@pensar/apex 0.0.104 → 0.0.105

package/build/auth.js

@@ -8,7 +8,7 @@ import fs from "fs/promises";
 // package.json
 var package_default = {
   name: "@pensar/apex",
-  version: "0.0.104",
+  version: "0.0.105",
   description: "AI-powered penetration testing CLI tool with terminal UI",
   module: "src/tui/index.tsx",
   main: "build/index.js",

package/build/index.js

@@ -31977,7 +31977,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@pensar/apex",
-    version: "0.0.104",
+    version: "0.0.105",
     description: "AI-powered penetration testing CLI tool with terminal UI",
     module: "src/tui/index.tsx",
     main: "build/index.js",
@@ -162544,7 +162544,7 @@ var require_jwa = __commonJS((exports, module2) => {
     return bufferEqual(a, b2);
   };
   function createHmacVerifier(bits) {
-    return function verify(thing, signature, secret) {
+    return function verify2(thing, signature, secret) {
       var computedSig = createHmacSigner(bits)(thing, secret);
       return timingSafeEqual(Buffer4.from(signature), Buffer4.from(computedSig));
     };
@@ -162559,7 +162559,7 @@ var require_jwa = __commonJS((exports, module2) => {
     };
   }
   function createKeyVerifier(bits) {
-    return function verify(thing, signature, publicKey) {
+    return function verify2(thing, signature, publicKey) {
       checkIsPublicKey(publicKey);
       thing = normalizeInput(thing);
       signature = toBase64(signature);
@@ -162582,7 +162582,7 @@ var require_jwa = __commonJS((exports, module2) => {
     };
   }
   function createPSSKeyVerifier(bits) {
-    return function verify(thing, signature, publicKey) {
+    return function verify2(thing, signature, publicKey) {
       checkIsPublicKey(publicKey);
       thing = normalizeInput(thing);
       signature = toBase64(signature);
@@ -162605,7 +162605,7 @@ var require_jwa = __commonJS((exports, module2) => {
   }
   function createECDSAVerifer(bits) {
     var inner = createKeyVerifier(bits);
-    return function verify(thing, signature, publicKey) {
+    return function verify2(thing, signature, publicKey) {
       signature = formatEcdsa.joseToDer(signature, "ES" + bits).toString("base64");
       var result = inner(thing, signature, publicKey);
       return result;
@@ -162617,7 +162617,7 @@ var require_jwa = __commonJS((exports, module2) => {
     };
   }
   function createNoneVerifier() {
-    return function verify(thing, signature) {
+    return function verify2(thing, signature) {
       return signature === "";
     };
   }
@@ -162825,7 +162825,7 @@ var require_verify_stream = __commonJS((exports, module2) => {
     }.bind(this));
   }
   util4.inherits(VerifyStream, Stream3);
-  VerifyStream.prototype.verify = function verify() {
+  VerifyStream.prototype.verify = function verify2() {
     try {
       var valid = jwsVerify(this.signature.buffer, this.algorithm, this.key.buffer);
       var obj = jwsDecode(this.signature.buffer, this.encoding);
@@ -273082,7 +273082,7 @@ import os6 from "os";
 // src/tui/context/agent.tsx
 init_models();
 init_config();
-var import_react11 = __toESM(require_react(), 1);
+var import_react12 = __toESM(require_react(), 1);
 
 // src/core/providers/utils.ts
 init_models();
@@ -273135,11 +273135,26 @@ var AVAILABLE_PROVIDERS = [
     id: "pensar",
     name: "Pensar",
     description: "Managed inference via Pensar Console (usage-based billing)",
-    requiresAPIKey: true
+    requiresAPIKey: false
   }
 ];
 
 // src/core/providers/utils.ts
+var PROVIDER_PREFERENCE_ORDER = [
+  "pensar",
+  "anthropic",
+  "openai",
+  "google",
+  "openrouter",
+  "bedrock"
+];
+var PREFERRED_MODEL_BY_PROVIDER = {
+  pensar: "pensar:anthropic.claude-opus-4-1-20250805-v1:0",
+  anthropic: "claude-opus-4-6",
+  openai: "gpt-5.2-pro",
+  google: "gemini-3.1-pro-preview",
+  openrouter: "anthropic/claude-opus-4.6"
+};
 function getConfiguredProviders(config) {
   return AVAILABLE_PROVIDERS.map((provider) => {
     const configured = isProviderConfigured(provider.id, config);
@@ -273188,6 +273203,30 @@ function getAvailableModels(config) {
   }
   return models;
 }
+function getDefaultModelForConfig(config) {
+  const available = getAvailableModels(config);
+  if (available.length === 0)
+    return null;
+  const byProvider = new Map;
+  for (const m2 of available) {
+    const list = byProvider.get(m2.provider) || [];
+    list.push(m2);
+    byProvider.set(m2.provider, list);
+  }
+  for (const provider of PROVIDER_PREFERENCE_ORDER) {
+    const models = byProvider.get(provider);
+    if (!models || models.length === 0)
+      continue;
+    const preferredId = PREFERRED_MODEL_BY_PROVIDER[provider];
+    if (preferredId) {
+      const preferred = models.find((m2) => m2.id === preferredId);
+      if (preferred)
+        return preferred;
+    }
+    return models[0];
+  }
+  return available[0] ?? null;
+}
 
 // src/core/logger/index.ts
 init_session();
@@ -273247,45 +273286,69 @@ ${error40.stack ?? ""}` : String(error40);
   } catch {}
 }
 
+// src/tui/context/config.tsx
+init_config2();
+var import_react11 = __toESM(require_react(), 1);
+
 // node_modules/@opentui/react/jsx-dev-runtime.js
 var import_jsx_dev_runtime2 = __toESM(require_jsx_dev_runtime(), 1);
 
-// src/tui/context/agent.tsx
-var PREFERRED_DEFAULTS = {
-  pensar: "pensar:anthropic.claude-haiku-4-5-20251001-v1:0",
-  anthropic: "claude-haiku-4-5",
-  openai: "gpt-4o-mini",
-  google: "gemini-2.5-flash"
+// src/tui/context/config.tsx
+var ctx = import_react11.createContext(null);
+function ConfigProvider({ children, config: config3 }) {
+  const [appConfig, setAppConfig] = import_react11.useState(config3);
+  const value = import_react11.useMemo(() => ({
+    data: appConfig,
+    update: async (newConfig) => {
+      await config2.update(newConfig);
+      setAppConfig({
+        ...appConfig,
+        ...newConfig
+      });
+    },
+    reload: async () => {
+      const freshConfig = await config2.get();
+      setAppConfig(freshConfig);
+    }
+  }), [appConfig]);
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx.Provider, {
+    value,
+    children
+  }, undefined, false, undefined, this);
+}
+var useConfig = () => {
+  const config3 = import_react11.useContext(ctx);
+  if (!config3) {
+    throw new Error("useConfig must be called within a ConfigProvider");
+  }
+  return config3;
 };
-var PROVIDER_PREFERENCE = [
-  "pensar",
-  "anthropic",
-  "openai",
-  "google",
-  "openrouter",
-  "bedrock"
-];
-var AgentContext = import_react11.createContext(null);
+
+// src/tui/context/agent.tsx
+var AgentContext = import_react12.createContext(null);
 function useAgent() {
-  const context2 = import_react11.useContext(AgentContext);
+  const context2 = import_react12.useContext(AgentContext);
   if (!context2) {
     throw new Error("useAgent must be used within AgentProvider");
   }
   return context2;
 }
 function AgentProvider({ children }) {
-  const [model, setModelInternal] = import_react11.useState(AVAILABLE_MODELS[0]);
-  const [isModelUserSelected, setIsModelUserSelected] = import_react11.useState(false);
-  const [tokenUsage, setTokenUsage] = import_react11.useState({
+  const appConfig = useConfig();
+  const [model, setModelInternal] = import_react12.useState(() => {
+    return getDefaultModelForConfig(appConfig.data) ?? AVAILABLE_MODELS[0];
+  });
+  const [isModelUserSelected, setIsModelUserSelected] = import_react12.useState(false);
+  const [tokenUsage, setTokenUsage] = import_react12.useState({
     inputTokens: 0,
     outputTokens: 0,
     totalTokens: 0
   });
-  const [hasExecuted, setHasExecuted] = import_react11.useState(false);
-  const [thinking, setThinking] = import_react11.useState(false);
-  const [isExecuting, setIsExecuting] = import_react11.useState(false);
-  const [sessionCwd, setSessionCwd] = import_react11.useState(null);
-  const setModel = import_react11.useCallback((newModel, persist = true) => {
+  const [hasExecuted, setHasExecuted] = import_react12.useState(false);
+  const [thinking, setThinking] = import_react12.useState(false);
+  const [isExecuting, setIsExecuting] = import_react12.useState(false);
+  const [sessionCwd, setSessionCwd] = import_react12.useState(null);
+  const setModel = import_react12.useCallback((newModel, persist = true) => {
     setModelInternal(newModel);
     if (persist) {
       setIsModelUserSelected(true);
@@ -273294,49 +273357,27 @@ function AgentProvider({ children }) {
       });
     }
   }, []);
-  import_react11.useEffect(() => {
-    get().then((config3) => {
-      const available = getAvailableModels(config3);
-      if (available.length === 0)
+  import_react12.useEffect(() => {
+    if (isModelUserSelected)
+      return;
+    const cfg = appConfig.data;
+    const available = getAvailableModels(cfg);
+    if (available.length === 0)
+      return;
+    if (cfg.selectedModelId) {
+      const savedModel = available.find((m2) => m2.id === cfg.selectedModelId);
+      if (savedModel) {
+        setModelInternal(savedModel);
+        setIsModelUserSelected(true);
         return;
-      if (config3.selectedModelId) {
-        const savedModel = available.find((m2) => m2.id === config3.selectedModelId);
-        if (savedModel) {
-          setModelInternal(savedModel);
-          setIsModelUserSelected(true);
-          return;
-        }
-      }
-      const byProvider = new Map;
-      for (const m2 of available) {
-        const list3 = byProvider.get(m2.provider) || [];
-        list3.push(m2);
-        byProvider.set(m2.provider, list3);
       }
-      let selectedModel = null;
-      for (const provider of PROVIDER_PREFERENCE) {
-        const models = byProvider.get(provider);
-        if (!models || models.length === 0)
-          continue;
-        const preferredId = PREFERRED_DEFAULTS[provider];
-        if (preferredId) {
-          const preferred = models.find((m2) => m2.id === preferredId);
-          if (preferred) {
-            selectedModel = preferred;
-            break;
-          }
-        }
-        selectedModel = models[0];
-        break;
-      }
-      if (selectedModel) {
-        setModelInternal(selectedModel);
-      }
-    }).catch((err) => {
-      writeErrorLog(err, "AGENT_CONTEXT");
-    });
-  }, []);
-  const addTokenUsage = import_react11.useCallback((input, output) => {
+    }
+    const defaultModel = getDefaultModelForConfig(cfg);
+    if (defaultModel) {
+      setModelInternal(defaultModel);
+    }
+  }, [appConfig.data, isModelUserSelected]);
+  const addTokenUsage = import_react12.useCallback((input, output) => {
     setHasExecuted(true);
     setTokenUsage((prev) => ({
       inputTokens: prev.inputTokens + input,
@@ -273344,11 +273385,11 @@ function AgentProvider({ children }) {
       totalTokens: prev.totalTokens + input + output
     }));
   }, []);
-  const resetTokenUsage = import_react11.useCallback(() => {
+  const resetTokenUsage = import_react12.useCallback(() => {
     setHasExecuted(false);
     setTokenUsage({ inputTokens: 0, outputTokens: 0, totalTokens: 0 });
   }, []);
-  const contextValue = import_react11.useMemo(() => ({
+  const contextValue = import_react12.useMemo(() => ({
     model,
     setModel,
     isModelUserSelected,
@@ -273381,7 +273422,7 @@ function AgentProvider({ children }) {
 }
 
 // src/tui/components/sprites.tsx
-var import_react13 = __toESM(require_react(), 1);
+var import_react14 = __toESM(require_react(), 1);
 
 // src/tui/theme/registry.ts
 var themes = new Map;
@@ -273401,8 +273442,8 @@ function getAllThemeNames() {
   return Array.from(themes.keys()).sort();
 }
 // src/tui/theme/context.tsx
-var import_react12 = __toESM(require_react(), 1);
-var ThemeContext = import_react12.createContext(null);
+var import_react13 = __toESM(require_react(), 1);
+var ThemeContext = import_react13.createContext(null);
 function resolveColor(value, mode) {
   if ("r" in value)
     return value;
@@ -273421,17 +273462,17 @@ function ThemeProvider({
   initialMode = "dark",
   children
 }) {
-  const [theme, setThemeState] = import_react12.useState(() => getTheme(initialTheme ?? DEFAULT_THEME_NAME));
-  const [mode, setModeState] = import_react12.useState(initialMode);
-  const colors = import_react12.useMemo(() => resolveThemeColors(theme, mode), [theme, mode]);
-  const setTheme = import_react12.useCallback((name26) => {
+  const [theme, setThemeState] = import_react13.useState(() => getTheme(initialTheme ?? DEFAULT_THEME_NAME));
+  const [mode, setModeState] = import_react13.useState(initialMode);
+  const colors = import_react13.useMemo(() => resolveThemeColors(theme, mode), [theme, mode]);
+  const setTheme = import_react13.useCallback((name26) => {
     const newTheme = getTheme(name26);
     setThemeState(newTheme);
   }, []);
-  const toggleMode = import_react12.useCallback(() => {
+  const toggleMode = import_react13.useCallback(() => {
     setModeState((prev) => prev === "dark" ? "light" : "dark");
   }, []);
-  const setMode = import_react12.useCallback((m2) => {
+  const setMode = import_react13.useCallback((m2) => {
     setModeState(m2);
   }, []);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ThemeContext, {
@@ -273448,10 +273489,10 @@ function ThemeProvider({
   }, undefined, false, undefined, this);
 }
 function useTheme() {
-  const ctx = import_react12.useContext(ThemeContext);
-  if (!ctx)
+  const ctx2 = import_react13.useContext(ThemeContext);
+  if (!ctx2)
     throw new Error("useTheme() must be used within <ThemeProvider>");
-  return ctx;
+  return ctx2;
 }
 // src/tui/theme/colors.ts
 var colors = {
@@ -273492,8 +273533,8 @@ function stopGlobalTick() {
   }
 }
 function useGlobalTick() {
-  const [, setTick] = import_react13.useState(0);
-  import_react13.useEffect(() => {
+  const [, setTick] = import_react14.useState(0);
+  import_react14.useEffect(() => {
     const listener = () => setTick((t2) => t2 + 1);
     globalListeners.add(listener);
     startGlobalTick();
@@ -273520,11 +273561,11 @@ function SpinnerDots({
 
 // src/tui/context/session.tsx
 init_session();
-var import_react14 = __toESM(require_react(), 1);
-var ctx = import_react14.createContext(null);
+var import_react15 = __toESM(require_react(), 1);
+var ctx2 = import_react15.createContext(null);
 function SessionProvider({ children, session }) {
-  const [activeSession, setActiveSession] = import_react14.useState(session);
-  const value = import_react14.useMemo(() => ({
+  const [activeSession, setActiveSession] = import_react15.useState(session);
+  const value = import_react15.useMemo(() => ({
     active: activeSession,
     load: async (id) => {
       try {
@@ -273545,40 +273586,40 @@ function SessionProvider({ children, session }) {
       return _session;
     }
   }), [activeSession]);
-  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx.Provider, {
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx2.Provider, {
     value,
     children
   }, undefined, false, undefined, this);
 }
 var useSession = () => {
-  const session = import_react14.useContext(ctx);
+  const session = import_react15.useContext(ctx2);
   if (!session)
     throw new Error("useSession must be called within a SessionProvider");
   return session;
 };
 
 // src/tui/context/route.tsx
-var import_react15 = __toESM(require_react(), 1);
-var ctx2 = import_react15.createContext(null);
+var import_react16 = __toESM(require_react(), 1);
+var ctx3 = import_react16.createContext(null);
 function RouteProvider({ children }) {
-  const [route, setRoute] = import_react15.useState({
+  const [route, setRoute] = import_react16.useState({
     type: "base",
     path: "home"
   });
-  const value = import_react15.useMemo(() => ({
+  const value = import_react16.useMemo(() => ({
     data: route,
     navigate: (newRoute) => {
       console.log("navigating to:", newRoute);
       setRoute(newRoute);
     }
   }), [route]);
-  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx2.Provider, {
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx3.Provider, {
     value,
     children
   }, undefined, false, undefined, this);
 }
 var useRoute = () => {
-  const route = import_react15.useContext(ctx2);
+  const route = import_react16.useContext(ctx3);
   if (!route) {
     throw new Error("useRoute must be called within a RouteProvider");
   }
@@ -273586,11 +273627,11 @@ var useRoute = () => {
 };
 
 // src/tui/context/input.tsx
-var import_react16 = __toESM(require_react(), 1);
-var InputContext = import_react16.createContext(undefined);
+var import_react17 = __toESM(require_react(), 1);
+var InputContext = import_react17.createContext(undefined);
 function InputProvider({ children }) {
-  const [inputValue, setInputValue] = import_react16.useState("");
-  const clearInput = import_react16.useCallback(() => {
+  const [inputValue, setInputValue] = import_react17.useState("");
+  const clearInput = import_react17.useCallback(() => {
     setInputValue("");
   }, []);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(InputContext.Provider, {
@@ -273604,7 +273645,7 @@ function InputProvider({ children }) {
   }, undefined, false, undefined, this);
 }
 function useInput() {
-  const context2 = import_react16.useContext(InputContext);
+  const context2 = import_react17.useContext(InputContext);
   if (!context2) {
     throw new Error("useInput must be used within InputProvider");
   }
@@ -273744,7 +273785,7 @@ function AgentStatus() {
 }
 
 // src/tui/context/command.tsx
-var import_react17 = __toESM(require_react(), 1);
+var import_react18 = __toESM(require_react(), 1);
 
 // src/tui/command-router.ts
 class CommandRouter {
@@ -273756,8 +273797,8 @@ class CommandRouter {
     for (const n of names)
       this.nameToCommand.set(n, command);
   }
-  registerWithContext(definition, ctx3) {
-    const { handler, ...metadata } = definition(ctx3);
+  registerWithContext(definition, ctx4) {
+    const { handler, ...metadata } = definition(ctx4);
     this.register({
       ...metadata,
       handler: (args) => handler(args)
@@ -273781,14 +273822,14 @@ class CommandRouter {
       return { name: null, args };
     return { name: name26, args };
   }
-  async execute(input, ctx3) {
+  async execute(input, ctx4) {
     const { name: name26, args } = this.parse(input);
     if (!name26)
       return false;
     const cmd = this.nameToCommand.get(name26);
     if (!cmd)
       return false;
-    await cmd.handler(args, ctx3);
+    await cmd.handler(args, ctx4);
     return true;
   }
 }
@@ -274080,18 +274121,18 @@ var commands = [
       },
       { name: "--model", valueHint: "<model>", description: "AI model to use" }
     ],
-    handler: async (args, ctx3) => {
+    handler: async (args, ctx4) => {
       const flags = parseWebFlags(args);
       if (flags.target && hasEnoughFlagsToSkipWizard(flags)) {
         const params = buildSwarmSessionConfig(flags);
-        ctx3.navigate({
+        ctx4.navigate({
           type: "pentest",
           targets: params.targets,
           sessionConfig: params.config
         });
         return;
       }
-      ctx3.openPentestDialog?.({ auto: true, ...flags });
+      ctx4.openPentestDialog?.({ auto: true, ...flags });
     }
   },
   {
@@ -274154,10 +274195,10 @@ var commands = [
       },
       { name: "--model", valueHint: "<model>", description: "AI model to use" }
     ],
-    handler: async (args, ctx3) => {
+    handler: async (args, ctx4) => {
       const flags = parseWebFlags(args);
       const params = buildOperatorSessionConfig(flags);
-      ctx3.navigate({
+      ctx4.navigate({
         type: "operator",
         nonce: Date.now(),
         initialConfig: {
@@ -274171,8 +274212,8 @@ var commands = [
     name: "help",
     description: "Show help dialog",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "help"
       });
@@ -274182,8 +274223,8 @@ var commands = [
     name: "config",
     description: "Show config dialog",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "config"
       });
@@ -274193,8 +274234,8 @@ var commands = [
     name: "models",
     description: "Show available AI models",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "models"
       });
@@ -274204,8 +274245,8 @@ var commands = [
     name: "providers",
     description: "Manage AI providers and API keys",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "providers"
       });
@@ -274216,16 +274257,16 @@ var commands = [
     aliases: ["s"],
     description: "Browse previous sessions",
     category: "Pentesting",
-    handler: async (_args, ctx3) => {
-      ctx3.openSessionsDialog?.();
+    handler: async (_args, ctx4) => {
+      ctx4.openSessionsDialog?.();
     }
   },
   {
     name: "new",
     description: "Start a new operator session",
     category: "Session",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({ type: "operator", nonce: Date.now() });
+    handler: async (args, ctx4) => {
+      ctx4.navigate({ type: "operator", nonce: Date.now() });
     }
   },
   {
@@ -274234,8 +274275,8 @@ var commands = [
     description: "Open the Chat TUI interface",
     category: "General",
     hidden: true,
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "home"
       });
@@ -274256,7 +274297,7 @@ var commands = [
         description: "Toggle or set dark/light mode (dark|light|auto)"
       }
     ],
-    handler: async (args, ctx3) => {
+    handler: async (args, ctx4) => {
       if (args[0] === "mode") {
         const modeArg = args[1];
         if (modeArg === "dark" || modeArg === "light") {
@@ -274279,7 +274320,7 @@ var commands = [
         }
         return;
       }
-      ctx3.openThemeDialog?.();
+      ctx4.openThemeDialog?.();
     }
   },
   {
@@ -274288,8 +274329,8 @@ var commands = [
     description: "View and manage active tools (session only)",
     category: "Session",
     hidden: true,
-    handler: async (args, ctx3) => {
-      if (ctx3.route.type !== "pentest") {
+    handler: async (args, ctx4) => {
+      if (ctx4.route.type !== "pentest") {
         return;
       }
     }
@@ -274307,8 +274348,8 @@ var commands = [
     name: "auth",
     description: "Connect to Pensar Console for managed inference",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.openAuthDialog?.();
+    handler: async (args, ctx4) => {
+      ctx4.openAuthDialog?.();
     }
   },
   {
@@ -274316,8 +274357,8 @@ var commands = [
     aliases: ["buy"],
     description: "Buy credits / check balance",
     category: "General",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "credits"
       });
@@ -274327,20 +274368,20 @@ var commands = [
     name: "create-skill",
     description: "Create a new operator skill",
     category: "Skills",
-    handler: async (args, ctx3) => {
-      ctx3.navigate({
+    handler: async (args, ctx4) => {
+      ctx4.navigate({
         type: "base",
         path: "create-skill"
       });
     }
   }
 ];
-var commandRegistry = commands.map((config3) => (ctx3) => ({
+var commandRegistry = commands.map((config3) => (ctx4) => ({
   name: config3.name,
   aliases: config3.aliases,
   description: config3.description,
   handler: async (args) => {
-    await config3.handler(args, ctx3);
+    await config3.handler(args, ctx4);
   }
 }));
 
@@ -274435,9 +274476,9 @@ async function skillExists(slug) {
 }
 
 // src/tui/context/command.tsx
-var CommandContext = import_react17.createContext(null);
+var CommandContext = import_react18.createContext(null);
 function useCommand() {
-  const context2 = import_react17.useContext(CommandContext);
+  const context2 = import_react18.useContext(CommandContext);
   if (!context2) {
     throw new Error("useCommand must be used within CommandProvider");
   }
@@ -274451,9 +274492,9 @@ function CommandProvider({
   onOpenPentestDialog
 }) {
   const route = useRoute();
-  const [skills, setSkills] = import_react17.useState([]);
-  const ctx3 = import_react17.useMemo(() => {
-    const ctx4 = {
+  const [skills, setSkills] = import_react18.useState([]);
+  const ctx4 = import_react18.useMemo(() => {
+    const ctx5 = {
       route: route.data,
       navigate: route.navigate,
       openSessionsDialog: onOpenSessionsDialog,
@@ -274461,7 +274502,7 @@ function CommandProvider({
       openAuthDialog: onOpenAuthDialog,
       openPentestDialog: onOpenPentestDialog
     };
-    return ctx4;
+    return ctx5;
   }, [
     route,
     onOpenSessionsDialog,
@@ -274469,33 +274510,33 @@ function CommandProvider({
     onOpenAuthDialog,
     onOpenPentestDialog
   ]);
-  const refreshSkills = import_react17.useCallback(async () => {
+  const refreshSkills = import_react18.useCallback(async () => {
     const loaded = await loadSkills();
     setSkills(loaded);
   }, []);
-  import_react17.useEffect(() => {
+  import_react18.useEffect(() => {
     refreshSkills();
   }, [route.data]);
-  const router = import_react17.useMemo(() => {
+  const router = import_react18.useMemo(() => {
     const router2 = new CommandRouter;
     for (const commandDef of commandRegistry) {
-      router2.registerWithContext(commandDef, ctx3);
+      router2.registerWithContext(commandDef, ctx4);
     }
     return router2;
   }, []);
-  const skillSlugMap = import_react17.useMemo(() => {
+  const skillSlugMap = import_react18.useMemo(() => {
     const map2 = new Map;
     for (const skill of skills) {
       map2.set(slugify(skill.name), skill);
     }
     return map2;
   }, [skills]);
-  const resolveSkillContent = import_react17.useCallback((input) => {
+  const resolveSkillContent = import_react18.useCallback((input) => {
     const trimmed = input.trim().replace(/^\/+/, "").toLowerCase();
     const skill = skillSlugMap.get(trimmed);
     return skill?.content ?? null;
   }, [skillSlugMap]);
-  const autocompleteOptions = import_react17.useMemo(() => {
+  const autocompleteOptions = import_react18.useMemo(() => {
     const routerCommands = router.getAllCommands();
     const options = [];
     for (const cmd of routerCommands) {
@@ -274539,10 +274580,10 @@ function CommandProvider({
       return a.value.localeCompare(b2.value);
     });
   }, [router, skills]);
-  const executeCommand = import_react17.useCallback(async (input) => {
-    return await router.execute(input, ctx3);
-  }, [router, ctx3]);
-  const value = import_react17.useMemo(() => ({
+  const executeCommand = import_react18.useCallback(async (input) => {
+    return await router.execute(input, ctx4);
+  }, [router, ctx4]);
+  const value = import_react18.useMemo(() => ({
     router,
     autocompleteOptions,
     executeCommand,
@@ -274565,24 +274606,24 @@ function CommandProvider({
 }
 
 // src/tui/components/commands/sessions-display.tsx
-var import_react24 = __toESM(require_react(), 1);
+var import_react25 = __toESM(require_react(), 1);
 
 // src/tui/context/focus.tsx
-var import_react18 = __toESM(require_react(), 1);
-var FocusContext = import_react18.createContext(undefined);
+var import_react19 = __toESM(require_react(), 1);
+var FocusContext = import_react19.createContext(undefined);
 function FocusProvider({ children }) {
-  const promptRef = import_react18.useRef(null);
-  const refocusPrompt = import_react18.useCallback(() => {
+  const promptRef = import_react19.useRef(null);
+  const refocusPrompt = import_react19.useCallback(() => {
     setTimeout(() => {
       promptRef.current?.focus();
     }, 1);
   }, []);
-  const focusPrompt = import_react18.useCallback(() => promptRef.current?.focus(), []);
-  const blurPrompt = import_react18.useCallback(() => promptRef.current?.blur(), []);
-  const resetPrompt = import_react18.useCallback(() => promptRef.current?.reset(), []);
-  const setPromptValue = import_react18.useCallback((value) => promptRef.current?.setValue(value), []);
-  const getPromptValue = import_react18.useCallback(() => promptRef.current?.getValue() ?? "", []);
-  const registerPromptRef = import_react18.useCallback((ref) => {
+  const focusPrompt = import_react19.useCallback(() => promptRef.current?.focus(), []);
+  const blurPrompt = import_react19.useCallback(() => promptRef.current?.blur(), []);
+  const resetPrompt = import_react19.useCallback(() => promptRef.current?.reset(), []);
+  const setPromptValue = import_react19.useCallback((value) => promptRef.current?.setValue(value), []);
+  const getPromptValue = import_react19.useCallback(() => promptRef.current?.getValue() ?? "", []);
+  const registerPromptRef = import_react19.useCallback((ref) => {
     promptRef.current = ref;
   }, []);
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(FocusContext.Provider, {
@@ -274600,7 +274641,7 @@ function FocusProvider({ children }) {
   }, undefined, false, undefined, this);
 }
 function useFocus() {
-  const context2 = import_react18.useContext(FocusContext);
+  const context2 = import_react19.useContext(FocusContext);
   if (!context2) {
     throw new Error("useFocus must be used within FocusProvider");
   }
@@ -274635,8 +274676,8 @@ function openSessionReport(sessionRootPath) {
 }
 
 // src/tui/context/dimensions.tsx
-var import_react19 = __toESM(require_react(), 1);
-var DimensionsContext = import_react19.createContext(null);
+var import_react20 = __toESM(require_react(), 1);
+var DimensionsContext = import_react20.createContext(null);
 function TerminalDimensionsProvider({
   children
 }) {
@@ -274647,14 +274688,14 @@ function TerminalDimensionsProvider({
   }, undefined, false, undefined, this);
 }
 function useDimensions() {
-  const ctx3 = import_react19.useContext(DimensionsContext);
-  if (!ctx3)
+  const ctx4 = import_react20.useContext(DimensionsContext);
+  if (!ctx4)
     throw new Error("useDimensions() must be used within <TerminalDimensionsProvider>");
-  return ctx3;
+  return ctx4;
 }
 
 // src/tui/context/dialog.tsx
-var import_react22 = __toESM(require_react(), 1);
+var import_react23 = __toESM(require_react(), 1);
 function Dialog({ size = "medium", onClose, children }) {
   const dimensions = useDimensions();
   const renderer = useRenderer();
@@ -274691,14 +274732,14 @@ function Dialog({ size = "medium", onClose, children }) {
     }, undefined, false, undefined, this)
   }, undefined, false, undefined, this);
 }
-var DialogContext = import_react22.createContext(null);
+var DialogContext = import_react23.createContext(null);
 function DialogProvider({ children }) {
-  const [stack, setStack] = import_react22.useState([]);
-  const [size, setSize] = import_react22.useState("medium");
-  const [externalDialogOpen, setExternalDialogOpen] = import_react22.useState(false);
+  const [stack, setStack] = import_react23.useState([]);
+  const [size, setSize] = import_react23.useState("medium");
+  const [externalDialogOpen, setExternalDialogOpen] = import_react23.useState(false);
   const renderer = useRenderer();
-  const focusRef = import_react22.useRef(null);
-  const refocus = import_react22.useCallback(() => {
+  const focusRef = import_react23.useRef(null);
+  const refocus = import_react23.useCallback(() => {
     setTimeout(() => {
       const focus = focusRef.current;
       if (!focus)
@@ -274720,7 +274761,7 @@ function DialogProvider({ children }) {
       focus.focus();
     }, 1);
   }, [renderer]);
-  const clear = import_react22.useCallback(() => {
+  const clear = import_react23.useCallback(() => {
     for (const item of stack) {
       if (item.onClose)
         item.onClose();
@@ -274729,7 +274770,7 @@ function DialogProvider({ children }) {
     setStack([]);
     refocus();
   }, [stack, refocus]);
-  const replace = import_react22.useCallback((element, onClose) => {
+  const replace = import_react23.useCallback((element, onClose) => {
     if (stack.length === 0) {
       focusRef.current = renderer.currentFocusedRenderable;
     }
@@ -274774,7 +274815,7 @@ function DialogProvider({ children }) {
   }, undefined, true, undefined, this);
 }
 function useDialog() {
-  const value = import_react22.useContext(DialogContext);
+  const value = import_react23.useContext(DialogContext);
   if (!value) {
     throw new Error("useDialog must be used within a DialogProvider");
   }
@@ -274839,7 +274880,7 @@ function findChildById(scrollBox, id) {
 // src/tui/hooks/use-sessions-list.ts
 init_session();
 init_report();
-var import_react23 = __toESM(require_react(), 1);
+var import_react24 = __toESM(require_react(), 1);
 import { existsSync as existsSync7, readdirSync } from "fs";
 import { join as join3 } from "path";
 function countFindings(findingsPath) {
@@ -274855,10 +274896,10 @@ function checkHasReport(rootPath) {
   return existsSync7(join3(rootPath, REPORT_FILENAME_MD));
 }
 function useSessionsList() {
-  const [allSessions, setAllSessions] = import_react23.useState([]);
-  const [loading, setLoading] = import_react23.useState(true);
-  const [searchTerm, setSearchTerm] = import_react23.useState("");
-  const loadSessions = import_react23.useCallback(async () => {
+  const [allSessions, setAllSessions] = import_react24.useState([]);
+  const [loading, setLoading] = import_react24.useState(true);
+  const [searchTerm, setSearchTerm] = import_react24.useState("");
+  const loadSessions = import_react24.useCallback(async () => {
     setLoading(true);
     try {
       const enriched = [];
@@ -274881,10 +274922,10 @@ function useSessionsList() {
       setLoading(false);
     }
   }, []);
-  import_react23.useEffect(() => {
+  import_react24.useEffect(() => {
     loadSessions();
   }, [loadSessions]);
-  const deleteSession = import_react23.useCallback(async (id) => {
+  const deleteSession = import_react24.useCallback(async (id) => {
     await sessions.remove({ sessionId: id });
     await loadSessions();
   }, [loadSessions]);
@@ -274943,10 +274984,10 @@ function useSessionsList() {
 function SessionsDisplay({ onClose }) {
   const { colors: colors2 } = useTheme();
   const { refocusPrompt } = useFocus();
-  const [selectedIndex, setSelectedIndex] = import_react24.useState(0);
-  const [statusMessage, setStatusMessage] = import_react24.useState("");
+  const [selectedIndex, setSelectedIndex] = import_react25.useState(0);
+  const [statusMessage, setStatusMessage] = import_react25.useState("");
   const route = useRoute();
-  const scroll = import_react24.useRef(null);
+  const scroll = import_react25.useRef(null);
   const {
     groupedSessions,
     visualOrderSessions,
@@ -274962,7 +275003,7 @@ function SessionsDisplay({ onClose }) {
       setTimeout(() => setStatusMessage(""), 2000);
     }
   }
-  import_react24.useEffect(() => {
+  import_react25.useEffect(() => {
     if (visualOrderSessions.length > 0 && selectedIndex >= visualOrderSessions.length) {
       setSelectedIndex(visualOrderSessions.length - 1);
     } else if (visualOrderSessions.length === 0) {
@@ -275244,7 +275285,7 @@ function SessionsDisplay({ onClose }) {
 }
 
 // src/tui/components/commands/config-dialog.tsx
-var import_react27 = __toESM(require_react(), 1);
+var import_react28 = __toESM(require_react(), 1);
 
 // src/tui/components/alert-dialog.tsx
 function AlertDialog({
@@ -275331,8 +275372,8 @@ function AlertDialog({
 init_config2();
 function ConfigDialog() {
   const route = useRoute();
-  const [open, setOpen] = import_react27.useState(false);
-  import_react27.useEffect(() => {
+  const [open, setOpen] = import_react28.useState(false);
+  import_react28.useEffect(() => {
     if (route.data.type === "base" && route.data.path === "config") {
       setOpen(true);
     } else {
@@ -275346,8 +275387,8 @@ function ConfigDialog() {
       path: "home"
     });
   };
-  const [appConfig, setAppConfig] = import_react27.useState(null);
-  import_react27.useEffect(() => {
+  const [appConfig, setAppConfig] = import_react28.useState(null);
+  import_react28.useEffect(() => {
     async function getConfig() {
       const _appConfig = await config2.get();
       setAppConfig(_appConfig);
@@ -275420,39 +275461,6 @@ function ConfigForm({ appConfig }) {
 init_session();
 var import_react38 = __toESM(require_react(), 1);
 
-// src/tui/context/config.tsx
-init_config2();
-var import_react28 = __toESM(require_react(), 1);
-var ctx3 = import_react28.createContext(null);
-function ConfigProvider({ children, config: config3 }) {
-  const [appConfig, setAppConfig] = import_react28.useState(config3);
-  const value = import_react28.useMemo(() => ({
-    data: appConfig,
-    update: async (newConfig) => {
-      await config2.update(newConfig);
-      setAppConfig({
-        ...appConfig,
-        ...newConfig
-      });
-    },
-    reload: async () => {
-      const freshConfig = await config2.get();
-      setAppConfig(freshConfig);
-    }
-  }), [appConfig]);
-  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ctx3.Provider, {
-    value,
-    children
-  }, undefined, false, undefined, this);
-}
-var useConfig = () => {
-  const config3 = import_react28.useContext(ctx3);
-  if (!config3) {
-    throw new Error("useConfig must be called within a ConfigProvider");
-  }
-  return config3;
-};
-
 // src/tui/components/chat/home-view.tsx
 var import_react33 = __toESM(require_react(), 1);
 
@@ -276915,18 +276923,25 @@ function ConfigView({ config: config3, onBack, onStart }) {
   const { colors: colors2 } = useTheme();
   const [targetUrl, setTargetUrl] = import_react36.useState("https://");
   const [strictScope, setStrictScope] = import_react36.useState(true);
-  const [selectedModel, setSelectedModel] = import_react36.useState({
-    id: "claude-sonnet-4-20250514",
-    name: "Claude Sonnet 4",
-    provider: "anthropic"
+  const [selectedModel, setSelectedModel] = import_react36.useState(() => {
+    if (config3) {
+      const dynamicDefault = getDefaultModelForConfig(config3);
+      if (dynamicDefault)
+        return dynamicDefault;
+    }
+    return {
+      id: "claude-sonnet-4-20250514",
+      name: "Claude Sonnet 4",
+      provider: "anthropic"
+    };
   });
   const [isModelUserSelected, setIsModelUserSelected] = import_react36.useState(false);
   const [focusedField, setFocusedField] = import_react36.useState("url");
   import_react36.useEffect(() => {
-    if (config3) {
+    if (config3 && !isModelUserSelected) {
       const models = getAvailableModels(config3);
-      if (models.length > 0 && !isModelUserSelected) {
-        const defaultModel = models.find((m2) => m2.provider === "anthropic") || models[0];
+      if (models.length > 0) {
+        const defaultModel = getDefaultModelForConfig(config3) ?? models[0];
         setSelectedModel(defaultModel);
       }
     }
@@ -278643,6 +278658,142 @@ function WebWizard({
 // src/tui/components/commands/provider-manager.tsx
 var import_react50 = __toESM(require_react(), 1);
 init_config2();
+// src/core/providers/verify.ts
+var VERIFY_TIMEOUT_MS = 15000;
+async function fetchWithTimeout(url2, init2) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), VERIFY_TIMEOUT_MS);
+  try {
+    return await fetch(url2, { ...init2, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function verifyAnthropic(apiKey) {
+  try {
+    const res = await fetchWithTimeout("https://api.anthropic.com/v1/models", {
+      method: "GET",
+      headers: {
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01"
+      }
+    });
+    if (res.ok)
+      return { valid: true };
+    if (res.status === 401)
+      return { valid: false, error: "Invalid API key" };
+    return {
+      valid: false,
+      error: `Anthropic returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      error: err instanceof DOMException && err.name === "AbortError" ? "Request timed out" : "Could not reach Anthropic API"
+    };
+  }
+}
+async function verifyOpenAI(apiKey) {
+  try {
+    const res = await fetchWithTimeout("https://api.openai.com/v1/models", {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok)
+      return { valid: true };
+    if (res.status === 401)
+      return { valid: false, error: "Invalid API key" };
+    return {
+      valid: false,
+      error: `OpenAI returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      error: err instanceof DOMException && err.name === "AbortError" ? "Request timed out" : "Could not reach OpenAI API"
+    };
+  }
+}
+async function verifyGoogle(apiKey) {
+  try {
+    const res = await fetchWithTimeout(`https://generativelanguage.googleapis.com/v1beta/models?key=${encodeURIComponent(apiKey)}`, { method: "GET" });
+    if (res.ok)
+      return { valid: true };
+    if (res.status === 400 || res.status === 403)
+      return { valid: false, error: "Invalid API key" };
+    return {
+      valid: false,
+      error: `Google returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      error: err instanceof DOMException && err.name === "AbortError" ? "Request timed out" : "Could not reach Google AI API"
+    };
+  }
+}
+async function verifyOpenRouter(apiKey) {
+  try {
+    const res = await fetchWithTimeout("https://openrouter.ai/api/v1/auth/key", {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok)
+      return { valid: true };
+    if (res.status === 401 || res.status === 403)
+      return { valid: false, error: "Invalid API key" };
+    return {
+      valid: false,
+      error: `OpenRouter returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      error: err instanceof DOMException && err.name === "AbortError" ? "Request timed out" : "Could not reach OpenRouter API"
+    };
+  }
+}
+async function verifyInception(apiKey) {
+  try {
+    const res = await fetchWithTimeout("https://api.inceptionlabs.ai/v1/models", {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` }
+    });
+    if (res.ok)
+      return { valid: true };
+    if (res.status === 401 || res.status === 403)
+      return { valid: false, error: "Invalid API key" };
+    return {
+      valid: false,
+      error: `Inception returned HTTP ${res.status}`
+    };
+  } catch (err) {
+    return {
+      valid: false,
+      error: err instanceof DOMException && err.name === "AbortError" ? "Request timed out" : "Could not reach Inception API"
+    };
+  }
+}
+async function verifyApiKey(provider, apiKey) {
+  switch (provider) {
+    case "anthropic":
+      return verifyAnthropic(apiKey);
+    case "openai":
+      return verifyOpenAI(apiKey);
+    case "google":
+      return verifyGoogle(apiKey);
+    case "openrouter":
+      return verifyOpenRouter(apiKey);
+    case "inception":
+      return verifyInception(apiKey);
+    case "bedrock":
+    case "local":
+    case "pensar":
+      return { valid: true };
+    default:
+      return { valid: true };
+  }
+}
 // src/tui/components/commands/provider-selection.tsx
 var import_react45 = __toESM(require_react(), 1);
 function ProviderSelection({
@@ -278816,12 +278967,30 @@ function APIKeyInput({
 }) {
   const { colors: colors2 } = useTheme();
   const [apiKey, setApiKey] = import_react47.useState("");
+  const [verifyState, setVerifyState] = import_react47.useState("idle");
+  const [errorMessage, setErrorMessage] = import_react47.useState("");
   useKeyboard((key) => {
     if (key.name === "escape") {
+      if (verifyState === "verifying")
+        return;
       onCancel();
       return;
     }
   });
+  const handleSubmit = async () => {
+    const key = apiKey.trim();
+    if (!key || verifyState === "verifying")
+      return;
+    setVerifyState("verifying");
+    setErrorMessage("");
+    const result = await verifyApiKey(provider, key);
+    if (result.valid) {
+      onSubmit(key);
+    } else {
+      setVerifyState("error");
+      setErrorMessage(result.error ?? "Invalid API key");
+    }
+  };
   const getProviderInstructions = (provider2) => {
     switch (provider2) {
       case "anthropic":
@@ -278834,8 +279003,6 @@ function APIKeyInput({
         return "Get your API key from openrouter.ai/keys";
       case "bedrock":
         return "Enter your AWS Access Key ID (configure region separately) or AWS Bedrock API Key";
-      case "pensar":
-        return "Get your API key from console.pensar.dev/connect (or run /auth)";
       default:
         return "Enter your API key";
     }
@@ -278889,20 +279056,32 @@ function APIKeyInput({
             label: "API Key",
             description: "Your API key will be stored locally in ~/.pensar/config.json",
             value: apiKey,
-            focused: true,
+            focused: verifyState !== "verifying",
             onChange: (value) => setApiKey(typeof value === "string" ? value : ""),
             onPaste: (event) => {
               const cleaned = String(event.text);
               setApiKey((prev) => `${prev}${cleaned}`);
             },
-            onSubmit: () => {
-              const key = apiKey.trim();
-              if (key) {
-                onSubmit(key);
-              }
-            }
+            onSubmit: handleSubmit
           }, undefined, false, undefined, this)
         }, undefined, false, undefined, this),
+        verifyState === "verifying" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginBottom: 1,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.textMuted,
+            children: "Verifying API key..."
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        verifyState === "error" && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+          marginBottom: 1,
+          children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+            fg: colors2.error,
+            children: [
+              "✗ ",
+              errorMessage
+            ]
+          }, undefined, true, undefined, this)
+        }, undefined, false, undefined, this),
         /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
           marginTop: 1,
           children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
@@ -279588,7 +279767,11 @@ function ProviderManager() {
   const [selectedProvider, setSelectedProvider] = import_react50.useState(null);
   const handleProviderSelected = (providerId) => {
     setSelectedProvider(providerId);
-    setFlowState("inputting");
+    if (providerId === "pensar") {
+      setFlowState("auth");
+    } else {
+      setFlowState("inputting");
+    }
   };
   const handleAPIKeySubmit = async (apiKey) => {
     if (!selectedProvider)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pensar/apex",
-  "version": "0.0.104",
+  "version": "0.0.105",
   "description": "AI-powered penetration testing CLI tool with terminal UI",
   "module": "src/tui/index.tsx",
   "main": "build/index.js",