@pensar/apex 0.0.115-canary.3bd03ff8 → 0.0.115-canary.3dff7f8d

package/README.md

@@ -54,6 +54,49 @@ Open the Apex TUI:
 pensar
 ```
 
+### Headless CLI
+
+Run pentests without the TUI for scripting, CI, or evalgate integration:
+
+```bash
+# Basic pentest
+pensar pentest --target https://example.com
+
+# With extended thinking and task-driven mode
+pensar pentest --target https://example.com --extended-thinking --task-driven
+
+# Whitebox (with source code access)
+pensar pentest --target https://example.com --cwd ./my-app
+
+# Targeted pentest with specific objectives
+pensar targeted-pentest --target https://example.com --objective "Test authentication bypass"
+```
+
+| Flag                           | Command                   | Description                                    |
+| ------------------------------ | ------------------------- | ---------------------------------------------- |
+| `--target <url>`               | pentest, targeted-pentest | Target URL (required)                          |
+| `--cwd <path>`                 | pentest                   | Source code path for whitebox mode             |
+| `--mode <mode>`                | pentest                   | `exfil` for pivoting and flag extraction       |
+| `--model <model>`              | pentest, targeted-pentest | AI model (default: auto-selected)              |
+| `--extended-thinking`          | pentest                   | Enable extended thinking for supported models  |
+| `--task-driven`                | pentest                   | Enable task-driven architecture (experimental) |
+| `--prompt <text\|@file>`       | pentest                   | Custom guidance for the agent                  |
+| `--threat-model <text\|@file>` | pentest                   | Threat model to guide testing                  |
+| `--objective <text>`           | targeted-pentest          | Testing objective (repeatable)                 |
+
+### W&B Weave Tracing
+
+Stream step-level agent traces to Weights & Biases Weave for analysis and fine-tuning:
+
+```bash
+export WANDB_API_KEY=your-key
+export WANDB_ENTITY=your-entity
+# WANDB_PROJECT defaults to "apex-traces"
+pensar pentest --target https://example.com
+```
+
+Traces include reasoning steps, tool calls, token usage, and state checkpoints. When credentials are not set, tracing is silently disabled.
+
 ## Kali Linux Container (Optional)
 
 For **best performance**, run Apex in the included Kali Linux container with preconfigured pentest tools:

package/build/agent-8n4fh36j.js

@@ -0,0 +1,17 @@
+import {
+  CodeAgent
+} from "./cli-8wy5b9jj.js";
+import"./cli-y2sz3mcw.js";
+import"./cli-avwxy3m0.js";
+import"./cli-3y0dgy56.js";
+import"./cli-tqgz4vr1.js";
+import"./cli-r8cerdwk.js";
+import"./cli-a8ba6n6t.js";
+import"./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
+import"./cli-7ckctq7a.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-z4ajdp3s.js → agent-t4r3pbb8.js}

@@ -1,19 +1,20 @@
 import {
   WhiteboxAttackSurfaceResultSchema
-} from "./cli-k7n1erh2.js";
+} from "./cli-2qa6mdgp.js";
 import {
   OffensiveSecurityAgent
-} from "./cli-rsrfym9h.js";
-import"./cli-b5ntxjsa.js";
+} from "./cli-y2sz3mcw.js";
+import"./cli-avwxy3m0.js";
+import"./cli-3y0dgy56.js";
 import {
   hasToolCall,
   tool
-} from "./cli-qh2jv1be.js";
-import"./cli-n8r79tnh.js";
-import"./cli-xcq92gq3.js";
-import"./cli-3tdnqq4n.js";
-import"./cli-5r3exzsd.js";
-import"./cli-217my1rx.js";
+} from "./cli-tqgz4vr1.js";
+import"./cli-r8cerdwk.js";
+import"./cli-a8ba6n6t.js";
+import"./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
 import"./cli-7ckctq7a.js";
 import"./cli-8rxa073f.js";
 
@@ -46,8 +47,8 @@ Your primary search tool. Use it to find route definitions, middleware, controll
 - Each application/service you identify (appType: "web_application" or "api")
 - Notable subdomains hosting distinct services (appType: "subdomain")
 - Cloud resources like S3 buckets, cloud storage, CDN origins (appType: "cloud_resource" or "storage")
-  - For S3 buckets: set url to the bucket endpoint (e.g. "https://bucket-name.s3.amazonaws.com") and use appType "storage"
-  - For other cloud resources: set url to the resource endpoint and use appType "cloud_resource"
+  - For S3 buckets: set \`domain\` to the **canonical virtual-hosted-style** endpoint (e.g. "https://bucket-name.s3.amazonaws.com") and use appType "storage". Do NOT use path-style URLs (e.g. "https://s3.amazonaws.com/bucket-name").
+  - For other cloud resources: set \`domain\` to the primary/canonical resource endpoint and use appType "cloud_resource"
 - If known domains are provided, set the \`domain\` field to associate the app with the correct domain
 
 ## document_endpoint
@@ -85,7 +86,9 @@ Call this LAST with your complete structured results. This ends your run.
    - S3 buckets, GCS buckets, Azure Blob Storage (search for bucket names, s3://, storage URLs)
    - CDN distributions (CloudFront, Cloudflare)
    - Infrastructure-as-code definitions (Terraform, CloudFormation, CDK, SST, Pulumi, serverless.yml)
-   - Document each as an app with appType "cloud_resource" or "storage" and set the url to the resource endpoint
+   - Document each as an app with appType "cloud_resource" or "storage" and set the \`domain\` to the **canonical** resource endpoint
+   - **S3 canonical URL:** Always use virtual-hosted-style "https://bucket-name.s3.amazonaws.com" (or with region: "https://bucket-name.s3.us-east-1.amazonaws.com"). Never use path-style "https://s3.amazonaws.com/bucket-name".
+   - **Do NOT document alternative URL formats** as separate endpoints — only document the canonical/primary URL and any distinct functional paths under it
 
 ## Phase 2: APP ANALYSIS (delegate to coding agents)
 For each app you identified, spawn a coding agent with a detailed objective. The objective should instruct the agent to:
@@ -101,7 +104,6 @@ For each app you identified, spawn a coding agent with a detailed objective. The
    - Source-code file in \`file\` (e.g., \`src/routes/users.ts\`) — this is NOT the route
    - Line number in \`line\`
    - Auth requirement in \`authRequired\`
-   - Specific pentest objectives in \`pentestObjectives\`
 
 **IMPORTANT:** Tell each coding agent to set \`appName\` on every \`document_endpoint\` call so endpoints are organized by application.
 

package/build/{auth-g0mfaeem.js → auth-k056m637.js}

@@ -8,14 +8,14 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-n8r79tnh.js";
+} from "./cli-a8ba6n6t.js";
 import {
   config,
   getPensarApiUrl,
   getPensarConsoleUrl
-} from "./cli-xcq92gq3.js";
-import"./cli-3tdnqq4n.js";
-import"./cli-5r3exzsd.js";
+} from "./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/{authentication-abnqr8dq.js → authentication-ssk385g3.js}

@@ -3,16 +3,17 @@ import {
 } from "./cli-6gtnyaqf.js";
 import {
   OffensiveSecurityAgent
-} from "./cli-rsrfym9h.js";
-import"./cli-b5ntxjsa.js";
+} from "./cli-y2sz3mcw.js";
+import"./cli-avwxy3m0.js";
+import"./cli-3y0dgy56.js";
 import {
   hasToolCall
-} from "./cli-qh2jv1be.js";
-import"./cli-n8r79tnh.js";
-import"./cli-xcq92gq3.js";
-import"./cli-3tdnqq4n.js";
-import"./cli-5r3exzsd.js";
-import"./cli-217my1rx.js";
+} from "./cli-tqgz4vr1.js";
+import"./cli-r8cerdwk.js";
+import"./cli-a8ba6n6t.js";
+import"./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
 import"./cli-7ckctq7a.js";
 import"./cli-8rxa073f.js";
 
@@ -86,13 +87,14 @@ Look for:
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
 2. \`browser_snapshot\` to find form fields and their refs
-3. \`browser_fill\` the username/email field (use ref from snapshot)
-4. \`browser_snapshot\` again (page may update after input)
-5. \`browser_fill\` the password field
-6. \`browser_click\` the submit/login button
-7. \`browser_snapshot\` or \`browser_screenshot\` to verify the result
-8. \`browser_get_cookies\` to extract session cookies
-9. Optionally \`browser_evaluate\` to extract tokens from localStorage/sessionStorage:
+3. \`browser_screenshot\` to capture the login page before filling credentials
+4. \`browser_fill\` the username/email field (use ref from snapshot)
+5. \`browser_snapshot\` again (page may update after input)
+6. \`browser_fill\` the password field
+7. \`browser_click\` the submit/login button
+8. \`browser_snapshot\` AND \`browser_screenshot\` to verify and document the post-submit state
+9. \`browser_get_cookies\` to extract session cookies
+10. Optionally \`browser_evaluate\` to extract tokens from localStorage/sessionStorage:
    \`\`\`javascript
    (() => {
      const tokens = {};
@@ -153,11 +155,11 @@ If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "to
 
 # Screenshot Evidence
 
-- Use \`browser_screenshot\` to capture the page state at key moments during authentication
-- **Always screenshot after login attempt** to document success (dashboard/welcome page) or failure (error message)
-- Screenshot any error pages, CAPTCHA challenges, MFA prompts, or unexpected barriers
-- Use descriptive filenames: "login-form", "auth-success", "auth-error", "mfa-prompt", "captcha-detected"
-- Screenshots are automatically stored and displayed in the console logs for debugging
+- **Screenshot liberally.** A human reviews your run after it completes and relies on screenshots to follow along with what the browser actually did. Every time you navigate to a new page, fill a form field, click a button, or observe a state change, call \`browser_screenshot\` so the reviewer can see exactly what you saw. Aim for at least one screenshot per distinct page or state change — screenshots are cheap, missing visual context is not.
+- **Always screenshot after login attempt** to document success (dashboard/welcome page) or failure (error message).
+- Screenshot any error pages, CAPTCHA challenges, MFA prompts, or unexpected barriers.
+- Use descriptive filenames: "login-form", "username-filled", "password-filled", "auth-success", "auth-error", "mfa-prompt", "captcha-detected".
+- Screenshots are automatically stored and displayed in the console logs for debugging and human review.
 `;
 
 // src/core/agents/specialized/authenticationAgent/agent.ts

package/build/blackboxAgent-181b9qak.js

@@ -0,0 +1,18 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-h6jcfm7a.js";
+import"./cli-6gtnyaqf.js";
+import"./cli-y2sz3mcw.js";
+import"./cli-avwxy3m0.js";
+import"./cli-3y0dgy56.js";
+import"./cli-tqgz4vr1.js";
+import"./cli-r8cerdwk.js";
+import"./cli-a8ba6n6t.js";
+import"./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
+import"./cli-7ckctq7a.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/blackboxPentest-mw112zdg.js

@@ -0,0 +1,36 @@
+import {
+  runPentestWorkflow
+} from "./cli-bnyw3j31.js";
+import"./cli-y9mxmfcd.js";
+import"./cli-54e201hd.js";
+import"./cli-h6jcfm7a.js";
+import"./cli-fw5r7pfj.js";
+import"./cli-8wy5b9jj.js";
+import"./cli-6gtnyaqf.js";
+import"./cli-2qa6mdgp.js";
+import"./cli-y2sz3mcw.js";
+import"./cli-avwxy3m0.js";
+import"./cli-3y0dgy56.js";
+import"./cli-tqgz4vr1.js";
+import"./cli-r8cerdwk.js";
+import"./cli-a8ba6n6t.js";
+import"./cli-6bhe5b0c.js";
+import"./cli-02b1whj6.js";
+import"./cli-j1asry8c.js";
+import"./cli-7ckctq7a.js";
+import"./cli-8rxa073f.js";
+
+// src/core/api/blackboxPentest.ts
+async function runPentestAgent(input) {
+  const { findings, findingsPath, pocsPath, reportPath } = await runPentestWorkflow(input);
+  console.log(`
+Found ${findings.length} vulnerabilities`);
+  console.log(`Findings: ${findingsPath}`);
+  console.log(`POCs: ${pocsPath}`);
+  if (reportPath)
+    console.log(`Report: ${reportPath}`);
+  return { findings, findingsPath, pocsPath, reportPath };
+}
+export {
+  runPentestAgent
+};

package/build/{cli-3tdnqq4n.js → cli-02b1whj6.js}

@@ -1,6 +1,6 @@
 import {
   getCurrentVersion
-} from "./cli-5r3exzsd.js";
+} from "./cli-j1asry8c.js";
 
 // src/core/config/config.ts
 import os from "os";

package/build/{cli-k7n1erh2.js → cli-2qa6mdgp.js}

@@ -1,7 +1,7 @@
 import {
   exports_external,
   init_zod
-} from "./cli-qh2jv1be.js";
+} from "./cli-tqgz4vr1.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/types.ts
 init_zod();
@@ -24,8 +24,9 @@ var EndpointSchema = exports_external.object({
   line: exports_external.number().optional().describe("Line number in the file"),
   authRequired: exports_external.boolean().optional().describe("Whether this endpoint appears to require authentication"),
   description: exports_external.string().optional().describe("Brief description of what this endpoint does"),
-  pentestObjectives: exports_external.array(exports_external.string()).describe("Specific pentest objectives for this endpoint (e.g. 'Test for IDOR by enumerating user IDs', 'Test for SQL injection in search parameter')"),
-  riskScore: RiskScoreSchema.optional().describe("AI-calculated risk score for prioritizing pentest efforts")
+  pentestObjectives: exports_external.array(exports_external.string()).default([]).describe("Pentest objectives for this endpoint, derived from the threat model when available " + "(e.g. 'Test for IDOR by enumerating user IDs', 'Test for SQL injection in search parameter')"),
+  riskScore: RiskScoreSchema.optional().describe("AI-calculated risk score for prioritizing pentest efforts"),
+  threatModel: exports_external.string().optional().describe("Endpoint-specific threat model describing attack vectors, data sensitivity, and testing priorities")
 });
 var AppSchema = exports_external.object({
   name: exports_external.string().describe("Application or service name"),