@pensar/apex 1.1.0 → 1.2.0-canary.2ce69867
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/agent-be8vym2e.js +18 -0
- package/build/{agent-wmynfx37.js → agent-hyttwsgv.js} +8 -8
- package/build/{auth-p2n15nfp.js → auth-0zjc84z7.js} +4 -4
- package/build/{authentication-ngxxzcvc.js → authentication-9dn25mm0.js} +7 -7
- package/build/blackboxAgent-prm6rrg4.js +18 -0
- package/build/{blackboxPentest-7jvcbz3f.js → blackboxPentest-123gpn1d.js} +13 -13
- package/build/{cli-gs7zy230.js → cli-1kn59fwk.js} +2 -2
- package/build/{cli-d5mcmzp1.js → cli-4rem64vw.js} +1 -1
- package/build/{cli-nwcvgx5m.js → cli-5kb1y9mm.js} +7 -7
- package/build/{cli-mazg4ajq.js → cli-68f3aaqf.js} +2 -2
- package/build/{cli-t1nkahx2.js → cli-7qew32h4.js} +1 -1
- package/build/{cli-6negm843.js → cli-8ph9fkgb.js} +1 -1
- package/build/{cli-1xdc0keq.js → cli-cyn21y8w.js} +1 -1
- package/build/{cli-yvnb3k0x.js → cli-fz1h9fpq.js} +1 -1
- package/build/{cli-06q6sz4x.js → cli-g6j8hr3k.js} +2 -2
- package/build/{cli-st6vsbzv.js → cli-gvwvpgxk.js} +1 -1
- package/build/{cli-1tv4x6xh.js → cli-jyk9tqwp.js} +2 -2
- package/build/{cli-ch1yfrj1.js → cli-kvc3z9fg.js} +2 -2
- package/build/{cli-tyrzasca.js → cli-mt3sq6yt.js} +63 -24
- package/build/{cli-ahmpjgg6.js → cli-pcaza9pg.js} +1 -1
- package/build/{cli-5xfjvm8j.js → cli-zwvp566y.js} +1 -1
- package/build/cli.js +34 -22
- package/build/{fixes-p4e3bjcg.js → fixes-rkk0t5s0.js} +4 -4
- package/build/{index-gpvx8y17.js → index-2zfe6gt3.js} +4 -4
- package/build/{index-esgrht7q.js → index-375975ry.js} +6 -6
- package/build/{index-m6gw4113.js → index-brc5g4zn.js} +2 -2
- package/build/{index-ywrq8mhc.js → index-sg2a5de2.js} +2197 -1531
- package/build/{issues-8had86x1.js → issues-xp2xzz90.js} +4 -4
- package/build/{logs-3fpd8xq8.js → logs-ayaqjbdq.js} +4 -4
- package/build/pentest-j32zdm0d.js +28 -0
- package/build/{pentests-tqv6zrqy.js → pentests-2eskyf75.js} +4 -4
- package/build/{projects-eh2g7061.js → projects-1qzspfg2.js} +4 -4
- package/build/{targetedPentest-60td56me.js → targetedPentest-9jzwb37n.js} +8 -8
- package/build/{threatModel-v46xygtn.js → threatModel-vx15n3qn.js} +8 -8
- package/build/{uninstall-vz6jzt86.js → uninstall-phbe1zc6.js} +1 -1
- package/package.json +1 -1
- package/build/agent-0jmzw6zx.js +0 -18
- package/build/blackboxAgent-v698p7e4.js +0 -18
- package/build/pentest-4ty38pt8.js +0 -28
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import {
|
|
2
|
+
CodeAgent
|
|
3
|
+
} from "./cli-68f3aaqf.js";
|
|
4
|
+
import"./cli-mt3sq6yt.js";
|
|
5
|
+
import"./cli-tp1tqn3k.js";
|
|
6
|
+
import"./cli-8ph9fkgb.js";
|
|
7
|
+
import"./cli-3y0dgy56.js";
|
|
8
|
+
import"./cli-jyk9tqwp.js";
|
|
9
|
+
import"./cli-03z6pswp.js";
|
|
10
|
+
import"./cli-7qew32h4.js";
|
|
11
|
+
import"./cli-zwvp566y.js";
|
|
12
|
+
import"./cli-fz1h9fpq.js";
|
|
13
|
+
import"./cli-gvwvpgxk.js";
|
|
14
|
+
import"./cli-gpnb45ck.js";
|
|
15
|
+
import"./cli-8rxa073f.js";
|
|
16
|
+
export {
|
|
17
|
+
CodeAgent
|
|
18
|
+
};
|
|
@@ -1,21 +1,21 @@
|
|
|
1
1
|
import {
|
|
2
2
|
WhiteboxAttackSurfaceResultSchema
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-cyn21y8w.js";
|
|
4
4
|
import {
|
|
5
5
|
OffensiveSecurityAgent
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-mt3sq6yt.js";
|
|
7
7
|
import"./cli-tp1tqn3k.js";
|
|
8
|
-
import"./cli-
|
|
8
|
+
import"./cli-8ph9fkgb.js";
|
|
9
9
|
import"./cli-3y0dgy56.js";
|
|
10
10
|
import {
|
|
11
11
|
hasToolCall,
|
|
12
12
|
tool
|
|
13
|
-
} from "./cli-
|
|
13
|
+
} from "./cli-jyk9tqwp.js";
|
|
14
14
|
import"./cli-03z6pswp.js";
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
15
|
+
import"./cli-7qew32h4.js";
|
|
16
|
+
import"./cli-zwvp566y.js";
|
|
17
|
+
import"./cli-fz1h9fpq.js";
|
|
18
|
+
import"./cli-gvwvpgxk.js";
|
|
19
19
|
import"./cli-gpnb45ck.js";
|
|
20
20
|
import"./cli-8rxa073f.js";
|
|
21
21
|
|
|
@@ -8,14 +8,14 @@ import {
|
|
|
8
8
|
pollWorkOSToken,
|
|
9
9
|
selectWorkspace,
|
|
10
10
|
startDeviceFlow
|
|
11
|
-
} from "./cli-
|
|
11
|
+
} from "./cli-7qew32h4.js";
|
|
12
12
|
import {
|
|
13
13
|
config,
|
|
14
14
|
getPensarApiUrl,
|
|
15
15
|
getPensarConsoleUrl
|
|
16
|
-
} from "./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
16
|
+
} from "./cli-zwvp566y.js";
|
|
17
|
+
import"./cli-fz1h9fpq.js";
|
|
18
|
+
import"./cli-gvwvpgxk.js";
|
|
19
19
|
import {
|
|
20
20
|
__require
|
|
21
21
|
} from "./cli-8rxa073f.js";
|
|
@@ -1,19 +1,19 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-mt3sq6yt.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
6
|
} from "./cli-tp1tqn3k.js";
|
|
7
|
-
import"./cli-
|
|
7
|
+
import"./cli-8ph9fkgb.js";
|
|
8
8
|
import"./cli-3y0dgy56.js";
|
|
9
9
|
import {
|
|
10
10
|
hasToolCall
|
|
11
|
-
} from "./cli-
|
|
11
|
+
} from "./cli-jyk9tqwp.js";
|
|
12
12
|
import"./cli-03z6pswp.js";
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
13
|
+
import"./cli-7qew32h4.js";
|
|
14
|
+
import"./cli-zwvp566y.js";
|
|
15
|
+
import"./cli-fz1h9fpq.js";
|
|
16
|
+
import"./cli-gvwvpgxk.js";
|
|
17
17
|
import"./cli-gpnb45ck.js";
|
|
18
18
|
import"./cli-8rxa073f.js";
|
|
19
19
|
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
import {
|
|
2
|
+
BlackboxAttackSurfaceAgent
|
|
3
|
+
} from "./cli-1kn59fwk.js";
|
|
4
|
+
import"./cli-mt3sq6yt.js";
|
|
5
|
+
import"./cli-tp1tqn3k.js";
|
|
6
|
+
import"./cli-8ph9fkgb.js";
|
|
7
|
+
import"./cli-3y0dgy56.js";
|
|
8
|
+
import"./cli-jyk9tqwp.js";
|
|
9
|
+
import"./cli-03z6pswp.js";
|
|
10
|
+
import"./cli-7qew32h4.js";
|
|
11
|
+
import"./cli-zwvp566y.js";
|
|
12
|
+
import"./cli-fz1h9fpq.js";
|
|
13
|
+
import"./cli-gvwvpgxk.js";
|
|
14
|
+
import"./cli-gpnb45ck.js";
|
|
15
|
+
import"./cli-8rxa073f.js";
|
|
16
|
+
export {
|
|
17
|
+
BlackboxAttackSurfaceAgent
|
|
18
|
+
};
|
|
@@ -1,22 +1,22 @@
|
|
|
1
1
|
import {
|
|
2
2
|
runPentestWorkflow
|
|
3
|
-
} from "./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
3
|
+
} from "./cli-5kb1y9mm.js";
|
|
4
|
+
import"./cli-g6j8hr3k.js";
|
|
5
|
+
import"./cli-kvc3z9fg.js";
|
|
6
|
+
import"./cli-1kn59fwk.js";
|
|
7
7
|
import"./cli-fw5r7pfj.js";
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
10
|
-
import"./cli-
|
|
8
|
+
import"./cli-68f3aaqf.js";
|
|
9
|
+
import"./cli-cyn21y8w.js";
|
|
10
|
+
import"./cli-mt3sq6yt.js";
|
|
11
11
|
import"./cli-tp1tqn3k.js";
|
|
12
|
-
import"./cli-
|
|
12
|
+
import"./cli-8ph9fkgb.js";
|
|
13
13
|
import"./cli-3y0dgy56.js";
|
|
14
|
-
import"./cli-
|
|
14
|
+
import"./cli-jyk9tqwp.js";
|
|
15
15
|
import"./cli-03z6pswp.js";
|
|
16
|
-
import"./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
16
|
+
import"./cli-7qew32h4.js";
|
|
17
|
+
import"./cli-zwvp566y.js";
|
|
18
|
+
import"./cli-fz1h9fpq.js";
|
|
19
|
+
import"./cli-gvwvpgxk.js";
|
|
20
20
|
import"./cli-gpnb45ck.js";
|
|
21
21
|
import"./cli-8rxa073f.js";
|
|
22
22
|
|
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-mt3sq6yt.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
6
|
} from "./cli-tp1tqn3k.js";
|
|
7
7
|
import {
|
|
8
8
|
hasToolCall,
|
|
9
9
|
stepCountIs
|
|
10
|
-
} from "./cli-
|
|
10
|
+
} from "./cli-jyk9tqwp.js";
|
|
11
11
|
|
|
12
12
|
// src/core/agents/specialized/attackSurface/blackboxAgent.ts
|
|
13
13
|
import { join } from "path";
|
|
@@ -14,33 +14,33 @@ import {
|
|
|
14
14
|
updateManifestEntryStatus,
|
|
15
15
|
writeAgentManifest,
|
|
16
16
|
writeExecutionMetrics
|
|
17
|
-
} from "./cli-
|
|
17
|
+
} from "./cli-g6j8hr3k.js";
|
|
18
18
|
import {
|
|
19
19
|
TargetedPentestAgent,
|
|
20
20
|
buildPentestSystemPrompt
|
|
21
|
-
} from "./cli-
|
|
21
|
+
} from "./cli-kvc3z9fg.js";
|
|
22
22
|
import {
|
|
23
23
|
BlackboxAttackSurfaceAgent
|
|
24
|
-
} from "./cli-
|
|
24
|
+
} from "./cli-1kn59fwk.js";
|
|
25
25
|
import {
|
|
26
26
|
createThreatModelPrompt
|
|
27
27
|
} from "./cli-fw5r7pfj.js";
|
|
28
28
|
import {
|
|
29
29
|
CodeAgent
|
|
30
|
-
} from "./cli-
|
|
30
|
+
} from "./cli-68f3aaqf.js";
|
|
31
31
|
import {
|
|
32
32
|
EndpointSchema
|
|
33
|
-
} from "./cli-
|
|
33
|
+
} from "./cli-cyn21y8w.js";
|
|
34
34
|
import {
|
|
35
35
|
FindingsRegistry,
|
|
36
36
|
OffensiveSecurityAgent,
|
|
37
37
|
PLAN_MODE_TOOL_NAMES
|
|
38
|
-
} from "./cli-
|
|
38
|
+
} from "./cli-mt3sq6yt.js";
|
|
39
39
|
import {
|
|
40
40
|
exports_external,
|
|
41
41
|
hasToolCall,
|
|
42
42
|
init_zod
|
|
43
|
-
} from "./cli-
|
|
43
|
+
} from "./cli-jyk9tqwp.js";
|
|
44
44
|
|
|
45
45
|
// src/core/workflows/pentest.ts
|
|
46
46
|
import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
|
|
@@ -1,9 +1,9 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-mt3sq6yt.js";
|
|
4
4
|
import {
|
|
5
5
|
stepCountIs
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-jyk9tqwp.js";
|
|
7
7
|
|
|
8
8
|
// src/core/agents/specialized/codeAgent/prompts.ts
|
|
9
9
|
var CODE_AGENT_SYSTEM_PROMPT = `You are an expert coding agent with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
|
|
@@ -2,11 +2,11 @@ import {
|
|
|
2
2
|
CweEntrySchema,
|
|
3
3
|
ValidatedCweEntrySchema,
|
|
4
4
|
hasCanonicalName
|
|
5
|
-
} from "./cli-
|
|
5
|
+
} from "./cli-mt3sq6yt.js";
|
|
6
6
|
import {
|
|
7
7
|
exports_external,
|
|
8
8
|
init_zod
|
|
9
|
-
} from "./cli-
|
|
9
|
+
} from "./cli-jyk9tqwp.js";
|
|
10
10
|
|
|
11
11
|
// src/core/report/schemas.ts
|
|
12
12
|
init_zod();
|
|
@@ -3,7 +3,7 @@ import { spawnSync } from "child_process";
|
|
|
3
3
|
// package.json
|
|
4
4
|
var package_default = {
|
|
5
5
|
name: "@pensar/apex",
|
|
6
|
-
version: "1.
|
|
6
|
+
version: "1.2.0-canary.2ce69867",
|
|
7
7
|
description: "AI-powered penetration testing CLI tool with terminal UI",
|
|
8
8
|
module: "src/tui/index.tsx",
|
|
9
9
|
main: "build/cli.js",
|
|
@@ -4,12 +4,12 @@ import {
|
|
|
4
4
|
} from "./cli-03z6pswp.js";
|
|
5
5
|
import {
|
|
6
6
|
signGatewayRequest
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-7qew32h4.js";
|
|
8
8
|
import {
|
|
9
9
|
config,
|
|
10
10
|
ensureValidToken,
|
|
11
11
|
getPensarGatewayUrl
|
|
12
|
-
} from "./cli-
|
|
12
|
+
} from "./cli-zwvp566y.js";
|
|
13
13
|
import {
|
|
14
14
|
require_auth_errors,
|
|
15
15
|
require_token_error,
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent,
|
|
3
3
|
readPlan
|
|
4
|
-
} from "./cli-
|
|
4
|
+
} from "./cli-mt3sq6yt.js";
|
|
5
5
|
import {
|
|
6
6
|
exports_external,
|
|
7
7
|
init_zod
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-jyk9tqwp.js";
|
|
9
9
|
|
|
10
10
|
// src/core/agents/specialized/pentest/agent.ts
|
|
11
11
|
import { existsSync, readdirSync, readFileSync } from "fs";
|
|
@@ -16,7 +16,7 @@ import {
|
|
|
16
16
|
update,
|
|
17
17
|
write,
|
|
18
18
|
writeRaw
|
|
19
|
-
} from "./cli-
|
|
19
|
+
} from "./cli-8ph9fkgb.js";
|
|
20
20
|
import {
|
|
21
21
|
parseTargetUrl
|
|
22
22
|
} from "./cli-3y0dgy56.js";
|
|
@@ -52,18 +52,18 @@ import {
|
|
|
52
52
|
union,
|
|
53
53
|
unknown,
|
|
54
54
|
zod_default
|
|
55
|
-
} from "./cli-
|
|
55
|
+
} from "./cli-jyk9tqwp.js";
|
|
56
56
|
import {
|
|
57
57
|
signGatewayRequest
|
|
58
|
-
} from "./cli-
|
|
58
|
+
} from "./cli-7qew32h4.js";
|
|
59
59
|
import {
|
|
60
60
|
config,
|
|
61
61
|
ensureValidToken,
|
|
62
62
|
getPensarApiUrl
|
|
63
|
-
} from "./cli-
|
|
63
|
+
} from "./cli-zwvp566y.js";
|
|
64
64
|
import {
|
|
65
65
|
getCurrentVersion
|
|
66
|
-
} from "./cli-
|
|
66
|
+
} from "./cli-gvwvpgxk.js";
|
|
67
67
|
import {
|
|
68
68
|
__commonJS,
|
|
69
69
|
__require,
|
|
@@ -99953,7 +99953,7 @@ async function generateThreatModelForEndpoint(ctx, input) {
|
|
|
99953
99953
|
return threatModelLimiter(async () => {
|
|
99954
99954
|
if (ctx.abortSignal?.aborted)
|
|
99955
99955
|
return null;
|
|
99956
|
-
const { CodeAgent } = await import("./agent-
|
|
99956
|
+
const { CodeAgent } = await import("./agent-be8vym2e.js");
|
|
99957
99957
|
const subagentId = `threat-model-${sanitize(input.appName)}-${sanitize(input.routePath)}`;
|
|
99958
99958
|
ctx.eventBus?.emit("subagent-spawn", {
|
|
99959
99959
|
subagentId,
|
|
@@ -100642,7 +100642,7 @@ When to use delegate_to_auth_subagent vs authenticate_session:
|
|
|
100642
100642
|
if (credentials) {
|
|
100643
100643
|
ctx.session.credentialManager.addFromAuthCredentials(credentials);
|
|
100644
100644
|
}
|
|
100645
|
-
const { runAuthenticationAgent } = await import("./authentication-
|
|
100645
|
+
const { runAuthenticationAgent } = await import("./authentication-9dn25mm0.js");
|
|
100646
100646
|
const localBus = new AgentEventBus;
|
|
100647
100647
|
AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
|
|
100648
100648
|
const result = await runAuthenticationAgent({
|
|
@@ -101555,7 +101555,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
|
|
|
101555
101555
|
});
|
|
101556
101556
|
if (cwd) {
|
|
101557
101557
|
try {
|
|
101558
|
-
const { WhiteboxAttackSurfaceAgent } = await import("./agent-
|
|
101558
|
+
const { WhiteboxAttackSurfaceAgent } = await import("./agent-hyttwsgv.js");
|
|
101559
101559
|
const localBus = new AgentEventBus;
|
|
101560
101560
|
AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
|
|
101561
101561
|
const agent = new WhiteboxAttackSurfaceAgent({
|
|
@@ -101604,7 +101604,7 @@ should be passed directly to spawn_pentest_swarm for deep testing.`,
|
|
|
101604
101604
|
}
|
|
101605
101605
|
}
|
|
101606
101606
|
try {
|
|
101607
|
-
const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-
|
|
101607
|
+
const { BlackboxAttackSurfaceAgent } = await import("./blackboxAgent-prm6rrg4.js");
|
|
101608
101608
|
const localBus = new AgentEventBus;
|
|
101609
101609
|
AgentEventBus.attachChild(localBus, ctx.eventBus, subagentId);
|
|
101610
101610
|
const agent = new BlackboxAttackSurfaceAgent({
|
|
@@ -101680,7 +101680,7 @@ Pass every target you want tested — the swarm handles concurrency automaticall
|
|
|
101680
101680
|
toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
|
|
101681
101681
|
}),
|
|
101682
101682
|
execute: async ({ targets }) => {
|
|
101683
|
-
const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-
|
|
101683
|
+
const { runPentestSwarm, DEFAULT_CONCURRENCY } = await import("./pentest-j32zdm0d.js");
|
|
101684
101684
|
if (!ctx.model) {
|
|
101685
101685
|
return {
|
|
101686
101686
|
success: false,
|
|
@@ -101808,7 +101808,7 @@ Returns an array of results with the text output from each agent.`,
|
|
|
101808
101808
|
});
|
|
101809
101809
|
}
|
|
101810
101810
|
async function runSingleCodingAgent(ctx, codebasePath, objective, agentIndex, name) {
|
|
101811
|
-
const { CodeAgent } = await import("./agent-
|
|
101811
|
+
const { CodeAgent } = await import("./agent-be8vym2e.js");
|
|
101812
101812
|
const subagentId = `coding-agent-${agentIndex}`;
|
|
101813
101813
|
ctx.eventBus?.emit("subagent-spawn", {
|
|
101814
101814
|
subagentId,
|
|
@@ -101869,7 +101869,7 @@ Omit \`cwd\` for blackbox mode (live target probing only).`,
|
|
|
101869
101869
|
toolCallDescription: exports_external.string().describe("A concise, human-readable description of what this tool call is doing")
|
|
101870
101870
|
}),
|
|
101871
101871
|
execute: async ({ target, cwd }) => {
|
|
101872
|
-
const { runPentestWorkflow: workflow } = await import("./pentest-
|
|
101872
|
+
const { runPentestWorkflow: workflow } = await import("./pentest-j32zdm0d.js");
|
|
101873
101873
|
if (!ctx.model) {
|
|
101874
101874
|
return {
|
|
101875
101875
|
success: false,
|
|
@@ -106478,8 +106478,45 @@ function killDescendants(rootPid, signal) {
|
|
|
106478
106478
|
}
|
|
106479
106479
|
|
|
106480
106480
|
// src/core/agents/offSecAgent/prompt.ts
|
|
106481
|
+
import { existsSync as existsSync12, readdirSync as readdirSync3, statSync } from "fs";
|
|
106482
|
+
import { join as join18 } from "path";
|
|
106483
|
+
function buildProvidedFilesSection(sessionRootPath) {
|
|
106484
|
+
const providedDir = join18(sessionRootPath, "provided_files");
|
|
106485
|
+
if (!existsSync12(providedDir))
|
|
106486
|
+
return "";
|
|
106487
|
+
let entries;
|
|
106488
|
+
try {
|
|
106489
|
+
entries = readdirSync3(providedDir);
|
|
106490
|
+
} catch {
|
|
106491
|
+
return "";
|
|
106492
|
+
}
|
|
106493
|
+
const fileEntries = entries.filter((name) => name !== "README.md").map((name) => {
|
|
106494
|
+
try {
|
|
106495
|
+
const stat2 = statSync(join18(providedDir, name));
|
|
106496
|
+
if (!stat2.isFile())
|
|
106497
|
+
return null;
|
|
106498
|
+
return { name, size: stat2.size };
|
|
106499
|
+
} catch {
|
|
106500
|
+
return null;
|
|
106501
|
+
}
|
|
106502
|
+
}).filter((e) => e !== null);
|
|
106503
|
+
if (fileEntries.length === 0)
|
|
106504
|
+
return "";
|
|
106505
|
+
const lines = fileEntries.map((f) => `- \`provided_files/${f.name}\` (${f.size} bytes)`);
|
|
106506
|
+
return `
|
|
106507
|
+
|
|
106508
|
+
# Provided Files
|
|
106509
|
+
|
|
106510
|
+
The user has uploaded the following files for this session. They are available at \`${providedDir}\` (relative path: \`provided_files/\`) and may include sample payloads, reference documentation, test data, or other context the agent should consult when planning and executing its work.
|
|
106511
|
+
|
|
106512
|
+
${lines.join(`
|
|
106513
|
+
`)}
|
|
106514
|
+
|
|
106515
|
+
Read these with \`read_file\` and list directory contents with \`list_files provided_files/\` as needed. A \`README.md\` inside \`provided_files/\` may include per-file descriptions supplied by the user — check it first before diving into individual files.`;
|
|
106516
|
+
}
|
|
106481
106517
|
function buildSessionWorkspaceSection(session, agentCwd) {
|
|
106482
106518
|
const sandboxMode = agentCwd === session.rootPath;
|
|
106519
|
+
const providedFilesSection = buildProvidedFilesSection(session.rootPath);
|
|
106483
106520
|
if (sandboxMode) {
|
|
106484
106521
|
return `
|
|
106485
106522
|
|
|
@@ -106493,8 +106530,9 @@ The session directory (${session.rootPath}) contains these subdirectories:
|
|
|
106493
106530
|
- **scratchpad/** — your scratch space for working notes, intermediate data, wordlists, temporary scripts. **Do NOT write reports, executive summaries, or finding compilations here** — reports are generated automatically from findings/.
|
|
106494
106531
|
- **logs/** — execution logs
|
|
106495
106532
|
- **evidence/** — screenshots and evidence (written by browser tools)
|
|
106533
|
+
- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
|
|
106496
106534
|
|
|
106497
|
-
Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically
|
|
106535
|
+
Tools like \`document_vulnerability\` and browser evidence capture write to the correct subdirectories automatically.${providedFilesSection}`;
|
|
106498
106536
|
}
|
|
106499
106537
|
return `
|
|
106500
106538
|
|
|
@@ -106509,8 +106547,9 @@ Session artifacts are stored separately at ${session.rootPath}:
|
|
|
106509
106547
|
- **scratchpad/** — your scratch space
|
|
106510
106548
|
- **logs/** — execution logs
|
|
106511
106549
|
- **evidence/** — screenshots and evidence
|
|
106550
|
+
- **provided_files/** — user-uploaded files (sample payloads, docs, test data); populated when the project has workspace files configured.
|
|
106512
106551
|
|
|
106513
|
-
Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically
|
|
106552
|
+
Tools like \`document_vulnerability\` and browser evidence capture write to the session directory automatically.${providedFilesSection}`;
|
|
106514
106553
|
}
|
|
106515
106554
|
function buildBaseSystemPrompt(options) {
|
|
106516
106555
|
const sandboxMode = options?.sandboxMode ?? true;
|
|
@@ -106874,7 +106913,7 @@ class ApprovalTimeoutError extends ApprovalDeniedError {
|
|
|
106874
106913
|
init_zod();
|
|
106875
106914
|
import path from "path";
|
|
106876
106915
|
import os from "os";
|
|
106877
|
-
import { existsSync as
|
|
106916
|
+
import { existsSync as existsSync13, readFileSync as readFileSync4 } from "fs";
|
|
106878
106917
|
init_toolset();
|
|
106879
106918
|
var DEFAULT_OUTCOME_GUIDANCE = "Prove the exploit can be run but do not exfiltrate data or cause any harm to the system. " + "Create proof-of-concept exploits that demonstrate the vulnerability exists without causing damage.";
|
|
106880
106919
|
var EXFIL_OUTCOME_GUIDANCE = "Exfiltrate data to extract the flag value. " + "Create proof-of-concept exploits that successfully extract the flag from the target system.";
|
|
@@ -107184,7 +107223,7 @@ async function loadOperatorState(sessionId) {
|
|
|
107184
107223
|
try {
|
|
107185
107224
|
const session = await get(sessionId);
|
|
107186
107225
|
const statePath = path.join(session.rootPath, "messages.json");
|
|
107187
|
-
if (!
|
|
107226
|
+
if (!existsSync13(statePath))
|
|
107188
107227
|
return null;
|
|
107189
107228
|
const data = readFileSync4(statePath, "utf-8");
|
|
107190
107229
|
const parsed = JSON.parse(data);
|
|
@@ -107213,7 +107252,7 @@ async function loadOperatorState(sessionId) {
|
|
|
107213
107252
|
}
|
|
107214
107253
|
function hasOperatorState(session) {
|
|
107215
107254
|
const statePath = path.join(session.rootPath, "messages.json");
|
|
107216
|
-
return
|
|
107255
|
+
return existsSync13(statePath);
|
|
107217
107256
|
}
|
|
107218
107257
|
var MAX_RESUME_MESSAGES = 200;
|
|
107219
107258
|
function getResumeMessages(messages, limit = MAX_RESUME_MESSAGES) {
|
|
@@ -107336,8 +107375,8 @@ var sessions = {
|
|
|
107336
107375
|
};
|
|
107337
107376
|
|
|
107338
107377
|
// src/core/agents/offSecAgent/offensiveSecurityAgent.ts
|
|
107339
|
-
import { join as
|
|
107340
|
-
import { mkdirSync as mkdirSync12, existsSync as
|
|
107378
|
+
import { join as join19 } from "path";
|
|
107379
|
+
import { mkdirSync as mkdirSync12, existsSync as existsSync14 } from "fs";
|
|
107341
107380
|
import { writeFile as writeFile4 } from "fs/promises";
|
|
107342
107381
|
|
|
107343
107382
|
// src/core/agents/offSecAgent/trace.ts
|
|
@@ -107584,15 +107623,15 @@ class OffensiveSecurityAgent {
|
|
|
107584
107623
|
input.commandCancelHandle.cancel = () => shell.cancelCurrentCommand();
|
|
107585
107624
|
}
|
|
107586
107625
|
}
|
|
107587
|
-
const messagesDir = input.messagesDir ?? (input.subagentId ?
|
|
107588
|
-
const tracePath = input.subagentId ?
|
|
107626
|
+
const messagesDir = input.messagesDir ?? (input.subagentId ? join19(input.session.rootPath, "subagents", input.subagentId) : input.session.rootPath);
|
|
107627
|
+
const tracePath = input.subagentId ? join19(input.session.rootPath, "subagents", `${input.subagentId}.trace.jsonl`) : join19(messagesDir, "trace.jsonl");
|
|
107589
107628
|
const traceWriter = new StepTraceWriter({
|
|
107590
107629
|
tracePath,
|
|
107591
107630
|
agentId: input.subagentId ?? null,
|
|
107592
107631
|
eventBus: this.eventBus
|
|
107593
107632
|
});
|
|
107594
107633
|
const taskDriven = input.session.config?.taskDriven ?? false;
|
|
107595
|
-
const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ?
|
|
107634
|
+
const tasksDir = input.tasksDir ?? (taskDriven ? input.subagentId ? join19(input.session.rootPath, "subagents", `${input.subagentId}-tasks`) : join19(input.session.rootPath, "tasks") : undefined);
|
|
107596
107635
|
const credentialManager = input.credentialManager ?? input.session.credentialManager;
|
|
107597
107636
|
const builtinTools = createAllTools({
|
|
107598
107637
|
session: input.session,
|
|
@@ -107655,10 +107694,10 @@ class OffensiveSecurityAgent {
|
|
|
107655
107694
|
const planSet = new Set(PLAN_MODE_TOOL_NAMES);
|
|
107656
107695
|
activeTools = activeTools.filter((t) => planSet.has(t));
|
|
107657
107696
|
}
|
|
107658
|
-
if (!
|
|
107697
|
+
if (!existsSync14(messagesDir)) {
|
|
107659
107698
|
mkdirSync12(messagesDir, { recursive: true });
|
|
107660
107699
|
}
|
|
107661
|
-
const messagesPath =
|
|
107700
|
+
const messagesPath = join19(messagesDir, "messages.json");
|
|
107662
107701
|
const initialMessagesRef = {
|
|
107663
107702
|
current: input.messages ? [...input.messages] : [
|
|
107664
107703
|
{
|