@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/build/cli.js

@@ -1,136 +1,62 @@
 #!/usr/bin/env bun
 // @bun
+import"./cli-8xknm7d9.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
-import"./cli-3y0dgy56.js";
+import"./cli-c8131c4q.js";
 import {
   init_toolset
-} from "./cli-k0tckznm.js";
-import"./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
+} from "./cli-s1nckt4k.js";
+import {
+  buildAuthConfig,
+  init_ai,
+  init_models,
+  init_utils
+} from "./cli-6p7d2k55.js";
+import"./cli-w5990vr6.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-9egg9azd.js";
 import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
+import"./cli-gtcd5c3f.js";
 import {
+  init_package,
   package_default
-} from "./cli-dj1dgw2n.js";
-import {
-  init_models
-} from "./cli-03z6pswp.js";
+} from "./cli-g5h24ny8.js";
 import {
   __require,
   __toESM
 } from "./cli-8rxa073f.js";
 // package.json
 var package_default2 = {
-  name: "@pensar/apex",
-  version: "1.8.0",
-  description: "AI-powered penetration testing CLI tool with terminal UI",
-  module: "src/tui/index.tsx",
-  main: "build/cli.js",
-  type: "module",
-  repository: {
-    type: "git",
-    url: "https://github.com/pensarai/apex.git"
-  },
+  author: "Pensar",
   bin: {
     pensar: "./bin/pensar.js"
   },
-  files: [
-    "build",
-    "bin",
-    "assets",
-    "pensar.svg",
-    "LICENSE"
-  ],
-  scripts: {
-    build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave",
-    "generate:ascii": "bun run scripts/generate-ascii-art.ts",
-    "generate:models": "bun run scripts/generate-models.ts",
-    "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
-    "build:binary:macos-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
-    "build:binary:macos-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
-    "build:binary:linux-x64": "bun build src/cli.ts --compile --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
-    "build:binary:linux-arm64": "bun build src/cli.ts --compile --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
-    "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
-    dev: "bun run scripts/watch.ts",
-    "dev:debug": "SHOW_CONSOLE=true bun run scripts/watch.ts",
-    start: "bun run src/tui/index.tsx",
-    pensar: "node bin/pensar.js",
-    tsc: "tsc --noEmit",
-    "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
-    "local-benchmark": "bun run scripts/local-benchmark.ts",
-    test: "vitest run",
-    "test:watch": "vitest",
-    lint: "eslint src/",
-    format: "prettier --write .",
-    "format:check": "prettier --check .",
-    prepublishOnly: "npm run build"
-  },
-  keywords: [
-    "penetration-testing",
-    "security",
-    "pentesting",
-    "ai",
-    "cli",
-    "terminal",
-    "tui"
-  ],
-  author: "Pensar",
-  license: "MIT",
-  engines: {
-    node: ">=18.0.0",
-    bun: ">=1.0.0"
-  },
-  optionalDependencies: {
-    weave: "^0.12.1"
-  },
-  devDependencies: {
-    "@eslint/js": "^10.0.1",
-    "@types/bun": "^1.3.0",
-    "@types/mailparser": "^3.4.6",
-    "@types/mime-types": "^3.0.1",
-    "@types/nodemailer": "^8.0.0",
-    "@types/react": "^19.2.6",
-    "@typescript-eslint/eslint-plugin": "^8.55.0",
-    "@typescript-eslint/parser": "^8.55.0",
-    dotenv: "^17.2.3",
-    eslint: "^10.0.0",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-unused-imports": "^4.4.1",
-    prettier: "^3.8.1",
-    "typescript-eslint": "^8.55.0",
-    vitest: "^2.1.8"
-  },
-  peerDependencies: {
-    typescript: "^5.9.3"
-  },
   dependencies: {
-    "@ai-sdk/amazon-bedrock": "^4.0.69",
-    "@ai-sdk/anthropic": "^3.0.50",
+    "@ai-sdk/amazon-bedrock": "^4.0.113",
+    "@ai-sdk/anthropic": "^3.0.81",
     "@ai-sdk/google": "^3.0.37",
     "@ai-sdk/openai": "3.0.46",
     "@ai-sdk/openai-compatible": "^2.0.35",
+    "@ai-sdk/provider": "^3.0.8",
     "@daytonaio/sdk": "^0.112.1",
     "@googleapis/gmail": "^16.1.1",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@openrouter/ai-sdk-provider": "^2.2.3",
-    "@opentui/core": "^0.1.80",
-    "@opentui/react": "^0.1.80",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentui/core": "^0.1.107",
+    "@opentui/react": "^0.1.107",
+    "@pensar/surface": "0.2.1",
     "@playwright/mcp": "^0.0.54",
     ai: "^6.0.105",
     glob: "^13.0.0",
-    "google-auth-library": "^10.6.1",
     "highlight.js": "^11.11.1",
-    ignore: "^7.0.5",
     imapflow: "^1.2.10",
-    jsonwebtoken: "^9.0.3",
     mailparser: "^3.9.3",
     marked: "^16.4.0",
     "mime-types": "^3.0.2",
-    nanoid: "^5.1.6",
     nodemailer: "^8.0.7",
     "p-limit": "^7.2.0",
     react: "^19.2.0",
@@ -139,10 +65,232 @@ var package_default2 = {
     yaml: "^2.8.2",
     zod: "^3.25.76"
   },
-  packageManager: "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  description: "AI-powered penetration testing CLI tool with terminal UI",
+  devDependencies: {
+    "@biomejs/biome": "2.4.14",
+    "@types/bun": "^1.3.0",
+    "@types/mailparser": "^3.4.6",
+    "@types/mime-types": "^3.0.1",
+    "@types/nodemailer": "^8.0.0",
+    "@types/react": "^19.2.6",
+    dotenv: "^17.2.3",
+    knip: "^6.12.0",
+    prettier: "^3.8.1",
+    vitest: "^2.1.8"
+  },
+  engines: {
+    bun: ">=1.0.0",
+    node: ">=18.0.0"
+  },
+  files: [
+    "build",
+    "bin",
+    "assets",
+    "pensar.svg",
+    "LICENSE"
+  ],
+  keywords: [
+    "penetration-testing",
+    "security",
+    "pentesting",
+    "ai",
+    "cli",
+    "terminal",
+    "tui"
+  ],
+  license: "MIT",
+  main: "build/cli.js",
+  module: "src/tui/index.tsx",
+  name: "@pensar/apex",
+  optionalDependencies: {
+    weave: "^0.12.1"
+  },
+  packageManager: "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e",
+  peerDependencies: {
+    typescript: "^5.9.3"
+  },
+  repository: {
+    type: "git",
+    url: "https://github.com/pensarai/apex.git"
+  },
+  scripts: {
+    build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave",
+    "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
+    "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
+    "build:binary:linux-arm64": "bun build src/cli.ts --compile --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
+    "build:binary:linux-x64": "bun build src/cli.ts --compile --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
+    "build:binary:macos-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
+    "build:binary:macos-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
+    check: "biome check --write",
+    "check:ci": "biome check",
+    "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
+    dev: "bun run scripts/watch.ts",
+    "dev:debug": "SHOW_CONSOLE=true bun run scripts/watch.ts",
+    format: 'biome check --write && prettier --write "**/*.{md,yml,yaml}"',
+    "format:check": 'biome check && prettier --check "**/*.{md,yml,yaml}"',
+    "generate:ascii": "bun run scripts/generate-ascii-art.ts",
+    "generate:models": "bun run scripts/generate-models.ts",
+    knip: "knip",
+    lint: "biome lint src/",
+    "lint:fix": "biome lint --write src/",
+    "local-benchmark": "bun run scripts/local-benchmark.ts",
+    pensar: "node bin/pensar.js",
+    prepublishOnly: "npm run build",
+    start: "bun run src/tui/index.tsx",
+    test: "vitest run",
+    "test:watch": "vitest",
+    tsc: "tsc --noEmit"
+  },
+  type: "module",
+  version: "1.8.2-canary.fb75c486"
 };
 
+// src/core/ai/index.ts
+init_ai();
+init_models();
+init_utils();
+
+// src/core/cli/pentestMode.ts
+var SUPPORTED_PENTEST_MODES = ["exfil"];
+function resolvePentestMode(mode) {
+  if (!mode) {
+    return { exfilMode: false };
+  }
+  if (mode === "exfil") {
+    return { exfilMode: true };
+  }
+  return {
+    exfilMode: false,
+    warning: `Warning: Unsupported --mode value "${mode}". Supported values: ${SUPPORTED_PENTEST_MODES.join(", ")}. Continuing in default mode.`
+  };
+}
+
+// src/core/eventBus.ts
+import { EventEmitter } from "events";
+var CHILD_BUS_FORWARD_POLICY = {
+  "text-delta": "forward",
+  "tool-call-start": "forward",
+  "tool-call-delta": "forward",
+  "tool-call-complete": "forward",
+  "tool-result": "forward",
+  "subagent-spawn": "forward",
+  "subagent-complete": "forward",
+  "step-finish": "forward",
+  "command-output": "forward",
+  error: "forward",
+  "trace-record": "forward",
+  "workflow-phase-start": "parent-only",
+  "workflow-phase-complete": "parent-only",
+  "app-analysis-progress": "parent-only"
+};
+var CHILD_BUS_FORWARDED_EVENTS = Object.keys(CHILD_BUS_FORWARD_POLICY).filter((key) => CHILD_BUS_FORWARD_POLICY[key] === "forward");
+
+class AgentEventBus {
+  emitter = new EventEmitter;
+  constructor() {
+    this.emitter.setMaxListeners(50);
+  }
+  on(event, handler) {
+    this.emitter.on(event, handler);
+    return this;
+  }
+  once(event, handler) {
+    this.emitter.once(event, handler);
+    return this;
+  }
+  off(event, handler) {
+    this.emitter.off(event, handler);
+    return this;
+  }
+  emit(event, payload) {
+    return this.emitter.emit(event, payload);
+  }
+  removeAllListeners(event) {
+    if (event) {
+      this.emitter.removeAllListeners(event);
+    } else {
+      this.emitter.removeAllListeners();
+    }
+    return this;
+  }
+  static attachChild(child, parent, subagentId) {
+    if (!parent)
+      return;
+    for (const key of CHILD_BUS_FORWARDED_EVENTS) {
+      const forwardKey = key;
+      child.on(forwardKey, (payload) => {
+        const p = payload;
+        const isLifecycle = forwardKey === "subagent-spawn" || forwardKey === "subagent-complete";
+        if (isLifecycle) {
+          if (p.parentSubagentId) {
+            parent.emit(forwardKey, payload);
+          } else {
+            parent.emit(forwardKey, {
+              ...p,
+              parentSubagentId: subagentId
+            });
+          }
+          return;
+        }
+        if (!p.subagentId) {
+          parent.emit(forwardKey, { ...p, subagentId });
+        } else {
+          parent.emit(forwardKey, payload);
+        }
+      });
+    }
+  }
+  emitStreamPart(chunk, subagentId) {
+    switch (chunk.type) {
+      case "text-delta":
+        this.emit("text-delta", { text: chunk.text, subagentId });
+        break;
+      case "tool-input-start":
+        this.emit("tool-call-start", {
+          toolCallId: chunk.id,
+          toolName: chunk.toolName,
+          subagentId
+        });
+        break;
+      case "tool-input-delta":
+        this.emit("tool-call-delta", {
+          toolCallId: chunk.id,
+          argsTextDelta: chunk.delta,
+          subagentId
+        });
+        break;
+      case "tool-call": {
+        const tc = chunk;
+        this.emit("tool-call-complete", {
+          toolCallId: tc.toolCallId,
+          toolName: tc.toolName,
+          args: tc.args ?? tc.input,
+          subagentId
+        });
+        break;
+      }
+      case "tool-result": {
+        const tr = chunk;
+        this.emit("tool-result", {
+          toolCallId: tr.toolCallId,
+          toolName: tr.toolName,
+          result: tr.result ?? tr.output,
+          subagentId
+        });
+        break;
+      }
+      case "error":
+        this.emit("error", {
+          error: chunk.error,
+          subagentId
+        });
+        break;
+    }
+  }
+}
+
 // src/core/installation/index.ts
+init_package();
 import { spawnSync } from "child_process";
 function getCurrentVersion() {
   return package_default.version;
@@ -273,152 +421,10 @@ You can upgrade manually by running:
   };
 }
 
-// src/core/ai/utils.ts
-init_models();
-var STREAMING_FETCH_TIMEOUT_MS = 15 * 60 * 1000;
-function buildAuthConfig(cfg) {
-  return {
-    anthropicAPIKey: cfg.anthropicAPIKey ?? undefined,
-    openAiAPIKey: cfg.openAiAPIKey ?? undefined,
-    googleAPIKey: cfg.googleAPIKey ?? undefined,
-    openRouterAPIKey: cfg.openRouterAPIKey ?? undefined,
-    inceptionAPIKey: cfg.inceptionAPIKey ?? undefined,
-    pensarAPIKey: cfg.pensarAPIKey ?? undefined,
-    accessToken: cfg.accessToken ?? undefined,
-    refreshToken: cfg.refreshToken ?? undefined,
-    workspaceId: cfg.workspaceId ?? undefined,
-    gatewaySigningKey: cfg.gatewaySigningKey ?? undefined,
-    gatewayUrl: cfg.gatewayUrl ?? undefined,
-    bedrock: cfg.bedrockAPIKey ? { apiKey: cfg.bedrockAPIKey } : undefined,
-    local: cfg.localModelUrl ? { baseURL: cfg.localModelUrl } : undefined
-  };
-}
-
-// src/core/cli/pentestMode.ts
-var SUPPORTED_PENTEST_MODES = ["exfil"];
-function resolvePentestMode(mode) {
-  if (!mode) {
-    return { exfilMode: false };
-  }
-  if (mode === "exfil") {
-    return { exfilMode: true };
-  }
-  return {
-    exfilMode: false,
-    warning: `Warning: Unsupported --mode value "${mode}". Supported values: ${SUPPORTED_PENTEST_MODES.join(", ")}. Continuing in default mode.`
-  };
-}
-
-// src/core/eventBus.ts
-import { EventEmitter } from "events";
-var CHILD_BUS_FORWARDED_EVENTS = [
-  "text-delta",
-  "tool-call-start",
-  "tool-call-delta",
-  "tool-call-complete",
-  "tool-result",
-  "subagent-spawn",
-  "subagent-complete",
-  "command-output",
-  "error",
-  "step-finish"
-];
-
-class AgentEventBus {
-  emitter = new EventEmitter;
-  constructor() {
-    this.emitter.setMaxListeners(50);
-  }
-  on(event, handler) {
-    this.emitter.on(event, handler);
-    return this;
-  }
-  once(event, handler) {
-    this.emitter.once(event, handler);
-    return this;
-  }
-  off(event, handler) {
-    this.emitter.off(event, handler);
-    return this;
-  }
-  emit(event, payload) {
-    return this.emitter.emit(event, payload);
-  }
-  removeAllListeners(event) {
-    if (event) {
-      this.emitter.removeAllListeners(event);
-    } else {
-      this.emitter.removeAllListeners();
-    }
-    return this;
-  }
-  static attachChild(child, parent, subagentId) {
-    for (const key of CHILD_BUS_FORWARDED_EVENTS) {
-      child.on(key, (payload) => {
-        if (!parent)
-          return;
-        const p = payload;
-        if (!p.subagentId) {
-          parent.emit(key, { ...p, subagentId });
-        } else {
-          parent.emit(key, payload);
-        }
-      });
-    }
-  }
-  emitStreamPart(chunk, subagentId) {
-    switch (chunk.type) {
-      case "text-delta":
-        this.emit("text-delta", { text: chunk.text, subagentId });
-        break;
-      case "tool-input-start":
-        this.emit("tool-call-start", {
-          toolCallId: chunk.id,
-          toolName: chunk.toolName,
-          subagentId
-        });
-        break;
-      case "tool-input-delta":
-        this.emit("tool-call-delta", {
-          toolCallId: chunk.id,
-          argsTextDelta: chunk.delta,
-          subagentId
-        });
-        break;
-      case "tool-call": {
-        const tc = chunk;
-        this.emit("tool-call-complete", {
-          toolCallId: tc.toolCallId,
-          toolName: tc.toolName,
-          args: tc.args ?? tc.input,
-          subagentId
-        });
-        break;
-      }
-      case "tool-result": {
-        const tr = chunk;
-        this.emit("tool-result", {
-          toolCallId: tr.toolCallId,
-          toolName: tr.toolName,
-          result: tr.result ?? tr.output,
-          subagentId
-        });
-        break;
-      }
-      case "error":
-        this.emit("error", {
-          error: chunk.error,
-          subagentId
-        });
-        break;
-    }
-  }
-}
-
 // src/tui/utils/command-flags.ts
-init_toolset();
 import { readFileSync } from "fs";
-import { resolve, isAbsolute } from "path";
+import { isAbsolute, resolve } from "path";
+init_toolset();
 function combinePromptParts(threatModel, prompt) {
   const parts = [];
   if (threatModel)
@@ -496,12 +502,52 @@ async function createInstrumentedBus(session) {
   });
   return { bus, cleanup: async () => wandbCleanup?.() };
 }
+async function resolveCliHeaders() {
+  const headerArgs = getAllArgs("--header");
+  const headersFromArg = getArg("--headers-from");
+  const noGlobal = hasFlag("--no-global-headers");
+  if (headerArgs.length === 0 && !headersFromArg && !noGlobal) {
+    return;
+  }
+  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-15kqmy2v.js");
+  const merged = {};
+  if (!noGlobal) {
+    const { config: appConfig } = await import("./index-cfberehw.js");
+    const cfg = await appConfig.get();
+    if (cfg.defaultHeaders) {
+      Object.assign(merged, cfg.defaultHeaders);
+    }
+  }
+  if (headersFromArg) {
+    const parsed = await parseHeadersFromFile(headersFromArg);
+    if (!parsed.ok) {
+      for (const err of parsed.error) {
+        console.error(`--headers-from error:
+${formatParseError2(err)}`);
+      }
+      process.exit(1);
+    }
+    for (const entry of parsed.value) {
+      merged[entry.name] = entry.value;
+    }
+  }
+  for (const arg of headerArgs) {
+    const parsed = parseHeaderLine2(arg);
+    if (!parsed.ok) {
+      console.error(`--header "${arg}" rejected:
+${formatParseError2(parsed.error)}`);
+      process.exit(1);
+    }
+    merged[parsed.value.name] = parsed.value.value;
+  }
+  return merged;
+}
 async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-e898mdyh.js");
-  const { getDefaultModelForConfig } = await import("./utils-jf52rmrb.js");
+  const { config: appConfig } = await import("./index-cfberehw.js");
+  const { getDefaultModelForConfig } = await import("./utils-dh1t2r1e.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -527,11 +573,12 @@ Usage:
   pensar threat-model [options]       Generate application-centric threat model
   pensar login                        Connect to Pensar Console
   pensar uninstall                    Uninstall Pensar (keeps sessions, memories, skills)
-  pensar projects                     List workspace projects
+  pensar apps                         Manage the attack surface (apps & endpoints)
   pensar pentests                     List and manage pentests
   pensar issues                       List and manage security issues
   pensar fixes                        View security fixes
   pensar logs                         View agent execution logs
+  pensar config headers               Manage global default HTTP headers
   pensar upgrade                      Update pensar to the latest version
   pensar doctor                       Check dependencies and install missing tools
   pensar help                         Show this help message
@@ -542,6 +589,9 @@ operator options (-p):
   -s, --system <text|@file>  Override the default system prompt
   --target <url>             Target URL / domain / IP
   --model <model>            AI model (default: auto-selected from configured provider)
+  --header "Name: Value"     Custom HTTP header (repeatable)
+  --headers-from <file>      Load headers from a JSON object or Name:Value file
+  --no-global-headers        Skip the global defaultHeaders snapshot
 
 pentest options:
   --target <url>           (required) Target URL / domain / IP
@@ -552,11 +602,17 @@ pentest options:
   --task-driven             Enable task-driven architecture (experimental)
   --prompt <text|@file>    Guidance for the pentest agent (inline text or @filepath)
   --threat-model <text|@file>  Threat model to guide the pentest (inline or @filepath)
+  --header "Name: Value"   Custom HTTP header (repeatable)
+  --headers-from <file>    Load headers from a JSON object or Name:Value file
+  --no-global-headers      Skip the global defaultHeaders snapshot
 
 targeted-pentest options:
   --target <url>          (required) Target URL / domain / IP
   --objective <text>      (required, repeatable) Testing objective
   --model <model>         AI model (default: auto-selected from configured provider)
+  --header "Name: Value"  Custom HTTP header (repeatable)
+  --headers-from <file>   Load headers from a JSON object or Name:Value file
+  --no-global-headers     Skip the global defaultHeaders snapshot
 
 threat-model options:
   --output, -o <path>  Output file path (default: ./threat-model.md)
@@ -571,11 +627,11 @@ Global options:
 `);
 }
 async function runPentest() {
-  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
-  config2();
-  const { runPentestAgent } = await import("./blackboxPentest-8ps4yvbk.js");
-  const { sessions } = await import("./index-y5xpp21a.js");
-  const { config: appConfig } = await import("./index-e898mdyh.js");
+  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  config();
+  const { runPentestAgent } = await import("./blackboxPentest-b5741n3h.js");
+  const { sessions } = await import("./index-acc00eq4.js");
+  const { config: appConfig } = await import("./index-cfberehw.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -588,6 +644,7 @@ async function runPentest() {
   const prompt = combinePromptParts(resolvedTm, resolvedPrompt);
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
+  const headers = await resolveCliHeaders();
   const { exfilMode, warning: modeWarning } = resolvePentestMode(mode);
   if (modeWarning) {
     console.warn(modeWarning);
@@ -601,7 +658,8 @@ Cwd:     ${cwd} (whitebox)` : ""}${exfilMode ? `
 Mode:    exfil` : ""}
 Model:   ${model}${enableThinking ? `
 Thinking: enabled` : ""}${taskDriven ? `
-Task-driven: enabled` : ""}
+Task-driven: enabled` : ""}${headers ? `
+Headers: ${Object.keys(headers).length} configured` : ""}
 `);
   const session = await sessions.create({
     name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
@@ -610,9 +668,11 @@ Task-driven: enabled` : ""}
       ...cwd ? { cwd } : {},
       ...exfilMode ? { exfilMode: true } : {},
       ...prompt ? { prompt } : {},
-      ...taskDriven ? { taskDriven: true } : {}
+      ...taskDriven ? { taskDriven: true } : {},
+      ...headers !== undefined ? { headers } : {}
     }
   });
+  console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
   const { bus: pentestBus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
   try {
     const { findings, findingsPath, pocsPath, reportPath } = await runPentestAgent({
@@ -621,6 +681,7 @@ Task-driven: enabled` : ""}
       session,
       model,
       enableThinking,
+      surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
       authConfig: buildAuthConfig(pensarConfig),
       eventBus: pentestBus
     });
@@ -635,13 +696,14 @@ Report:    ${reportPath}` : ""}`);
   } finally {
     await wandbCleanup();
   }
+  process.exit(0);
 }
 async function runTargetedPentest() {
-  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
-  config2();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-fs0v570s.js");
-  const { sessions } = await import("./index-y5xpp21a.js");
-  const { config: appConfig } = await import("./index-e898mdyh.js");
+  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  config();
+  const { runTargetedPentestAgent } = await import("./targetedPentest-fjxqn089.js");
+  const { sessions } = await import("./index-acc00eq4.js");
+  const { config: appConfig } = await import("./index-cfberehw.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -661,10 +723,13 @@ Model:   ${model}
 Objectives:
 ${objectivesList}
 `);
+  const headers = await resolveCliHeaders();
   const session = await sessions.create({
     name: "Targeted Pentest",
-    targets: [target]
+    targets: [target],
+    ...headers !== undefined ? { config: { headers } } : {}
   });
+  console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
   const { bus: targetedBus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
   try {
     const { findings, findingsPath, pocsPath } = await runTargetedPentestAgent({
@@ -685,12 +750,13 @@ POCs:      ${pocsPath}`);
   } finally {
     await wandbCleanup();
   }
+  process.exit(0);
 }
 async function runThreatModel() {
-  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
-  config2();
-  const { runThreatModelWorkflow } = await import("./threatModel-xfvc6cch.js");
-  const { config: appConfig } = await import("./index-e898mdyh.js");
+  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  config();
+  const { runThreatModelWorkflow } = await import("./threatModel-9yqx7d7x.js");
+  const { config: appConfig } = await import("./index-cfberehw.js");
   const path = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
@@ -724,16 +790,16 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { config: config2 } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
-  config2();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-re6kt2ff.js");
-  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-y5xpp21a.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-bz6f8jry.js");
-  const { config: appConfig } = await import("./index-e898mdyh.js");
+  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  config();
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-w9m0svwk.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-acc00eq4.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-vwt27stc.js");
+  const { config: appConfig } = await import("./index-cfberehw.js");
   const { createInterface } = await import("readline");
   const { readFileSync: readFileSync2, existsSync } = await import("fs");
   const path = await import("path");
-  const { stepCountIs } = await import("./index-dw1xbhfn.js");
+  const { stepCountIs } = await import("./index-vc29b21w.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -753,6 +819,7 @@ Model:   ${model}${target ? `
 Target:  ${target}` : ""}
 ${sep}
 `);
+  const headers = await resolveCliHeaders();
   const session = await sessions.create({
     name: "Operator Session",
     targets: target ? [target] : [],
@@ -763,7 +830,8 @@ ${sep}
         initialMode: "auto",
         requireApproval: false,
         enableSuggestions: false
-      }
+      },
+      ...headers !== undefined ? { headers } : {}
     }
   });
   const { bus, cleanup: wandbCleanup } = await createInstrumentedBus(session);
@@ -841,29 +909,32 @@ if (hasFlag("-p") || command === "--prompt") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-dxjgy41e.js");
+  await import("./auth-p4r1m7xq.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-qb2xbh2t.js");
-} else if (command === "projects") {
+  await import("./uninstall-9zbf4cwc.js");
+} else if (command === "apps") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./projects-qk22qcbt.js");
+  await import("./apps-t0gmwc7z.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-e3rj5845.js");
+  await import("./pentests-nq7wa8yb.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-qbmdneej.js");
+  await import("./issues-1bynat5q.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-q5bhgxhc.js");
+  await import("./fixes-60k3ts71.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-xm5vbymy.js");
+  await import("./logs-e78vx2dy.js");
+} else if (command === "config") {
+  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+  await import("./config-3bvtf3j8.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-8tva8j99.js");
+  const { runDoctor } = await import("./doctor-2bkpddws.js");
   await runDoctor();
 } else if (args.length === 0) {
   if (process.env.PENSAR_NO_TUI === "1") {
@@ -871,7 +942,7 @@ if (hasFlag("-p") || command === "--prompt") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-pfee23kv.js");
+  await import("./index-0gp3x2r8.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();