From be7e3f87918cc548dcbabb62ce7947792c7ce4af Mon Sep 17 00:00:00 2001
From: CyberSecurityUP <joasantonio108@gmail.com>
Date: Sun, 18 Oct 2026 17:02:42 -0300
Subject: [PATCH] feat(web): add max agents field and wire research/quick CLI
 flags

Add Max Agents input to Run Settings section in wizard. Wire maxAgents
through POST body, sanitizeLaunch, buildArgs (CLI), and buildReplScript
(REPL /agents command). Also pass --quick and --research as CLI flags
in buildArgs for modes that support them (run/whitebox/greybox).
---
 web/public/app.js     | 2 ++
 web/public/index.html | 1 +
 web/server.js         | 5 +++++
 3 files changed, 8 insertions(+)

diff --git a/web/public/app.js b/web/public/app.js
index 53860d5..52374af 100644
--- a/web/public/app.js
+++ b/web/public/app.js
@@ -624,6 +624,7 @@ function renderReview() {
     { k: 'Leads selected', v: `${state.selected.size} of ${allAgents().length}${state.selected.size === 0 ? ' — auto (recon-driven)' : ''}` },
     { k: 'Custom leads', v: String(state.customLeads.length) },
     { k: 'Votes / chain / recon', v: `${$('#fieldVotes').value} / ${$('#fieldChain').value} / ${$('#fieldRecon').value}` },
+    { k: 'Max agents', v: $('#fieldMaxAgents').value || 'auto' },
     { k: 'Budget', v: budgetSummary() },
     { k: 'Egress', v: state.authz.transport || 'direct' },
     { k: 'Out-of-band', v: state.authz.oobDomain ? `*.${state.authz.oobDomain}` : 'none — blind classes stay leads' },
@@ -665,6 +666,7 @@ async function startExploitation() {
     votes: Number($('#fieldVotes').value) || 3,
     chainDepth: Number($('#fieldChain').value),
     recon: Number($('#fieldRecon').value),
+    maxAgents: Number($('#fieldMaxAgents').value) || undefined,
     quick: $('#fieldQuick') ? $('#fieldQuick').checked : false,
     research: $('#fieldResearch') ? $('#fieldResearch').checked : false,
     subscription: state.authMode === 'subscription',
diff --git a/web/public/index.html b/web/public/index.html
index 38173d1..d591094 100644
--- a/web/public/index.html
+++ b/web/public/index.html
@@ -551,6 +551,7 @@
           <div class="field-row">
             <div class="field-group"><label class="field-label" for="fieldVotes">Votes</label><input class="narrow" id="fieldVotes" type="number" min="1" max="9" value="3" /><div class="field-help">Models that must agree before a finding is kept.</div></div>
             <div class="field-group"><label class="field-label" for="fieldChain">Chain depth</label><input class="narrow" id="fieldChain" type="number" min="0" max="5" value="2" /><div class="field-help">How far findings get chained into attack paths.</div></div>
+            <div class="field-group"><label class="field-label" for="fieldMaxAgents">Max agents</label><input class="narrow" id="fieldMaxAgents" type="number" min="1" max="64" placeholder="auto" /><div class="field-help">Concurrent agents. Empty = harness default.</div></div>
             <div class="field-group"><label class="field-label" for="fieldRecon">Recon intensity</label>
               <select class="narrow" id="fieldRecon">
                 <option value="1">1 · quick</option>
diff --git a/web/server.js b/web/server.js
index 1bce159..1d0cc14 100644
--- a/web/server.js
+++ b/web/server.js
@@ -1202,6 +1202,9 @@ function buildArgs(body) {
   if (body.chainDepth !== undefined) args.push('--chain-depth', String(body.chainDepth));
   if (body.recon) args.push('--recon', String(body.recon));
   if (body.maxAgents) args.push('--max-agents', String(body.maxAgents));
+  const hasQuick = ['run', 'whitebox', 'greybox'].includes(mode);
+  if (body.quick && hasQuick) args.push('--quick');
+  if (body.research && (mode === 'whitebox' || mode === 'greybox')) args.push('--research');
   if (body.offline) args.push('--offline');
   if (body.subscription) args.push('--subscription');
   if (body.mcp) args.push('--mcp');
@@ -1337,6 +1340,7 @@ function sanitizeLaunch(body) {
     typesafe: body.typesafe,
     quick: !!body.quick,
     research: !!body.research,
+    maxAgents: body.maxAgents || undefined,
   };
 }
 
@@ -1353,6 +1357,7 @@ function buildReplScript(body) {
   if (body.votes) lines.push(`/votes ${body.votes}`);
   if (body.chainDepth !== undefined) lines.push(`/chain ${body.chainDepth}`);
   if (body.recon) lines.push(`/recon ${body.recon}`);
+  if (body.maxAgents) lines.push(`/agents ${body.maxAgents}`);
   if (body.focus) lines.push(`/focus ${body.focus}`);
   if (body.objective) lines.push(`/objective ${body.objective}`);
   if (body.outOfScope) lines.push(`/scope-out ${body.outOfScope}`);