@pensar/apex 0.0.113 → 0.0.114-canary.f792214a
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +36 -36
- package/build/agent-dd7afyam.js +16 -0
- package/build/{agent-k1n19b3w.js → agent-sjab42xk.js} +8 -8
- package/build/{auth-a0ftn8cb.js → auth-5mtxy20q.js} +4 -4
- package/build/{authentication-vjefzf37.js → authentication-h4dg1gcd.js} +7 -7
- package/build/blackboxAgent-ktmms41d.js +17 -0
- package/build/{blackboxPentest-26japf1w.js → blackboxPentest-pavtaqc6.js} +12 -12
- package/build/{cli-t7dpdkd6.js → cli-2hjsjm5s.js} +42 -13
- package/build/{cli-wqh6md2n.js → cli-4d0jjptp.js} +1 -1
- package/build/{cli-mnqb1xvt.js → cli-4g56qmea.js} +1 -1
- package/build/{cli-6nhtpv4g.js → cli-cx0g6jf4.js} +1 -1
- package/build/{cli-qeg15dzj.js → cli-dgfmj3s1.js} +1 -1
- package/build/{cli-tat7hrek.js → cli-dm7saexk.js} +6 -6
- package/build/{cli-0v3p48tt.js → cli-q2tc8qhm.js} +2 -2
- package/build/{cli-7kpzf8kz.js → cli-r9qfcjrr.js} +2 -2
- package/build/{cli-4sxvxwcb.js → cli-s46fscp0.js} +1 -1
- package/build/{cli-j6qdxby9.js → cli-tcxy5qkd.js} +2 -2
- package/build/{cli-g0r410cd.js → cli-whvgjtjf.js} +1 -1
- package/build/{cli-065mgjsh.js → cli-x2dp74cp.js} +2 -2
- package/build/{cli-yc2cs5cs.js → cli-zvsgr240.js} +1 -1
- package/build/cli.js +20 -20
- package/build/{fixes-szq7tb0p.js → fixes-v544jyb3.js} +4 -4
- package/build/{index-sr5w8v3d.js → index-65be6zgt.js} +7716 -676
- package/build/{index-4ds7eh13.js → index-tw309xvg.js} +6 -6
- package/build/{index-8dgs0erz.js → index-xz0w2myr.js} +2 -2
- package/build/{issues-7yvjwc2j.js → issues-j50x9sc5.js} +4 -4
- package/build/{logs-22ks7j0v.js → logs-pb78963z.js} +4 -4
- package/build/pentest-nf69khpt.js +25 -0
- package/build/{pentests-7a8s43nj.js → pentests-22dfjtbt.js} +4 -4
- package/build/{projects-0a1zfjgm.js → projects-dfhkbbq7.js} +4 -4
- package/build/{targetedPentest-qrcrtpzg.js → targetedPentest-ecyf5r05.js} +8 -8
- package/build/{uninstall-hp43qwmn.js → uninstall-dvfatr60.js} +1 -1
- package/package.json +1 -1
- package/build/agent-cff8va32.js +0 -16
- package/build/blackboxAgent-dq8eany1.js +0 -17
- package/build/pentest-agm6pqh1.js +0 -25
package/README.md
CHANGED
|
@@ -1,6 +1,8 @@
|
|
|
1
1
|
<h1 align="center">Pensar Apex</h1>
|
|
2
2
|
|
|
3
|
-
<p align="center">
|
|
3
|
+
<p align="center">
|
|
4
|
+
AI-powered penetration testing using autonomous agents — directly in your terminal. Run blackbox and whitebox pentests that explore, reason, and surface real vulnerabilities.
|
|
5
|
+
|
|
4
6
|
</p>
|
|
5
7
|
|
|
6
8
|
<p align="center">
|
|
@@ -20,52 +22,50 @@ Want to run from the cloud or integrate it with your CI/CD? See <a href="https:/
|
|
|
20
22
|
<img src="screenshot.png" alt="Pensar Apex Screenshot" width="800">
|
|
21
23
|
</p> -->
|
|
22
24
|
|
|
23
|
-
##
|
|
25
|
+
## What is Apex?
|
|
24
26
|
|
|
25
|
-
Apex
|
|
27
|
+
Apex is an autonomous penetration testing agent that runs directly in your terminal.
|
|
26
28
|
|
|
27
|
-
|
|
29
|
+
It doesn't wrap existing scanners or chain shell scripts. Apex deploys a **swarm of specialized AI agents** — each with domain expertise in reconnaissance, authentication analysis, exploitation, and code review — that coordinate a real penetration test against your application. Every finding comes with CVSS 4.0 scoring, CWE classification, evidence, and a validated proof-of-concept.
|
|
28
30
|
|
|
29
|
-
|
|
31
|
+
The result is a pentest that runs like `npm test` — but thinks like a red team.
|
|
30
32
|
|
|
31
|
-
|
|
33
|
+
## Why Apex?
|
|
32
34
|
|
|
33
|
-
|
|
35
|
+
Traditional scanners execute signatures. Apex executes a methodology.
|
|
34
36
|
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
37
|
+
- **Swarm architecture** - Specialized agents run in parallel across your attack surface, the same way a real red team divides and conquers. Up to 10 concurrent agents, each scoped to a specific objective.
|
|
38
|
+
- **Structured, auditable output** - Every vulnerability is automatically scored (CVSS 4.0), classified (CWE), and documented with evidence and remediation steps. No raw tool dumps.
|
|
39
|
+
- **Real exploitation, not guesswork** - Apex writes, runs, and validates proof-of-concept scripts. If the PoC doesn't succeed, it pivots to a different technique.
|
|
40
|
+
- **Blackbox and whitebox** - Test a live target with no source access, or analyze your codebase to map endpoints and test them against a running instance.
|
|
41
|
+
- **30+ built-in tools** - Browser automation, shell execution, HTTP requests, file analysis, web search for CVE lookups, authenticated crawling, and more. Optional Kali Linux container adds 25+ offensive security tools (nmap, sqlmap, hydra, hashcat, gobuster, and others).
|
|
38
42
|
|
|
39
|
-
|
|
43
|
+
## Two Modes
|
|
40
44
|
|
|
41
|
-
|
|
42
|
-
- Scan a newly launched domain or API
|
|
43
|
-
- Run quick security checks during development
|
|
44
|
-
- Identify exposed services or misconfigurations
|
|
45
|
+
### `/pentest` — Autonomous
|
|
45
46
|
|
|
46
|
-
|
|
47
|
+
Fire and forget. Apex runs a full engagement end-to-end: attack surface discovery, parallel swarm testing, and a structured report with findings in Markdown and JSON. No security expertise required.
|
|
47
48
|
|
|
48
|
-
|
|
49
|
+
### `/operator` — Interactive
|
|
49
50
|
|
|
50
|
-
|
|
51
|
+
Full control. Steer the agent step by step, approve each action, chain exploits manually, and dig deep into specific targets. Every tool is available. The approval gate holds until you say go.
|
|
51
52
|
|
|
52
|
-
|
|
53
|
+
Start with `/pentest` to get coverage, then reopen the session in `/operator` to investigate specific findings — all context carries over.
|
|
53
54
|
|
|
54
|
-
|
|
55
|
+
## Use Cases
|
|
55
56
|
|
|
56
|
-
|
|
57
|
-
/operator
|
|
58
|
-
```
|
|
57
|
+
### Developers
|
|
59
58
|
|
|
60
|
-
|
|
59
|
+
- Run `/pentest` before merging a PR — catch vulnerabilities as naturally as running tests
|
|
60
|
+
- Get actionable findings with severity scores, evidence, and suggested fixes — no security background needed
|
|
61
|
+
- Integrate into CI/CD via headless CLI commands or Pensar Console
|
|
61
62
|
|
|
62
|
-
|
|
63
|
-
- Manual exploitation of discovered vulnerabilities
|
|
64
|
-
- Tool orchestration across recon and exploitation phases
|
|
65
|
-
- Validation and reproduction of vulnerabilities
|
|
66
|
-
- Open-source security research / testing
|
|
63
|
+
### Security Engineers
|
|
67
64
|
|
|
68
|
-
|
|
65
|
+
- Deploy agent-driven swarm testing across large attack surfaces
|
|
66
|
+
- Use `/operator` mode for manual investigation, exploit chaining, and validation
|
|
67
|
+
- Automate repetitive testing workflows with persistent memory that accumulates across engagements
|
|
68
|
+
- Scale across teams and projects through Pensar Console
|
|
69
69
|
|
|
70
70
|
## Installation
|
|
71
71
|
|
|
@@ -82,18 +82,18 @@ brew tap pensarai/tap
|
|
|
82
82
|
brew install apex
|
|
83
83
|
```
|
|
84
84
|
|
|
85
|
-
#### Windows (PowerShell)
|
|
86
|
-
|
|
87
|
-
```powershell
|
|
88
|
-
irm https://www.pensarai.com/apex.ps1 | iex
|
|
89
|
-
```
|
|
90
|
-
|
|
91
85
|
#### npm
|
|
92
86
|
|
|
93
87
|
```bash
|
|
94
88
|
npm install -g @pensar/apex
|
|
95
89
|
```
|
|
96
90
|
|
|
91
|
+
#### Windows (PowerShell)
|
|
92
|
+
|
|
93
|
+
```powershell
|
|
94
|
+
irm https://www.pensarai.com/apex.ps1 | iex
|
|
95
|
+
```
|
|
96
|
+
|
|
97
97
|
## Usage
|
|
98
98
|
|
|
99
99
|
Open the Apex TUI:
|
|
@@ -0,0 +1,16 @@
|
|
|
1
|
+
import {
|
|
2
|
+
CodeAgent
|
|
3
|
+
} from "./cli-r9qfcjrr.js";
|
|
4
|
+
import"./cli-2hjsjm5s.js";
|
|
5
|
+
import"./cli-4d0jjptp.js";
|
|
6
|
+
import"./cli-tcxy5qkd.js";
|
|
7
|
+
import"./cli-zvsgr240.js";
|
|
8
|
+
import"./cli-dgfmj3s1.js";
|
|
9
|
+
import"./cli-cx0g6jf4.js";
|
|
10
|
+
import"./cli-4g56qmea.js";
|
|
11
|
+
import"./cli-0tpx8khk.js";
|
|
12
|
+
import"./cli-7ckctq7a.js";
|
|
13
|
+
import"./cli-8rxa073f.js";
|
|
14
|
+
export {
|
|
15
|
+
CodeAgent
|
|
16
|
+
};
|
|
@@ -1,18 +1,18 @@
|
|
|
1
1
|
import {
|
|
2
2
|
WhiteboxAttackSurfaceResultSchema
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-s46fscp0.js";
|
|
4
4
|
import {
|
|
5
5
|
OffensiveSecurityAgent
|
|
6
|
-
} from "./cli-
|
|
7
|
-
import"./cli-
|
|
6
|
+
} from "./cli-2hjsjm5s.js";
|
|
7
|
+
import"./cli-4d0jjptp.js";
|
|
8
8
|
import {
|
|
9
9
|
hasToolCall,
|
|
10
10
|
tool
|
|
11
|
-
} from "./cli-
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
15
|
-
import"./cli-
|
|
11
|
+
} from "./cli-tcxy5qkd.js";
|
|
12
|
+
import"./cli-zvsgr240.js";
|
|
13
|
+
import"./cli-dgfmj3s1.js";
|
|
14
|
+
import"./cli-cx0g6jf4.js";
|
|
15
|
+
import"./cli-4g56qmea.js";
|
|
16
16
|
import"./cli-0tpx8khk.js";
|
|
17
17
|
import"./cli-7ckctq7a.js";
|
|
18
18
|
import"./cli-8rxa073f.js";
|
|
@@ -8,14 +8,14 @@ import {
|
|
|
8
8
|
pollWorkOSToken,
|
|
9
9
|
selectWorkspace,
|
|
10
10
|
startDeviceFlow
|
|
11
|
-
} from "./cli-
|
|
11
|
+
} from "./cli-zvsgr240.js";
|
|
12
12
|
import {
|
|
13
13
|
config,
|
|
14
14
|
getPensarApiUrl,
|
|
15
15
|
getPensarConsoleUrl
|
|
16
|
-
} from "./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
16
|
+
} from "./cli-dgfmj3s1.js";
|
|
17
|
+
import"./cli-cx0g6jf4.js";
|
|
18
|
+
import"./cli-4g56qmea.js";
|
|
19
19
|
import {
|
|
20
20
|
__require
|
|
21
21
|
} from "./cli-8rxa073f.js";
|
|
@@ -3,15 +3,15 @@ import {
|
|
|
3
3
|
} from "./cli-6gtnyaqf.js";
|
|
4
4
|
import {
|
|
5
5
|
OffensiveSecurityAgent
|
|
6
|
-
} from "./cli-
|
|
7
|
-
import"./cli-
|
|
6
|
+
} from "./cli-2hjsjm5s.js";
|
|
7
|
+
import"./cli-4d0jjptp.js";
|
|
8
8
|
import {
|
|
9
9
|
hasToolCall
|
|
10
|
-
} from "./cli-
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
10
|
+
} from "./cli-tcxy5qkd.js";
|
|
11
|
+
import"./cli-zvsgr240.js";
|
|
12
|
+
import"./cli-dgfmj3s1.js";
|
|
13
|
+
import"./cli-cx0g6jf4.js";
|
|
14
|
+
import"./cli-4g56qmea.js";
|
|
15
15
|
import"./cli-0tpx8khk.js";
|
|
16
16
|
import"./cli-7ckctq7a.js";
|
|
17
17
|
import"./cli-8rxa073f.js";
|
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import {
|
|
2
|
+
BlackboxAttackSurfaceAgent
|
|
3
|
+
} from "./cli-x2dp74cp.js";
|
|
4
|
+
import"./cli-6gtnyaqf.js";
|
|
5
|
+
import"./cli-2hjsjm5s.js";
|
|
6
|
+
import"./cli-4d0jjptp.js";
|
|
7
|
+
import"./cli-tcxy5qkd.js";
|
|
8
|
+
import"./cli-zvsgr240.js";
|
|
9
|
+
import"./cli-dgfmj3s1.js";
|
|
10
|
+
import"./cli-cx0g6jf4.js";
|
|
11
|
+
import"./cli-4g56qmea.js";
|
|
12
|
+
import"./cli-0tpx8khk.js";
|
|
13
|
+
import"./cli-7ckctq7a.js";
|
|
14
|
+
import"./cli-8rxa073f.js";
|
|
15
|
+
export {
|
|
16
|
+
BlackboxAttackSurfaceAgent
|
|
17
|
+
};
|
|
@@ -1,18 +1,18 @@
|
|
|
1
1
|
import {
|
|
2
2
|
runPentestWorkflow
|
|
3
|
-
} from "./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
3
|
+
} from "./cli-dm7saexk.js";
|
|
4
|
+
import"./cli-q2tc8qhm.js";
|
|
5
|
+
import"./cli-r9qfcjrr.js";
|
|
6
|
+
import"./cli-s46fscp0.js";
|
|
7
|
+
import"./cli-x2dp74cp.js";
|
|
8
8
|
import"./cli-6gtnyaqf.js";
|
|
9
|
-
import"./cli-
|
|
10
|
-
import"./cli-
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
15
|
-
import"./cli-
|
|
9
|
+
import"./cli-2hjsjm5s.js";
|
|
10
|
+
import"./cli-4d0jjptp.js";
|
|
11
|
+
import"./cli-tcxy5qkd.js";
|
|
12
|
+
import"./cli-zvsgr240.js";
|
|
13
|
+
import"./cli-dgfmj3s1.js";
|
|
14
|
+
import"./cli-cx0g6jf4.js";
|
|
15
|
+
import"./cli-4g56qmea.js";
|
|
16
16
|
import"./cli-0tpx8khk.js";
|
|
17
17
|
import"./cli-7ckctq7a.js";
|
|
18
18
|
import"./cli-8rxa073f.js";
|
|
@@ -17,7 +17,7 @@ import {
|
|
|
17
17
|
update,
|
|
18
18
|
write,
|
|
19
19
|
writeRaw
|
|
20
|
-
} from "./cli-
|
|
20
|
+
} from "./cli-4d0jjptp.js";
|
|
21
21
|
import {
|
|
22
22
|
_enum,
|
|
23
23
|
_null,
|
|
@@ -46,18 +46,18 @@ import {
|
|
|
46
46
|
union,
|
|
47
47
|
unknown,
|
|
48
48
|
zod_default
|
|
49
|
-
} from "./cli-
|
|
49
|
+
} from "./cli-tcxy5qkd.js";
|
|
50
50
|
import {
|
|
51
51
|
signGatewayRequest
|
|
52
|
-
} from "./cli-
|
|
52
|
+
} from "./cli-zvsgr240.js";
|
|
53
53
|
import {
|
|
54
54
|
config,
|
|
55
55
|
ensureValidToken,
|
|
56
56
|
getPensarApiUrl
|
|
57
|
-
} from "./cli-
|
|
57
|
+
} from "./cli-dgfmj3s1.js";
|
|
58
58
|
import {
|
|
59
59
|
getCurrentVersion
|
|
60
|
-
} from "./cli-
|
|
60
|
+
} from "./cli-4g56qmea.js";
|
|
61
61
|
import {
|
|
62
62
|
__commonJS,
|
|
63
63
|
__require,
|
|
@@ -90666,7 +90666,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
|
|
|
90666
90666
|
if (credentials) {
|
|
90667
90667
|
ctx.session.credentialManager.addFromAuthCredentials(credentials);
|
|
90668
90668
|
}
|
|
90669
|
-
const { runAuthenticationAgent } = await import("./authentication-
|
|
90669
|
+
const { runAuthenticationAgent } = await import("./authentication-h4dg1gcd.js");
|
|
90670
90670
|
const subagentCallbacks = cbs ? {
|
|
90671
90671
|
onTextDelta: (d) => cbs.onTextDelta?.({ ...d, subagentId }),
|
|
90672
90672
|
onToolCall: (d) => cbs.onToolCall?.({ ...d, subagentId }),
|
|
@@ -91568,7 +91568,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
|
|
|
91568
91568
|
});
|
|
91569
91569
|
if (cwd) {
|
|
91570
91570
|
try {
|
|
91571
|
-
const { WhiteboxAttackSurfaceAgent } = await import("./agent-
|
|
91571
|
+
const { WhiteboxAttackSurfaceAgent } = await import("./agent-sjab42xk.js");
|
|
91572
91572
|
const agent = new WhiteboxAttackSurfaceAgent({
|
|
91573
91573
|
codebasePath: cwd,
|
|
91574
91574
|
model: ctx.model,
|
|
@@ -91620,7 +91620,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
|
|
|
91620
91620
|
}
|
|
91621
91621
|
}
|
|
91622
91622
|
try {
|
|
91623
|
-
const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-
|
|
91623
|
+
const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-ktmms41d.js");
|
|
91624
91624
|
const agent = new BlackboxAttackSurfaceAgent({
|
|
91625
91625
|
target,
|
|
91626
91626
|
model: ctx.model,
|
|
@@ -91699,7 +91699,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
|
|
|
91699
91699
|
toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
|
|
91700
91700
|
}),
|
|
91701
91701
|
execute: async ({ targets }) => {
|
|
91702
|
-
const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-
|
|
91702
|
+
const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-nf69khpt.js");
|
|
91703
91703
|
if (!ctx.model) {
|
|
91704
91704
|
return {
|
|
91705
91705
|
success: false,
|
|
@@ -91826,7 +91826,7 @@ Returns an array of results with the text output from each agent.`,
|
|
|
91826
91826
|
});
|
|
91827
91827
|
}
|
|
91828
91828
|
async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
|
|
91829
|
-
const { CodeAgent } = await import("./agent-
|
|
91829
|
+
const { CodeAgent } = await import("./agent-dd7afyam.js");
|
|
91830
91830
|
const subagentId = `coding-agent-${agentIndex}`;
|
|
91831
91831
|
ctx.subagentCallbacks?.onSubagentSpawn?.({
|
|
91832
91832
|
subagentId,
|
|
@@ -95270,6 +95270,32 @@ BEST PRACTICES:
|
|
|
95270
95270
|
}
|
|
95271
95271
|
});
|
|
95272
95272
|
}
|
|
95273
|
+
// src/core/agents/offSecAgent/tools/readSkill.ts
|
|
95274
|
+
init_zod();
|
|
95275
|
+
function readSkill(ctx) {
|
|
95276
|
+
return tool({
|
|
95277
|
+
description: "Load a skill's full instructions by name from the available skills catalog.",
|
|
95278
|
+
inputSchema: exports_external.object({
|
|
95279
|
+
name: exports_external.string().describe("Skill slug from the available skills catalog"),
|
|
95280
|
+
toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
|
|
95281
|
+
}),
|
|
95282
|
+
execute: async ({ name }) => {
|
|
95283
|
+
if (!ctx.skillsRegistry) {
|
|
95284
|
+
return { success: false, error: "Skills not available" };
|
|
95285
|
+
}
|
|
95286
|
+
try {
|
|
95287
|
+
const { name: skillName, content } = await ctx.skillsRegistry.readSkillContent(name);
|
|
95288
|
+
return { success: true, name: skillName, content };
|
|
95289
|
+
} catch {
|
|
95290
|
+
const available = ctx.skillsRegistry.list().map((e) => e.slug).join(", ");
|
|
95291
|
+
return {
|
|
95292
|
+
success: false,
|
|
95293
|
+
error: `Unknown skill "${name}". Available: ${available}`
|
|
95294
|
+
};
|
|
95295
|
+
}
|
|
95296
|
+
}
|
|
95297
|
+
});
|
|
95298
|
+
}
|
|
95273
95299
|
// src/core/agents/offSecAgent/tools/index.ts
|
|
95274
95300
|
function createAllTools(ctx) {
|
|
95275
95301
|
return {
|
|
@@ -95307,7 +95333,8 @@ function createAllTools(ctx) {
|
|
|
95307
95333
|
email_search_messages: emailSearchMessages(ctx),
|
|
95308
95334
|
email_get_message: emailGetMessage(ctx),
|
|
95309
95335
|
web_search: webSearch(ctx),
|
|
95310
|
-
get_page: getPage(ctx)
|
|
95336
|
+
get_page: getPage(ctx),
|
|
95337
|
+
...ctx.skillsRegistry ? { read_skill: readSkill(ctx) } : {}
|
|
95311
95338
|
};
|
|
95312
95339
|
}
|
|
95313
95340
|
var ALL_TOOL_NAMES = [
|
|
@@ -95383,6 +95410,7 @@ var PLAN_MODE_TOOL_NAMES = [
|
|
|
95383
95410
|
"web_search",
|
|
95384
95411
|
"get_page"
|
|
95385
95412
|
];
|
|
95413
|
+
var SKILL_TOOL_NAMES = ["read_skill"];
|
|
95386
95414
|
|
|
95387
95415
|
// src/core/agents/offSecAgent/tools/response.ts
|
|
95388
95416
|
init_zod();
|
|
@@ -96486,7 +96514,8 @@ class OffensiveSecurityAgent {
|
|
|
96486
96514
|
attackSurfaceRegistry: input.attackSurfaceRegistry,
|
|
96487
96515
|
credentialManager,
|
|
96488
96516
|
persistentShell: this.persistentShell,
|
|
96489
|
-
onCommandOutput: input.callbacks?.onCommandOutput
|
|
96517
|
+
onCommandOutput: input.callbacks?.onCommandOutput,
|
|
96518
|
+
skillsRegistry: input.skillsRegistry
|
|
96490
96519
|
});
|
|
96491
96520
|
let tools = input.extraTools ? { ...builtinTools, ...input.extraTools } : { ...builtinTools };
|
|
96492
96521
|
if (input.approvalGate) {
|
|
@@ -96698,4 +96727,4 @@ function wrapToolsWithApprovalGate(tools, gate) {
|
|
|
96698
96727
|
return wrapped;
|
|
96699
96728
|
}
|
|
96700
96729
|
|
|
96701
|
-
export { CweEntrySchema, FindingsRegistry, ALL_TOOL_NAMES, PLAN_MODE_TOOL_NAMES, BASE_SYSTEM_PROMPT, createInitialOperatorState, ApprovalGate, normalizeMessages, sessions, OffensiveSecurityAgent };
|
|
96730
|
+
export { CweEntrySchema, FindingsRegistry, ALL_TOOL_NAMES, PLAN_MODE_TOOL_NAMES, SKILL_TOOL_NAMES, BASE_SYSTEM_PROMPT, createInitialOperatorState, ApprovalGate, normalizeMessages, sessions, OffensiveSecurityAgent };
|
|
@@ -3,7 +3,7 @@ import { spawnSync } from "child_process";
|
|
|
3
3
|
// package.json
|
|
4
4
|
var package_default = {
|
|
5
5
|
name: "@pensar/apex",
|
|
6
|
-
version: "0.0.
|
|
6
|
+
version: "0.0.114-canary.f792214a",
|
|
7
7
|
description: "AI-powered penetration testing CLI tool with terminal UI",
|
|
8
8
|
module: "src/tui/index.tsx",
|
|
9
9
|
main: "build/cli.js",
|
|
@@ -1,23 +1,23 @@
|
|
|
1
1
|
import {
|
|
2
2
|
TargetedPentestAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-q2tc8qhm.js";
|
|
4
4
|
import {
|
|
5
5
|
CodeAgent
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-r9qfcjrr.js";
|
|
7
7
|
import {
|
|
8
8
|
EndpointSchema
|
|
9
|
-
} from "./cli-
|
|
9
|
+
} from "./cli-s46fscp0.js";
|
|
10
10
|
import {
|
|
11
11
|
BlackboxAttackSurfaceAgent
|
|
12
|
-
} from "./cli-
|
|
12
|
+
} from "./cli-x2dp74cp.js";
|
|
13
13
|
import {
|
|
14
14
|
CweEntrySchema,
|
|
15
15
|
FindingsRegistry
|
|
16
|
-
} from "./cli-
|
|
16
|
+
} from "./cli-2hjsjm5s.js";
|
|
17
17
|
import {
|
|
18
18
|
exports_external,
|
|
19
19
|
init_zod
|
|
20
|
-
} from "./cli-
|
|
20
|
+
} from "./cli-tcxy5qkd.js";
|
|
21
21
|
|
|
22
22
|
// src/core/workflows/pentest.ts
|
|
23
23
|
import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
|
|
@@ -1,10 +1,10 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-2hjsjm5s.js";
|
|
4
4
|
import {
|
|
5
5
|
exports_external,
|
|
6
6
|
init_zod
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-tcxy5qkd.js";
|
|
8
8
|
|
|
9
9
|
// src/core/agents/specialized/pentest/agent.ts
|
|
10
10
|
init_zod();
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-2hjsjm5s.js";
|
|
4
4
|
import {
|
|
5
5
|
stepCountIs
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-tcxy5qkd.js";
|
|
7
7
|
|
|
8
8
|
// src/core/agents/specialized/codeAgent/prompts.ts
|
|
9
9
|
var CODE_AGENT_SYSTEM_PROMPT = `You are an expert coding agent with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
2
|
signGatewayRequest
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-zvsgr240.js";
|
|
4
4
|
import {
|
|
5
5
|
config,
|
|
6
6
|
ensureValidToken,
|
|
7
7
|
getPensarGatewayUrl
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-dgfmj3s1.js";
|
|
9
9
|
import {
|
|
10
10
|
getModelInfo
|
|
11
11
|
} from "./cli-0tpx8khk.js";
|
|
@@ -3,11 +3,11 @@ import {
|
|
|
3
3
|
} from "./cli-6gtnyaqf.js";
|
|
4
4
|
import {
|
|
5
5
|
OffensiveSecurityAgent
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-2hjsjm5s.js";
|
|
7
7
|
import {
|
|
8
8
|
hasToolCall,
|
|
9
9
|
stepCountIs
|
|
10
|
-
} from "./cli-
|
|
10
|
+
} from "./cli-tcxy5qkd.js";
|
|
11
11
|
|
|
12
12
|
// src/core/agents/specialized/attackSurface/blackboxAgent.ts
|
|
13
13
|
import { join } from "path";
|
package/build/cli.js
CHANGED
|
@@ -1,12 +1,12 @@
|
|
|
1
1
|
#!/usr/bin/env bun
|
|
2
2
|
// @bun
|
|
3
|
-
import"./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
3
|
+
import"./cli-tcxy5qkd.js";
|
|
4
|
+
import"./cli-zvsgr240.js";
|
|
5
|
+
import"./cli-dgfmj3s1.js";
|
|
6
|
+
import"./cli-cx0g6jf4.js";
|
|
7
7
|
import {
|
|
8
8
|
package_default
|
|
9
|
-
} from "./cli-
|
|
9
|
+
} from "./cli-4g56qmea.js";
|
|
10
10
|
import"./cli-0tpx8khk.js";
|
|
11
11
|
import"./cli-7ckctq7a.js";
|
|
12
12
|
import {
|
|
@@ -16,7 +16,7 @@ import {
|
|
|
16
16
|
// package.json
|
|
17
17
|
var package_default2 = {
|
|
18
18
|
name: "@pensar/apex",
|
|
19
|
-
version: "0.0.
|
|
19
|
+
version: "0.0.114-canary.f792214a",
|
|
20
20
|
description: "AI-powered penetration testing CLI tool with terminal UI",
|
|
21
21
|
module: "src/tui/index.tsx",
|
|
22
22
|
main: "build/cli.js",
|
|
@@ -351,9 +351,9 @@ Global options:
|
|
|
351
351
|
async function runPentest() {
|
|
352
352
|
const { config: config2 } = await import("./main-2483qzbq.js").then((m)=>__toESM(m.default,1));
|
|
353
353
|
config2();
|
|
354
|
-
const { runPentestAgent } = await import("./blackboxPentest-
|
|
355
|
-
const { sessions } = await import("./index-
|
|
356
|
-
const { config: appConfig } = await import("./index-
|
|
354
|
+
const { runPentestAgent } = await import("./blackboxPentest-pavtaqc6.js");
|
|
355
|
+
const { sessions } = await import("./index-tw309xvg.js");
|
|
356
|
+
const { config: appConfig } = await import("./index-xz0w2myr.js");
|
|
357
357
|
const { getDefaultModelForConfig } = await import("./utils-9fhmzzzh.js");
|
|
358
358
|
const target = getArgRequired("--target");
|
|
359
359
|
const cwd = getArg("--cwd");
|
|
@@ -408,9 +408,9 @@ Report: ${reportPath}` : ""}`);
|
|
|
408
408
|
async function runTargetedPentest() {
|
|
409
409
|
const { config: config2 } = await import("./main-2483qzbq.js").then((m)=>__toESM(m.default,1));
|
|
410
410
|
config2();
|
|
411
|
-
const { runTargetedPentestAgent } = await import("./targetedPentest-
|
|
412
|
-
const { sessions } = await import("./index-
|
|
413
|
-
const { config: appConfig } = await import("./index-
|
|
411
|
+
const { runTargetedPentestAgent } = await import("./targetedPentest-ecyf5r05.js");
|
|
412
|
+
const { sessions } = await import("./index-tw309xvg.js");
|
|
413
|
+
const { config: appConfig } = await import("./index-xz0w2myr.js");
|
|
414
414
|
const { getDefaultModelForConfig } = await import("./utils-9fhmzzzh.js");
|
|
415
415
|
const target = getArgRequired("--target");
|
|
416
416
|
const objectives = getAllArgs("--objective");
|
|
@@ -472,25 +472,25 @@ if (command === "version" || command === "--version" || command === "-v") {
|
|
|
472
472
|
await runTargetedPentest();
|
|
473
473
|
} else if (command === "auth") {
|
|
474
474
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
475
|
-
await import("./auth-
|
|
475
|
+
await import("./auth-5mtxy20q.js");
|
|
476
476
|
} else if (command === "uninstall") {
|
|
477
477
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
478
|
-
await import("./uninstall-
|
|
478
|
+
await import("./uninstall-dvfatr60.js");
|
|
479
479
|
} else if (command === "projects") {
|
|
480
480
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
481
|
-
await import("./projects-
|
|
481
|
+
await import("./projects-dfhkbbq7.js");
|
|
482
482
|
} else if (command === "pentests") {
|
|
483
483
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
484
|
-
await import("./pentests-
|
|
484
|
+
await import("./pentests-22dfjtbt.js");
|
|
485
485
|
} else if (command === "issues") {
|
|
486
486
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
487
|
-
await import("./issues-
|
|
487
|
+
await import("./issues-j50x9sc5.js");
|
|
488
488
|
} else if (command === "fixes") {
|
|
489
489
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
490
|
-
await import("./fixes-
|
|
490
|
+
await import("./fixes-v544jyb3.js");
|
|
491
491
|
} else if (command === "logs") {
|
|
492
492
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
493
|
-
await import("./logs-
|
|
493
|
+
await import("./logs-pb78963z.js");
|
|
494
494
|
} else if (command === "doctor") {
|
|
495
495
|
const { runDoctor } = await import("./doctor-b7612pzw.js");
|
|
496
496
|
await runDoctor();
|
|
@@ -500,7 +500,7 @@ if (command === "version" || command === "--version" || command === "-v") {
|
|
|
500
500
|
console.error("All other commands work with Node \u2014 run 'pensar --help'.");
|
|
501
501
|
process.exit(1);
|
|
502
502
|
}
|
|
503
|
-
await import("./index-
|
|
503
|
+
await import("./index-65be6zgt.js");
|
|
504
504
|
} else {
|
|
505
505
|
console.error(`Error: Unknown command '${command}'`);
|
|
506
506
|
console.error();
|