b == b'_' || b == b'.' || b == b'~' {
+                vec![b as char]
+            } else {
+                format!("%{:02X}", b).chars().collect()
+            }
+        })
+        .collect();
+    let api_url = format!(
+        "{}/api/v1/pentest/lookup-repo?url={}",
+        state.agent_api_url, encoded_url
+    );
+    let resp = reqwest::get(&api_url)
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let body: serde_json::Value = resp
+        .json()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    Ok(body.get("data").cloned().unwrap_or(serde_json::Value::Null))
+}
+
 #[server]
 pub async fn send_pentest_message(
     session_id: String,
@@ -250,6 +309,48 @@ pub async fn stop_pentest_session(session_id: String) -> Result<(), ServerFnErro
     Ok(())
 }
 
+#[server]
+pub async fn pause_pentest_session(session_id: String) -> Result<(), ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!(
+        "{}/api/v1/pentest/sessions/{session_id}/pause",
+        state.agent_api_url
+    );
+    let client = reqwest::Client::new();
+    let resp = client
+        .post(&url)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let text = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!("Pause failed: {text}")));
+    }
+    Ok(())
+}
+
+#[server]
+pub async fn resume_pentest_session(session_id: String) -> Result<(), ServerFnError> {
+    let state: super::server_state::ServerState =
+        dioxus_fullstack::FullstackContext::extract().await?;
+    let url = format!(
+        "{}/api/v1/pentest/sessions/{session_id}/resume",
+        state.agent_api_url
+    );
+    let client = reqwest::Client::new();
+    let resp = client
+        .post(&url)
+        .send()
+        .await
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    if !resp.status().is_success() {
+        let text = resp.text().await.unwrap_or_default();
+        return Err(ServerFnError::new(format!("Resume failed: {text}")));
+    }
+    Ok(())
+}
+
 #[server]
 pub async fn fetch_pentest_findings(
     session_id: String,

compliance-dashboard/src/pages/pentest_dashboard.rs

@@ -4,59 +4,18 @@ use dioxus_free_icons::Icon;
 
 use crate::app::Route;
 use crate::components::page_header::PageHeader;
-use crate::infrastructure::dast::fetch_dast_targets;
+use crate::components::pentest_wizard::PentestWizard;
 use crate::infrastructure::pentest::{
-    create_pentest_session, fetch_pentest_sessions, fetch_pentest_stats, stop_pentest_session,
+    fetch_pentest_sessions, fetch_pentest_stats, pause_pentest_session, resume_pentest_session,
+    stop_pentest_session,
 };
 
 #[component]
 pub fn PentestDashboardPage() -> Element {
     let mut sessions = use_resource(|| async { fetch_pentest_sessions().await.ok() });
     let stats = use_resource(|| async { fetch_pentest_stats().await.ok() });
-    let targets = use_resource(|| async { fetch_dast_targets().await.ok() });
 
-    let mut show_modal = use_signal(|| false);
-    let mut new_target_id = use_signal(String::new);
-    let mut new_strategy = use_signal(|| "comprehensive".to_string());
-    let mut new_message = use_signal(String::new);
-    let mut creating = use_signal(|| false);
-
-    let on_create = move |_| {
-        let tid = new_target_id.read().clone();
-        let strat = new_strategy.read().clone();
-        let msg = new_message.read().clone();
-        if tid.is_empty() || msg.is_empty() {
-            return;
-        }
-        creating.set(true);
-        spawn(async move {
-            match create_pentest_session(tid, strat, msg).await {
-                Ok(resp) => {
-                    let session_id = resp
-                        .data
-                        .get("_id")
-                        .and_then(|v| v.get("$oid"))
-                        .and_then(|v| v.as_str())
-                        .unwrap_or("")
-                        .to_string();
-                    creating.set(false);
-                    show_modal.set(false);
-                    new_target_id.set(String::new());
-                    new_message.set(String::new());
-                    if !session_id.is_empty() {
-                        navigator().push(Route::PentestSessionPage {
-                            session_id: session_id.clone(),
-                        });
-                    } else {
-                        sessions.restart();
-                    }
-                }
-                Err(_) => {
-                    creating.set(false);
-                }
-            }
-        });
-    };
+    let mut show_wizard = use_signal(|| false);
 
     // Extract stats values
     let running_sessions = {
@@ -193,7 +152,7 @@ pub fn PentestDashboardPage() -> Element {
         div { style: "display: flex; gap: 12px; margin-bottom: 24px;",
             button {
                 class: "btn btn-primary",
-                onclick: move |_| show_modal.set(true),
+                onclick: move |_| show_wizard.set(true),
                 Icon { icon: BsPlusCircle, width: 14, height: 14 }
                 " New Pentest"
             }
@@ -235,7 +194,10 @@ pub fn PentestDashboardPage() -> Element {
                                         };
                                         {
                                             let is_session_running = status == "running";
+                                            let is_session_paused = status == "paused";
                                             let stop_id = id.clone();
+                                            let pause_id = id.clone();
+                                            let resume_id = id.clone();
                                             rsx! {
                                                 div { class: "card", style: "padding: 16px; transition: border-color 0.15s;",
                                                     Link {
@@ -272,8 +234,42 @@ pub fn PentestDashboardPage() -> Element {
                                                             }
                                                         }
                                                     }
-                                                    if is_session_running {
-                                                        div { style: "margin-top: 8px; display: flex; justify-content: flex-end;",
+                                                    if is_session_running || is_session_paused {
+                                                        div { style: "margin-top: 8px; display: flex; justify-content: flex-end; gap: 6px;",
+                                                            if is_session_running {
+                                                                button {
+                                                                    class: "btn btn-ghost",
+                                                                    style: "font-size: 0.8rem; padding: 4px 12px; color: #d97706; border-color: #d97706;",
+                                                                    onclick: move |e| {
+                                                                        e.stop_propagation();
+                                                                        e.prevent_default();
+                                                                        let sid = pause_id.clone();
+                                                                        spawn(async move {
+                                                                            let _ = pause_pentest_session(sid).await;
+                                                                            sessions.restart();
+                                                                        });
+                                                                    },
+                                                                    Icon { icon: BsPauseCircle, width: 12, height: 12 }
+                                                                    " Pause"
+                                                                }
+                                                            }
+                                                            if is_session_paused {
+                                                                button {
+                                                                    class: "btn btn-ghost",
+                                                                    style: "font-size: 0.8rem; padding: 4px 12px; color: #16a34a; border-color: #16a34a;",
+                                                                    onclick: move |e| {
+                                                                        e.stop_propagation();
+                                                                        e.prevent_default();
+                                                                        let sid = resume_id.clone();
+                                                                        spawn(async move {
+                                                                            let _ = resume_pentest_session(sid).await;
+                                                                            sessions.restart();
+                                                                        });
+                                                                    },
+                                                                    Icon { icon: BsPlayCircle, width: 12, height: 12 }
+                                                                    " Resume"
+                                                                }
+                                                            }
                                                             button {
                                                                 class: "btn btn-ghost",
                                                                 style: "font-size: 0.8rem; padding: 4px 12px; color: #dc2626; border-color: #dc2626;",
@@ -305,97 +301,9 @@ pub fn PentestDashboardPage() -> Element {
             }
         }
 
-        // New Pentest Modal
-        if *show_modal.read() {
-            div {
-                style: "position: fixed; inset: 0; background: rgba(0,0,0,0.6); display: flex; align-items: center; justify-content: center; z-index: 1000;",
-                onclick: move |_| show_modal.set(false),
-                div {
-                    style: "background: var(--bg-secondary); border: 1px solid var(--border-color); border-radius: 12px; padding: 24px; width: 480px; max-width: 90vw;",
-                    onclick: move |e| e.stop_propagation(),
-                    h3 { style: "margin: 0 0 16px 0;", "New Pentest Session" }
-
-                    // Target selection
-                    div { style: "margin-bottom: 12px;",
-                        label { style: "display: block; font-size: 0.85rem; color: var(--text-secondary); margin-bottom: 4px;",
-                            "Target"
-                        }
-                        select {
-                            class: "chat-input",
-                            style: "width: 100%; padding: 8px; resize: none; height: auto;",
-                            value: "{new_target_id}",
-                            onchange: move |e| new_target_id.set(e.value()),
-                            option { value: "", "Select a target..." }
-                            match &*targets.read() {
-                                Some(Some(data)) => {
-                                    rsx! {
-                                        for target in &data.data {
-                                            {
-                                                let tid = target.get("_id")
-                                                    .and_then(|v| v.get("$oid"))
-                                                    .and_then(|v| v.as_str())
-                                                    .unwrap_or("").to_string();
-                                                let tname = target.get("name").and_then(|v| v.as_str()).unwrap_or("Unknown").to_string();
-                                                let turl = target.get("base_url").and_then(|v| v.as_str()).unwrap_or("").to_string();
-                                                rsx! {
-                                                    option { value: "{tid}", "{tname} ({turl})" }
-                                                }
-                                            }
-                                        }
-                                    }
-                                },
-                                _ => rsx! {},
-                            }
-                        }
-                    }
-
-                    // Strategy selection
-                    div { style: "margin-bottom: 12px;",
-                        label { style: "display: block; font-size: 0.85rem; color: var(--text-secondary); margin-bottom: 4px;",
-                            "Strategy"
-                        }
-                        select {
-                            class: "chat-input",
-                            style: "width: 100%; padding: 8px; resize: none; height: auto;",
-                            value: "{new_strategy}",
-                            onchange: move |e| new_strategy.set(e.value()),
-                            option { value: "comprehensive", "Comprehensive" }
-                            option { value: "quick", "Quick Scan" }
-                            option { value: "owasp_top_10", "OWASP Top 10" }
-                            option { value: "api_focused", "API Focused" }
-                            option { value: "authentication", "Authentication" }
-                        }
-                    }
-
-                    // Initial message
-                    div { style: "margin-bottom: 16px;",
-                        label { style: "display: block; font-size: 0.85rem; color: var(--text-secondary); margin-bottom: 4px;",
-                            "Initial Instructions"
-                        }
-                        textarea {
-                            class: "chat-input",
-                            style: "width: 100%; min-height: 80px;",
-                            placeholder: "Describe the scope and goals of this pentest...",
-                            value: "{new_message}",
-                            oninput: move |e| new_message.set(e.value()),
-                        }
-                    }
-
-                    div { style: "display: flex; justify-content: flex-end; gap: 8px;",
-                        button {
-                            class: "btn btn-ghost",
-                            onclick: move |_| show_modal.set(false),
-                            "Cancel"
-                        }
-                        button {
-                            class: "btn btn-primary",
-                            disabled: *creating.read() || new_target_id.read().is_empty() || new_message.read().is_empty(),
-                            onclick: on_create,
-                            if *creating.read() { "Creating..." } else { "Start Pentest" }
-                        }
-                    }
-                }
-            }
+        // Pentest Wizard
+        if *show_wizard.read() {
+            PentestWizard { show: show_wizard }
         }
     }
 }

compliance-dashboard/src/pages/pentest_session.rs

@@ -7,6 +7,7 @@ use crate::components::attack_chain::AttackChainView;
 use crate::components::severity_badge::SeverityBadge;
 use crate::infrastructure::pentest::{
     export_pentest_report, fetch_attack_chain, fetch_pentest_findings, fetch_pentest_session,
+    pause_pentest_session, resume_pentest_session,
 };
 
 #[component]
@@ -87,11 +88,13 @@ pub fn PentestSessionPage(session_id: String) -> Element {
     };
 
     let is_running = session_status == "running";
+    let is_paused = session_status == "paused";
+    let is_active = is_running || is_paused;
 
-    // Poll while running
+    // Poll while running or paused
     use_effect(move || {
         let _gen = *poll_gen.read();
-        if is_running {
+        if is_active {
             spawn(async move {
                 #[cfg(feature = "web")]
                 gloo_timers::future::TimeoutFuture::new(3_000).await;
@@ -226,9 +229,55 @@ pub fn PentestSessionPage(session_id: String) -> Element {
                             " Running..."
                         }
                     }
+                    if is_paused {
+                        span { style: "font-size: 0.8rem; color: #d97706;",
+                            Icon { icon: BsPauseCircle, width: 12, height: 12 }
+                            " Paused"
+                        }
+                    }
                 }
             }
             div { style: "display: flex; gap: 8px;",
+                if is_running {
+                    {
+                        let sid_pause = session_id.clone();
+                        rsx! {
+                            button {
+                                class: "btn btn-ghost",
+                                style: "font-size: 0.85rem; color: #d97706; border-color: #d97706;",
+                                onclick: move |_| {
+                                    let sid = sid_pause.clone();
+                                    spawn(async move {
+                                        let _ = pause_pentest_session(sid).await;
+                                        session.restart();
+                                    });
+                                },
+                                Icon { icon: BsPauseCircle, width: 14, height: 14 }
+                                " Pause"
+                            }
+                        }
+                    }
+                }
+                if is_paused {
+                    {
+                        let sid_resume = session_id.clone();
+                        rsx! {
+                            button {
+                                class: "btn btn-ghost",
+                                style: "font-size: 0.85rem; color: #16a34a; border-color: #16a34a;",
+                                onclick: move |_| {
+                                    let sid = sid_resume.clone();
+                                    spawn(async move {
+                                        let _ = resume_pentest_session(sid).await;
+                                        session.restart();
+                                    });
+                                },
+                                Icon { icon: BsPlayCircle, width: 14, height: 14 }
+                                " Resume"
+                            }
+                        }
+                    }
+                }
                 button {
                     class: "btn btn-primary",
                     style: "font-size: 0.85rem;",

compliance-dast/Cargo.toml

@@ -31,6 +31,11 @@ bollard = "0.18"
 native-tls = "0.2"
 tokio-native-tls = "0.3"
 
+# CDP WebSocket (browser tool)
+tokio-tungstenite = { version = "0.26", features = ["rustls-tls-webpki-roots"] }
+futures-util = "0.3"
+base64 = "0.22"
+
 # Serialization
 bson = { version = "2", features = ["chrono-0_4"] }
 url = "2"

compliance-dast/src/tools/browser.rs

@@ -0,0 +1,650 @@
+use std::collections::HashMap;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::Duration;
+
+use base64::Engine;
+use compliance_core::error::CoreError;
+use compliance_core::traits::pentest_tool::{PentestTool, PentestToolContext, PentestToolResult};
+use futures_util::{SinkExt, StreamExt};
+use serde_json::json;
+use tokio::sync::Mutex;
+use tokio_tungstenite::tungstenite::Message;
+use tracing::info;
+
+type WsStream =
+    tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>;
+
+/// Global pool of persistent browser sessions keyed by pentest session ID.
+/// Each pentest session gets one Chrome tab that stays alive across tool calls.
+static BROWSER_SESSIONS: std::sync::LazyLock<Arc<Mutex<HashMap<String, BrowserSession>>>> =
+    std::sync::LazyLock::new(|| Arc::new(Mutex::new(HashMap::new())));
+
+/// A browser automation tool that exposes headless Chrome actions to the LLM
+/// via the Chrome DevTools Protocol.
+///
+/// **Session-persistent**: the same Chrome tab is reused across all invocations
+/// within a pentest session, so cookies, auth state, and page context are
+/// preserved between navigate → click → fill → screenshot calls.
+///
+/// Supported actions: navigate, screenshot, click, fill, get_content, evaluate, close.
+pub struct BrowserTool;
+
+impl Default for BrowserTool {
+    fn default() -> Self {
+        Self
+    }
+}
+
+impl PentestTool for BrowserTool {
+    fn name(&self) -> &str {
+        "browser"
+    }
+
+    fn description(&self) -> &str {
+        "Headless browser automation via Chrome DevTools Protocol. The browser tab persists \
+         across calls within the same pentest session — cookies, login state, and page context \
+         are preserved. Supports navigating to URLs, taking screenshots, clicking elements, \
+         filling form fields, reading page content, and evaluating JavaScript. \
+         Use CSS selectors to target elements. After navigating, use get_content to read the \
+         page HTML and find elements to click or fill. Use this to discover registration pages, \
+         fill out signup forms, complete email verification, and test authenticated flows."
+    }
+
+    fn input_schema(&self) -> serde_json::Value {
+        json!({
+            "type": "object",
+            "properties": {
+                "action": {
+                    "type": "string",
+                    "enum": ["navigate", "screenshot", "click", "fill", "get_content", "evaluate", "close"],
+                    "description": "Action to perform. The browser tab persists between calls — use navigate first, then get_content to see the page, then click/fill to interact."
+                },
+                "url": {
+                    "type": "string",
+                    "description": "URL to navigate to (for 'navigate' action)"
+                },
+                "selector": {
+                    "type": "string",
+                    "description": "CSS selector for click/fill actions (e.g. '#username', 'a[href*=register]', 'button[type=submit]')"
+                },
+                "value": {
+                    "type": "string",
+                    "description": "Text value for 'fill' action, or JS expression for 'evaluate'"
+                },
+                "wait_ms": {
+                    "type": "integer",
+                    "description": "Milliseconds to wait after action (default: 1000)"
+                }
+            },
+            "required": ["action"]
+        })
+    }
+
+    fn execute<'a>(
+        &'a self,
+        input: serde_json::Value,
+        context: &'a PentestToolContext,
+    ) -> Pin<Box<dyn std::future::Future<Output = Result<PentestToolResult, CoreError>> + Send + 'a>>
+    {
+        Box::pin(async move {
+            let action = input.get("action").and_then(|v| v.as_str()).unwrap_or("");
+            let url = input.get("url").and_then(|v| v.as_str()).unwrap_or("");
+            let selector = input.get("selector").and_then(|v| v.as_str()).unwrap_or("");
+            let value = input.get("value").and_then(|v| v.as_str()).unwrap_or("");
+            let wait_ms = input
+                .get("wait_ms")
+                .and_then(|v| v.as_u64())
+                .unwrap_or(1000);
+            let session_key = context.session_id.clone();
+
+            // Handle close action — tear down the persistent session
+            if action == "close" {
+                let mut pool = BROWSER_SESSIONS.lock().await;
+                if let Some(mut sess) = pool.remove(&session_key) {
+                    let _ = sess.close().await;
+                }
+                return Ok(PentestToolResult {
+                    summary: "Browser session closed".to_string(),
+                    findings: Vec::new(),
+                    data: json!({ "closed": true }),
+                });
+            }
+
+            // Get or create persistent session for this pentest
+            let mut pool = BROWSER_SESSIONS.lock().await;
+            if !pool.contains_key(&session_key) {
+                match BrowserSession::connect().await {
+                    Ok(sess) => {
+                        pool.insert(session_key.clone(), sess);
+                    }
+                    Err(e) => {
+                        return Err(CoreError::Other(format!("Browser connect failed: {e}")));
+                    }
+                }
+            }
+
+            let session = pool.get_mut(&session_key);
+            let Some(session) = session else {
+                return Err(CoreError::Other("Browser session not found".to_string()));
+            };
+
+            let result = match action {
+                "navigate" => session.navigate(url, wait_ms).await,
+                "screenshot" => session.screenshot().await,
+                "click" => session.click(selector, wait_ms).await,
+                "fill" => session.fill(selector, value, wait_ms).await,
+                "get_content" => session.get_content().await,
+                "evaluate" => session.evaluate(value).await,
+                _ => Err(format!("Unknown browser action: {action}")),
+            };
+
+            // If the session errored, remove it so the next call creates a fresh one
+            if result.is_err() {
+                if let Some(mut dead) = pool.remove(&session_key) {
+                    let _ = dead.close().await;
+                }
+            }
+
+            // Release the lock before building the response
+            drop(pool);
+
+            match result {
+                Ok(data) => {
+                    let summary = match action {
+                        "navigate" => format!("Navigated to {url}"),
+                        "screenshot" => "Captured page screenshot".to_string(),
+                        "click" => format!("Clicked element: {selector}"),
+                        "fill" => format!("Filled element: {selector}"),
+                        "get_content" => "Retrieved page content".to_string(),
+                        "evaluate" => "Evaluated JavaScript".to_string(),
+                        _ => "Browser action completed".to_string(),
+                    };
+                    info!(action, %summary, "Browser tool executed");
+                    Ok(PentestToolResult {
+                        summary,
+                        findings: Vec::new(),
+                        data,
+                    })
+                }
+                Err(e) => Ok(PentestToolResult {
+                    summary: format!("Browser action '{action}' failed: {e}"),
+                    findings: Vec::new(),
+                    data: json!({ "error": e }),
+                }),
+            }
+        })
+    }
+}
+
+/// A single CDP session wrapping a browser tab.
+struct BrowserSession {
+    ws: WsStream,
+    next_id: u64,
+    session_id: String,
+    target_id: String,
+}
+
+impl BrowserSession {
+    /// Connect to headless Chrome and create a new tab.
+    async fn connect() -> Result<Self, String> {
+        let ws_url = std::env::var("CHROME_WS_URL").map_err(|_| {
+            "CHROME_WS_URL not set — headless Chrome is required for browser actions".to_string()
+        })?;
+
+        // Discover browser WS endpoint
+        let http_url = ws_url
+            .replace("ws://", "http://")
+            .replace("wss://", "https://");
+        let version_url = format!("{http_url}/json/version");
+
+        let version: serde_json::Value = reqwest::get(&version_url)
+            .await
+            .map_err(|e| format!("Cannot reach Chrome at {version_url}: {e}"))?
+            .json()
+            .await
+            .map_err(|e| format!("Invalid /json/version response: {e}"))?;
+
+        let browser_ws = version["webSocketDebuggerUrl"]
+            .as_str()
+            .ok_or_else(|| "No webSocketDebuggerUrl in /json/version".to_string())?;
+
+        let (mut ws, _) = tokio_tungstenite::connect_async(browser_ws)
+            .await
+            .map_err(|e| format!("WebSocket connect failed: {e}"))?;
+
+        let mut next_id: u64 = 1;
+
+        // Create tab
+        let resp = cdp_send(
+            &mut ws,
+            next_id,
+            "Target.createTarget",
+            json!({ "url": "about:blank" }),
+        )
+        .await?;
+        next_id += 1;
+
+        let target_id = resp
+            .get("result")
+            .and_then(|r| r.get("targetId"))
+            .and_then(|t| t.as_str())
+            .ok_or("No targetId in createTarget response")?
+            .to_string();
+
+        // Attach
+        let resp = cdp_send(
+            &mut ws,
+            next_id,
+            "Target.attachToTarget",
+            json!({ "targetId": target_id, "flatten": true }),
+        )
+        .await?;
+        next_id += 1;
+
+        let session_id = resp
+            .get("result")
+            .and_then(|r| r.get("sessionId"))
+            .and_then(|s| s.as_str())
+            .ok_or("No sessionId in attachToTarget response")?
+            .to_string();
+
+        // Enable domains
+        cdp_send_session(&mut ws, next_id, &session_id, "Page.enable", json!({})).await?;
+        next_id += 1;
+
+        cdp_send_session(&mut ws, next_id, &session_id, "Runtime.enable", json!({})).await?;
+        next_id += 1;
+
+        Ok(Self {
+            ws,
+            next_id,
+            session_id,
+            target_id,
+        })
+    }
+
+    async fn navigate(&mut self, url: &str, wait_ms: u64) -> Result<serde_json::Value, String> {
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Page.navigate",
+            json!({ "url": url }),
+        )
+        .await?;
+        self.next_id += 1;
+
+        tokio::time::sleep(Duration::from_millis(wait_ms)).await;
+
+        // Get page title and current URL (may have redirected)
+        let title = self
+            .evaluate_raw("document.title")
+            .await
+            .unwrap_or_default();
+        let page_url = self
+            .evaluate_raw("window.location.href")
+            .await
+            .unwrap_or_default();
+
+        // Auto-get a summary of interactive elements on the page
+        let links_js = r#"(function(){
+            var items = [];
+            document.querySelectorAll('a[href]').forEach(function(a, i) {
+                if (i < 20) items.push({tag:'a', text:a.textContent.trim().substring(0,60), href:a.href});
+            });
+            document.querySelectorAll('input,select,textarea,button[type=submit]').forEach(function(el, i) {
+                if (i < 20) items.push({tag:el.tagName.toLowerCase(), type:el.type||'', name:el.name||'', id:el.id||'', placeholder:el.placeholder||''});
+            });
+            return JSON.stringify(items);
+        })()"#;
+        let elements_json = self.evaluate_raw(links_js).await.unwrap_or_default();
+        let elements: serde_json::Value = serde_json::from_str(&elements_json).unwrap_or(json!([]));
+
+        // Auto-capture screenshot after every navigation
+        let screenshot_b64 = self.capture_screenshot_b64().await.unwrap_or_default();
+
+        Ok(json!({
+            "navigated": true,
+            "url": page_url,
+            "title": title,
+            "elements": elements,
+            "screenshot_base64": screenshot_b64,
+        }))
+    }
+
+    /// Capture a screenshot and return the base64 string (empty on failure).
+    async fn capture_screenshot_b64(&mut self) -> Result<String, String> {
+        let resp = cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Page.captureScreenshot",
+            json!({ "format": "png", "quality": 80 }),
+        )
+        .await?;
+        self.next_id += 1;
+
+        Ok(resp
+            .get("result")
+            .and_then(|r| r.get("data"))
+            .and_then(|d| d.as_str())
+            .unwrap_or("")
+            .to_string())
+    }
+
+    async fn screenshot(&mut self) -> Result<serde_json::Value, String> {
+        let b64 = self.capture_screenshot_b64().await?;
+
+        let size_kb = base64::engine::general_purpose::STANDARD
+            .decode(&b64)
+            .map(|b| b.len() / 1024)
+            .unwrap_or(0);
+
+        Ok(json!({
+            "screenshot_base64": b64,
+            "size_kb": size_kb,
+        }))
+    }
+
+    async fn click(&mut self, selector: &str, wait_ms: u64) -> Result<serde_json::Value, String> {
+        let js = format!(
+            r#"(function() {{
+                var el = document.querySelector({sel});
+                if (!el) return JSON.stringify({{error: "Element not found: {raw}"}});
+                var rect = el.getBoundingClientRect();
+                el.click();
+                return JSON.stringify({{
+                    clicked: true,
+                    tag: el.tagName,
+                    text: el.textContent.substring(0, 100),
+                    x: rect.x + rect.width/2,
+                    y: rect.y + rect.height/2
+                }});
+            }})()"#,
+            sel = serde_json::to_string(selector).unwrap_or_default(),
+            raw = selector.replace('"', r#"\""#),
+        );
+
+        let result = self.evaluate_raw(&js).await?;
+        tokio::time::sleep(Duration::from_millis(wait_ms)).await;
+
+        // After click, get current URL (may have navigated)
+        let current_url = self
+            .evaluate_raw("window.location.href")
+            .await
+            .unwrap_or_default();
+        let title = self
+            .evaluate_raw("document.title")
+            .await
+            .unwrap_or_default();
+
+        // Auto-capture screenshot after click
+        let screenshot_b64 = self.capture_screenshot_b64().await.unwrap_or_default();
+
+        let mut click_result: serde_json::Value =
+            serde_json::from_str(&result).unwrap_or(json!({ "result": result }));
+        if let Some(obj) = click_result.as_object_mut() {
+            obj.insert("current_url".to_string(), json!(current_url));
+            obj.insert("page_title".to_string(), json!(title));
+            if !screenshot_b64.is_empty() {
+                obj.insert("screenshot_base64".to_string(), json!(screenshot_b64));
+            }
+        }
+        Ok(click_result)
+    }
+
+    async fn fill(
+        &mut self,
+        selector: &str,
+        value: &str,
+        wait_ms: u64,
+    ) -> Result<serde_json::Value, String> {
+        // Step 1: Focus the element via JS
+        let focus_js = format!(
+            "(function(){{var e=document.querySelector({sel});\
+             if(!e)return 'notfound';e.focus();e.select();return 'ok'}})()",
+            sel = serde_json::to_string(selector).unwrap_or_default(),
+        );
+        let found = self.evaluate_raw(&focus_js).await?;
+        if found == "notfound" {
+            return Ok(json!({ "error": format!("Element not found: {selector}") }));
+        }
+
+        // Step 2: Clear existing content with Select All + Delete
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Input.dispatchKeyEvent",
+            json!({"type": "keyDown", "key": "a", "code": "KeyA", "modifiers": 2}),
+        )
+        .await?;
+        self.next_id += 1;
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Input.dispatchKeyEvent",
+            json!({"type": "keyUp", "key": "a", "code": "KeyA", "modifiers": 2}),
+        )
+        .await?;
+        self.next_id += 1;
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Input.dispatchKeyEvent",
+            json!({"type": "keyDown", "key": "Backspace", "code": "Backspace"}),
+        )
+        .await?;
+        self.next_id += 1;
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Input.dispatchKeyEvent",
+            json!({"type": "keyUp", "key": "Backspace", "code": "Backspace"}),
+        )
+        .await?;
+        self.next_id += 1;
+
+        // Step 3: Insert the text using Input.insertText (single CDP command, no JS eval)
+        cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Input.insertText",
+            json!({"text": value}),
+        )
+        .await?;
+        self.next_id += 1;
+
+        // Step 4: Verify the value was set
+        let verify_js = format!(
+            "(function(){{var e=document.querySelector({sel});return e?e.value:''}})()",
+            sel = serde_json::to_string(selector).unwrap_or_default(),
+        );
+        let final_value = self.evaluate_raw(&verify_js).await.unwrap_or_default();
+
+        tokio::time::sleep(Duration::from_millis(wait_ms)).await;
+
+        Ok(json!({
+            "filled": true,
+            "selector": selector,
+            "value": final_value,
+        }))
+    }
+
+    async fn get_content(&mut self) -> Result<serde_json::Value, String> {
+        let title = self
+            .evaluate_raw("document.title")
+            .await
+            .unwrap_or_default();
+        let url = self
+            .evaluate_raw("window.location.href")
+            .await
+            .unwrap_or_default();
+
+        // Get a structured summary instead of raw HTML (more useful for LLM)
+        let summary_js = r#"(function(){
+            var result = {forms:[], links:[], inputs:[], buttons:[], headings:[], text:''};
+
+            // Forms
+            document.querySelectorAll('form').forEach(function(f,i){
+                if(i<10) result.forms.push({action:f.action, method:f.method, id:f.id});
+            });
+
+            // Links
+            document.querySelectorAll('a[href]').forEach(function(a,i){
+                if(i<30) result.links.push({text:a.textContent.trim().substring(0,80), href:a.href});
+            });
+
+            // Inputs
+            document.querySelectorAll('input,select,textarea').forEach(function(el,i){
+                if(i<30) result.inputs.push({
+                    tag:el.tagName.toLowerCase(),
+                    type:el.type||'',
+                    name:el.name||'',
+                    id:el.id||'',
+                    placeholder:el.placeholder||'',
+                    value:el.type==='password'?'***':el.value.substring(0,50)
+                });
+            });
+
+            // Buttons
+            document.querySelectorAll('button,[type=submit],[role=button]').forEach(function(b,i){
+                if(i<20) result.buttons.push({text:b.textContent.trim().substring(0,60), type:b.type||'', id:b.id||''});
+            });
+
+            // Headings
+            document.querySelectorAll('h1,h2,h3').forEach(function(h,i){
+                if(i<10) result.headings.push(h.textContent.trim().substring(0,100));
+            });
+
+            // Page text (truncated)
+            result.text = document.body ? document.body.innerText.substring(0, 3000) : '';
+
+            return JSON.stringify(result);
+        })()"#;
+
+        let summary = self.evaluate_raw(summary_js).await.unwrap_or_default();
+        let page_data: serde_json::Value = serde_json::from_str(&summary).unwrap_or(json!({}));
+
+        Ok(json!({
+            "url": url,
+            "title": title,
+            "page": page_data,
+        }))
+    }
+
+    async fn evaluate(&mut self, expression: &str) -> Result<serde_json::Value, String> {
+        let result = self.evaluate_raw(expression).await?;
+        Ok(json!({
+            "result": result,
+        }))
+    }
+
+    /// Execute JS and return the string result.
+    async fn evaluate_raw(&mut self, expression: &str) -> Result<String, String> {
+        let resp = cdp_send_session(
+            &mut self.ws,
+            self.next_id,
+            &self.session_id,
+            "Runtime.evaluate",
+            json!({
+                "expression": expression,
+                "returnByValue": true,
+            }),
+        )
+        .await?;
+        self.next_id += 1;
+
+        let result = resp
+            .get("result")
+            .and_then(|r| r.get("result"))
+            .and_then(|r| r.get("value"));
+
+        match result {
+            Some(serde_json::Value::String(s)) => Ok(s.clone()),
+            Some(v) => Ok(v.to_string()),
+            None => Ok(String::new()),
+        }
+    }
+
+    async fn close(&mut self) -> Result<(), String> {
+        let _ = cdp_send(
+            &mut self.ws,
+            self.next_id,
+            "Target.closeTarget",
+            json!({ "targetId": self.target_id }),
+        )
+        .await;
+        let _ = self.ws.close(None).await;
+        Ok(())
+    }
+}
+
+/// Clean up the browser session for a pentest session (call when session ends).
+pub async fn cleanup_browser_session(session_id: &str) {
+    let mut pool = BROWSER_SESSIONS.lock().await;
+    if let Some(mut sess) = pool.remove(session_id) {
+        let _ = sess.close().await;
+    }
+}
+
+// ── CDP helpers ──
+
+async fn cdp_send(
+    ws: &mut WsStream,
+    id: u64,
+    method: &str,
+    params: serde_json::Value,
+) -> Result<serde_json::Value, String> {
+    let msg = json!({ "id": id, "method": method, "params": params });
+    ws.send(Message::Text(msg.to_string().into()))
+        .await
+        .map_err(|e| format!("WS send failed: {e}"))?;
+    read_until_result(ws, id).await
+}
+
+async fn cdp_send_session(
+    ws: &mut WsStream,
+    id: u64,
+    session_id: &str,
+    method: &str,
+    params: serde_json::Value,
+) -> Result<serde_json::Value, String> {
+    let msg = json!({
+        "id": id,
+        "sessionId": session_id,
+        "method": method,
+        "params": params,
+    });
+    ws.send(Message::Text(msg.to_string().into()))
+        .await
+        .map_err(|e| format!("WS send failed: {e}"))?;
+    read_until_result(ws, id).await
+}
+
+async fn read_until_result(ws: &mut WsStream, id: u64) -> Result<serde_json::Value, String> {
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(30);
+    loop {
+        let msg = tokio::time::timeout_at(deadline, ws.next())
+            .await
+            .map_err(|_| format!("Timeout waiting for CDP response id={id}"))?
+            .ok_or_else(|| "WebSocket closed unexpectedly".to_string())?
+            .map_err(|e| format!("WebSocket read error: {e}"))?;
+
+        if let Message::Text(text) = msg {
+            if let Ok(val) = serde_json::from_str::<serde_json::Value>(&text) {
+                if val.get("id").and_then(|i| i.as_u64()) == Some(id) {
+                    if let Some(err) = val.get("error") {
+                        return Err(format!("CDP error: {err}"));
+                    }
+                    return Ok(val);
+                }
+            }
+        }
+    }
+}

compliance-dast/src/tools/mod.rs

@@ -1,5 +1,6 @@
 pub mod api_fuzzer;
 pub mod auth_bypass;
+pub mod browser;
 pub mod console_log_detector;
 pub mod cookie_analyzer;
 pub mod cors_checker;
@@ -114,6 +115,7 @@ impl ToolRegistry {
             Box::new(openapi_parser::OpenApiParserTool::new(http.clone())),
         );
         register(&mut tools, Box::new(recon::ReconTool::new(http)));
+        register(&mut tools, Box::<browser::BrowserTool>::default());
 
         Self { tools }
     }
@@ -140,3 +142,105 @@ impl ToolRegistry {
         self.tools.keys().cloned().collect()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn registry_has_all_expected_tools() {
+        let registry = ToolRegistry::new();
+        let names = registry.list_names();
+
+        let expected = [
+            "recon",
+            "openapi_parser",
+            "dns_checker",
+            "dmarc_checker",
+            "tls_analyzer",
+            "security_headers",
+            "cookie_analyzer",
+            "csp_analyzer",
+            "cors_checker",
+            "rate_limit_tester",
+            "console_log_detector",
+            "sql_injection_scanner",
+            "xss_scanner",
+            "ssrf_scanner",
+            "auth_bypass_scanner",
+            "api_fuzzer",
+            "browser",
+        ];
+
+        for name in &expected {
+            assert!(
+                names.contains(&name.to_string()),
+                "Missing tool: {name}. Registered: {names:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn registry_get_returns_tool() {
+        let registry = ToolRegistry::new();
+        assert!(registry.get("recon").is_some());
+        assert!(registry.get("browser").is_some());
+        assert!(registry.get("nonexistent").is_none());
+    }
+
+    #[test]
+    fn all_definitions_have_valid_schemas() {
+        let registry = ToolRegistry::new();
+        let defs = registry.all_definitions();
+
+        assert!(!defs.is_empty());
+        for def in &defs {
+            assert!(!def.name.is_empty(), "Tool has empty name");
+            assert!(
+                !def.description.is_empty(),
+                "Tool {} has empty description",
+                def.name
+            );
+            assert!(
+                def.input_schema.is_object(),
+                "Tool {} schema is not an object",
+                def.name
+            );
+            // Every schema should have "type": "object"
+            assert_eq!(
+                def.input_schema.get("type").and_then(|v| v.as_str()),
+                Some("object"),
+                "Tool {} schema type is not 'object'",
+                def.name
+            );
+        }
+    }
+
+    #[test]
+    fn browser_tool_schema_has_action_enum() {
+        let registry = ToolRegistry::new();
+        let browser = registry.get("browser");
+        assert!(browser.is_some());
+        let schema = browser.map(|t| t.input_schema()).unwrap_or_default();
+        let action_prop = schema.get("properties").and_then(|p| p.get("action"));
+        assert!(
+            action_prop.is_some(),
+            "Browser tool missing 'action' property"
+        );
+        let action_enum = action_prop
+            .and_then(|a| a.get("enum"))
+            .and_then(|e| e.as_array());
+        assert!(action_enum.is_some(), "Browser action missing enum");
+        let actions: Vec<&str> = action_enum
+            .into_iter()
+            .flatten()
+            .filter_map(|v| v.as_str())
+            .collect();
+        assert!(actions.contains(&"navigate"));
+        assert!(actions.contains(&"screenshot"));
+        assert!(actions.contains(&"click"));
+        assert!(actions.contains(&"fill"));
+        assert!(actions.contains(&"get_content"));
+        assert!(actions.contains(&"close"));
+    }
+}

deploy/docker-compose.mailserver.yml

@@ -0,0 +1,63 @@
+version: "3.8"
+
+services:
+  mailserver:
+    image: ghcr.io/docker-mailserver/docker-mailserver:14
+    hostname: mail.scanner.meghsakha.com
+    domainname: scanner.meghsakha.com
+    container_name: mailserver
+    ports:
+      - "25:25"      # SMTP (inbound mail)
+      - "143:143"    # IMAP (orchestrator reads mail)
+      - "993:993"    # IMAPS (TLS)
+      - "587:587"    # Submission (outbound, if needed)
+    volumes:
+      - maildata:/var/mail
+      - mailstate:/var/mail-state
+      - maillogs:/var/log/mail
+      - /etc/localtime:/etc/localtime:ro
+    environment:
+      # Hostname
+      - OVERRIDE_HOSTNAME=mail.scanner.meghsakha.com
+
+      # Disable features we don't need
+      - ENABLE_SPAMASSASSIN=0
+      - ENABLE_CLAMAV=0
+      - ENABLE_FAIL2BAN=0
+      - ENABLE_POSTGREY=0
+      - ENABLE_AMAVIS=0
+
+      # Enable what we need
+      - ENABLE_IMAP=1
+      - ENABLE_POP3=0
+
+      # Plus-addressing (critical for pentest)
+      - POSTFIX_RECIPIENT_DELIMITER=+
+
+      # SSL (start with no TLS, add Let's Encrypt later)
+      - SSL_TYPE=
+
+      # Accept mail for our domain
+      - PERMIT_DOCKER=none
+
+      # Disable inbound SPF checking — we need to accept verification
+      # emails from Keycloak and other external senders
+      - ENABLE_OPENDKIM=0
+      - ENABLE_OPENDMARC=0
+      - ENABLE_POLICYD_SPF=0
+      - SPOOF_PROTECTION=0
+
+      # One domain
+      - POSTFIX_MYDESTINATION=scanner.meghsakha.com, localhost
+
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "ss", "-tlnp", "|", "grep", "25"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+volumes:
+  maildata:
+  mailstate:
+  maillogs:

docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   mongo:
-    image: mongo:latest
+    image: mongo:7
     ports:
       - "27017:27017"
     environment:

docs/.vitepress/config.mts

@@ -1,6 +1,7 @@
 import { defineConfig } from 'vitepress'
+import { withMermaid } from 'vitepress-plugin-mermaid'
 
-export default defineConfig({
+export default withMermaid(defineConfig({
   title: 'Certifai',
   description: 'AI-powered security compliance scanning platform',
   ignoreDeadLinks: [
@@ -31,6 +32,7 @@ export default defineConfig({
           { text: 'Dashboard Overview', link: '/features/overview' },
           { text: 'DAST Scanning', link: '/features/dast' },
           { text: 'AI Pentest', link: '/features/pentest' },
+          { text: 'Pentest Architecture', link: '/features/pentest-architecture' },
           { text: 'AI Chat', link: '/features/ai-chat' },
           { text: 'Code Knowledge Graph', link: '/features/graph' },
           { text: 'MCP Integration', link: '/features/mcp-server' },
@@ -51,4 +53,5 @@ export default defineConfig({
       message: 'Certifai Documentation',
     },
   },
-})
+  mermaid: {},
+}))

docs/features/pentest-architecture.md

@@ -0,0 +1,273 @@
+# Pentest Orchestration Architecture
+
+This document explains how the AI pentest orchestrator works under the hood — which steps use the LLM, what context is passed at each stage, and how findings are correlated back to source code.
+
+## High-Level Flow
+
+```mermaid
+flowchart TD
+    subgraph Wizard["Onboarding Wizard (Dashboard)"]
+        W1[Step 1: Target & Scope] --> W2[Step 2: Authentication]
+        W2 --> W3[Step 3: Strategy & Instructions]
+        W3 --> W4[Step 4: Disclaimer & Confirm]
+    end
+
+    W4 -->|POST /sessions| API["Agent API"]
+    API -->|Encrypt credentials| CRYPTO["AES-256-GCM<br/>Credentials at Rest"]
+    API -->|Acquire semaphore| SEM["Concurrency Limiter<br/>(max 5 sessions)"]
+    SEM --> SPAWN["Spawn Orchestrator Task"]
+
+    SPAWN --> GATHER["Gather Repo Context"]
+
+    subgraph Context["Context Gathering (DB Queries)"]
+        GATHER --> SAST["SAST Findings<br/>(open/triaged, top 100)"]
+        GATHER --> SBOM["SBOM Entries<br/>(with known CVEs)"]
+        GATHER --> GRAPH["Code Knowledge Graph<br/>(entry points → source files)"]
+    end
+
+    SAST & SBOM & GRAPH --> PROMPT["Build System Prompt"]
+
+    subgraph LLMLoop["LLM Orchestration Loop (max 50 iterations)"]
+        PROMPT --> PAUSE{"Paused?"}
+        PAUSE -->|Yes| WAIT["Wait for resume signal"]
+        WAIT --> PAUSE
+        PAUSE -->|No| LLM["LLM Call<br/>(LiteLLM → Claude/GPT)"]
+        LLM -->|Content response| DONE["Session Complete"]
+        LLM -->|Tool calls| EXEC["Execute Tools"]
+        EXEC --> STORE["Store attack chain nodes<br/>+ findings in MongoDB"]
+        STORE --> SSE["Broadcast SSE events"]
+        SSE --> LLM
+    end
+
+    STORE --> REPORT["Report Generation"]
+
+    subgraph Report["Report Export"]
+        REPORT --> HTML["HTML Report Builder"]
+        HTML --> CORRELATE["Code-Level Correlation"]
+        CORRELATE --> PDF["Chrome CDP → PDF"]
+        PDF --> ZIP["AES-256 ZIP Archive"]
+    end
+
+    style LLMLoop fill:#1e293b,stroke:#3b82f6,color:#f8fafc
+    style Context fill:#0f172a,stroke:#16a34a,color:#f8fafc
+    style Report fill:#0f172a,stroke:#d97706,color:#f8fafc
+```
+
+## What the LLM Sees
+
+The orchestrator constructs a system prompt containing all available context. Here is exactly what is passed to the LLM at the start of each session:
+
+### System Prompt Structure
+
+```
+┌─────────────────────────────────────────────────────────┐
+│ SYSTEM PROMPT                                           │
+├─────────────────────────────────────────────────────────┤
+│ ## Target                                               │
+│ Name, URL, type, rate limit, destructive flag, repo ID  │
+│                                                         │
+│ ## Strategy                                             │
+│ Guidance text based on selected strategy                │
+│                                                         │
+│ ## SAST Findings (Static Analysis)                      │
+│ Up to 20 findings with severity, file:line, CWE        │
+│ ← From linked repository's SAST scan                   │
+│                                                         │
+│ ## Vulnerable Dependencies (SBOM)                       │
+│ Up to 15 entries with package, version, CVE IDs         │
+│ ← From linked repository's SBOM scan                   │
+│                                                         │
+│ ## Code Entry Points (Knowledge Graph)                  │
+│ Up to 20 entry points with endpoint → file mapping      │
+│ Each linked to SAST findings in the same file           │
+│ ← From code knowledge graph build                      │
+│                                                         │
+│ ## Authentication (if configured)                       │
+│ Mode, credentials (decrypted), registration URL         │
+│ Verification email for plus-addressing                  │
+│                                                         │
+│ ## Custom HTTP Headers                                  │
+│ Key-value pairs to include in all requests              │
+│                                                         │
+│ ## Scope Exclusions                                     │
+│ Paths the LLM must not test                             │
+│                                                         │
+│ ## Available Tools                                      │
+│ List of all registered tool names                       │
+│                                                         │
+│ ## Instructions                                         │
+│ Step-by-step testing methodology                        │
+└─────────────────────────────────────────────────────────┘
+```
+
+### Per-Iteration Messages
+
+After the system prompt, each LLM call includes the full conversation history:
+
+| Role | Content |
+|------|---------|
+| `system` | System prompt (above) |
+| `user` | Initial instructions or user message |
+| `assistant` | LLM reasoning + tool call requests |
+| `tool` | Tool execution results (one per tool call) |
+| `assistant` | Next reasoning + tool calls |
+| ... | Continues until LLM says "testing complete" or max 50 iterations |
+
+## Tool Registry
+
+The LLM can invoke any of these tools. Each tool is registered with a JSON Schema that the LLM uses for structured tool calling:
+
+| Tool | Category | What it does |
+|------|----------|-------------|
+| `recon` | Recon | HTTP fingerprinting, technology detection |
+| `openapi_parser` | API | Discover endpoints from OpenAPI/Swagger specs |
+| `security_headers` | Headers | Check for missing security headers |
+| `cookie_analyzer` | Cookies | Analyze cookie flags (Secure, HttpOnly, SameSite) |
+| `csp_analyzer` | CSP | Evaluate Content-Security-Policy directives |
+| `cors_checker` | CORS | Test CORS misconfiguration |
+| `tls_analyzer` | TLS | Inspect TLS certificate and cipher suites |
+| `dns_checker` | DNS | DNS record enumeration |
+| `dmarc_checker` | Email | DMARC/SPF/DKIM verification |
+| `rate_limit_tester` | Rate Limit | Test rate limiting on endpoints |
+| `console_log_detector` | Logs | Find console.log leakage in JavaScript |
+| `sql_injection` | SQLi | SQL injection testing with payloads |
+| `xss` | XSS | Cross-site scripting testing |
+| `ssrf` | SSRF | Server-side request forgery testing |
+| `auth_bypass` | Auth | Authentication bypass testing |
+| `api_fuzzer` | Fuzzer | API endpoint fuzzing |
+| `browser` | Browser | Headless Chrome automation (navigate, click, fill, screenshot, evaluate JS) |
+
+### Browser Tool
+
+The `browser` tool gives the LLM full control of a headless Chrome instance via CDP (Chrome DevTools Protocol). It supports:
+
+- **navigate** — Go to a URL, return title
+- **screenshot** — Capture PNG screenshot (base64)
+- **click** — Click a CSS-selected element
+- **fill** — Fill a form field with a value
+- **get_content** — Read full page HTML
+- **evaluate** — Execute arbitrary JavaScript
+
+This is used for registration page discovery, form filling, and visual inspection.
+
+## Session Lifecycle
+
+```mermaid
+stateDiagram-v2
+    [*] --> Running : POST /sessions
+    Running --> Paused : POST /sessions/{id}/pause
+    Paused --> Running : POST /sessions/{id}/resume
+    Running --> Completed : LLM says "testing complete"
+    Running --> Failed : Error or timeout
+    Paused --> Failed : POST /sessions/{id}/stop
+    Running --> Failed : POST /sessions/{id}/stop
+    Completed --> [*]
+    Failed --> [*]
+```
+
+## SSE Streaming
+
+Each session has a dedicated broadcast channel. The `/sessions/{id}/stream` endpoint:
+
+1. **Replays** stored messages and attack chain nodes as an initial burst
+2. **Subscribes** to the live broadcast for real-time events
+3. **Keepalive** comments every 15 seconds
+
+Event types:
+
+| Event | When |
+|-------|------|
+| `tool_start` | LLM requests a tool execution |
+| `tool_complete` | Tool finishes with summary + finding count |
+| `finding` | New vulnerability discovered |
+| `message` | LLM sends a text message |
+| `paused` | Session paused |
+| `resumed` | Session resumed |
+| `complete` | Session finished |
+| `error` | Session failed |
+
+## Code-Level Correlation in Reports
+
+When a DAST finding is linked to source code, the report includes a **Code-Level Remediation** section showing exactly what to fix:
+
+### Correlation Channels
+
+```mermaid
+flowchart LR
+    DAST["DAST Finding"]
+
+    DAST -->|linked_sast_finding_id| SAST["SAST Finding"]
+    SAST --> CODE["file:line + code snippet<br/>+ suggested fix"]
+
+    DAST -->|endpoint match| GRAPH["Code Knowledge Graph"]
+    GRAPH --> ENTRY["Handler function + file<br/>+ known vulns in file"]
+
+    DAST -->|linked CVE| SBOM["SBOM Entry"]
+    SBOM --> DEP["Package + version<br/>+ upgrade recommendation"]
+
+    style CODE fill:#dc2626,color:#fff
+    style ENTRY fill:#3b82f6,color:#fff
+    style DEP fill:#d97706,color:#fff
+```
+
+| Channel | Priority | What it shows |
+|---------|----------|---------------|
+| **SAST Correlation** | 1 (direct link) | Exact file:line, vulnerable code snippet (red), suggested fix (green), scanner rule, CWE |
+| **Code Entry Point** | 2 (endpoint match) | Handler function, source file, all SAST issues in that file |
+| **Vulnerable Dependency** | 3 (CVE match) | Package name + version, CVE IDs, PURL, upgrade guidance |
+
+### Example Report Finding
+
+A finding like "Reflected XSS in /api/search" would show:
+
+1. The DAST evidence (request, response, payload)
+2. **SAST Correlation**: `src/routes/search.rs:42` — semgrep found unescaped user input
+3. **Code snippet**: The vulnerable line highlighted in red
+4. **Suggested fix**: The patched code in green
+5. **Recommendation**: Framework-specific guidance
+
+## Screenshots
+
+### Pentest Dashboard
+
+![Pentest Dashboard](/screenshots/pentest-dashboard.png)
+
+The dashboard shows aggregate statistics, severity distribution, and recent sessions with status badges. Running sessions can be paused, resumed, or stopped.
+
+### Onboarding Wizard
+
+**Step 1 — Target & Scope** (with dropdown showing existing DAST targets):
+
+![Wizard Step 1 — Target dropdown](/screenshots/pentest-wizard-step1-dropdown.png)
+
+**Step 2 — Authentication** (Auto-Register mode with optional registration URL, verification email, IMAP settings):
+
+![Wizard Step 2 — Auth](/screenshots/pentest-wizard-step2-auth.png)
+
+**Step 3 — Strategy & Instructions** (strategy selection, scope exclusions, duration, tester info):
+
+![Wizard Step 3 — Strategy](/screenshots/pentest-wizard-step3-strategy.png)
+
+**Step 4 — Review & Confirm** (summary + authorization disclaimer):
+
+![Wizard Step 4 — Confirm](/screenshots/pentest-wizard-step4-confirm.png)
+
+### Session — Findings
+
+![Session Findings](/screenshots/pentest-session-findings.png)
+
+Each finding shows severity, CWE, endpoint, description, and remediation. Exploitable findings are flagged. SAST correlations are shown when available.
+
+### Session — Attack Chain
+
+![Attack Chain](/screenshots/pentest-attack-chain.png)
+
+The attack chain visualizes the DAG of tool executions grouped into phases (Reconnaissance, Analysis, Boundary Testing, Exploitation). Each node shows tool name, category, duration, findings count, and risk score. Running nodes pulse with an animation.
+
+## Concurrency & Security
+
+- **Max 5 concurrent sessions** via `tokio::Semaphore` — returns HTTP 429 when exhausted
+- **Credentials encrypted at rest** with AES-256-GCM (key from `PENTEST_ENCRYPTION_KEY` env var)
+- **Credentials redacted** in all API responses (replaced with `********`)
+- **Credentials decrypted only** when building the LLM prompt (in-memory, never logged)
+- **Report archives** are AES-256 encrypted ZIPs with SHA-256 integrity checksums

docs/features/pentest.md

@@ -15,17 +15,47 @@ The dashboard shows:
 
 ## Starting a Pentest Session
 
-1. Click **New Pentest** on the dashboard
-2. Select a **DAST target** (must be configured under DAST > Targets first)
-3. Choose a **strategy**:
+Click **New Pentest** on the dashboard to open the 4-step onboarding wizard:
+
+### Step 1 — Target & Scope
+
+- **App URL** — enter manually or select from existing DAST targets (dropdown)
+- **Git Repository URL** — enter manually or select from tracked repositories (dropdown). If an SSH URL is selected, the deploy key is displayed for easy copy
+- **Branch / Commit** — auto-populated when you click **Lookup** for a tracked repo
+- **App Type** and **Rate Limit**
+
+### Step 2 — Authentication
+
+- **None** — unauthenticated testing
+- **Manual Credentials** — provide username/password (encrypted at rest with AES-256-GCM)
+- **Auto-Register** — the orchestrator uses the browser tool (headless Chrome) to discover the registration page and create a test account:
+  - **Registration URL** (optional) — auto-discovered via Playwright if omitted
+  - **Verification Email** (optional) — override the agent's default mailbox. Uses plus-addressing (`base+sessionid@domain`) and polls IMAP for verification links
+  - **IMAP Settings** — collapsible section to override host/port/credentials
+
+### Step 3 — Strategy & Instructions
 
 | Strategy | Description |
 |----------|-------------|
 | **Comprehensive** | Full-spectrum test covering recon, API analysis, injection testing, auth checks, and more |
-| **Focused** | Targets specific vulnerability categories based on initial reconnaissance |
+| **Quick** | Focus on common/high-impact vulnerabilities with minimal tool invocations |
+| **Targeted** | SAST-guided — prioritize areas where static analysis found issues |
+| **Aggressive** | Maximum payloads, attempt full exploitation |
+| **Stealth** | Minimal noise, passive analysis, targeted probes |
 
-4. Optionally provide an initial **message** to guide the AI's focus
-5. Click **Start** to begin the session
+- **Initial Instructions** — free-text guidance for the AI
+- **Scope Exclusions** — paths to skip
+- **Max Duration**, **Tester Name/Email**, **Destructive Tests** toggle
+
+### Step 4 — Disclaimer & Confirm
+
+Review the configuration summary and accept the authorization disclaimer.
+
+The wizard can be closed at any time via the **X** button (top-right corner) or by clicking outside the modal.
+
+::: tip Architecture Deep-Dive
+See [Pentest Orchestration Architecture](./pentest-architecture.md) for details on how the LLM loop works, what context is passed, and how findings are correlated to source code.
+:::
 
 The AI orchestrator will autonomously select and execute security tools in phases, using the output of each phase to inform the next.
 
@@ -65,9 +95,11 @@ A visual DAG (directed acyclic graph) showing the sequence of tools executed dur
 - **Finding badges** — red badge showing the number of findings produced by each tool
 - **Interactive** — hover for details, click to select, scroll to zoom, drag to pan
 
-### Stopping a Session
+### Pausing, Resuming & Stopping
 
-Running sessions can be stopped from the dashboard by clicking the **Stop** button on the session card. This immediately halts all tool execution.
+- **Pause** — click the **Pause** button on a running session to suspend the orchestrator loop. The session status changes to `paused` and the LLM stops iterating. SSE clients receive a `paused` event.
+- **Resume** — click **Resume** on a paused session to continue from where it left off. The status returns to `running` and a `resumed` event is broadcast.
+- **Stop** — click **Stop** to permanently halt the session. This marks it as `failed` with reason "Stopped by user".
 
 ## Exporting Reports
 

docs/package.json

@@ -8,5 +8,9 @@
   },
   "devDependencies": {
     "vitepress": "^1.6.4"
+  },
+  "dependencies": {
+    "mermaid": "^11.13.0",
+    "vitepress-plugin-mermaid": "^2.0.17"
   }
 }