@pensar/apex 1.2.0 → 1.3.0-canary.f6d7a6d1

package/build/{cli-avnfgjhs.js → cli-h2vwr2b3.js}

@@ -2,11 +2,11 @@ import {
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-dvsj2p1x.js";
+} from "./cli-dj3jc5bq.js";
 import {
-  exports_external,
+  exports_external1 as exports_external,
   init_zod
-} from "./cli-s43zrc3b.js";
+} from "./cli-0ghkg3w6.js";
 
 // src/core/report/schemas.ts
 init_zod();

package/build/{cli-2mnefwqh.js → cli-hxegwkcg.js}

@@ -2,7 +2,7 @@ import {
   get,
   init,
   update
-} from "./cli-1rz3jys3.js";
+} from "./cli-73yjzavm.js";
 
 // src/core/api/constants.ts
 var PENSAR_API_BASE_URL = "https://api.pensar.dev";

package/build/{cli-erp6djfj.js → cli-kx4mh9b9.js}

@@ -14,33 +14,35 @@ import {
   updateManifestEntryStatus,
   writeAgentManifest,
   writeExecutionMetrics
-} from "./cli-avnfgjhs.js";
+} from "./cli-h2vwr2b3.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-ypxq76sm.js";
+} from "./cli-x071hk62.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-gqphezya.js";
+} from "./cli-ye1c6gz7.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
 import {
   CodeAgent
-} from "./cli-3sg681re.js";
+} from "./cli-zm5htfj3.js";
 import {
   EndpointSchema
-} from "./cli-33rkyxds.js";
+} from "./cli-0fy9j5dw.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
   PLAN_MODE_TOOL_NAMES
-} from "./cli-dvsj2p1x.js";
+} from "./cli-dj3jc5bq.js";
 import {
-  exports_external,
-  hasToolCall,
+  hasToolCall
+} from "./cli-7qr65rt6.js";
+import {
+  exports_external1 as exports_external,
   init_zod
-} from "./cli-s43zrc3b.js";
+} from "./cli-0ghkg3w6.js";
 
 // src/core/workflows/pentest.ts
 import { existsSync as existsSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";

package/build/{cli-4m9f65ze.js → cli-s9fq1gez.js}

@@ -2,7 +2,7 @@ import {
   config,
   ensureValidToken,
   getPensarApiUrl
-} from "./cli-2mnefwqh.js";
+} from "./cli-hxegwkcg.js";
 
 // src/core/api/issues.ts
 async function getAuthHeaders() {

package/build/{cli-ypxq76sm.js → cli-x071hk62.js}

@@ -1,11 +1,11 @@
 import {
   OffensiveSecurityAgent,
   readPlan
-} from "./cli-dvsj2p1x.js";
+} from "./cli-dj3jc5bq.js";
 import {
-  exports_external,
+  exports_external1 as exports_external,
   init_zod
-} from "./cli-s43zrc3b.js";
+} from "./cli-0ghkg3w6.js";
 
 // src/core/agents/specialized/pentest/agent.ts
 import { existsSync, readdirSync, readFileSync } from "fs";

package/build/{cli-720fdbrk.js → cli-xv1d4cgj.js}

@@ -3,7 +3,7 @@ import {
   ensureValidToken,
   getPensarApiUrl,
   getPensarGatewayUrl
-} from "./cli-2mnefwqh.js";
+} from "./cli-hxegwkcg.js";
 
 // src/core/auth/signing.ts
 import { createHmac, createHash, randomUUID } from "crypto";

package/build/{cli-gqphezya.js → cli-ye1c6gz7.js}

@@ -1,13 +1,13 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dvsj2p1x.js";
+} from "./cli-dj3jc5bq.js";
 import {
   detectOSAndEnhancePrompt
 } from "./cli-tp1tqn3k.js";
 import {
   hasToolCall,
   stepCountIs
-} from "./cli-s43zrc3b.js";
+} from "./cli-7qr65rt6.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 import { join } from "path";

package/build/{cli-3sg681re.js → cli-zm5htfj3.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-dvsj2p1x.js";
+} from "./cli-dj3jc5bq.js";
 import {
   stepCountIs
-} from "./cli-s43zrc3b.js";
+} from "./cli-7qr65rt6.js";
 
 // src/core/agents/specialized/codeAgent/prompts.ts
 var CODE_AGENT_SYSTEM_PROMPT = `You are an expert coding agent with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.

package/build/cli.js

@@ -6,16 +6,17 @@ import {
 import"./cli-3y0dgy56.js";
 import {
   init_toolset
-} from "./cli-s43zrc3b.js";
+} from "./cli-7qr65rt6.js";
 import {
   init_models
 } from "./cli-03z6pswp.js";
-import"./cli-720fdbrk.js";
-import"./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
+import"./cli-0ghkg3w6.js";
+import"./cli-xv1d4cgj.js";
+import"./cli-hxegwkcg.js";
+import"./cli-73yjzavm.js";
 import {
   package_default
-} from "./cli-qaaesy26.js";
+} from "./cli-942axn0y.js";
 import"./cli-gpnb45ck.js";
 import {
   __require,
@@ -24,7 +25,7 @@ import {
 // package.json
 var package_default2 = {
   name: "@pensar/apex",
-  version: "1.2.0",
+  version: "1.3.0-canary.f6d7a6d1",
   description: "AI-powered penetration testing CLI tool with terminal UI",
   module: "src/tui/index.tsx",
   main: "build/cli.js",
@@ -496,6 +497,7 @@ function showHelp() {
 
 Usage:
   pensar                             Launch the TUI
+  pensar -p <prompt>                 Start an operator session with a prompt
   pensar pentest [options]            Run a full pentest orchestration
   pensar targeted-pentest [options]   Run a targeted pentest on a single target
   pensar threat-model [options]       Generate application-centric threat model
@@ -511,6 +513,11 @@ Usage:
   pensar help                         Show this help message
   pensar version                      Show version number
 
+operator options (-p):
+  -p, --prompt <text|@file>  (required) Prompt for the operator agent
+  --target <url>             Target URL / domain / IP
+  --model <model>            AI model (default: claude-sonnet-4-5)
+
 pentest options:
   --target <url>           (required) Target URL / domain / IP
   --cwd <path>             Source code path \u2014 enables whitebox attack surface
@@ -541,9 +548,9 @@ Global options:
 async function runPentest() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runPentestAgent } = await import("./blackboxPentest-prq8qrhc.js");
-  const { sessions } = await import("./index-fds2qfsc.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runPentestAgent } = await import("./blackboxPentest-zeva1p2s.js");
+  const { sessions } = await import("./index-h0n7kjbs.js");
+  const { config: appConfig } = await import("./index-zy8wgxwc.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
@@ -609,9 +616,9 @@ Report:    ${reportPath}` : ""}`);
 async function runTargetedPentest() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-6qpsqdx5.js");
-  const { sessions } = await import("./index-fds2qfsc.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-krm97f3d.js");
+  const { sessions } = await import("./index-h0n7kjbs.js");
+  const { config: appConfig } = await import("./index-zy8wgxwc.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
@@ -661,8 +668,8 @@ POCs:      ${pocsPath}`);
 async function runThreatModel() {
   const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config2();
-  const { runThreatModelWorkflow } = await import("./threatModel-g0azznnt.js");
-  const { config: appConfig } = await import("./index-ftdt7ktr.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-jsqeh9md.js");
+  const { config: appConfig } = await import("./index-zy8wgxwc.js");
   const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
   const path = await import("path");
   const pensarConfig = await appConfig.get();
@@ -697,6 +704,100 @@ COMPLETE
 ${sep}
 Threat model written to: ${resolvedPath}`);
 }
+async function runOperator() {
+  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  config2();
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-ppbv80cs.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-h0n7kjbs.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-jcrwgbaz.js");
+  const { config: appConfig } = await import("./index-zy8wgxwc.js");
+  const { getDefaultModelForConfig } = await import("./utils-8yqe12jr.js");
+  const { createInterface } = await import("readline");
+  const { readFileSync: readFileSync2, existsSync } = await import("fs");
+  const path = await import("path");
+  const { stepCountIs } = await import("./index-dw1xbhfn.js");
+  const promptRaw = getArg("-p") ?? getArg("--prompt");
+  if (!promptRaw) {
+    console.error("Error: -p <prompt> is required");
+    process.exit(1);
+  }
+  const prompt = resolveFlagValue(promptRaw);
+  const target = getArg("--target");
+  const pensarConfig = await appConfig.get();
+  const dynamicDefault = getDefaultModelForConfig(pensarConfig)?.id ?? "claude-sonnet-4-5";
+  const model = getArg("--model") ?? dynamicDefault;
+  const sep = "\u2500".repeat(60);
+  console.log(`${sep}
+OPERATOR SESSION
+${sep}
+Model:   ${model}${target ? `
+Target:  ${target}` : ""}
+${sep}
+`);
+  const session = await sessions.create({
+    name: "Operator Session",
+    targets: target ? [target] : [],
+    config: {
+      mode: "operator",
+      agentCwd: process.cwd(),
+      operatorSettings: {
+        initialMode: "auto",
+        requireApproval: false,
+        enableSuggestions: false
+      }
+    }
+  });
+  const { bus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
+  let currentPrompt = prompt;
+  let messages;
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const askFollowUp = () => new Promise((resolve2) => {
+    process.stdout.write(`
+${sep}
+`);
+    rl.question("follow-up (empty to exit): ", (answer) => {
+      const trimmed = answer.trim();
+      resolve2(trimmed || null);
+    });
+  });
+  try {
+    for (;; ) {
+      await runOffensiveSecurityAgent({
+        prompt: currentPrompt,
+        model,
+        target,
+        activeTools: [...ALL_TOOL_NAMES, ...SKILL_TOOL_NAMES],
+        stopWhen: stepCountIs(1e4),
+        authConfig: buildAuthConfig(pensarConfig),
+        eventBus: bus,
+        session,
+        messages
+      });
+      const messagesPath = path.join(session.rootPath, "messages.json");
+      if (existsSync(messagesPath)) {
+        const raw = JSON.parse(readFileSync2(messagesPath, "utf-8"));
+        const allMessages = Array.isArray(raw) ? raw : [];
+        messages = normalizeMessages(getResumeMessages(allMessages));
+      }
+      const followUp = await askFollowUp();
+      if (!followUp)
+        break;
+      currentPrompt = followUp;
+      messages = normalizeMessages([
+        ...messages ?? [],
+        { role: "user", content: followUp }
+      ]);
+    }
+  } finally {
+    rl.close();
+    await wandbCleanup();
+  }
+  console.log(`
+Session: ${session.rootPath}`);
+}
 async function runUpgrade2() {
   const currentVersion = getCurrentVersion();
   console.log(`Current version: v${currentVersion}
@@ -706,7 +807,9 @@ Checking for updates...`);
 ${result.message}`);
   process.exit(result.success ? 0 : 1);
 }
-if (command === "version" || command === "--version" || command === "-v") {
+if (hasFlag("-p") || command === "--prompt") {
+  await runOperator();
+} else if (command === "version" || command === "--version" || command === "-v") {
   console.log(`v${version}`);
 } else if (command === "help" || command === "--help" || command === "-h") {
   showHelp();
@@ -718,25 +821,25 @@ if (command === "version" || command === "--version" || command === "-v") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-aj10f99d.js");
+  await import("./auth-eyah4gg5.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-0yjhkdk3.js");
+  await import("./uninstall-k7g5jpkt.js");
 } else if (command === "projects") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./projects-zkw40bda.js");
+  await import("./projects-3qxp342f.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-bsh9ht7r.js");
+  await import("./pentests-3g8pbrk3.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-tecf6w97.js");
+  await import("./issues-9w54wf9a.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-g7b34fs5.js");
+  await import("./fixes-v3ydfqpe.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-5qwr98mr.js");
+  await import("./logs-d9zgppn7.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
@@ -748,7 +851,7 @@ if (command === "version" || command === "--version" || command === "-v") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-cpj7zx72.js");
+  await import("./index-q7jya07x.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{fixes-g7b34fs5.js → fixes-v3ydfqpe.js}

@@ -2,10 +2,10 @@
 import {
   getFix,
   listFixes
-} from "./cli-4m9f65ze.js";
-import"./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
-import"./cli-qaaesy26.js";
+} from "./cli-s9fq1gez.js";
+import"./cli-hxegwkcg.js";
+import"./cli-73yjzavm.js";
+import"./cli-942axn0y.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/fixes.ts

package/build/{index-9j9dqpdd.js → index-66d5h9d5.js}

@@ -9,15 +9,15 @@ import {
   signGatewayRequest,
   startDeviceFlow,
   validateGateway
-} from "./cli-720fdbrk.js";
+} from "./cli-xv1d4cgj.js";
 import {
   ensureValidToken,
   fetchWorkOSClientId,
   isTokenExpired,
   refreshAccessToken
-} from "./cli-2mnefwqh.js";
-import"./cli-1rz3jys3.js";
-import"./cli-qaaesy26.js";
+} from "./cli-hxegwkcg.js";
+import"./cli-73yjzavm.js";
+import"./cli-942axn0y.js";
 import"./cli-8rxa073f.js";
 export {
   validateGateway,