@pensar/apex 1.1.0 → 1.2.0-canary.2ce69867

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (39) hide show
  1. package/build/agent-be8vym2e.js +18 -0
  2. package/build/{agent-wmynfx37.js → agent-hyttwsgv.js} +8 -8
  3. package/build/{auth-p2n15nfp.js → auth-0zjc84z7.js} +4 -4
  4. package/build/{authentication-ngxxzcvc.js → authentication-9dn25mm0.js} +7 -7
  5. package/build/blackboxAgent-prm6rrg4.js +18 -0
  6. package/build/{blackboxPentest-7jvcbz3f.js → blackboxPentest-123gpn1d.js} +13 -13
  7. package/build/{cli-gs7zy230.js → cli-1kn59fwk.js} +2 -2
  8. package/build/{cli-d5mcmzp1.js → cli-4rem64vw.js} +1 -1
  9. package/build/{cli-nwcvgx5m.js → cli-5kb1y9mm.js} +7 -7
  10. package/build/{cli-mazg4ajq.js → cli-68f3aaqf.js} +2 -2
  11. package/build/{cli-t1nkahx2.js → cli-7qew32h4.js} +1 -1
  12. package/build/{cli-6negm843.js → cli-8ph9fkgb.js} +1 -1
  13. package/build/{cli-1xdc0keq.js → cli-cyn21y8w.js} +1 -1
  14. package/build/{cli-yvnb3k0x.js → cli-fz1h9fpq.js} +1 -1
  15. package/build/{cli-06q6sz4x.js → cli-g6j8hr3k.js} +2 -2
  16. package/build/{cli-st6vsbzv.js → cli-gvwvpgxk.js} +1 -1
  17. package/build/{cli-1tv4x6xh.js → cli-jyk9tqwp.js} +2 -2
  18. package/build/{cli-ch1yfrj1.js → cli-kvc3z9fg.js} +2 -2
  19. package/build/{cli-tyrzasca.js → cli-mt3sq6yt.js} +63 -24
  20. package/build/{cli-ahmpjgg6.js → cli-pcaza9pg.js} +1 -1
  21. package/build/{cli-5xfjvm8j.js → cli-zwvp566y.js} +1 -1
  22. package/build/cli.js +34 -22
  23. package/build/{fixes-p4e3bjcg.js → fixes-rkk0t5s0.js} +4 -4
  24. package/build/{index-gpvx8y17.js → index-2zfe6gt3.js} +4 -4
  25. package/build/{index-esgrht7q.js → index-375975ry.js} +6 -6
  26. package/build/{index-m6gw4113.js → index-brc5g4zn.js} +2 -2
  27. package/build/{index-ywrq8mhc.js → index-sg2a5de2.js} +2197 -1531
  28. package/build/{issues-8had86x1.js → issues-xp2xzz90.js} +4 -4
  29. package/build/{logs-3fpd8xq8.js → logs-ayaqjbdq.js} +4 -4
  30. package/build/pentest-j32zdm0d.js +28 -0
  31. package/build/{pentests-tqv6zrqy.js → pentests-2eskyf75.js} +4 -4
  32. package/build/{projects-eh2g7061.js → projects-1qzspfg2.js} +4 -4
  33. package/build/{targetedPentest-60td56me.js → targetedPentest-9jzwb37n.js} +8 -8
  34. package/build/{threatModel-v46xygtn.js → threatModel-vx15n3qn.js} +8 -8
  35. package/build/{uninstall-vz6jzt86.js → uninstall-phbe1zc6.js} +1 -1
  36. package/package.json +1 -1
  37. package/build/agent-0jmzw6zx.js +0 -18
  38. package/build/blackboxAgent-v698p7e4.js +0 -18
  39. package/build/pentest-4ty38pt8.js +0 -28
@@ -0,0 +1,18 @@
1
+ import {
2
+ CodeAgent
3
+ } from "./cli-68f3aaqf.js";
4
+ import"./cli-mt3sq6yt.js";
5
+ import"./cli-tp1tqn3k.js";
6
+ import"./cli-8ph9fkgb.js";
7
+ import"./cli-3y0dgy56.js";
8
+ import"./cli-jyk9tqwp.js";
9
+ import"./cli-03z6pswp.js";
10
+ import"./cli-7qew32h4.js";
11
+ import"./cli-zwvp566y.js";
12
+ import"./cli-fz1h9fpq.js";
13
+ import"./cli-gvwvpgxk.js";
14
+ import"./cli-gpnb45ck.js";
15
+ import"./cli-8rxa073f.js";
16
+ export {
17
+ CodeAgent
18
+ };
@@ -1,21 +1,21 @@
1
1
  import {
2
2
  WhiteboxAttackSurfaceResultSchema
3
- } from "./cli-1xdc0keq.js";
3
+ } from "./cli-cyn21y8w.js";
4
4
  import {
5
5
  OffensiveSecurityAgent
6
- } from "./cli-tyrzasca.js";
6
+ } from "./cli-mt3sq6yt.js";
7
7
  import"./cli-tp1tqn3k.js";
8
- import"./cli-6negm843.js";
8
+ import"./cli-8ph9fkgb.js";
9
9
  import"./cli-3y0dgy56.js";
10
10
  import {
11
11
  hasToolCall,
12
12
  tool
13
- } from "./cli-1tv4x6xh.js";
13
+ } from "./cli-jyk9tqwp.js";
14
14
  import"./cli-03z6pswp.js";
15
- import"./cli-t1nkahx2.js";
16
- import"./cli-5xfjvm8j.js";
17
- import"./cli-yvnb3k0x.js";
18
- import"./cli-st6vsbzv.js";
15
+ import"./cli-7qew32h4.js";
16
+ import"./cli-zwvp566y.js";
17
+ import"./cli-fz1h9fpq.js";
18
+ import"./cli-gvwvpgxk.js";
19
19
  import"./cli-gpnb45ck.js";
20
20
  import"./cli-8rxa073f.js";
21
21
 
@@ -8,14 +8,14 @@ import {
8
8
  pollWorkOSToken,
9
9
  selectWorkspace,
10
10
  startDeviceFlow
11
- } from "./cli-t1nkahx2.js";
11
+ } from "./cli-7qew32h4.js";
12
12
  import {
13
13
  config,
14
14
  getPensarApiUrl,
15
15
  getPensarConsoleUrl
16
- } from "./cli-5xfjvm8j.js";
17
- import"./cli-yvnb3k0x.js";
18
- import"./cli-st6vsbzv.js";
16
+ } from "./cli-zwvp566y.js";
17
+ import"./cli-fz1h9fpq.js";
18
+ import"./cli-gvwvpgxk.js";
19
19
  import {
20
20
  __require
21
21
  } from "./cli-8rxa073f.js";
@@ -1,19 +1,19 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-tyrzasca.js";
3
+ } from "./cli-mt3sq6yt.js";
4
4
  import {
5
5
  detectOSAndEnhancePrompt
6
6
  } from "./cli-tp1tqn3k.js";
7
- import"./cli-6negm843.js";
7
+ import"./cli-8ph9fkgb.js";
8
8
  import"./cli-3y0dgy56.js";
9
9
  import {
10
10
  hasToolCall
11
- } from "./cli-1tv4x6xh.js";
11
+ } from "./cli-jyk9tqwp.js";
12
12
  import"./cli-03z6pswp.js";
13
- import"./cli-t1nkahx2.js";
14
- import"./cli-5xfjvm8j.js";
15
- import"./cli-yvnb3k0x.js";
16
- import"./cli-st6vsbzv.js";
13
+ import"./cli-7qew32h4.js";
14
+ import"./cli-zwvp566y.js";
15
+ import"./cli-fz1h9fpq.js";
16
+ import"./cli-gvwvpgxk.js";
17
17
  import"./cli-gpnb45ck.js";
18
18
  import"./cli-8rxa073f.js";
19
19
 
@@ -0,0 +1,18 @@
1
+ import {
2
+ BlackboxAttackSurfaceAgent
3
+ } from "./cli-1kn59fwk.js";
4
+ import"./cli-mt3sq6yt.js";
5
+ import"./cli-tp1tqn3k.js";
6
+ import"./cli-8ph9fkgb.js";
7
+ import"./cli-3y0dgy56.js";
8
+ import"./cli-jyk9tqwp.js";
9
+ import"./cli-03z6pswp.js";
10
+ import"./cli-7qew32h4.js";
11
+ import"./cli-zwvp566y.js";
12
+ import"./cli-fz1h9fpq.js";
13
+ import"./cli-gvwvpgxk.js";
14
+ import"./cli-gpnb45ck.js";
15
+ import"./cli-8rxa073f.js";
16
+ export {
17
+ BlackboxAttackSurfaceAgent
18
+ };
@@ -1,22 +1,22 @@
1
1
  import {
2
2
  runPentestWorkflow
3
- } from "./cli-nwcvgx5m.js";
4
- import"./cli-06q6sz4x.js";
5
- import"./cli-ch1yfrj1.js";
6
- import"./cli-gs7zy230.js";
3
+ } from "./cli-5kb1y9mm.js";
4
+ import"./cli-g6j8hr3k.js";
5
+ import"./cli-kvc3z9fg.js";
6
+ import"./cli-1kn59fwk.js";
7
7
  import"./cli-fw5r7pfj.js";
8
- import"./cli-mazg4ajq.js";
9
- import"./cli-1xdc0keq.js";
10
- import"./cli-tyrzasca.js";
8
+ import"./cli-68f3aaqf.js";
9
+ import"./cli-cyn21y8w.js";
10
+ import"./cli-mt3sq6yt.js";
11
11
  import"./cli-tp1tqn3k.js";
12
- import"./cli-6negm843.js";
12
+ import"./cli-8ph9fkgb.js";
13
13
  import"./cli-3y0dgy56.js";
14
- import"./cli-1tv4x6xh.js";
14
+ import"./cli-jyk9tqwp.js";
15
15
  import"./cli-03z6pswp.js";
16
- import"./cli-t1nkahx2.js";
17
- import"./cli-5xfjvm8j.js";
18
- import"./cli-yvnb3k0x.js";
19
- import"./cli-st6vsbzv.js";
16
+ import"./cli-7qew32h4.js";
17
+ import"./cli-zwvp566y.js";
18
+ import"./cli-fz1h9fpq.js";
19
+ import"./cli-gvwvpgxk.js";
20
20
  import"./cli-gpnb45ck.js";
21
21
  import"./cli-8rxa073f.js";
22
22
 
@@ -1,13 +1,13 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-tyrzasca.js";
3
+ } from "./cli-mt3sq6yt.js";
4
4
  import {
5
5
  detectOSAndEnhancePrompt
6
6
  } from "./cli-tp1tqn3k.js";
7
7
  import {
8
8
  hasToolCall,
9
9
  stepCountIs
10
- } from "./cli-1tv4x6xh.js";
10
+ } from "./cli-jyk9tqwp.js";
11
11
 
12
12
  // src/core/agents/specialized/attackSurface/blackboxAgent.ts
13
13
  import { join } from "path";
@@ -2,7 +2,7 @@ import {
2
2
  config,
3
3
  ensureValidToken,
4
4
  getPensarApiUrl
5
- } from "./cli-5xfjvm8j.js";
5
+ } from "./cli-zwvp566y.js";
6
6
 
7
7
  // src/core/api/issues.ts
8
8
  async function getAuthHeaders() {
@@ -14,33 +14,33 @@ import {
14
14
  updateManifestEntryStatus,
15
15
  writeAgentManifest,
16
16
  writeExecutionMetrics
17
- } from "./cli-06q6sz4x.js";
17
+ } from "./cli-g6j8hr3k.js";
18
18
  import {
19
19
  TargetedPentestAgent,
20
20
  buildPentestSystemPrompt
21
- } from "./cli-ch1yfrj1.js";
21
+ } from "./cli-kvc3z9fg.js";
22
22
  import {
23
23
  BlackboxAttackSurfaceAgent
24
- } from "./cli-gs7zy230.js";
24
+ } from "./cli-1kn59fwk.js";
25
25
  import {
26
26
  createThreatModelPrompt
27
27
  } from "./cli-fw5r7pfj.js";
28
28
  import {
29
29
  CodeAgent
30
- } from "./cli-mazg4ajq.js";
30
+ } from "./cli-68f3aaqf.js";
31
31
  import {
32
32
  EndpointSchema
33
- } from "./cli-1xdc0keq.js";
33
+ } from "./cli-cyn21y8w.js";
34
34
  import {
35
35
  FindingsRegistry,
36
36
  OffensiveSecurityAgent,
37
37
  PLAN_MODE_TOOL_NAMES
38
- } from "./cli-tyrzasca.js";
38
+ } from "./cli-mt3sq6yt.js";
39
39
  import {
40
40
  exports_external,
41
41
  hasToolCall,
42
42
  init_zod
43
- } from "./cli-1tv4x6xh.js";
43
+ } from "./cli-jyk9tqwp.js";
44
44
 
45
45
  // src/core/workflows/pentest.ts
46
46
  import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-tyrzasca.js";
3
+ } from "./cli-mt3sq6yt.js";
4
4
  import {
5
5
  stepCountIs
6
- } from "./cli-1tv4x6xh.js";
6
+ } from "./cli-jyk9tqwp.js";
7
7
 
8
8
  // src/core/agents/specialized/codeAgent/prompts.ts
9
9
  var CODE_AGENT_SYSTEM_PROMPT = `You are an expert coding agent with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
@@ -3,7 +3,7 @@ import {
3
3
  ensureValidToken,
4
4
  getPensarApiUrl,
5
5
  getPensarGatewayUrl
6
- } from "./cli-5xfjvm8j.js";
6
+ } from "./cli-zwvp566y.js";
7
7
 
8
8
  // src/core/auth/signing.ts
9
9
  import { createHmac, createHash, randomUUID } from "crypto";
@@ -3,7 +3,7 @@ import {
3
3
  generateObjectResponse,
4
4
  init_zod,
5
5
  zod_default
6
- } from "./cli-1tv4x6xh.js";
6
+ } from "./cli-jyk9tqwp.js";
7
7
  import {
8
8
  __callDispose,
9
9
  __using
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  exports_external,
3
3
  init_zod
4
- } from "./cli-1tv4x6xh.js";
4
+ } from "./cli-jyk9tqwp.js";
5
5
 
6
6
  // src/core/agents/specialized/whiteboxAttackSurface/types.ts
7
7
  init_zod();
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  getCurrentVersion
3
- } from "./cli-st6vsbzv.js";
3
+ } from "./cli-gvwvpgxk.js";
4
4
 
5
5
  // src/core/config/config.ts
6
6
  import os from "os";
@@ -2,11 +2,11 @@ import {
2
2
  CweEntrySchema,
3
3
  ValidatedCweEntrySchema,
4
4
  hasCanonicalName
5
- } from "./cli-tyrzasca.js";
5
+ } from "./cli-mt3sq6yt.js";
6
6
  import {
7
7
  exports_external,
8
8
  init_zod
9
- } from "./cli-1tv4x6xh.js";
9
+ } from "./cli-jyk9tqwp.js";
10
10
 
11
11
  // src/core/report/schemas.ts
12
12
  init_zod();
@@ -3,7 +3,7 @@ import { spawnSync } from "child_process";
3
3
  // package.json
4
4
  var package_default = {
5
5
  name: "@pensar/apex",
6
- version: "1.1.0",
6
+ version: "1.2.0-canary.2ce69867",
7
7
  description: "AI-powered penetration testing CLI tool with terminal UI",
8
8
  module: "src/tui/index.tsx",
9
9
  main: "build/cli.js",
@@ -4,12 +4,12 @@ import {
4
4
  } from "./cli-03z6pswp.js";
5
5
  import {
6
6
  signGatewayRequest
7
- } from "./cli-t1nkahx2.js";
7
+ } from "./cli-7qew32h4.js";
8
8
  import {
9
9
  config,
10
10
  ensureValidToken,
11
11
  getPensarGatewayUrl
12
- } from "./cli-5xfjvm8j.js";
12
+ } from "./cli-zwvp566y.js";
13
13
  import {
14
14
  require_auth_errors,
15
15
  require_token_error,
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  OffensiveSecurityAgent,
3
3
  readPlan
4
- } from "./cli-tyrzasca.js";
4
+ } from "./cli-mt3sq6yt.js";
5
5
  import {
6
6
  exports_external,
7
7
  init_zod
8
- } from "./cli-1tv4x6xh.js";
8
+ } from "./cli-jyk9tqwp.js";
9
9
 
10
10
  // src/core/agents/specialized/pentest/agent.ts
11
11
  import { existsSync, readdirSync, readFileSync } from "fs";
@@ -16,7 +16,7 @@ import {
16
16
  update,
17
17
  write,
18
18
  writeRaw
19
- } from "./cli-6negm843.js";
19
+ } from "./cli-8ph9fkgb.js";
20
20
  import {
21
21
  parseTargetUrl
22
22
  } from "./cli-3y0dgy56.js";
@@ -52,18 +52,18 @@ import {
52
52
  union,
53
53
  unknown,
54
54
  zod_default
55
- } from "./cli-1tv4x6xh.js";
55
+ } from "./cli-jyk9tqwp.js";
56
56
  import {
57
57
  signGatewayRequest
58
- } from "./cli-t1nkahx2.js";
58
+ } from "./cli-7qew32h4.js";
59
59
  import {
60
60
  config,
61
61
  ensureValidToken,
62
62
  getPensarApiUrl
63
- } from "./cli-5xfjvm8j.js";
63
+ } from "./cli-zwvp566y.js";
64
64
  import {
65
65
  getCurrentVersion
66
- } from "./cli-st6vsbzv.js";
66
+ } from "./cli-gvwvpgxk.js";
67
67
  import {
68
68
  __commonJS,
69
69
  __require,
@@ -99953,7 +99953,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
99953
99953
  return threatModelLimiter(async () => {
99954
99954
  if (ctx.abortSignal?.aborted)
99955
99955
  return null;
99956
- const { CodeAgent } = await import("./agent-0jmzw6zx.js");
99956
+ const { CodeAgent } = await import("./agent-be8vym2e.js");
99957
99957
  const subagentId = `threat-model-${sanitize(input.appName)}-${sanitize(input.routePath)}`;
99958
99958
  ctx.eventBus?.emit("subagent-spawn", {
99959
99959
  subagentId,
@@ -100642,7 +100642,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
100642
100642
  if (credentials) {
100643
100643
  ctx.session.credentialManager.addFromAuthCredentials(credentials);
100644
100644
  }
100645
- const { runAuthenticationAgent } = await import("./authentication-ngxxzcvc.js");
100645
+ const { runAuthenticationAgent } = await import("./authentication-9dn25mm0.js");
100646
100646
  const localBus = new AgentEventBus;
100647
100647
  AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
100648
100648
  const result = await runAuthenticationAgent({
@@ -101555,7 +101555,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
101555
101555
  });
101556
101556
  if (cwd) {
101557
101557
  try {
101558
- const { WhiteboxAttackSurfaceAgent } = await import("./agent-wmynfx37.js");
101558
+ const { WhiteboxAttackSurfaceAgent } = await import("./agent-hyttwsgv.js");
101559
101559
  const localBus = new AgentEventBus;
101560
101560
  AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
101561
101561
  const agent = new WhiteboxAttackSurfaceAgent({
@@ -101604,7 +101604,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
101604
101604
  }
101605
101605
  }
101606
101606
  try {
101607
- const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-v698p7e4.js");
101607
+ const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-prm6rrg4.js");
101608
101608
  const localBus = new AgentEventBus;
101609
101609
  AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
101610
101610
  const agent = new BlackboxAttackSurfaceAgent({
@@ -101680,7 +101680,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
101680
101680
  toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
101681
101681
  }),
101682
101682
  execute: async ({ targets }) => {
101683
- const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-4ty38pt8.js");
101683
+ const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-j32zdm0d.js");
101684
101684
  if (!ctx.model) {
101685
101685
  return {
101686
101686
  success: false,
@@ -101808,7 +101808,7 @@ Returns an array of results with the text output from each agent.`,
101808
101808
  });
101809
101809
  }
101810
101810
  async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
101811
- const { CodeAgent } = await import("./agent-0jmzw6zx.js");
101811
+ const { CodeAgent } = await import("./agent-be8vym2e.js");
101812
101812
  const subagentId = `coding-agent-${agentIndex}`;
101813
101813
  ctx.eventBus?.emit("subagent-spawn", {
101814
101814
  subagentId,
@@ -101869,7 +101869,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
101869
101869
  toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
101870
101870
  }),
101871
101871
  execute: async ({ target, cwd }) => {
101872
- const { runPentestWorkflow: workflow } = await import("./pentest-4ty38pt8.js");
101872
+ const { runPentestWorkflow: workflow } = await import("./pentest-j32zdm0d.js");
101873
101873
  if (!ctx.model) {
101874
101874
  return {
101875
101875
  success: false,
@@ -106478,8 +106478,45 @@ function killDescendants(rootPid, signal) {
106478
106478
  }
106479
106479
 
106480
106480
  // src/core/agents/offSecAgent/prompt.ts
106481
+ import { existsSync as existsSync12, readdirSync as readdirSync3, statSync } from "fs";
106482
+ import { join as join18 } from "path";
106483
+ function buildProvidedFilesSection(sessionRootPath) {
106484
+ const providedDir = join18(sessionRootPath, "provided_files");
106485
+ if (!existsSync12(providedDir))
106486
+ return "";
106487
+ let entries;
106488
+ try {
106489
+ entries = readdirSync3(providedDir);
106490
+ } catch {
106491
+ return "";
106492
+ }
106493
+ const fileEntries = entries.filter((name) => name !== "README.md").map((name) => {
106494
+ try {
106495
+ const stat2 = statSync(join18(providedDir, name));
106496
+ if (!stat2.isFile())
106497
+ return null;
106498
+ return { name, size: stat2.size };
106499
+ } catch {
106500
+ return null;
106501
+ }
106502
+ }).filter((e) => e !== null);
106503
+ if (fileEntries.length === 0)
106504
+ return "";
106505
+ const lines = fileEntries.map((f) => `- \`provided_files/${f.name}\` (${f.size} bytes)`);
106506
+ return `
106507
+
106508
+ # Provided Files
106509
+
106510
+ The user has uploaded the following files for this session. They are available at \`${providedDir}\` (relative path: \`provided_files/\`) and may include sample payloads, reference documentation, test data, or other context the agent should consult when planning and executing its work.
106511
+
106512
+ ${lines.join(`
106513
+ `)}
106514
+
106515
+ Read these with \`read_file\` and list directory contents with \`list_files provided_files/\` as needed. A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
106516
+ }
106481
106517
  function buildSessionWorkspaceSection(session, agentCwd) {
106482
106518
  const sandboxMode = agentCwd === session.rootPath;
106519
+ const providedFilesSection = buildProvidedFilesSection(session.rootPath);
106483
106520
  if (sandboxMode) {
106484
106521
  return `
106485
106522
 
@@ -106493,8 +106530,9 @@ The session directory (${session.rootPath}) contains these subdirectories:
106493
106530
  - **scratchpad/** — your scratch space for working notes, intermediate data, wordlists, temporary scripts. **Do NOT write reports, executive summaries, or finding compilations here** — reports are generated automatically from findings/.
106494
106531
  - **logs/** — execution logs
106495
106532
  - **evidence/** — screenshots and evidence (written by browser tools)
106533
+ - **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
106496
106534
 
106497
- Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.`;
106535
+ Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}`;
106498
106536
  }
106499
106537
  return `
106500
106538
 
@@ -106509,8 +106547,9 @@ Session artifacts are stored separately at ${session.rootPath}:
106509
106547
  - **scratchpad/** — your scratch space
106510
106548
  - **logs/** — execution logs
106511
106549
  - **evidence/** — screenshots and evidence
106550
+ - **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
106512
106551
 
106513
- Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically.`;
106552
+ Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically.${providedFilesSection}`;
106514
106553
  }
106515
106554
  function buildBaseSystemPrompt(options) {
106516
106555
  const sandboxMode = options?.sandboxMode ?? true;
@@ -106874,7 +106913,7 @@ class ApprovalTimeoutError extends ApprovalDeniedError {
106874
106913
  init_zod();
106875
106914
  import path from "path";
106876
106915
  import os from "os";
106877
- import { existsSync as existsSync12, readFileSync as readFileSync4 } from "fs";
106916
+ import { existsSync as existsSync13, readFileSync as readFileSync4 } from "fs";
106878
106917
  init_toolset();
106879
106918
  var DEFAULT_OUTCOME_GUIDANCE = "Prove the exploit can be run but do not exfiltrate data or cause any harm to the system. " + "Create proof-of-concept exploits that demonstrate the vulnerability exists without causing damage.";
106880
106919
  var EXFIL_OUTCOME_GUIDANCE = "Exfiltrate data to extract the flag value. " + "Create proof-of-concept exploits that successfully extract the flag from the target system.";
@@ -107184,7 +107223,7 @@ async function loadOperatorState(sessionId) {
107184
107223
  try {
107185
107224
  const session = await get(sessionId);
107186
107225
  const statePath = path.join(session.rootPath, "messages.json");
107187
- if (!existsSync12(statePath))
107226
+ if (!existsSync13(statePath))
107188
107227
  return null;
107189
107228
  const data = readFileSync4(statePath, "utf-8");
107190
107229
  const parsed = JSON.parse(data);
@@ -107213,7 +107252,7 @@ async function loadOperatorState(sessionId) {
107213
107252
  }
107214
107253
  function hasOperatorState(session) {
107215
107254
  const statePath = path.join(session.rootPath, "messages.json");
107216
- return existsSync12(statePath);
107255
+ return existsSync13(statePath);
107217
107256
  }
107218
107257
  var MAX_RESUME_MESSAGES = 200;
107219
107258
  function getResumeMessages(messages, limit = MAX_RESUME_MESSAGES) {
@@ -107336,8 +107375,8 @@ var sessions = {
107336
107375
  };
107337
107376
 
107338
107377
  // src/core/agents/offSecAgent/offensiveSecurityAgent.ts
107339
- import { join as join18 } from "path";
107340
- import { mkdirSync as mkdirSync12, existsSync as existsSync13 } from "fs";
107378
+ import { join as join19 } from "path";
107379
+ import { mkdirSync as mkdirSync12, existsSync as existsSync14 } from "fs";
107341
107380
  import { writeFile as writeFile4 } from "fs/promises";
107342
107381
 
107343
107382
  // src/core/agents/offSecAgent/trace.ts
@@ -107584,15 +107623,15 @@ class OffensiveSecurityAgent {
107584
107623
  input.commandCancelHandle.cancel = () => shell.cancelCurrentCommand();
107585
107624
  }
107586
107625
  }
107587
- const messagesDir = input.messagesDir ?? (input.subagentId ? join18(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
107588
- const tracePath = input.subagentId ? join18(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join18(messagesDir, "trace.jsonl");
107626
+ const messagesDir = input.messagesDir ?? (input.subagentId ? join19(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
107627
+ const tracePath = input.subagentId ? join19(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join19(messagesDir, "trace.jsonl");
107589
107628
  const traceWriter = new StepTraceWriter({
107590
107629
  tracePath,
107591
107630
  agentId: input.subagentId ?? null,
107592
107631
  eventBus: this.eventBus
107593
107632
  });
107594
107633
  const taskDriven = input.session.config?.taskDriven ?? false;
107595
- const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join18(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join18(input.session.rootPath, "tasks") : undefined);
107634
+ const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join19(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join19(input.session.rootPath, "tasks") : undefined);
107596
107635
  const credentialManager = input.credentialManager ?? input.session.credentialManager;
107597
107636
  const builtinTools = createAllTools({
107598
107637
  session: input.session,
@@ -107655,10 +107694,10 @@ class OffensiveSecurityAgent {
107655
107694
  const planSet = new Set(PLAN_MODE_TOOL_NAMES);
107656
107695
  activeTools = activeTools.filter((t) => planSet.has(t));
107657
107696
  }
107658
- if (!existsSync13(messagesDir)) {
107697
+ if (!existsSync14(messagesDir)) {
107659
107698
  mkdirSync12(messagesDir, { recursive: true });
107660
107699
  }
107661
- const messagesPath = join18(messagesDir, "messages.json");
107700
+ const messagesPath = join19(messagesDir, "messages.json");
107662
107701
  const initialMessagesRef = {
107663
107702
  current: input.messages ? [...input.messages] : [
107664
107703
  {
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-tyrzasca.js";
3
+ } from "./cli-mt3sq6yt.js";
4
4
  import {
5
5
  __commonJS,
6
6
  __require
@@ -2,7 +2,7 @@ import {
2
2
  get,
3
3
  init,
4
4
  update
5
- } from "./cli-yvnb3k0x.js";
5
+ } from "./cli-fz1h9fpq.js";
6
6
 
7
7
  // src/core/api/constants.ts
8
8
  var PENSAR_API_BASE_URL = "https://api.pensar.dev";