@pensar/apex 0.0.99 → 0.0.100-canary.826dfe3c

package/bin/pensar.js

@@ -66,6 +66,13 @@ if (command === "benchmark") {
 
   // Import and run auth
   await import(authPath);
+} else if (command === "uninstall") {
+  // Run uninstall CLI
+  const uninstallPath = join(__dirname, "..", "build", "uninstall.js");
+
+  process.argv = [process.argv[0], uninstallPath, ...args.slice(1)];
+
+  await import(uninstallPath);
 } else if (command === "upgrade" || command === "update") {
   const currentVersion = getCurrentVersion();
   console.log(`Current version: v${currentVersion}`);
@@ -89,6 +96,7 @@ if (command === "benchmark") {
   console.log();
   console.log("Usage:");
   console.log("  pensar              Launch the TUI (Terminal User Interface)");
+  console.log("  pensar uninstall    Uninstall Pensar (keeps sessions, memories, skills)");
   console.log("  pensar upgrade      Update pensar to the latest version");
   console.log("  pensar help         Show this help message");
   console.log("  pensar version      Show version number");
@@ -181,6 +189,14 @@ if (command === "benchmark") {
   console.log("  pensar auth logout       Disconnect from Pensar Console");
   console.log("  pensar auth status       Show connection status");
   console.log();
+  console.log("Uninstall Usage:");
+  console.log(
+    "  pensar uninstall             Fully uninstall Pensar"
+  );
+  console.log(
+    "  pensar uninstall --force     Skip confirmation prompt"
+  );
+  console.log();
   console.log("Header Modes (for quicktest, pentest, swarm):");
   console.log("  none                     No custom headers added to requests");
   console.log(

package/build/auth.js

@@ -8,7 +8,7 @@ import fs from "fs/promises";
 // package.json
 var package_default = {
   name: "@pensar/apex",
-  version: "0.0.99",
+  version: "0.0.100-canary.826dfe3c",
   description: "AI-powered penetration testing CLI tool with terminal UI",
   module: "src/tui/index.tsx",
   main: "build/index.js",

package/build/index.js

@@ -31880,12 +31880,6 @@ var init_openrouter = __esm(() => {
 var PENSAR_MODELS;
 var init_pensar = __esm(() => {
   PENSAR_MODELS = [
-    {
-      id: "pensar:anthropic.claude-opus-4-6-v1",
-      name: "Claude Opus 4.6 (Pensar)",
-      provider: "pensar",
-      contextLength: 200000
-    },
     {
       id: "pensar:anthropic.claude-sonnet-4-5-20250929-v1:0",
       name: "Claude Sonnet 4.5 (Pensar)",
@@ -31977,7 +31971,7 @@ var package_default2;
 var init_package = __esm(() => {
   package_default2 = {
     name: "@pensar/apex",
-    version: "0.0.99",
+    version: "0.0.100-canary.826dfe3c",
     description: "AI-powered penetration testing CLI tool with terminal UI",
     module: "src/tui/index.tsx",
     main: "build/index.js",
@@ -193797,6 +193791,19 @@ COMMON SEARCH PATTERNS:
     execute: async ({ query }) => {
       try {
         const cfg = await config2.get();
+        const apiUrl = getPensarApiUrl();
+        const body = JSON.stringify({ query });
+        if (cfg.pensarAPIKey && !cfg.accessToken) {
+          const response2 = await fetch(`${apiUrl}/agents/web_search`, {
+            method: "POST",
+            headers: {
+              "Content-Type": "application/json",
+              "x-api-key": cfg.pensarAPIKey
+            },
+            body
+          });
+          return handleSearchResponse(response2);
+        }
         const tokenResult = await ensureValidToken({
           accessToken: cfg.accessToken,
           refreshToken: cfg.refreshToken,
@@ -193823,8 +193830,6 @@ COMMON SEARCH PATTERNS:
             error: "Web search requires authentication. Please sign in again to your Pensar account."
           };
         }
-        const apiUrl = getPensarApiUrl();
-        const body = JSON.stringify({ query });
         const { signature, timestamp, nonce } = signGatewayRequest(cfg.gatewaySigningKey, "web_search", body);
         const response = await fetch(`${apiUrl}/agents/web_search`, {
           method: "POST",
@@ -193838,40 +193843,7 @@ COMMON SEARCH PATTERNS:
           },
           body
         });
-        if (!response.ok) {
-          if (response.status === 401) {
-            return {
-              success: false,
-              results: [],
-              error: "Authentication failed. Please sign in again to your Pensar account."
-            };
-          }
-          if (response.status === 429) {
-            return {
-              success: false,
-              results: [],
-              error: "Rate limit exceeded. Please wait a moment before searching again."
-            };
-          }
-          const errorText = await response.text().catch(() => "Unknown error");
-          return {
-            success: false,
-            results: [],
-            error: `Web search failed: ${response.status} ${response.statusText}. ${errorText}`
-          };
-        }
-        const data = await response.json();
-        if (data.error) {
-          return {
-            success: false,
-            results: [],
-            error: data.error
-          };
-        }
-        return {
-          success: true,
-          results: data.results || []
-        };
+        return handleSearchResponse(response);
       } catch (error40) {
         const errorMsg = error40 instanceof Error ? error40.message : String(error40);
         return {
@@ -193883,6 +193855,42 @@ COMMON SEARCH PATTERNS:
     }
   });
 }
+async function handleSearchResponse(response) {
+  if (!response.ok) {
+    if (response.status === 401) {
+      return {
+        success: false,
+        results: [],
+        error: "Authentication failed. Please sign in again to your Pensar account."
+      };
+    }
+    if (response.status === 429) {
+      return {
+        success: false,
+        results: [],
+        error: "Rate limit exceeded. Please wait a moment before searching again."
+      };
+    }
+    const errorText = await response.text().catch(() => "Unknown error");
+    return {
+      success: false,
+      results: [],
+      error: `Web search failed: ${response.status} ${response.statusText}. ${errorText}`
+    };
+  }
+  const data = await response.json();
+  if (data.error) {
+    return {
+      success: false,
+      results: [],
+      error: data.error
+    };
+  }
+  return {
+    success: true,
+    results: data.results || []
+  };
+}
 var webSearchInputSchema2;
 var init_webSearch = __esm(() => {
   init_dist5();
@@ -194042,7 +194050,7 @@ function createAllTools(ctx4) {
     get_page: getPage(ctx4)
   };
 }
-var ALL_TOOL_NAMES;
+var ALL_TOOL_NAMES, PLAN_MODE_TOOL_NAMES;
 var init_tools = __esm(() => {
   init_browserTools();
   init_sandboxPlaywright();
@@ -194151,6 +194159,40 @@ var init_tools = __esm(() => {
     "web_search",
     "get_page"
   ];
+  PLAN_MODE_TOOL_NAMES = [
+    "browser_navigate",
+    "browser_snapshot",
+    "browser_screenshot",
+    "browser_click",
+    "browser_fill",
+    "browser_evaluate",
+    "browser_console",
+    "browser_get_cookies",
+    "execute_command",
+    "http_request",
+    "read_file",
+    "list_files",
+    "grep",
+    "authenticate_session",
+    "delegate_to_auth_subagent",
+    "create_attack_surface_report",
+    "complete_authentication",
+    "run_attack_surface",
+    "spawn_pentest_swarm",
+    "spawn_coding_agent",
+    "provide_comparison_results",
+    "add_memory",
+    "list_memories",
+    "get_memory",
+    "email_list_inboxes",
+    "email_list_messages",
+    "email_get_message",
+    "email_search_messages",
+    "email_get_attachments",
+    "email_mark_read",
+    "web_search",
+    "get_page"
+  ];
 });
 
 // src/core/agents/offSecAgent/tools/response.ts
@@ -194892,7 +194934,11 @@ var init_offensiveSecurityAgent = __esm(() => {
       }
       const hasEmail = (input.session.config?.emailIntegration?.inboxes?.length ?? 0) > 0;
       const emailToolSet = new Set(EMAIL_TOOL_NAMES);
-      const activeTools = hasEmail ? input.activeTools : input.activeTools.filter((t3) => !emailToolSet.has(t3));
+      let activeTools = hasEmail ? input.activeTools : input.activeTools.filter((t3) => !emailToolSet.has(t3));
+      if (input.mode === "plan") {
+        const planSet = new Set(PLAN_MODE_TOOL_NAMES);
+        activeTools = activeTools.filter((t3) => planSet.has(t3));
+      }
       const messagesDir = input.messagesDir ?? input.session.rootPath;
       if (!existsSync21(messagesDir)) {
         mkdirSync10(messagesDir, { recursive: true });
@@ -276318,6 +276364,37 @@ var providerOrder = [
   "bedrock",
   "local"
 ];
+function setsAreEqual(a, b2) {
+  return a.size === b2.size && [...a].every((value) => b2.has(value));
+}
+function PickerRow({
+  children,
+  id,
+  paddingLeft,
+  paddingRight,
+  backgroundColor,
+  flexDirection = "row",
+  gap = 0
+}) {
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+    id,
+    width: "100%",
+    overflow: "hidden",
+    flexDirection,
+    paddingLeft,
+    paddingRight,
+    backgroundColor,
+    gap,
+    children
+  }, undefined, false, undefined, this);
+}
+function getNavItemId(item) {
+  if (item.type === "provider")
+    return `provider-${item.provider}`;
+  if (item.type === "model")
+    return `model-${item.model.id}`;
+  return `local-input-${item.field}`;
+}
 function ModelPicker({
   config: config3,
   selectedModel,
@@ -276328,6 +276405,7 @@ function ModelPicker({
   isModelUserSelected = false
 }) {
   const { colors: colors2 } = useTheme();
+  const scrollBoxRef = import_react34.useRef(null);
   const [availableModels, setAvailableModels] = import_react34.useState([]);
   const [searchQuery, setSearchQuery] = import_react34.useState("");
   const [expandedProviders, setExpandedProviders] = import_react34.useState(new Set(["anthropic"]));
@@ -276340,17 +276418,29 @@ function ModelPicker({
     setLocalModelName(config3?.localModelName ?? "");
   }, [config3?.localModelUrl, config3?.localModelName]);
   import_react34.useEffect(() => {
-    if (config3) {
-      const models = getAvailableModels(config3);
-      setAvailableModels(models);
-      if (models.length > 0) {
-        const currentModel = models.find((m2) => m2.id === selectedModel.id) || models[0];
-        if (currentModel) {
-          setExpandedProviders(new Set([currentModel.provider]));
-        }
-      }
+    if (!config3) {
+      setAvailableModels([]);
+      return;
     }
-  }, [config3, selectedModel.id]);
+    setAvailableModels(getAvailableModels(config3));
+  }, [config3]);
+  import_react34.useEffect(() => {
+    const availableProviders = new Set(availableModels.map((model) => model.provider));
+    setExpandedProviders((prev) => {
+      if (availableProviders.size === 0) {
+        return prev.size === 0 ? prev : new Set;
+      }
+      const preservedProviders = new Set([...prev].filter((provider) => availableProviders.has(provider)));
+      if (preservedProviders.size > 0) {
+        return setsAreEqual(prev, preservedProviders) ? prev : preservedProviders;
+      }
+      const fallbackProvider = availableProviders.has(selectedModel.provider) ? selectedModel.provider : availableModels[0]?.provider;
+      if (!fallbackProvider) {
+        return prev.size === 0 ? prev : new Set;
+      }
+      return prev.size === 1 && prev.has(fallbackProvider) ? prev : new Set([fallbackProvider]);
+    });
+  }, [availableModels, selectedModel.provider]);
   const groupedModels = import_react34.useMemo(() => {
     const groups = {};
     const query = searchQuery.toLowerCase().trim();
@@ -276403,6 +276493,12 @@ function ModelPicker({
   import_react34.useEffect(() => {
     setFocusedIndex((prev) => Math.min(prev, Math.max(0, navigationItems.length - 1)));
   }, [navigationItems.length]);
+  import_react34.useEffect(() => {
+    const item = navigationItems[focusedIndex];
+    if (!item)
+      return;
+    scrollToChild(scrollBoxRef.current, getNavItemId(item));
+  }, [focusedIndex, navigationItems]);
   const commitLocalConfig = import_react34.useCallback((url2, modelName) => {
     if (!onConfigUpdate)
       return;
@@ -276510,169 +276606,206 @@ function ModelPicker({
   useKeyboard((key) => {
     handleKeyboard(key);
   });
+  const isProviderFocused = (provider) => navigationItems[focusedIndex]?.type === "provider" && navigationItems[focusedIndex].provider === provider;
+  const isModelFocused = (modelId) => navigationItems[focusedIndex]?.type === "model" && navigationItems[focusedIndex].model.id === modelId;
+  const isLocalFieldFocused = (field) => navigationItems[focusedIndex]?.type === "local-input" && navigationItems[focusedIndex].field === field;
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
     flexDirection: "column",
     gap: 0,
+    width: "100%",
+    flexGrow: 1,
+    flexShrink: 1,
+    overflow: "hidden",
     children: [
-      searchQuery ? /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-        fg: colors2.text,
-        children: [
-          "Search: ",
-          searchQuery,
-          "_"
-        ]
-      }, undefined, true, undefined, this) : /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-        fg: colors2.textMuted,
-        children: "Type to search models..."
+      searchQuery ? /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+        children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+          fg: colors2.text,
+          children: [
+            "Search: ",
+            searchQuery
+          ]
+        }, undefined, true, undefined, this)
+      }, undefined, false, undefined, this) : /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+        children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+          fg: colors2.textMuted,
+          children: "Type to search models..."
+        }, undefined, false, undefined, this)
       }, undefined, false, undefined, this),
-      providerOrder.map((provider) => {
-        const isExpanded = expandedProviders.has(provider);
-        const providerName = providerNames[provider] || provider;
-        const isProviderFocused = navigationItems[focusedIndex]?.type === "provider" && navigationItems[focusedIndex].provider === provider;
-        if (provider === "local") {
-          const localModels = groupedModels["local"];
-          const modelCount = localModels?.length ?? 0;
-          return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-            flexDirection: "column",
-            gap: 0,
-            children: [
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                fg: isProviderFocused ? colors2.primary : isExpanded ? colors2.text : colors2.textMuted,
+      /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("scrollbox", {
+        ref: scrollBoxRef,
+        style: {
+          rootOptions: {
+            flexGrow: 1,
+            flexShrink: 1,
+            width: "100%",
+            overflow: "hidden"
+          },
+          contentOptions: {
+            flexDirection: "column"
+          },
+          scrollbarOptions: {
+            visible: false
+          }
+        },
+        stickyScroll: false,
+        children: providerOrder.flatMap((provider) => {
+          const isExpanded = expandedProviders.has(provider);
+          const providerName = providerNames[provider] || provider;
+          const isFocused = isProviderFocused(provider);
+          if (provider === "local") {
+            const localModels = groupedModels["local"];
+            const modelCount = localModels?.length ?? 0;
+            const elements2 = [];
+            elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+              id: "provider-local",
+              children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: isFocused ? colors2.primary : isExpanded ? colors2.text : colors2.textMuted,
                 children: [
-                  isProviderFocused ? "❯" : isExpanded ? "▾" : "▸",
+                  isFocused ? "❯" : isExpanded ? "▾" : "▸",
                   " ",
                   providerName,
                   modelCount > 0 ? ` (${modelCount})` : ""
                 ]
-              }, undefined, true, undefined, this),
-              isExpanded && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-                flexDirection: "column",
-                gap: 0,
-                paddingLeft: 2,
-                children: [
-                  (() => {
-                    const isUrlFocused = navigationItems[focusedIndex]?.type === "local-input" && navigationItems[focusedIndex].field === "url";
-                    const isUrlEditing = editingLocalField === "url";
-                    if (isUrlEditing) {
-                      return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-                        flexDirection: "row",
-                        children: [
-                          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                            fg: colors2.primary,
-                            children: " URL: "
-                          }, undefined, false, undefined, this),
-                          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("input", {
-                            focused: true,
-                            value: localUrl,
-                            backgroundColor: "transparent",
-                            cursorColor: colors2.textMuted,
-                            onInput: (v2) => setLocalUrl(typeof v2 === "string" ? v2 : ""),
-                            onPaste: (event) => {
-                              const cleaned = String(event.text).replace(/\r?\n/g, "");
-                              setLocalUrl((prev) => `${prev}${cleaned}`);
-                            },
-                            onSubmit: finishEditing
-                          }, undefined, false, undefined, this)
-                        ]
-                      }, undefined, true, undefined, this);
-                    }
-                    return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                      fg: isUrlFocused ? colors2.primary : colors2.textMuted,
-                      children: `  URL: ${localUrl || "(press Enter to set)"}`
-                    }, undefined, false, undefined, this);
-                  })(),
-                  (() => {
-                    const isModelFocused = navigationItems[focusedIndex]?.type === "local-input" && navigationItems[focusedIndex].field === "model";
-                    const isModelEditing = editingLocalField === "model";
-                    if (isModelEditing) {
-                      return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-                        flexDirection: "row",
-                        children: [
-                          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                            fg: colors2.primary,
-                            children: " Model: "
-                          }, undefined, false, undefined, this),
-                          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("input", {
-                            focused: true,
-                            value: localModelName,
-                            backgroundColor: "transparent",
-                            cursorColor: colors2.textMuted,
-                            onInput: (v2) => setLocalModelName(typeof v2 === "string" ? v2 : ""),
-                            onPaste: (event) => {
-                              const cleaned = String(event.text).replace(/\r?\n/g, "");
-                              setLocalModelName((prev) => `${prev}${cleaned}`);
-                            },
-                            onSubmit: finishEditing
-                          }, undefined, false, undefined, this)
-                        ]
-                      }, undefined, true, undefined, this);
-                    }
-                    return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                      fg: isModelFocused ? colors2.primary : colors2.textMuted,
-                      children: `  Model: ${localModelName || "(press Enter to set)"}`
-                    }, undefined, false, undefined, this);
-                  })(),
-                  localModels?.map((m2) => {
-                    const isSelected = m2.id === selectedModel.id;
-                    const isFocused = navigationItems[focusedIndex]?.type === "model" && navigationItems[focusedIndex].model.id === m2.id;
-                    return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                      fg: isFocused ? colors2.primary : colors2.textMuted,
+              }, undefined, true, undefined, this)
+            }, "local", false, undefined, this));
+            if (isExpanded) {
+              const isUrlFocused = isLocalFieldFocused("url");
+              const isUrlEditing = editingLocalField === "url";
+              if (isUrlEditing) {
+                elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                  id: "local-input-url",
+                  paddingLeft: 2,
+                  children: [
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                      fg: colors2.primary,
+                      children: " URL: "
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("input", {
+                      focused: true,
+                      value: localUrl,
+                      backgroundColor: "transparent",
+                      cursorColor: colors2.textMuted,
+                      onInput: (v2) => setLocalUrl(typeof v2 === "string" ? v2 : ""),
+                      onPaste: (event) => {
+                        const cleaned = String(event.text).replace(/\r?\n/g, "");
+                        setLocalUrl((prev) => `${prev}${cleaned}`);
+                      },
+                      onSubmit: finishEditing
+                    }, undefined, false, undefined, this)
+                  ]
+                }, "local-url", true, undefined, this));
+              } else {
+                elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                  id: "local-input-url",
+                  paddingLeft: 2,
+                  children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                    fg: isUrlFocused ? colors2.primary : colors2.textMuted,
+                    children: `  URL: ${localUrl || "(press Enter to set)"}`
+                  }, undefined, false, undefined, this)
+                }, "local-url", false, undefined, this));
+              }
+              const isModelFieldFocused = isLocalFieldFocused("model");
+              const isModelEditing = editingLocalField === "model";
+              if (isModelEditing) {
+                elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                  id: "local-input-model",
+                  paddingLeft: 2,
+                  children: [
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                      fg: colors2.primary,
+                      children: " Model: "
+                    }, undefined, false, undefined, this),
+                    /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("input", {
+                      focused: true,
+                      value: localModelName,
+                      backgroundColor: "transparent",
+                      cursorColor: colors2.textMuted,
+                      onInput: (v2) => setLocalModelName(typeof v2 === "string" ? v2 : ""),
+                      onPaste: (event) => {
+                        const cleaned = String(event.text).replace(/\r?\n/g, "");
+                        setLocalModelName((prev) => `${prev}${cleaned}`);
+                      },
+                      onSubmit: finishEditing
+                    }, undefined, false, undefined, this)
+                  ]
+                }, "local-model", true, undefined, this));
+              } else {
+                elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                  id: "local-input-model",
+                  paddingLeft: 2,
+                  children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                    fg: isModelFieldFocused ? colors2.primary : colors2.textMuted,
+                    children: `  Model: ${localModelName || "(press Enter to set)"}`
+                  }, undefined, false, undefined, this)
+                }, "local-model", false, undefined, this));
+              }
+              if (localModels) {
+                for (const m2 of localModels) {
+                  const isSelected = m2.id === selectedModel.id;
+                  const isMFocused = isModelFocused(m2.id);
+                  elements2.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                    id: `model-${m2.id}`,
+                    paddingLeft: 2,
+                    children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                      fg: isMFocused ? colors2.primary : colors2.textMuted,
                       children: [
                         isSelected ? "●" : "○",
                         " ",
                         m2.name
                       ]
-                    }, m2.id, true, undefined, this);
-                  })
-                ]
-              }, undefined, true, undefined, this)
-            ]
-          }, "local", true, undefined, this);
-        }
-        const models = groupedModels[provider];
-        if (!models || models.length === 0)
-          return null;
-        return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-          flexDirection: "column",
-          gap: 0,
-          children: [
-            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-              fg: isProviderFocused ? colors2.primary : isExpanded ? colors2.text : colors2.textMuted,
+                    }, undefined, true, undefined, this)
+                  }, m2.id, false, undefined, this));
+                }
+              }
+            }
+            return elements2;
+          }
+          const models = groupedModels[provider];
+          if (!models || models.length === 0)
+            return [];
+          const elements = [];
+          elements.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+            id: `provider-${provider}`,
+            children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+              fg: isFocused ? colors2.primary : isExpanded ? colors2.text : colors2.textMuted,
               children: [
-                isProviderFocused ? "❯" : isExpanded ? "▾" : "▸",
+                isFocused ? "❯" : isExpanded ? "▾" : "▸",
                 " ",
                 providerName,
-                " ",
-                "(",
+                " (",
                 models.length,
                 ")"
               ]
-            }, undefined, true, undefined, this),
-            isExpanded && /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
-              flexDirection: "column",
-              gap: 0,
-              paddingLeft: 2,
-              children: models.map((m2) => {
-                const isSelected = m2.id === selectedModel.id;
-                const isFocused = navigationItems[focusedIndex]?.type === "model" && navigationItems[focusedIndex].model.id === m2.id;
-                const isDefault = m2.id === "claude-haiku-4-5" || m2.id === "gpt-4o-mini";
-                return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-                  fg: isFocused ? colors2.primary : colors2.textMuted,
+            }, undefined, true, undefined, this)
+          }, provider, false, undefined, this));
+          if (isExpanded) {
+            for (const m2 of models) {
+              const isSelected = m2.id === selectedModel.id;
+              const isMFocused = isModelFocused(m2.id);
+              const isDefault = m2.id === "claude-haiku-4-5" || m2.id === "gpt-4o-mini";
+              elements.push(/* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+                id: `model-${m2.id}`,
+                paddingLeft: 2,
+                children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                  fg: isMFocused ? colors2.primary : colors2.textMuted,
                   children: [
                     isSelected ? "●" : "○",
                     " ",
                     m2.name,
                     isDefault && !isModelUserSelected && isSelected ? " [default]" : ""
                   ]
-                }, m2.id, true, undefined, this);
-              })
-            }, undefined, false, undefined, this)
-          ]
-        }, provider, true, undefined, this);
-      }),
-      /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-        fg: colors2.textMuted,
-        children: editingLocalField ? "Type or paste | Enter/Esc to confirm" : "↑/↓ navigate | ←/→ collapse/expand | Type to search"
+                }, undefined, true, undefined, this)
+              }, m2.id, false, undefined, this));
+            }
+          }
+          return elements;
+        })
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(PickerRow, {
+        children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+          fg: colors2.textMuted,
+          children: editingLocalField ? "Type or paste | Enter/Esc to confirm" : "↑/↓ navigate | ←/→ collapse/expand | Type to search"
+        }, undefined, false, undefined, this)
       }, undefined, false, undefined, this)
     ]
   }, undefined, true, undefined, this);
@@ -276847,7 +276980,8 @@ function ConfigView({ config: config3, onBack, onStart }) {
             borderColor: focusedField === "model" ? colors2.primary : colors2.border,
             paddingLeft: 1,
             paddingRight: 1,
-            maxHeight: 8,
+            height: 8,
+            overflow: "hidden",
             children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ModelPicker, {
               config: config3,
               selectedModel,
@@ -280254,6 +280388,13 @@ function HelpDialog() {
   }, undefined, false, undefined, this);
 }
 // src/tui/components/commands/models-display.tsx
+function ClippedLine({ children }) {
+  return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
+    width: "100%",
+    overflow: "hidden",
+    children
+  }, undefined, false, undefined, this);
+}
 function ModelsDisplay() {
   const { colors: colors2 } = useTheme();
   const route = useRoute();
@@ -280281,42 +280422,52 @@ function ModelsDisplay() {
   return /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
     flexDirection: "column",
     width: "100%",
+    height: "100%",
     paddingLeft: 4,
+    paddingRight: 4,
     paddingTop: 2,
+    overflow: "hidden",
     children: [
-      /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-        children: [
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-            fg: colors2.primary,
-            children: "█ "
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-            fg: colors2.text,
-            children: "Select AI Model"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-            fg: colors2.textMuted,
-            children: [
-              " (",
-              model.name,
-              ")"
-            ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-            fg: colors2.textMuted,
-            children: [
-              " ",
-              "[",
-              isModelUserSelected ? "user" : "default",
-              "]"
-            ]
-          }, undefined, true, undefined, this)
-        ]
-      }, undefined, true, undefined, this),
+      /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ClippedLine, {
+        children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+          children: [
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+              fg: colors2.primary,
+              children: "█ "
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+              fg: colors2.text,
+              children: "Select AI Model"
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+              fg: colors2.textMuted,
+              children: [
+                " (",
+                model.name,
+                ")"
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+              fg: colors2.textMuted,
+              children: [
+                " ",
+                "[",
+                isModelUserSelected ? "user" : "default",
+                "]"
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this)
+      }, undefined, false, undefined, this),
       /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("box", {
         flexDirection: "column",
+        width: "100%",
         paddingLeft: 2,
+        paddingRight: 2,
         marginTop: 1,
+        flexGrow: 1,
+        flexShrink: 1,
+        overflow: "hidden",
         children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ModelPicker, {
           config: config3.data,
           selectedModel: model,
@@ -280331,66 +280482,72 @@ function ModelsDisplay() {
         flexDirection: "column",
         marginTop: 2,
         children: [
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            children: [
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.primary,
-                children: "█ "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: "Press "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.text,
-                children: "[Enter]"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: " to confirm"
-              }, undefined, false, undefined, this)
-            ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            children: [
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.primary,
-                children: "█ "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: "Press "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.text,
-                children: "[ESC]"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: " to go back"
-              }, undefined, false, undefined, this)
-            ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
-            children: [
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.primary,
-                children: "█ "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: "Press "
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.text,
-                children: "[Ctrl+P]"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
-                fg: colors2.textMuted,
-                children: " to connect provider"
-              }, undefined, false, undefined, this)
-            ]
-          }, undefined, true, undefined, this)
+          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ClippedLine, {
+            children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+              children: [
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.primary,
+                  children: "█ "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: "Press "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.text,
+                  children: "[Enter]"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: " to confirm"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this)
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ClippedLine, {
+            children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+              children: [
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.primary,
+                  children: "█ "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: "Press "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.text,
+                  children: "[ESC]"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: " to go back"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this)
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV(ClippedLine, {
+            children: /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+              children: [
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.primary,
+                  children: "█ "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: "Press "
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.text,
+                  children: "[Ctrl+P]"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("span", {
+                  fg: colors2.textMuted,
+                  children: " to connect provider"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this)
+          }, undefined, false, undefined, this)
         ]
       }, undefined, true, undefined, this)
     ]
@@ -286458,8 +286615,10 @@ function resolveKeyboardShortcut(key, status, inputValue, hasPendingApprovals, d
     return { type: "toggle-verbose" };
   if (key.ctrl && key.name === "l")
     return { type: "toggle-expanded-logs" };
-  if (key.name === "tab" && key.shift)
+  if (key.name === "tab" && key.shift && key.meta)
     return { type: "toggle-approval" };
+  if (key.name === "tab" && key.shift)
+    return { type: "toggle-mode" };
   if (status === "waiting" && hasPendingApprovals && (key.name === "y" || key.raw === "Y")) {
     return { type: "approve" };
   }
@@ -286474,7 +286633,9 @@ function resolveAbortAction(commandCancelled, cancelCommand) {
   }
   return { type: "kill-agent" };
 }
-function buildOperatorSystemPrompt(target, operatorState) {
+function buildOperatorSystemPrompt(target, operatorState, agentMode) {
+  const modeNote = agentMode === "plan" ? `
+Agent mode: PLAN — read-only tools only, no mutations allowed` : "";
   return `${BASE_SYSTEM_PROMPT}
 
 # Operator Mode
@@ -286483,7 +286644,7 @@ You are operating in interactive operator mode. The human operator will guide yo
 
 Target: ${target || "unknown"}
 Stage: ${operatorState.currentStage}
-Command approval: ${operatorState.requireApproval ? "enabled — the operator will approve each tool call" : "disabled — tool calls execute automatically"}`;
+Command approval: ${operatorState.requireApproval ? "enabled — the operator will approve each tool call" : "disabled — tool calls execute automatically"}${modeNote}`;
 }
 function resolveInputFocused(status, dialogStackLength, externalDialogOpen) {
   return status !== "running" && dialogStackLength === 0 && !externalDialogOpen;
@@ -286653,6 +286814,7 @@ function OperatorDashboard({
   const [lastApprovedAction, setLastApprovedAction] = import_react79.useState(null);
   const [verboseMode, setVerboseMode] = import_react79.useState(false);
   const [expandedLogs, setExpandedLogs] = import_react79.useState(false);
+  const [agentMode, setAgentMode] = import_react79.useState("default");
   const tokenUsageRef = import_react79.useRef(tokenUsage);
   import_react79.useEffect(() => {
     tokenUsageRef.current = tokenUsage;
@@ -287095,7 +287257,10 @@ function OperatorDashboard({
       messages: nextMessages,
       stopWhen: [stepCountIs(1e4)],
       target: initialConfig?.target,
-      activeTools: [...ALL_TOOL_NAMES],
+      activeTools: [
+        ...agentMode === "plan" ? PLAN_MODE_TOOL_NAMES : ALL_TOOL_NAMES
+      ],
+      mode: agentMode,
       abortSignal: controller.signal,
       authConfig: buildAuthConfig(config3.data),
       approvalGate: approvalGateRef.current,
@@ -287111,7 +287276,7 @@ function OperatorDashboard({
       if (session) {
         agentResult = await runOffensiveSecurityAgent({
           ...commonInput,
-          system: buildOperatorSystemPrompt(initialConfig?.target, operatorState),
+          system: buildOperatorSystemPrompt(initialConfig?.target, operatorState, agentMode),
           session
         });
       } else {
@@ -287127,7 +287292,7 @@ function OperatorDashboard({
         };
         agentResult = await runOffensiveSecurityAgent({
           ...commonInput,
-          system: buildOperatorSystemPrompt(initialConfig?.target, operatorState),
+          system: buildOperatorSystemPrompt(initialConfig?.target, operatorState, agentMode),
           sessionConfig,
           onNameGenerated: (name26) => {
             pendingNameRef.current = name26;
@@ -287192,6 +287357,7 @@ function OperatorDashboard({
     model.id,
     config3.data,
     operatorState,
+    agentMode,
     addTokenUsage,
     appendText,
     addStreamingToolCall,
@@ -287382,6 +287548,9 @@ function OperatorDashboard({
       return { ...prev, requireApproval: newVal };
     });
   }, []);
+  const toggleMode = import_react79.useCallback(() => {
+    setAgentMode((prev) => prev === "default" ? "plan" : "default");
+  }, []);
   useKeyboard((key) => {
     if (status === "running" && queuedMessages.length > 0 && !inputValue.trim()) {
       if (key.name === "up") {
@@ -287453,6 +287622,9 @@ function OperatorDashboard({
       case "toggle-approval":
         toggleApproval();
         return;
+      case "toggle-mode":
+        toggleMode();
+        return;
       case "approve":
         handleApprove();
         return;
@@ -287548,6 +287720,10 @@ function OperatorDashboard({
             flexDirection: "row",
             gap: 2,
             children: [
+              /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
+                fg: agentMode === "plan" ? colors2.warning : colors2.primary,
+                children: agentMode === "plan" ? "PLAN" : "DEFAULT"
+              }, undefined, false, undefined, this),
               /* @__PURE__ */ import_jsx_dev_runtime2.jsxDEV("text", {
                 fg: operatorState.requireApproval ? colors2.warning : colors2.primary,
                 children: operatorState.requireApproval ? "APPROVAL ON" : "APPROVAL OFF"
@@ -287591,7 +287767,7 @@ function OperatorDashboard({
         focused: status === "running" ? selectedQueueIndex < 0 : resolveInputFocused(status, stack.length, externalDialogOpen),
         status: status === "waiting" ? "running" : status,
         mode: "operator",
-        operatorMode: operatorState.mode,
+        operatorMode: agentMode === "plan" ? "plan" : operatorState.mode,
         verboseMode,
         expandedLogs,
         pendingApproval: currentPending,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pensar/apex",
-  "version": "0.0.99",
+  "version": "0.0.100-canary.826dfe3c",
   "description": "AI-powered penetration testing CLI tool with terminal UI",
   "module": "src/tui/index.tsx",
   "main": "build/index.js",