@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/build/{cli-g8t710ew.js → cli-ryy39d77.js}

@@ -1,16 +1,133 @@
+import {
+  init_ai
+} from "./cli-87zakjb2.js";
 import {
   generateObjectResponse
-} from "./cli-k0tckznm.js";
+} from "./cli-6p7d2k55.js";
 import {
   exports_external1 as exports_external,
   init_zod,
   zod_default
-} from "./cli-0ghkg3w6.js";
+} from "./cli-e6rgwtpb.js";
 import {
   __callDispose,
   __using
 } from "./cli-8rxa073f.js";
 
+// src/util/name.ts
+init_zod();
+init_ai();
+var adjectives = [
+  "swift",
+  "bright",
+  "calm",
+  "bold",
+  "keen",
+  "noble",
+  "quick",
+  "sharp",
+  "vivid",
+  "warm",
+  "agile",
+  "brave",
+  "clever",
+  "daring",
+  "eager",
+  "fierce",
+  "gentle",
+  "humble",
+  "jolly",
+  "lively",
+  "merry",
+  "nimble",
+  "proud",
+  "quiet",
+  "rapid",
+  "serene",
+  "sturdy",
+  "tender",
+  "valiant",
+  "witty",
+  "zealous"
+];
+var nouns = [
+  "falcon",
+  "wolf",
+  "hawk",
+  "bear",
+  "lion",
+  "tiger",
+  "eagle",
+  "raven",
+  "phoenix",
+  "dragon",
+  "panther",
+  "cobra",
+  "viper",
+  "shark",
+  "orca",
+  "mantis",
+  "spider",
+  "scorpion",
+  "hydra",
+  "griffin",
+  "sphinx",
+  "kraken",
+  "cipher",
+  "nexus",
+  "prism",
+  "vector",
+  "matrix",
+  "pulse",
+  "surge",
+  "flux"
+];
+function generateRandomName() {
+  const adj = adjectives[Math.floor(Math.random() * adjectives.length)] ?? "swift";
+  const noun = nouns[Math.floor(Math.random() * nouns.length)] ?? "falcon";
+  return `${adj}-${noun}`;
+}
+var sessionNameSchema = exports_external.object({
+  name: exports_external.string().describe("A short, descriptive session name (2-4 words, lowercase, hyphenated)")
+});
+async function generateSessionName(opts) {
+  const { targets, userMessage, model, authConfig, abortSignal } = opts;
+  const contextParts = [];
+  if (targets.length > 0) {
+    contextParts.push(`Target(s): ${targets.join(", ")}`);
+  }
+  if (userMessage) {
+    contextParts.push(`User objective: ${userMessage}`);
+  }
+  if (contextParts.length === 0)
+    return null;
+  const prompt = [
+    "Generate a short, descriptive name for a penetration testing session.",
+    "The name should be 2-4 lowercase words separated by hyphens.",
+    "It should capture the key aspect of the target or task — e.g. 'acme-api-pentest', 'login-auth-bypass', 'ecommerce-checkout-test'.",
+    "",
+    ...contextParts
+  ].join(`
+`);
+  try {
+    const result = await generateObjectResponse({
+      model,
+      schema: sessionNameSchema,
+      prompt,
+      maxTokens: 50,
+      temperature: 0.7,
+      authConfig,
+      abortSignal
+    });
+    if (!result?.name)
+      return null;
+    const name = result.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 50);
+    return name || null;
+  } catch {
+    return null;
+  }
+}
+
 // src/core/credentials/manager.ts
 import { randomBytes } from "crypto";
 function generateCredentialId() {
@@ -105,6 +222,16 @@ class CredentialManager {
   listReferences() {
     return Array.from(this.store.values()).map(toReference);
   }
+  listCredentialsWithHeaders() {
+    const out = [];
+    for (const stored of this.store.values()) {
+      const headers = stored.tokens?.customHeaders;
+      if (headers && Object.keys(headers).length > 0) {
+        out.push({ tokens: { customHeaders: { ...headers } } });
+      }
+    }
+    return out;
+  }
   remove(credentialId) {
     return this.store.delete(credentialId);
   }
@@ -166,25 +293,135 @@ ${lines.join(`
 </available_credentials>`;
   }
 }
+// src/core/id/id.ts
+init_zod();
+import { randomBytes as randomBytes2 } from "crypto";
+var prefixes = {
+  session: "ses",
+  message: "msg",
+  permission: "per",
+  user: "usr",
+  part: "prt"
+};
+function schema(prefix) {
+  return zod_default.string().startsWith(prefixes[prefix]);
+}
+var LENGTH = 26;
+var lastTimestamp = 0;
+var counter = 0;
+function descending(prefix, given) {
+  return generateID(prefix, true, given);
+}
+function generateID(prefix, descending2, given) {
+  if (!given) {
+    return create(prefix, descending2);
+  }
+  if (!given.startsWith(prefixes[prefix])) {
+    throw new Error(`ID ${given} does not start with ${prefixes[prefix]}`);
+  }
+  return given;
+}
+function randomBase62(length) {
+  const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+  let result = "";
+  const bytes = randomBytes2(length);
+  for (let i = 0;i < length; i++) {
+    result += chars[bytes[i] % 62];
+  }
+  return result;
+}
+function create(prefix, descending2, timestamp) {
+  const currentTimestamp = timestamp ?? Date.now();
+  if (currentTimestamp !== lastTimestamp) {
+    lastTimestamp = currentTimestamp;
+    counter = 0;
+  }
+  counter++;
+  let now = BigInt(currentTimestamp) * BigInt(4096) + BigInt(counter);
+  now = descending2 ? ~now : now;
+  const timeBytes = Buffer.alloc(6);
+  for (let i = 0;i < 6; i++) {
+    timeBytes[i] = Number(now >> BigInt(40 - 8 * i) & BigInt(255));
+  }
+  return prefixes[prefix] + "_" + timeBytes.toString("hex") + randomBase62(LENGTH - 12);
+}
+
+// src/core/services/rateLimiter/index.ts
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+class RateLimiter {
+  tokens;
+  lastRefillTime;
+  rps;
+  bucketSize;
+  msPerToken;
+  queue;
+  constructor(config) {
+    this.rps = config?.requestsPerSecond;
+    this.bucketSize = this.rps ? 1 : 0;
+    this.tokens = this.bucketSize;
+    this.lastRefillTime = performance.now();
+    this.msPerToken = this.rps ? 1000 / this.rps : undefined;
+    this.queue = Promise.resolve();
+  }
+  async acquireSlot() {
+    if (!this.rps || !this.msPerToken)
+      return;
+    const previousPromise = this.queue;
+    let resolveCurrentRequest;
+    this.queue = new Promise((resolve) => {
+      resolveCurrentRequest = resolve;
+    });
+    await previousPromise;
+    try {
+      const now = performance.now();
+      this.refill(now);
+      if (this.tokens < 1) {
+        const waitTime = (1 - this.tokens) * this.msPerToken;
+        await sleep(waitTime);
+        const nowAfterSleep = performance.now();
+        this.refill(nowAfterSleep);
+      }
+      this.tokens -= 1;
+    } finally {
+      resolveCurrentRequest();
+    }
+  }
+  refill(now) {
+    if (this.tokens >= this.bucketSize) {
+      this.lastRefillTime = now;
+      return;
+    }
+    const elapsed = now - this.lastRefillTime;
+    const tokensToAdd = elapsed / this.msPerToken;
+    this.tokens = Math.min(this.bucketSize, this.tokens + tokensToAdd);
+    this.lastRefillTime = now;
+  }
+  isEnabled() {
+    return this.rps !== undefined;
+  }
+}
+
 // src/core/storage/index.ts
 init_zod();
+import fs, { readdir } from "fs/promises";
 import os from "os";
 import path from "path";
-import fs from "fs/promises";
-import { readdir } from "fs/promises";
 
 // src/util/errors.ts
 init_zod();
 
 class NamedError extends Error {
   static create(name, data) {
-    const schema = zod_default.object({
+    const schema2 = zod_default.object({
       name: zod_default.literal(name),
       data
     });
     const result = class extends NamedError {
       data;
-      static Schema = schema;
+      static Schema = schema2;
       name = name;
       constructor(data2, options) {
         super(name, options);
@@ -195,7 +432,7 @@ class NamedError extends Error {
         return typeof input === "object" && input !== null && "name" in input && input.name === name;
       }
       schema() {
-        return schema;
+        return schema2;
       }
       toObject() {
         return {
@@ -215,15 +452,17 @@ class NamedError extends Error {
 // src/util/lock.ts
 var locks = new Map;
 function getLock(key) {
-  if (!locks.has(key)) {
-    locks.set(key, {
+  let lock = locks.get(key);
+  if (!lock) {
+    lock = {
       readers: 0,
       writer: false,
       waitingReaders: [],
       waitingWriters: []
-    });
+    };
+    locks.set(key, lock);
   }
-  return locks.get(key);
+  return lock;
 }
 function processQueue(key) {
   const lock = locks.get(key);
@@ -231,12 +470,12 @@ function processQueue(key) {
     return;
   if (lock.waitingWriters.length > 0) {
     const nextWriter = lock.waitingWriters.shift();
-    nextWriter();
+    nextWriter?.();
     return;
   }
   while (lock.waitingReaders.length > 0) {
     const nextReader = lock.waitingReaders.shift();
-    nextReader();
+    nextReader?.();
   }
   if (lock.readers === 0 && !lock.writer && lock.waitingReaders.length === 0 && lock.waitingWriters.length === 0) {
     locks.delete(key);
@@ -298,18 +537,6 @@ var NotFoundError = NamedError.create("NotFoundError", zod_default.object({
 function getBaseDir() {
   return process.env.PENSAR_DATA_DIR ?? path.join(os.homedir(), ".pensar");
 }
-async function remove(key) {
-  const dir = getBaseDir();
-  const target = path.join(dir, ...key) + ".json";
-  return withErrorHandling(async () => {
-    await fs.unlink(target).catch(() => {});
-  });
-}
-async function locate(key, ext) {
-  const dir = getBaseDir();
-  const target = path.join(dir, ...key) + (ext ? ext : ".json");
-  return target;
-}
 async function write2(key, content, ext) {
   const dir = getBaseDir();
   const target = path.join(dir, ...key) + (ext ? ext : ".json");
@@ -436,228 +663,4 @@ async function list(prefix) {
   }
 }
 
-// src/core/id/id.ts
-init_zod();
-import { randomBytes as randomBytes2 } from "crypto";
-var prefixes = {
-  session: "ses",
-  message: "msg",
-  permission: "per",
-  user: "usr",
-  part: "prt"
-};
-function schema(prefix) {
-  return zod_default.string().startsWith(prefixes[prefix]);
-}
-var LENGTH = 26;
-var lastTimestamp = 0;
-var counter = 0;
-function descending(prefix, given) {
-  return generateID(prefix, true, given);
-}
-function generateID(prefix, descending2, given) {
-  if (!given) {
-    return create(prefix, descending2);
-  }
-  if (!given.startsWith(prefixes[prefix])) {
-    throw new Error(`ID ${given} does not start with ${prefixes[prefix]}`);
-  }
-  return given;
-}
-function randomBase62(length) {
-  const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-  let result = "";
-  const bytes = randomBytes2(length);
-  for (let i = 0;i < length; i++) {
-    result += chars[bytes[i] % 62];
-  }
-  return result;
-}
-function create(prefix, descending2, timestamp) {
-  const currentTimestamp = timestamp ?? Date.now();
-  if (currentTimestamp !== lastTimestamp) {
-    lastTimestamp = currentTimestamp;
-    counter = 0;
-  }
-  counter++;
-  let now = BigInt(currentTimestamp) * BigInt(4096) + BigInt(counter);
-  now = descending2 ? ~now : now;
-  const timeBytes = Buffer.alloc(6);
-  for (let i = 0;i < 6; i++) {
-    timeBytes[i] = Number(now >> BigInt(40 - 8 * i) & BigInt(255));
-  }
-  return prefixes[prefix] + "_" + timeBytes.toString("hex") + randomBase62(LENGTH - 12);
-}
-
-// src/core/services/rateLimiter/index.ts
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-class RateLimiter {
-  tokens;
-  lastRefillTime;
-  rps;
-  bucketSize;
-  msPerToken;
-  queue;
-  constructor(config) {
-    this.rps = config?.requestsPerSecond;
-    this.bucketSize = this.rps ? 1 : 0;
-    this.tokens = this.bucketSize;
-    this.lastRefillTime = performance.now();
-    this.msPerToken = this.rps ? 1000 / this.rps : undefined;
-    this.queue = Promise.resolve();
-  }
-  async acquireSlot() {
-    if (!this.rps || !this.msPerToken)
-      return;
-    const previousPromise = this.queue;
-    let resolveCurrentRequest;
-    this.queue = new Promise((resolve) => {
-      resolveCurrentRequest = resolve;
-    });
-    await previousPromise;
-    try {
-      const now = performance.now();
-      this.refill(now);
-      if (this.tokens < 1) {
-        const waitTime = (1 - this.tokens) * this.msPerToken;
-        await sleep(waitTime);
-        const nowAfterSleep = performance.now();
-        this.refill(nowAfterSleep);
-      }
-      this.tokens -= 1;
-    } finally {
-      resolveCurrentRequest();
-    }
-  }
-  refill(now) {
-    if (this.tokens >= this.bucketSize) {
-      this.lastRefillTime = now;
-      return;
-    }
-    const elapsed = now - this.lastRefillTime;
-    const tokensToAdd = elapsed / this.msPerToken;
-    this.tokens = Math.min(this.bucketSize, this.tokens + tokensToAdd);
-    this.lastRefillTime = now;
-  }
-  isEnabled() {
-    return this.rps !== undefined;
-  }
-}
-
-// src/util/name.ts
-init_zod();
-var adjectives = [
-  "swift",
-  "bright",
-  "calm",
-  "bold",
-  "keen",
-  "noble",
-  "quick",
-  "sharp",
-  "vivid",
-  "warm",
-  "agile",
-  "brave",
-  "clever",
-  "daring",
-  "eager",
-  "fierce",
-  "gentle",
-  "humble",
-  "jolly",
-  "lively",
-  "merry",
-  "nimble",
-  "proud",
-  "quiet",
-  "rapid",
-  "serene",
-  "sturdy",
-  "tender",
-  "valiant",
-  "witty",
-  "zealous"
-];
-var nouns = [
-  "falcon",
-  "wolf",
-  "hawk",
-  "bear",
-  "lion",
-  "tiger",
-  "eagle",
-  "raven",
-  "phoenix",
-  "dragon",
-  "panther",
-  "cobra",
-  "viper",
-  "shark",
-  "orca",
-  "mantis",
-  "spider",
-  "scorpion",
-  "hydra",
-  "griffin",
-  "sphinx",
-  "kraken",
-  "cipher",
-  "nexus",
-  "prism",
-  "vector",
-  "matrix",
-  "pulse",
-  "surge",
-  "flux"
-];
-function generateRandomName() {
-  const adj = adjectives[Math.floor(Math.random() * adjectives.length)];
-  const noun = nouns[Math.floor(Math.random() * nouns.length)];
-  return `${adj}-${noun}`;
-}
-var sessionNameSchema = exports_external.object({
-  name: exports_external.string().describe("A short, descriptive session name (2-4 words, lowercase, hyphenated)")
-});
-async function generateSessionName(opts) {
-  const { targets, userMessage, model, authConfig, abortSignal } = opts;
-  const contextParts = [];
-  if (targets.length > 0) {
-    contextParts.push(`Target(s): ${targets.join(", ")}`);
-  }
-  if (userMessage) {
-    contextParts.push(`User objective: ${userMessage}`);
-  }
-  if (contextParts.length === 0)
-    return null;
-  const prompt = [
-    "Generate a short, descriptive name for a penetration testing session.",
-    "The name should be 2-4 lowercase words separated by hyphens.",
-    "It should capture the key aspect of the target or task — e.g. 'acme-api-pentest', 'login-auth-bypass', 'ecommerce-checkout-test'.",
-    "",
-    ...contextParts
-  ].join(`
-`);
-  try {
-    const result = await generateObjectResponse({
-      model,
-      schema: sessionNameSchema,
-      prompt,
-      maxTokens: 50,
-      temperature: 0.7,
-      authConfig,
-      abortSignal
-    });
-    if (!result?.name)
-      return null;
-    const name = result.name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 50);
-    return name || null;
-  } catch {
-    return null;
-  }
-}
-
-export { CredentialManager, NotFoundError, remove, locate, write2 as write, createDir, writeRaw, read2 as read, update, list, schema, descending, RateLimiter, generateRandomName, generateSessionName };
+export { generateRandomName, generateSessionName, CredentialManager, schema, descending, RateLimiter, NotFoundError, write2 as write, createDir, writeRaw, read2 as read, update, list };

package/build/cli-s1nckt4k.js

@@ -0,0 +1,20 @@
+import {
+  exports_external1 as exports_external,
+  init_zod
+} from "./cli-e6rgwtpb.js";
+import {
+  __esm
+} from "./cli-8rxa073f.js";
+
+// src/core/toolset/index.ts
+var ToolsetStateSchema;
+var init_toolset = __esm(() => {
+  init_zod();
+  ToolsetStateSchema = exports_external.object({
+    baseToolsetId: exports_external.string(),
+    enabledTools: exports_external.record(exports_external.string(), exports_external.boolean()),
+    lastModified: exports_external.number()
+  });
+});
+
+export { ToolsetStateSchema, init_toolset };

package/build/{cli-k4hrygff.js → cli-v9ds4jb8.js}

@@ -1,17 +1,19 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-3w2syxpv.js";
+} from "./cli-wfmdch3r.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tp1tqn3k.js";
+} from "./cli-mswm4k81.js";
 import {
   hasToolCall,
+  init_dist,
   stepCountIs
-} from "./cli-k0tckznm.js";
+} from "./cli-6p7d2k55.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
-import { join } from "path";
+init_dist();
 import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
 
 // src/core/agents/specialized/attackSurface/prompts.ts
 var SYSTEM = `You are an autonomous attack surface analysis agent. Your mission is to comprehensively map the attack surface of a target and produce a structured report of all discovered assets and pentest objectives.
@@ -384,7 +386,8 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       eventBus,
       subagentId,
-      enableThinking
+      enableThinking,
+      openAIReasoningEffort
     } = opts;
     const target = opts.target ?? opts.cwd;
     const resultsPath = join(session.rootPath, "attack-surface-results.json");
@@ -413,6 +416,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       eventBus,
       subagentId,
       enableThinking,
+      openAIReasoningEffort,
       messages: opts.messages,
       activeTools: [
         "execute_command",