@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/build/index-861hkebg.js

@@ -0,0 +1,12 @@
+import {
+  config,
+  init_config
+} from "./cli-9egg9azd.js";
+import"./cli-gtcd5c3f.js";
+import"./cli-g5h24ny8.js";
+import"./cli-8rxa073f.js";
+init_config();
+
+export {
+  config
+};

package/build/{index-y5xpp21a.js → index-acc00eq4.js}

@@ -1,51 +1,48 @@
 import {
   CredentialManager,
-  NotFoundError,
   RateLimiter,
   createDir,
   descending,
   generateRandomName,
   generateSessionName,
-  locate,
   read,
-  remove,
   schema,
   update,
   write,
   writeRaw
-} from "./cli-g8t710ew.js";
+} from "./cli-ryy39d77.js";
 import {
   ToolsetStateSchema,
-  exports_toolset,
-  init_toolset,
-  toggleTool
-} from "./cli-k0tckznm.js";
+  init_toolset
+} from "./cli-s1nckt4k.js";
+import"./cli-87zakjb2.js";
+import"./cli-6p7d2k55.js";
+import"./cli-w5990vr6.js";
 import {
   init_zod,
   zod_default
-} from "./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
+} from "./cli-e6rgwtpb.js";
+import"./cli-9egg9azd.js";
 import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
+import"./cli-gtcd5c3f.js";
 import {
-  getCurrentVersion
-} from "./cli-dj1dgw2n.js";
-import"./cli-03z6pswp.js";
+  getCurrentVersion,
+  init_installation
+} from "./cli-g5h24ny8.js";
 import {
-  __require,
-  __toCommonJS
+  __require
 } from "./cli-8rxa073f.js";
 
 // src/core/session/index.ts
 init_zod();
-import path from "path";
-import os from "os";
 import { existsSync, readFileSync } from "fs";
+import os from "os";
+import path from "path";
+init_installation();
 init_toolset();
 var DEFAULT_OUTCOME_GUIDANCE = "Prove the exploit can be run but do not exfiltrate data or cause any harm to the system. " + "Create proof-of-concept exploits that demonstrate the vulnerability exists without causing damage.";
 var EXFIL_OUTCOME_GUIDANCE = "Exfiltrate data to extract the flag value. " + "Create proof-of-concept exploits that successfully extract the flag from the target system.";
-var DEFAULT_OFFENSIVE_HEADERS = {
+var DEFAULT_HEADER_RECORD = {
   "User-Agent": "pensar-apex"
 };
 var AuthCredentialsObject = zod_default.object({
@@ -68,9 +65,10 @@ var ScopeConstraintsObject = zod_default.object({
   allowedPorts: zod_default.number().array().optional(),
   strictScope: zod_default.boolean().optional()
 });
+var SessionHeadersRecord = zod_default.record(zod_default.string(), zod_default.string());
 var OffensiveHeadersConfigObject = zod_default.object({
-  mode: zod_default.enum(["none", "default", "custom"]),
-  headers: zod_default.record(zod_default.string(), zod_default.string()).optional()
+  mode: zod_default.enum(["none", "default", "custom"]).optional(),
+  headers: SessionHeadersRecord.optional()
 });
 var OperatorSettingsObject = zod_default.object({
   initialMode: zod_default.enum(["plan", "manual", "auto"]).default("manual"),
@@ -155,6 +153,7 @@ function resolveSmtpConfig(explicit) {
   return;
 }
 var SessionConfigObject = zod_default.object({
+  headers: SessionHeadersRecord.optional(),
   offensiveHeaders: OffensiveHeadersConfigObject.optional(),
   sessionType: zod_default.enum(["web-app"]).optional(),
   mode: zod_default.enum(["auto", "driver", "operator"]).optional(),
@@ -221,29 +220,40 @@ Security findings will be documented in the \`findings/\` directory as individua
 Testing in progress...
 `;
 }
-async function getExecution(sessionId) {
-  try {
-    const metadata = await read(["sessions", sessionId, "session"]);
-    return metadata;
-  } catch (e) {
-    if (e instanceof NotFoundError) {
-      return null;
-    }
-    throw e;
-  }
-}
-function getOffensiveHeaders(session) {
-  const config = session.config?.offensiveHeaders;
-  if (!config || config.mode === "none") {
-    return;
+function normalizeDeprecatedHeaders(config) {
+  if (!config)
+    return config;
+  if (config.offensiveHeaders == null) {
+    const { offensiveHeaders: _drop, ...rest2 } = config;
+    return rest2;
   }
-  if (config.mode === "default") {
-    return DEFAULT_OFFENSIVE_HEADERS;
+  const { offensiveHeaders, ...rest } = config;
+  const restWithHeaders = rest;
+  if (restWithHeaders.headers !== undefined) {
+    return restWithHeaders;
   }
-  if (config.mode === "custom" && config.headers) {
-    return config.headers;
+  const oh = offensiveHeaders;
+  if (oh.mode === "none") {
+    return { ...restWithHeaders, headers: {} };
   }
-  return;
+  let headers = {};
+  if (oh.mode === "default")
+    headers = { ...DEFAULT_HEADER_RECORD };
+  if (oh.headers)
+    headers = { ...headers, ...oh.headers };
+  return { ...restWithHeaders, headers };
+}
+function migrateLegacySessionData(input) {
+  if (!input || typeof input !== "object")
+    return input;
+  const root = input;
+  const config = root.config;
+  if (!config || typeof config !== "object")
+    return input;
+  const cfg = config;
+  if (!("offensiveHeaders" in cfg))
+    return input;
+  return { ...root, config: normalizeDeprecatedHeaders(cfg) };
 }
 var SessionInfoObject = zod_default.object({
   id: schema("session"),
@@ -263,6 +273,7 @@ var SessionInfoObject = zod_default.object({
 });
 async function create(input) {
   const name = input.name ?? generateRandomName();
+  const normalizedConfig = normalizeDeprecatedHeaders(input.config);
   const id = `${input.prefix ? input.prefix : ""}` + descending("session", input.id);
   const rootPath = getSessionRoot(id);
   const findingsPath = path.join(rootPath, "findings");
@@ -270,17 +281,25 @@ async function create(input) {
   const logsPath = path.join(rootPath, "logs");
   const pocsPath = path.join(rootPath, "pocs");
   const rateLimiter = new RateLimiter({
-    requestsPerSecond: input.config?.requestsPerSecond
+    requestsPerSecond: normalizedConfig?.requestsPerSecond
   });
   let credentialManager;
-  if (input.config?.authCredentials) {
+  if (normalizedConfig?.authCredentials) {
     credentialManager = new CredentialManager;
-    const creds = Array.isArray(input.config.authCredentials) ? input.config.authCredentials : [input.config.authCredentials];
+    const creds = Array.isArray(normalizedConfig.authCredentials) ? normalizedConfig.authCredentials : [normalizedConfig.authCredentials];
     for (const cred of creds) {
       credentialManager.addFromAuthCredentials(cred);
     }
   }
-  const smtpConfig = resolveSmtpConfig(input.config?.smtpConfig);
+  const smtpConfig = resolveSmtpConfig(normalizedConfig?.smtpConfig);
+  let snapshotHeaders;
+  if (normalizedConfig?.headers !== undefined) {
+    snapshotHeaders = { ...normalizedConfig.headers };
+  } else {
+    const { config: appConfig } = await import("./index-861hkebg.js");
+    const cfg = await appConfig.get();
+    snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
+  }
   const result = {
     id,
     version: getCurrentVersion(),
@@ -291,15 +310,10 @@ async function create(input) {
       updated: Date.now()
     },
     config: {
-      ...input.config,
-      mode: input.config?.mode || "auto",
-      offensiveHeaders: input.config?.offensiveHeaders || {
-        mode: "default",
-        headers: {
-          "User-Agent": "pensar-apex"
-        }
-      },
-      outcomeGuidance: input.config?.outcomeGuidance || (input.config?.exfilMode ? EXFIL_OUTCOME_GUIDANCE : DEFAULT_OUTCOME_GUIDANCE),
+      ...normalizedConfig,
+      mode: normalizedConfig?.mode || "auto",
+      headers: snapshotHeaders,
+      outcomeGuidance: normalizedConfig?.outcomeGuidance || (normalizedConfig?.exfilMode ? EXFIL_OUTCOME_GUIDANCE : DEFAULT_OUTCOME_GUIDANCE),
       smtpConfig
     },
     _rateLimiter: rateLimiter,
@@ -332,7 +346,8 @@ async function create(input) {
   return result;
 }
 var get = async (id) => {
-  const read2 = await read(["sessions", id, "session"]);
+  const raw = await read(["sessions", id, "session"]);
+  const read2 = migrateLegacySessionData(raw);
   if (read2.config?.requestsPerSecond) {
     read2._rateLimiter = new RateLimiter({
       requestsPerSecond: read2.config.requestsPerSecond
@@ -342,7 +357,6 @@ var get = async (id) => {
   }
   return read2;
 };
-var sessionPath = (id) => locate(["sessions", id], "");
 async function update2(id, editor) {
   const result = await update(["sessions", id, "session"], (draft) => {
     editor(draft);
@@ -382,23 +396,10 @@ var remove2 = async (input) => {
     console.error(e);
   }
 };
-var updateMessage = async (msg) => {
-  await write(["sessions", msg.sessionId, "messages", msg.id], msg);
-  return msg;
-};
 var RemoveMsgInput = zod_default.object({
   sessionId: schema("session"),
   messageId: schema("message")
 });
-var removeMessage = async (input) => {
-  await remove([
-    "sessions",
-    input.sessionId,
-    "messages",
-    input.messageId
-  ]);
-  return input.messageId;
-};
 async function loadOperatorState(sessionId) {
   try {
     const session = await get(sessionId);
@@ -514,71 +515,39 @@ async function updateOperatorSettings(sessionId, settings) {
     }
   });
 }
-async function updateToolsetState(sessionId, toolsetState) {
+async function updateSessionHeaders(sessionId, headers) {
   return await update2(sessionId, (session) => {
     if (!session.config) {
       session.config = {};
     }
-    session.config.toolsetState = toolsetState;
-  });
-}
-async function toggleTool2(sessionId, toolId, enabled) {
-  return await update2(sessionId, (session) => {
-    if (!session.config) {
-      session.config = {};
-    }
-    if (!session.config.toolsetState) {
-      const { createToolsetState } = (init_toolset(), __toCommonJS(exports_toolset));
-      session.config.toolsetState = createToolsetState("web-pentest");
-    }
-    session.config.toolsetState = toggleTool(session.config.toolsetState, toolId, enabled);
+    session.config.headers = { ...headers };
   });
 }
 var sessions = {
   getSessionRoot,
-  getOffensiveHeaders,
-  DEFAULT_OUTCOME_GUIDANCE,
   EXFIL_OUTCOME_GUIDANCE,
   create,
   get,
-  update: update2,
-  list,
   remove: remove2,
-  updateMessage,
-  removeMessage,
   loadOperatorState,
   hasOperatorState,
   getResumeMessages,
   updateOperatorSettings,
-  updateToolsetState,
-  toggleTool: toggleTool2
+  updateSessionHeaders
 };
 export {
-  updateToolsetState,
+  updateSessionHeaders,
   updateOperatorSettings,
-  updateMessage,
-  update2 as update,
-  toggleTool2 as toggleTool,
   sessions,
-  sessionPath,
-  resolveSmtpConfig,
-  removeMessage,
-  remove2 as remove,
   normalizeMessages,
+  migrateLegacySessionData,
   loadOperatorState,
   list,
   hasOperatorState,
-  getSessionsDir,
   getSessionRoot,
   getResumeMessages,
-  getPensarDir,
-  getOffensiveHeaders,
-  getExecution,
   get,
-  createSessionDirs,
   create,
   SessionInfoObject,
-  EXFIL_OUTCOME_GUIDANCE,
-  DEFAULT_OUTCOME_GUIDANCE,
-  DEFAULT_OFFENSIVE_HEADERS
+  EXFIL_OUTCOME_GUIDANCE
 };

package/build/index-acdgrqa0.js

@@ -0,0 +1,36 @@
+import {
+  AppsDiscoveryResultSchema,
+  DiscoverySummarySchema,
+  EndpointSchema,
+  RiskScoreBreakdownSchema,
+  RiskScoreSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WhiteboxAttackSurfaceAgent
+} from "./cli-abbka8n3.js";
+import"./cli-9fsre5pt.js";
+import"./cli-k0730f59.js";
+import"./cli-wfmdch3r.js";
+import"./cli-mswm4k81.js";
+import"./cli-ryy39d77.js";
+import"./cli-c8131c4q.js";
+import"./cli-s1nckt4k.js";
+import"./cli-87zakjb2.js";
+import"./cli-6p7d2k55.js";
+import"./cli-w5990vr6.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-9egg9azd.js";
+import"./cli-gpnb45ck.js";
+import"./cli-gtcd5c3f.js";
+import"./cli-g5h24ny8.js";
+import"./cli-8rxa073f.js";
+export {
+  WhiteboxAttackSurfaceAgent,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  RiskScoreSchema,
+  RiskScoreBreakdownSchema,
+  EndpointSchema,
+  DiscoverySummarySchema,
+  AppsDiscoveryResultSchema
+};

package/build/{index-e898mdyh.js → index-cfberehw.js}

@@ -1,12 +1,14 @@
 import {
   get,
   init,
+  init_config,
   update
-} from "./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
+} from "./cli-gtcd5c3f.js";
+import"./cli-g5h24ny8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/config/index.ts
+init_config();
 var config = {
   get,
   init,

package/build/{index-wfeb2gcc.js → index-hxn4rk8f.js}

@@ -1,7 +1,10 @@
 import {
   disconnect,
+  ensureValidToken,
   fetchWorkspaces,
+  init_auth,
   isConnected,
+  isTokenExpired,
   pollForWorkspaceCreation,
   pollLegacyToken,
   pollWorkOSToken,
@@ -9,29 +12,24 @@ import {
   signGatewayRequest,
   startDeviceFlow,
   validateGateway
-} from "./cli-dqt80sw3.js";
-import {
-  ensureValidToken,
-  fetchWorkOSClientId,
-  isTokenExpired,
-  refreshAccessToken
-} from "./cli-asyas1xb.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
+} from "./cli-w5990vr6.js";
+import"./cli-9egg9azd.js";
+import"./cli-gtcd5c3f.js";
+import"./cli-g5h24ny8.js";
 import"./cli-8rxa073f.js";
+init_auth();
+
 export {
   validateGateway,
   startDeviceFlow,
   signGatewayRequest,
   selectWorkspace,
-  refreshAccessToken,
   pollWorkOSToken,
   pollLegacyToken,
   pollForWorkspaceCreation,
   isTokenExpired,
   isConnected,
   fetchWorkspaces,
-  fetchWorkOSClientId,
   ensureValidToken,
   disconnect
 };