@pensar/apex 1.2.0 → 1.3.0-canary.c0b95df3

package/build/{cli-avnfgjhs.js → cli-q9zgbdpc.js}

@@ -2,11 +2,11 @@ import {
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-dvsj2p1x.js";
+} from "./cli-3h1t6f9h.js";
 import {
-  exports_external,
+  exports_external1 as exports_external,
   init_zod
-} from "./cli-s43zrc3b.js";
+} from "./cli-0ghkg3w6.js";
 
 // src/core/report/schemas.ts
 init_zod();

package/build/{cli-gqphezya.js → cli-thtbxsva.js}

@@ -1,13 +1,13 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dvsj2p1x.js";
+} from "./cli-3h1t6f9h.js";
 import {
   detectOSAndEnhancePrompt
 } from "./cli-tp1tqn3k.js";
 import {
   hasToolCall,
   stepCountIs
-} from "./cli-s43zrc3b.js";
+} from "./cli-pyf1ftj8.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 import { join } from "path";
@@ -431,6 +431,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_list_messages",
         "email_search_messages",
         "email_get_message",
+        "send_email",
         "web_search",
         "get_page"
       ],

package/build/{cli-4m9f65ze.js → cli-vekv219j.js}

@@ -2,7 +2,7 @@ import {
   config,
   ensureValidToken,
   getPensarApiUrl
-} from "./cli-2mnefwqh.js";
+} from "./cli-z7ejvarb.js";
 
 // src/core/api/issues.ts
 async function getAuthHeaders() {

package/build/{cli-720fdbrk.js → cli-y9kk9q6n.js}

@@ -3,7 +3,7 @@ import {
   ensureValidToken,
   getPensarApiUrl,
   getPensarGatewayUrl
-} from "./cli-2mnefwqh.js";
+} from "./cli-z7ejvarb.js";
 
 // src/core/auth/signing.ts
 import { createHmac, createHash, randomUUID } from "crypto";

package/build/{cli-2mnefwqh.js → cli-z7ejvarb.js}

@@ -2,7 +2,7 @@ import {
   get,
   init,
   update
-} from "./cli-1rz3jys3.js";
+} from "./cli-9969518r.js";
 
 // src/core/api/constants.ts
 var PENSAR_API_BASE_URL = "https://api.pensar.dev";

package/build/cli.js

@@ -6,16 +6,17 @@ import {
 import"./cli-3y0dgy56.js";
 import {
   init_toolset
-} from "./cli-s43zrc3b.js";
+} from "./cli-pyf1ftj8.js";
 import {
   init_models
 } from "./cli-03z6pswp.js";
-import"./cli-720fdbrk.js";
-import"./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
+import"./cli-0ghkg3w6.js";
+import"./cli-y9kk9q6n.js";
+import"./cli-z7ejvarb.js";
+import"./cli-9969518r.js";
 import {
   package_default
-} from "./cli-qaaesy26.js";
+} from "./cli-3zrry4dg.js";
 import"./cli-gpnb45ck.js";
 import {
   __require,
@@ -24,7 +25,7 @@ import {
 // package.json
 var package_default2 = {
   name: "@pensar/apex",
-  version: "1.2.0",
+  version: "1.3.0-canary.c0b95df3",
   description: "AI-powered penetration testing CLI tool with terminal UI",
   module: "src/tui/index.tsx",
   main: "build/cli.js",
@@ -89,6 +90,7 @@ var package_default2 = {
     "@eslint/js": "^10.0.1",
     "@types/bun": "^1.3.0",
     "@types/mailparser": "^3.4.6",
+    "@types/nodemailer": "^8.0.0",
     "@types/react": "^19.2.6",
     "@typescript-eslint/eslint-plugin": "^8.55.0",
     "@typescript-eslint/parser": "^8.55.0",
@@ -127,6 +129,7 @@ var package_default2 = {
     mailparser: "^3.9.3",
     marked: "^16.4.0",
     nanoid: "^5.1.6",
+    nodemailer: "^8.0.7",
     "p-limit": "^7.2.0",
     react: "^19.2.0",
     sharp: "^0.34.4",
@@ -496,6 +499,7 @@ function showHelp() {
 
 Usage:
   pensar                             Launch the TUI
+  pensar -p <prompt>                 Start an operator session with a prompt
   pensar pentest [options]            Run a full pentest orchestration
   pensar targeted-pentest [options]   Run a targeted pentest on a single target
   pensar threat-model [options]       Generate application-centric threat model
@@ -511,6 +515,11 @@ Usage:
   pensar help                         Show this help message
   pensar version                      Show version number
 
+operator options (-p):
+  -p, --prompt <text|@file>  (required) Prompt for the operator agent
+  --target <url>             Target URL / domain / IP
+  --model <model>            AI model (default: claude-sonnet-4-5)
+
 pentest options:
   --target <url>           (required) Target URL / domain / IP
   --cwd <path>             Source code path \u2014 enables whitebox attack surface
@@ -541,9 +550,9 @@ Global options:
 async function runPentest() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runPentestAgent } = await import("./blackboxPentest-prq8qrhc.js");
-  const { sessions } = await import("./index-fds2qfsc.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runPentestAgent } = await import("./blackboxPentest-tvmjsvap.js");
+  const { sessions } = await import("./index-bmtt83ar.js");
+  const { config: appConfig } = await import("./index-y13qss6f.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
@@ -609,9 +618,9 @@ Report:    ${reportPath}` : ""}`);
 async function runTargetedPentest() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-6qpsqdx5.js");
-  const { sessions } = await import("./index-fds2qfsc.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-d7cbc8c4.js");
+  const { sessions } = await import("./index-bmtt83ar.js");
+  const { config: appConfig } = await import("./index-y13qss6f.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
@@ -661,8 +670,8 @@ POCs:      ${pocsPath}`);
 async function runThreatModel() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runThreatModelWorkflow } = await import("./threatModel-g0azznnt.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-z7ej9gye.js");
+  const { config: appConfig } = await import("./index-y13qss6f.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const path = await import("path");
   const pensarConfig = await appConfig.get();
@@ -697,6 +706,100 @@ COMPLETE
 ${sep}
 Threat model written to: ${resolvedPath}`);
 }
+async function runOperator() {
+  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  config2();
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-h8pa499d.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-bmtt83ar.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-hpe2h5a7.js");
+  const { config: appConfig } = await import("./index-y13qss6f.js");
+  const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
+  const { createInterface } = await import("readline");
+  const { readFileSync: readFileSync2, existsSync } = await import("fs");
+  const path = await import("path");
+  const { stepCountIs } = await import("./index-dw1xbhfn.js");
+  const promptRaw = getArg("-p") ?? getArg("--prompt");
+  if (!promptRaw) {
+    console.error("Error: -p <prompt> is required");
+    process.exit(1);
+  }
+  const prompt = resolveFlagValue(promptRaw);
+  const target = getArg("--target");
+  const pensarConfig = await appConfig.get();
+  const dynamicDefault = getDefaultModelForConfig(pensarConfig)?.id ?? "claude-sonnet-4-5";
+  const model = getArg("--model") ?? dynamicDefault;
+  const sep = "\u2500".repeat(60);
+  console.log(`${sep}
+OPERATOR SESSION
+${sep}
+Model:   ${model}${target ? `
+Target:  ${target}` : ""}
+${sep}
+`);
+  const session = await sessions.create({
+    name: "Operator Session",
+    targets: target ? [target] : [],
+    config: {
+      mode: "operator",
+      agentCwd: process.cwd(),
+      operatorSettings: {
+        initialMode: "auto",
+        requireApproval: false,
+        enableSuggestions: false
+      }
+    }
+  });
+  const { bus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
+  let currentPrompt = prompt;
+  let messages;
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const askFollowUp = () => new Promise((resolve2) => {
+    process.stdout.write(`
+${sep}
+`);
+    rl.question("follow-up (empty to exit): ", (answer) => {
+      const trimmed = answer.trim();
+      resolve2(trimmed || null);
+    });
+  });
+  try {
+    for (;; ) {
+      await runOffensiveSecurityAgent({
+        prompt: currentPrompt,
+        model,
+        target,
+        activeTools: [...ALL_TOOL_NAMES, ...SKILL_TOOL_NAMES],
+        stopWhen: stepCountIs(1e4),
+        authConfig: buildAuthConfig(pensarConfig),
+        eventBus: bus,
+        session,
+        messages
+      });
+      const messagesPath = path.join(session.rootPath, "messages.json");
+      if (existsSync(messagesPath)) {
+        const raw = JSON.parse(readFileSync2(messagesPath, "utf-8"));
+        const allMessages = Array.isArray(raw) ? raw : [];
+        messages = normalizeMessages(getResumeMessages(allMessages));
+      }
+      const followUp = await askFollowUp();
+      if (!followUp)
+        break;
+      currentPrompt = followUp;
+      messages = normalizeMessages([
+        ...messages ?? [],
+        { role: "user", content: followUp }
+      ]);
+    }
+  } finally {
+    rl.close();
+    await wandbCleanup();
+  }
+  console.log(`
+Session: ${session.rootPath}`);
+}
 async function runUpgrade2() {
   const currentVersion = getCurrentVersion();
   console.log(`Current version: v${currentVersion}
@@ -706,7 +809,9 @@ Checking for updates...`);
 ${result.message}`);
   process.exit(result.success ? 0 : 1);
 }
-if (command === "version" || command === "--version" || command === "-v") {
+if (hasFlag("-p") || command === "--prompt") {
+  await runOperator();
+} else if (command === "version" || command === "--version" || command === "-v") {
   console.log(`v${version}`);
 } else if (command === "help" || command === "--help" || command === "-h") {
   showHelp();
@@ -718,25 +823,25 @@ if (command === "version" || command === "--version" || command === "-v") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-aj10f99d.js");
+  await import("./auth-qqbaj612.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-0yjhkdk3.js");
+  await import("./uninstall-vdwpn0d5.js");
 } else if (command === "projects") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./projects-zkw40bda.js");
+  await import("./projects-q06fynf8.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-bsh9ht7r.js");
+  await import("./pentests-tfkjrsh9.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-tecf6w97.js");
+  await import("./issues-4j7jvbrq.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-g7b34fs5.js");
+  await import("./fixes-aa6jd5kg.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-5qwr98mr.js");
+  await import("./logs-wraftaa2.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
@@ -748,7 +853,7 @@ if (command === "version" || command === "--version" || command === "-v") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-cpj7zx72.js");
+  await import("./index-hafgteqb.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{fixes-g7b34fs5.js → fixes-aa6jd5kg.js}

@@ -2,10 +2,10 @@
 import {
   getFix,
   listFixes
-} from "./cli-4m9f65ze.js";
-import"./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
-import"./cli-qaaesy26.js";
+} from "./cli-vekv219j.js";
+import"./cli-z7ejvarb.js";
+import"./cli-9969518r.js";
+import"./cli-3zrry4dg.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/fixes.ts

package/build/{index-fds2qfsc.js → index-bmtt83ar.js}

@@ -13,22 +13,24 @@ import {
   update,
   write,
   writeRaw
-} from "./cli-q43w92k5.js";
+} from "./cli-dzzf9m5e.js";
 import {
   ToolsetStateSchema,
   exports_toolset,
   init_toolset,
+  toggleTool
+} from "./cli-pyf1ftj8.js";
+import"./cli-03z6pswp.js";
+import {
   init_zod,
-  toggleTool,
   zod_default
-} from "./cli-s43zrc3b.js";
-import"./cli-03z6pswp.js";
-import"./cli-720fdbrk.js";
-import"./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
+} from "./cli-0ghkg3w6.js";
+import"./cli-y9kk9q6n.js";
+import"./cli-z7ejvarb.js";
+import"./cli-9969518r.js";
 import {
   getCurrentVersion
-} from "./cli-qaaesy26.js";
+} from "./cli-3zrry4dg.js";
 import"./cli-gpnb45ck.js";
 import {
   __require,
@@ -113,6 +115,45 @@ var EmailInboxConfigObject = zod_default.discriminatedUnion("provider", [
 var EmailIntegrationConfigObject = zod_default.object({
   inboxes: zod_default.array(EmailInboxConfigObject)
 });
+var SmtpConfigObject = zod_default.object({
+  host: zod_default.string(),
+  port: zod_default.number(),
+  username: zod_default.string(),
+  password: zod_default.string(),
+  tls: zod_default.boolean().default(true),
+  fromAddress: zod_default.string().optional()
+});
+function resolveSmtpConfig(explicit) {
+  if (explicit)
+    return explicit;
+  const fromAddress = process.env.OUTBOUND_EMAIL;
+  const resendKey = process.env.RESEND_API_KEY;
+  if (resendKey) {
+    return {
+      host: "smtp.resend.com",
+      port: 465,
+      username: "resend",
+      password: resendKey,
+      tls: true,
+      fromAddress
+    };
+  }
+  const host = process.env.SMTP_HOST;
+  const port = process.env.SMTP_PORT;
+  const username = process.env.SMTP_USERNAME;
+  const password = process.env.SMTP_PASSWORD;
+  if (host && port && username && password) {
+    return {
+      host,
+      port: parseInt(port, 10),
+      username,
+      password,
+      tls: process.env.SMTP_TLS !== "false",
+      fromAddress
+    };
+  }
+  return;
+}
 var SessionConfigObject = zod_default.object({
   offensiveHeaders: OffensiveHeadersConfigObject.optional(),
   sessionType: zod_default.enum(["web-app"]).optional(),
@@ -127,6 +168,7 @@ var SessionConfigObject = zod_default.object({
   enumerateSubdomains: zod_default.boolean().optional(),
   codebasePath: zod_default.string().optional(),
   emailIntegration: EmailIntegrationConfigObject.optional(),
+  smtpConfig: SmtpConfigObject.optional(),
   exfilMode: zod_default.boolean().optional(),
   agentCwd: zod_default.string().optional(),
   prompt: zod_default.string().optional(),
@@ -238,6 +280,7 @@ async function create(input) {
       credentialManager.addFromAuthCredentials(cred);
     }
   }
+  const smtpConfig = resolveSmtpConfig(input.config?.smtpConfig);
   const result = {
     id,
     version: getCurrentVersion(),
@@ -256,7 +299,8 @@ async function create(input) {
           "User-Agent": "pensar-apex"
         }
       },
-      outcomeGuidance: input.config?.outcomeGuidance || (input.config?.exfilMode ? EXFIL_OUTCOME_GUIDANCE : DEFAULT_OUTCOME_GUIDANCE)
+      outcomeGuidance: input.config?.outcomeGuidance || (input.config?.exfilMode ? EXFIL_OUTCOME_GUIDANCE : DEFAULT_OUTCOME_GUIDANCE),
+      smtpConfig
     },
     _rateLimiter: rateLimiter,
     credentialManager,
@@ -266,7 +310,6 @@ async function create(input) {
     scratchpadPath,
     findingsPath
   };
-  console.info("created session", result);
   const { _rateLimiter, credentialManager: _cm, ...sessionData } = result;
   await createSessionDirs({ session: result });
   await write(["sessions", result.id, "session"], sessionData);
@@ -305,7 +348,6 @@ async function update2(id, editor) {
     editor(draft);
     draft.time.updated = Date.now();
   });
-  console.info("updated session", result);
   return result;
 }
 async function* list() {
@@ -519,6 +561,7 @@ export {
   toggleTool2 as toggleTool,
   sessions,
   sessionPath,
+  resolveSmtpConfig,
   removeMessage,
   remove2 as remove,
   normalizeMessages,