chore: remove unused scan tools and dead error type (#327)

* chore: remove unused scan tools and dead error type

* chore(logs): redact base URL and target URL from preflight info logs

apps/worker/prompts/exploit-injection.txt

@@ -182,17 +182,16 @@ For each root vulnerability in your plan, you will follow this systematic, four-
 ## **Strategic Tool Usage**
 Use the right tool for the job to ensure thoroughness.
 - **Use `curl` (Manual Probing) for:** Initial confirmation, simple UNION/Error-based injections, and crafting specific WAF bypasses.
-- **Use `sqlmap` (Automation) for:** Time-consuming blind injections, automating enumeration **after** manual confirmation, and as a final step to try a wide range of payloads when manual techniques are failing.
 
 ## **Persistence and Effort Allocation**
 Measure your effort using tool calls rather than time to ensure thorough testing:
 - **Initial Confirmation Phase:** Minimum 3 distinct payload attempts per vulnerability before concluding it's not exploitable
 - **Bypass Attempts:** If a vulnerability appears mitigated, try at least 8-10 different technique variations (encoding, syntax, comment styles, etc.) before concluding it's properly defended  
-- **Escalation Trigger:** If manual testing exceeds 10-12 tool calls without progress on a single vulnerability, escalate to automated tools (`sqlmap`) or Task Agent scripting
+- **Escalation Trigger:** If manual testing exceeds 10-12 tool calls without progress on a single vulnerability, escalate to Task Agent scripting
 - **Termination Criteria:** After systematic attempts with multiple different techniques → classify as appropriate level
   
 ## **Using the Task Agent for Custom Scripting**
-You must delegate every injection automation task to the Task Agent. Use manual `curl` or `sqlmap` runs for spot checks, then escalate to scripted payload loops handled by the Task Agent.
+You must delegate every injection automation task to the Task Agent. Use manual `curl` runs for spot checks, then escalate to scripted payload loops handled by the Task Agent.
 
 **TEMPLATE FOR SCRIPTING TASKS (REQUIRED):**
 "

apps/worker/prompts/pre-recon-code.txt

@@ -44,7 +44,7 @@ Downstream vulnerability analysis will cover these classes: {{VULN_CLASSES_TESTE
 
 **Phase Sequence:** **PRE-RECON (You)** → RECON → VULN ANALYSIS (5 agents) → EXPLOITATION (5 agents) → REPORTING
 
-**Your Input:** External scan results from pre-recon tools (nmap, subfinder, whatweb)
+**Your Input:** Target application source code in the working directory
 **Your Output:** `.shannon/deliverables/pre_recon_deliverable.md` (feeds all subsequent analysis phases)
 **Shared Intelligence:** You create the foundational intelligence baseline that all other agents depend on
 
@@ -79,7 +79,6 @@ You are the **Code Intelligence Gatherer** and **Architectural Foundation Builde
 
 <starting_context>
 - You are the **ENTRY POINT** of the comprehensive security assessment - no prior deliverables exist to read
-- External reconnaissance tools have completed and their results are available in the working environment
 - The target application source code has been cloned and is ready for analysis in the current directory
 - You must create the **foundational intelligence baseline** that all subsequent agents depend on
 - **CRITICAL:** This is the ONLY agent with full source code access - your completeness determines whether vulnerabilities are found

apps/worker/prompts/recon.txt

@@ -1,5 +1,5 @@
 <role>
-You are a world-class Reconnaissance Analyst and Attack Surface Mapper. Your mission is to conduct a thorough white-box analysis of the target application by correlating external scan data, live application behavior, and the full source code.
+You are a world-class Reconnaissance Analyst and Attack Surface Mapper. Your mission is to conduct a thorough white-box analysis of the target application by correlating live application behavior with the full source code.
 </role>
 
 <objective>
@@ -7,7 +7,7 @@ Your goal is to create a comprehensive, structured map of the application's atta
 </objective>
 
 <starting_context>
-Your analysis must begin by reading and fully comprehending the initial intelligence report located at `.shannon/deliverables/pre_recon_deliverable.md`. This file contains the output of initial nmap, subfinder, whatweb, and code analysis scans. This is your only starting information.
+Your analysis must begin by reading and fully comprehending the initial intelligence report located at `.shannon/deliverables/pre_recon_deliverable.md`. This file contains the initial source code analysis. This is your only starting information.
 </starting_context>
 
 <target>
@@ -88,13 +88,13 @@ Please use these tools for the following use cases:
 
 **Phase Sequence:** PRE-RECON (Complete) → **RECONNAISSANCE (You)** → VULN ANALYSIS (5 agents) → EXPLOITATION (5 agents) → FINAL REPORT (next phase)
 
-**Your Input:** `.shannon/deliverables/pre_recon_deliverable.md` (external scan data, initial code analysis)
+**Your Input:** `.shannon/deliverables/pre_recon_deliverable.md` (initial code analysis)
 **Your Output:** `.shannon/deliverables/recon_deliverable.md` (comprehensive attack surface map)
 **Shared Intelligence:** None (you are the first analysis specialist)
 
 **WHAT HAPPENED BEFORE YOU:**
-- Pre-reconnaissance agent performed external scans (nmap, subfinder, whatweb) and initial code analysis
-- All attack surfaces, technologies, and entry points were catalogued from external perspective
+- Pre-reconnaissance agent performed initial source code analysis
+- Attack surfaces, technologies, and entry points were catalogued from the codebase
 
 **WHAT HAPPENS AFTER YOU:**
 - Injection Analysis specialist will analyze SQL injection and command injection vulnerabilities using your attack surface map
@@ -120,7 +120,7 @@ You must follow this methodical four-step process:
 
 1.  **Synthesize Initial Data:**
     - Read the entire `.shannon/deliverables/pre_recon_deliverable.md`.
-    - In your thoughts, create a preliminary list of known technologies, subdomains, open ports, and key code modules.
+    - In your thoughts, create a preliminary list of known technologies and key code modules.
 
 2.  **Interactive Application Exploration:**
     - Invoke the `playwright-cli` skill, then use it with `-s={{PLAYWRIGHT_SESSION}}` to navigate to the target.
@@ -174,8 +174,6 @@ A brief overview of the application's purpose, core technology stack (e.g., Next
 - **Frontend:** [Framework, key libraries, authentication libraries]
 - **Backend:** [Language, framework, key dependencies]
 - **Infrastructure:** [Hosting provider, CDN, database type]
-- **Identified Subdomains:** [List from subfinder and any others discovered]
-- **Open Ports & Services:** [List from nmap and their purpose]
 
 ## 3. Authentication & Session Management Flow
 - **Entry Points:** [e.g., /login, /register, /auth/sso]

apps/worker/prompts/report-executive.txt

@@ -12,7 +12,7 @@ Technical leadership (CTOs, CISOs, Engineering VPs) who need both technical accu
 The orchestrator has already concatenated all per-class deliverables into `comprehensive_security_assessment_report.md`. Each per-class section is either exploit-agent-produced exploitation evidence (when exploitation ran) or deterministically rendered findings from analysis-phase queues (when exploitation was disabled). The cleanup rules below apply uniformly to either source.
 Your task is to:
 1. Read this existing concatenated report
-2. Add Executive Summary (vulnerability overview) and Network Reconnaissance (security-relevant scan findings) sections at the top
+2. Add an Executive Summary (vulnerability overview) at the top
 3. Clean up ALL per-class report sections by removing extraneous content
 4. Save the modified version back to the same file
 
@@ -65,19 +65,10 @@ MODIFY the existing file `.shannon/deliverables/comprehensive_security_assessmen
 
 {{VULN_SUMMARY_SUBSECTIONS}}
 
-## Network Reconnaissance
-{Extract security-relevant findings from automated scanning tools:
-- Open ports and exposed services from nmap
-- Subdomain discoveries from subfinder that could expand attack surface
-- Security headers or misconfigurations detected by whatweb
-- Any other security-relevant findings from the automated tools
-SKIP stack details - technical leaders know their infrastructure}
-
 2. KEEPING the existing per-class report sections but CLEANING them according to the rules below
 
 3. The final structure should be:
    - Executive Summary (new)
-   - Network Reconnaissance (new)
    - All existing per-class report sections (cleaned)
 
 IMPORTANT: Do NOT reorder the existing per-class report sections. Maintain the exact order they appear in the concatenated report. Only remove sections that do not match the defined criteria above.
@@ -86,15 +77,12 @@ IMPORTANT: Do NOT reorder the existing per-class report sections. Maintain the e
 
 <instructions>
 1. Read the pre_recon and recon deliverable files to gather security-relevant information:
-   - Focus on findings from automated tools (nmap, subfinder, whatweb) that indicate security risks
-   - Note exposed services, open ports, subdomains, security misconfigurations
    - Skip basic information such as technology stack information (the team knows their own stack)
    - Use technical leadership tone - precise but concise
    - Use the current date for the assessment date
 
-2. Create the Executive Summary and Network Reconnaissance content:
+2. Create the Executive Summary content:
    - Executive Summary: Technical overview with actionable findings for engineering leaders
-   - Network Reconnaissance: Focus on security-relevant discoveries from automated scans
 
 3. Clean the per-class report sections in `.shannon/deliverables/comprehensive_security_assessment_report.md` by applying these rules:
    - KEEP these specific section headings:

apps/worker/src/services/preflight.ts

@@ -270,7 +270,7 @@ async function validateCredentials(logger: ActivityLogger, apiKey?: string, prov
   // 1. Custom base URL — validate endpoint is reachable via SDK query
   if (process.env.ANTHROPIC_BASE_URL && process.env.ANTHROPIC_AUTH_TOKEN) {
     const baseUrl = process.env.ANTHROPIC_BASE_URL;
-    logger.info(`Validating custom base URL: ${baseUrl}`);
+    logger.info('Validating custom base URL');
 
     try {
       for await (const message of query({ prompt: 'hi', options: { model: resolveModel('small'), maxTurns: 1 } })) {
@@ -454,7 +454,7 @@ function httpHead(url: string, timeoutMs: number): Promise<number> {
 
 /** Check that the target URL is reachable from inside the container. */
 async function validateTargetUrl(targetUrl: string, logger: ActivityLogger): Promise<Result<void, PentestError>> {
-  logger.info('Checking target URL reachability...', { targetUrl });
+  logger.info('Checking target URL reachability...');
 
   // 1. Parse URL
   let parsed: URL;

apps/worker/src/types/errors.ts

@@ -11,7 +11,7 @@
 /**
  * Specific error codes for reliable classification.
  *
- * ErrorCode provides precision within the coarse 8-category PentestErrorType.
+ * ErrorCode provides precision within the coarse 7-category PentestErrorType.
  * Used by classifyErrorForTemporal for code-based classification (preferred)
  * with string matching as fallback for external errors.
  */
@@ -47,15 +47,7 @@ export enum ErrorCode {
   BILLING_ERROR = 'BILLING_ERROR',
 }
 
-export type PentestErrorType =
-  | 'config'
-  | 'network'
-  | 'tool'
-  | 'prompt'
-  | 'filesystem'
-  | 'validation'
-  | 'billing'
-  | 'unknown';
+export type PentestErrorType = 'config' | 'network' | 'prompt' | 'filesystem' | 'validation' | 'billing' | 'unknown';
 
 export interface PentestErrorContext {
   [key: string]: unknown;