@pensar/apex 1.7.0 → 1.8.0-canary.12d8c6ce

package/build/agent-296395pk.js

@@ -0,0 +1,138 @@
+import {
+  WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT,
+  WhiteboxAttackSurfaceResultSchema
+} from "./cli-rs7t70an.js";
+import {
+  OffensiveSecurityAgent
+} from "./cli-g82bk3cj.js";
+import"./cli-tp1tqn3k.js";
+import"./cli-k9mz32aa.js";
+import"./cli-3y0dgy56.js";
+import {
+  hasToolCall
+} from "./cli-tkqzmbr6.js";
+import {
+  tool
+} from "./cli-0ghkg3w6.js";
+import"./cli-7b1zxzm1.js";
+import"./cli-7ftzn306.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
+import"./cli-hjc1pbs8.js";
+import"./cli-8rxa073f.js";
+
+// src/core/agents/specialized/whiteboxAttackSurface/agent.ts
+class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
+  constructor(opts) {
+    const {
+      model,
+      codebasePath,
+      session,
+      authConfig,
+      onStepFinish,
+      abortSignal,
+      eventBus,
+      subagentId,
+      attackSurfaceRegistry,
+      domains,
+      enableThinking
+    } = opts;
+    let capturedResult = null;
+    const submitResultsTool = tool({
+      description: `Submit the final whitebox attack surface analysis results.
+
+Call this ONCE at the end with your complete structured findings.
+This ends the agent run — make sure all data is included.`,
+      inputSchema: WhiteboxAttackSurfaceResultSchema,
+      execute: async (results) => {
+        capturedResult = results;
+        return { success: true, message: "Results submitted." };
+      }
+    });
+    super({
+      system: WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT,
+      prompt: buildPrompt(codebasePath, domains, session.config?.prompt),
+      model,
+      session,
+      authConfig,
+      onStepFinish,
+      abortSignal,
+      eventBus,
+      subagentId,
+      attackSurfaceRegistry,
+      enableThinking,
+      activeTools: [
+        "read_file",
+        "list_files",
+        "grep",
+        "document_app",
+        "document_endpoint",
+        "spawn_coding_agent",
+        "submit_results"
+      ],
+      extraTools: {
+        submit_results: submitResultsTool
+      },
+      stopWhen: hasToolCall("submit_results"),
+      resolveResult: () => {
+        if (capturedResult) {
+          return capturedResult;
+        }
+        return {
+          repoType: "unknown",
+          packageManager: "unknown",
+          apps: [],
+          summary: {
+            totalApps: 0,
+            totalPages: 0,
+            totalApiEndpoints: 0,
+            totalPentestObjectives: 0
+          }
+        };
+      }
+    });
+  }
+}
+function buildPrompt(codebasePath, domains, operatorPrompt) {
+  const domainSection = domains?.length ? `
+## Known Domains
+The following domains are **hints for association only** — they are known to be operated by the target and should be set on the \`domain\` field of \`document_app\` when you can determine which domain serves a given app.
+
+**IMPORTANT — these domains DO NOT define the scope of discovery:**
+- Discover and document **every** app/service/cloud resource defined in the codebase, regardless of whether it maps to one of these domains.
+- Apps with no known public domain (internal services, background workers, staging-only apps, functions, admin tools, etc.) MUST still be documented. Leave \`domain\` unset or use the canonical resource URL for cloud resources.
+- Do NOT filter out apps, endpoints, subdomains, or cloud resources because they don't appear to belong to one of these domains.
+- Do NOT skip directories, packages, or services because they "look unrelated" to the listed domains.
+
+Known domains:
+${domains.map((d) => `- ${d}`).join(`
+`)}
+` : "";
+  const operatorGuidanceBlock = operatorPrompt ? `
+## Operator Guidance
+${operatorPrompt}
+` : "";
+  return `# Whitebox Attack Surface Analysis
+
+## Codebase
+- **Path:** ${codebasePath}
+${domainSection}${operatorGuidanceBlock}
+## Task
+Analyze this codebase and produce a complete attack surface map:
+1. Identify the repo type and package manager
+2. Discover all apps/services
+3. Discover cloud resources and external infrastructure referenced in the code (S3 buckets, cloud storage, CDN origins, etc.) — document these as apps with the appropriate type
+4. For each app, find all web pages and API endpoints
+5. For each endpoint, generate pentest objectives
+6. **Before submitting**, perform the Phase 3 coverage double-check from the system prompt — re-scan workspace roots, framework configs, Dockerfiles, IaC, and CI/deploy configs for apps you may have missed on the first pass, and document any that were missed.
+
+Use \`spawn_coding_agent\` to delegate app-level analysis for higher fidelity.
+
+When finished, call \`submit_results\` with the complete structured output. Do NOT call \`submit_results\` until you have explicitly completed the coverage double-check.
+
+Begin now.`;
+}
+export {
+  WhiteboxAttackSurfaceAgent
+};

package/build/agent-d7ykbm5k.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-12z0rn8s.js";
+import"./cli-g82bk3cj.js";
+import"./cli-tp1tqn3k.js";
+import"./cli-k9mz32aa.js";
+import"./cli-3y0dgy56.js";
+import"./cli-tkqzmbr6.js";
+import"./cli-0ghkg3w6.js";
+import"./cli-7b1zxzm1.js";
+import"./cli-7ftzn306.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
+import"./cli-hjc1pbs8.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{auth-wvh553ea.js → auth-7jbyp815.js}

@@ -8,14 +8,14 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-xtqm11qt.js";
+} from "./cli-7b1zxzm1.js";
 import {
   config,
   getPensarApiUrl,
   getPensarConsoleUrl
-} from "./cli-q2dty8g4.js";
-import"./cli-40ef01tb.js";
-import"./cli-r879p2yz.js";
+} from "./cli-7ftzn306.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/{authentication-ec7trwb4.js → authentication-ye7mrmzt.js}

@@ -1,21 +1,21 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-x3k26g1t.js";
+} from "./cli-g82bk3cj.js";
 import {
   detectOSAndEnhancePrompt
 } from "./cli-tp1tqn3k.js";
-import"./cli-nqx9y9ds.js";
+import"./cli-k9mz32aa.js";
 import"./cli-3y0dgy56.js";
 import {
   hasToolCall
-} from "./cli-rc7hyq7e.js";
+} from "./cli-tkqzmbr6.js";
 import"./cli-0ghkg3w6.js";
-import"./cli-xtqm11qt.js";
-import"./cli-q2dty8g4.js";
+import"./cli-7b1zxzm1.js";
+import"./cli-7ftzn306.js";
 import"./cli-gpnb45ck.js";
-import"./cli-40ef01tb.js";
-import"./cli-r879p2yz.js";
-import"./cli-03z6pswp.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
+import"./cli-hjc1pbs8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts

package/build/blackboxAgent-d5skf3w1.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-4h5g3581.js";
+import"./cli-g82bk3cj.js";
+import"./cli-tp1tqn3k.js";
+import"./cli-k9mz32aa.js";
+import"./cli-3y0dgy56.js";
+import"./cli-tkqzmbr6.js";
+import"./cli-0ghkg3w6.js";
+import"./cli-7b1zxzm1.js";
+import"./cli-7ftzn306.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
+import"./cli-hjc1pbs8.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-rwyjy4kq.js → blackboxPentest-e5xyh6mv.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-09prdch1.js";
-import"./cli-gr3zncst.js";
-import"./cli-5m0347h3.js";
-import"./cli-0fy9j5dw.js";
-import"./cli-06zt0g1a.js";
+} from "./cli-mk4mytk7.js";
+import"./cli-xf0wpcaa.js";
+import"./cli-c9qmk6g9.js";
+import"./cli-rs7t70an.js";
+import"./cli-4h5g3581.js";
 import"./cli-fw5r7pfj.js";
-import"./cli-zr7sg2m2.js";
-import"./cli-x3k26g1t.js";
+import"./cli-12z0rn8s.js";
+import"./cli-g82bk3cj.js";
 import"./cli-tp1tqn3k.js";
-import"./cli-nqx9y9ds.js";
+import"./cli-k9mz32aa.js";
 import"./cli-3y0dgy56.js";
-import"./cli-rc7hyq7e.js";
+import"./cli-tkqzmbr6.js";
 import"./cli-0ghkg3w6.js";
-import"./cli-xtqm11qt.js";
-import"./cli-q2dty8g4.js";
+import"./cli-7b1zxzm1.js";
+import"./cli-7ftzn306.js";
 import"./cli-gpnb45ck.js";
-import"./cli-40ef01tb.js";
-import"./cli-r879p2yz.js";
-import"./cli-03z6pswp.js";
+import"./cli-kjhfp9qw.js";
+import"./cli-d9865q9t.js";
+import"./cli-hjc1pbs8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-zr7sg2m2.js → cli-12z0rn8s.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-x3k26g1t.js";
+} from "./cli-g82bk3cj.js";
 import {
   stepCountIs
-} from "./cli-rc7hyq7e.js";
+} from "./cli-tkqzmbr6.js";
 
 // src/core/agents/specialized/codeAgent/prompts.ts
 var CODE_AGENT_SYSTEM_PROMPT = `You are an expert coding agent with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.

package/build/{cli-06zt0g1a.js → cli-4h5g3581.js}

@@ -1,13 +1,13 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-x3k26g1t.js";
+} from "./cli-g82bk3cj.js";
 import {
   detectOSAndEnhancePrompt
 } from "./cli-tp1tqn3k.js";
 import {
   hasToolCall,
   stepCountIs
-} from "./cli-rc7hyq7e.js";
+} from "./cli-tkqzmbr6.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 import { join } from "path";

package/build/{cli-vvyq7ace.js → cli-5gppgkrv.js}

@@ -2,7 +2,7 @@ import {
   config,
   ensureValidToken,
   getPensarApiUrl
-} from "./cli-q2dty8g4.js";
+} from "./cli-7ftzn306.js";
 
 // src/core/api/issues.ts
 async function getAuthHeaders() {

package/build/{cli-xtqm11qt.js → cli-7b1zxzm1.js}

@@ -3,7 +3,7 @@ import {
   ensureValidToken,
   getPensarApiUrl,
   getPensarGatewayUrl
-} from "./cli-q2dty8g4.js";
+} from "./cli-7ftzn306.js";
 
 // src/core/auth/signing.ts
 import { createHmac, createHash, randomUUID } from "crypto";

package/build/{cli-q2dty8g4.js → cli-7ftzn306.js}

@@ -2,7 +2,7 @@ import {
   get,
   init,
   update
-} from "./cli-40ef01tb.js";
+} from "./cli-kjhfp9qw.js";
 
 // src/core/api/constants.ts
 var PENSAR_API_BASE_URL = "https://api.pensar.dev";

package/build/{cli-5m0347h3.js → cli-c9qmk6g9.js}

@@ -1,7 +1,7 @@
 import {
   OffensiveSecurityAgent,
   readPlan
-} from "./cli-x3k26g1t.js";
+} from "./cli-g82bk3cj.js";
 import {
   exports_external1 as exports_external,
   init_zod

package/build/{cli-r879p2yz.js → cli-d9865q9t.js}

@@ -3,7 +3,7 @@ import { spawnSync } from "child_process";
 // package.json
 var package_default = {
   name: "@pensar/apex",
-  version: "1.7.0",
+  version: "1.8.0-canary.12d8c6ce",
   description: "AI-powered penetration testing CLI tool with terminal UI",
   module: "src/tui/index.tsx",
   main: "build/cli.js",
@@ -97,6 +97,7 @@ var package_default = {
     "@openrouter/ai-sdk-provider": "^2.2.3",
     "@opentui/core": "^0.1.80",
     "@opentui/react": "^0.1.80",
+    "@pensar/surface": "0.2.1",
     "@playwright/mcp": "^0.0.54",
     ai: "^6.0.105",
     glob: "^13.0.0",