@pensar/apex 1.8.0 → 1.8.2-canary.fb75c486

package/package.json

@@ -1,111 +1,32 @@
 {
-  "name": "@pensar/apex",
-  "version": "1.8.0",
-  "description": "AI-powered penetration testing CLI tool with terminal UI",
-  "module": "src/tui/index.tsx",
-  "main": "build/cli.js",
-  "type": "module",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/pensarai/apex.git"
-  },
+  "author": "Pensar",
   "bin": {
     "pensar": "./bin/pensar.js"
   },
-  "files": [
-    "build",
-    "bin",
-    "assets",
-    "pensar.svg",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave",
-    "generate:ascii": "bun run scripts/generate-ascii-art.ts",
-    "generate:models": "bun run scripts/generate-models.ts",
-    "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
-    "build:binary:macos-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
-    "build:binary:macos-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
-    "build:binary:linux-x64": "bun build src/cli.ts --compile --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
-    "build:binary:linux-arm64": "bun build src/cli.ts --compile --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
-    "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
-    "dev": "bun run scripts/watch.ts",
-    "dev:debug": "SHOW_CONSOLE=true bun run scripts/watch.ts",
-    "start": "bun run src/tui/index.tsx",
-    "pensar": "node bin/pensar.js",
-    "tsc": "tsc --noEmit",
-    "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
-    "local-benchmark": "bun run scripts/local-benchmark.ts",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "eslint src/",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "penetration-testing",
-    "security",
-    "pentesting",
-    "ai",
-    "cli",
-    "terminal",
-    "tui"
-  ],
-  "author": "Pensar",
-  "license": "MIT",
-  "engines": {
-    "node": ">=18.0.0",
-    "bun": ">=1.0.0"
-  },
-  "optionalDependencies": {
-    "weave": "^0.12.1"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/bun": "^1.3.0",
-    "@types/mailparser": "^3.4.6",
-    "@types/mime-types": "^3.0.1",
-    "@types/nodemailer": "^8.0.0",
-    "@types/react": "^19.2.6",
-    "@typescript-eslint/eslint-plugin": "^8.55.0",
-    "@typescript-eslint/parser": "^8.55.0",
-    "dotenv": "^17.2.3",
-    "eslint": "^10.0.0",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-unused-imports": "^4.4.1",
-    "prettier": "^3.8.1",
-    "typescript-eslint": "^8.55.0",
-    "vitest": "^2.1.8"
-  },
-  "peerDependencies": {
-    "typescript": "^5.9.3"
-  },
   "dependencies": {
-    "@ai-sdk/amazon-bedrock": "^4.0.69",
-    "@ai-sdk/anthropic": "^3.0.50",
+    "@ai-sdk/amazon-bedrock": "^4.0.113",
+    "@ai-sdk/anthropic": "^3.0.81",
     "@ai-sdk/google": "^3.0.37",
     "@ai-sdk/openai": "3.0.46",
     "@ai-sdk/openai-compatible": "^2.0.35",
+    "@ai-sdk/provider": "^3.0.8",
     "@daytonaio/sdk": "^0.112.1",
     "@googleapis/gmail": "^16.1.1",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@openrouter/ai-sdk-provider": "^2.2.3",
-    "@opentui/core": "^0.1.80",
-    "@opentui/react": "^0.1.80",
+    "@opentelemetry/api": "^1.9.0",
+    "@opentui/core": "^0.1.107",
+    "@opentui/react": "^0.1.107",
+    "@pensar/surface": "0.2.1",
     "@playwright/mcp": "^0.0.54",
     "ai": "^6.0.105",
     "glob": "^13.0.0",
-    "google-auth-library": "^10.6.1",
     "highlight.js": "^11.11.1",
-    "ignore": "^7.0.5",
     "imapflow": "^1.2.10",
-    "jsonwebtoken": "^9.0.3",
     "mailparser": "^3.9.3",
     "marked": "^16.4.0",
     "mime-types": "^3.0.2",
-    "nanoid": "^5.1.6",
     "nodemailer": "^8.0.7",
     "p-limit": "^7.2.0",
     "react": "^19.2.0",
@@ -114,5 +35,82 @@
     "yaml": "^2.8.2",
     "zod": "^3.25.76"
   },
-  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
+  "description": "AI-powered penetration testing CLI tool with terminal UI",
+  "devDependencies": {
+    "@biomejs/biome": "2.4.14",
+    "@types/bun": "^1.3.0",
+    "@types/mailparser": "^3.4.6",
+    "@types/mime-types": "^3.0.1",
+    "@types/nodemailer": "^8.0.0",
+    "@types/react": "^19.2.6",
+    "dotenv": "^17.2.3",
+    "knip": "^6.12.0",
+    "prettier": "^3.8.1",
+    "vitest": "^2.1.8"
+  },
+  "engines": {
+    "bun": ">=1.0.0",
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "build",
+    "bin",
+    "assets",
+    "pensar.svg",
+    "LICENSE"
+  ],
+  "keywords": [
+    "penetration-testing",
+    "security",
+    "pentesting",
+    "ai",
+    "cli",
+    "terminal",
+    "tui"
+  ],
+  "license": "MIT",
+  "main": "build/cli.js",
+  "module": "src/tui/index.tsx",
+  "name": "@pensar/apex",
+  "optionalDependencies": {
+    "weave": "^0.12.1"
+  },
+  "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e",
+  "peerDependencies": {
+    "typescript": "^5.9.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pensarai/apex.git"
+  },
+  "scripts": {
+    "build": "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave",
+    "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
+    "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
+    "build:binary:linux-arm64": "bun build src/cli.ts --compile --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
+    "build:binary:linux-x64": "bun build src/cli.ts --compile --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
+    "build:binary:macos-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
+    "build:binary:macos-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
+    "check": "biome check --write",
+    "check:ci": "biome check",
+    "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
+    "dev": "bun run scripts/watch.ts",
+    "dev:debug": "SHOW_CONSOLE=true bun run scripts/watch.ts",
+    "format": "biome check --write && prettier --write \"**/*.{md,yml,yaml}\"",
+    "format:check": "biome check && prettier --check \"**/*.{md,yml,yaml}\"",
+    "generate:ascii": "bun run scripts/generate-ascii-art.ts",
+    "generate:models": "bun run scripts/generate-models.ts",
+    "knip": "knip",
+    "lint": "biome lint src/",
+    "lint:fix": "biome lint --write src/",
+    "local-benchmark": "bun run scripts/local-benchmark.ts",
+    "pensar": "node bin/pensar.js",
+    "prepublishOnly": "npm run build",
+    "start": "bun run src/tui/index.tsx",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "tsc": "tsc --noEmit"
+  },
+  "type": "module",
+  "version": "1.8.2-canary.fb75c486"
 }

package/build/agent-4d8j2jsw.js

@@ -1,278 +0,0 @@
-import {
-  WhiteboxAttackSurfaceResultSchema
-} from "./cli-0fy9j5dw.js";
-import {
-  OffensiveSecurityAgent
-} from "./cli-3w2syxpv.js";
-import"./cli-tp1tqn3k.js";
-import"./cli-g8t710ew.js";
-import"./cli-3y0dgy56.js";
-import {
-  hasToolCall
-} from "./cli-k0tckznm.js";
-import {
-  tool
-} from "./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
-import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
-import"./cli-03z6pswp.js";
-import"./cli-8rxa073f.js";
-
-// src/core/agents/specialized/whiteboxAttackSurface/prompts.ts
-var WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT = `You are an expert source-code analyst and orchestrator. Your mission is to comprehensively map the attack surface of a codebase by analyzing its source code directly.
-
-You operate completely autonomously. Do not ask for permission or wait for user input.
-
-# Your Goal
-
-Given a codebase path, you must:
-1. Identify the repository structure (monorepo vs single app, package manager, etc.)
-2. Discover every application/service defined in the repo
-3. For each app, enumerate ALL web pages and ALL API endpoints defined in the source code
-4. For each endpoint, generate specific pentest objectives
-5. **Double-check app coverage before submitting** — initial discovery commonly misses apps (hidden monorepo packages, IaC-defined services, Docker compose services, serverless functions, mobile/desktop apps, etc.). A dedicated verification pass is mandatory before you submit results.
-
-# Tools at Your Disposal
-
-## list_files
-List directories to understand project structure. Start here.
-
-## read_file
-Read config files, entry points, route definitions, etc.
-
-## grep
-Your primary search tool. Use it to find route definitions, middleware, controllers, etc.
-
-## document_app
-**Use this to document each application/service you identify.** Each call persists a JSON record to the session's apps directory. Document:
-- Each application/service you identify (appType: "web_application" or "api")
-- Notable subdomains hosting distinct services (appType: "subdomain")
-- Cloud resources like S3 buckets, cloud storage, CDN origins (appType: "cloud_resource" or "storage")
-  - For S3 buckets: set \`domain\` to the **canonical virtual-hosted-style** endpoint (e.g. "https://bucket-name.s3.amazonaws.com") and use appType "storage". Do NOT use path-style URLs (e.g. "https://s3.amazonaws.com/bucket-name").
-  - For other cloud resources: set \`domain\` to the primary/canonical resource endpoint and use appType "cloud_resource"
-- If known domains are provided, set the \`domain\` field to associate the app with the correct domain. **Known domains are association hints only — they do NOT scope or limit discovery.** Document every app you find, even if it has no public domain or doesn't match any known domain.
-
-## document_endpoint
-**This is your primary output tool for endpoints.** Each call persists a JSON record to the session's endpoints directory, organized by app. Document:
-- Individual API endpoints and web pages
-
-**CRITICAL — endpoint documentation rules:**
-- **ONE endpoint per unique route path.** Do NOT create separate entries for different HTTP methods on the same path. If \`/api/users\` supports GET, POST, and DELETE, that is ONE entry with \`method: ["GET", "POST", "DELETE"]\`.
-- **Use \`method: "PAGE"\`** for web pages and views.
-- **Always set \`appName\`** to group endpoints under the correct application.
-- **Always set \`routePath\`** to the HTTP route (e.g., \`/api/users\`). This is the URL path a client requests — NOT a source-file path.
-- **Always set \`file\`** to the source-code file (e.g., \`src/routes/users.ts\`). This is NOT the HTTP route.
-- **Always set \`handler\`** to the function name, and \`authRequired\` to indicate auth requirements.
-
-Call these tools throughout your analysis as you discover apps and endpoints — don't wait until the end.
-
-## spawn_coding_agent
-**This is your key tool for scaling out analysis.** Spawn coding sub-agents to analyze individual apps in parallel for higher fidelity. Each sub-agent has full filesystem access (read_file, list_files, grep, execute_command) and the document_app/document_endpoint tools.
-
-## submit_results
-Call this LAST with your complete structured results. This ends your run.
-
-# Methodology
-
-## Phase 1: REPO IDENTIFICATION (do this yourself — it's fast)
-1. List the root directory
-2. Read the top-level config files to determine:
-   - Package manager (package.json → npm/yarn/pnpm, requirements.txt → pip, Cargo.toml → cargo, go.mod → go, etc.)
-   - Repo structure (workspaces field in package.json → monorepo, multiple service dirs → multi-package, etc.)
-3. Identify all apps/services — look for:
-   - Monorepo workspace packages with their own entry points
-   - Separate service directories with their own configs
-   - A single app at the root
-4. Discover cloud resources and external infrastructure referenced in the code:
-   - S3 buckets, GCS buckets, Azure Blob Storage (search for bucket names, s3://, storage URLs)
-   - CDN distributions (CloudFront, Cloudflare)
-   - Infrastructure-as-code definitions (Terraform, CloudFormation, CDK, SST, Pulumi, serverless.yml)
-   - Document each as an app with appType "cloud_resource" or "storage" and set the \`domain\` to the **canonical** resource endpoint
-   - **S3 canonical URL:** Always use virtual-hosted-style "https://bucket-name.s3.amazonaws.com" (or with region: "https://bucket-name.s3.us-east-1.amazonaws.com"). Never use path-style "https://s3.amazonaws.com/bucket-name".
-   - **Do NOT document alternative URL formats** as separate endpoints — only document the canonical/primary URL and any distinct functional paths under it
-
-## Phase 2: APP ANALYSIS (delegate to coding agents)
-For each app you identified, spawn a coding agent with a detailed objective. The objective should instruct the agent to:
-
-1. **Identify the framework** — read the app's config/entry point to determine the web framework
-2. **Document the application** — call \`document_app\` with the app name, type, and framework
-3. **Find ALL web pages** — search for page/view/route definitions and document each with \`document_endpoint\` using \`method: "PAGE"\`
-4. **Find ALL API endpoints** — search for route/endpoint definitions and document each unique path with \`document_endpoint\`, listing ALL HTTP methods in \`method\`
-5. **For each endpoint, include** in the document_endpoint call:
-   - HTTP route in \`routePath\` (e.g., \`/api/users\`) — this is the URL path, NOT a file path
-   - ALL HTTP methods in \`method\` (consolidated — one entry per path)
-   - Handler function in \`handler\`
-   - Source-code file in \`file\` (e.g., \`src/routes/users.ts\`) — this is NOT the route
-   - Line number in \`line\`
-   - Auth requirement in \`authRequired\`
-
-**IMPORTANT:** Tell each coding agent to set \`appName\` on every \`document_endpoint\` call so endpoints are organized by application.
-
-## Phase 3: COVERAGE DOUBLE-CHECK (do this yourself — DO NOT SKIP)
-
-**Initial app discovery almost always misses something.** Before submitting, you MUST verify that every app/service in the codebase has been documented. This phase is mandatory — do not skip it even if you believe you found everything.
-
-1. **Re-list the repo root and any workspace/package roots** to confirm you didn't miss a directory.
-2. **Check monorepo workspace declarations** against your documented apps:
-   - \`package.json\` \`workspaces\` field, \`pnpm-workspace.yaml\`, \`lerna.json\`, \`nx.json\`, \`turbo.json\`, \`rush.json\`
-   - \`Cargo.toml\` \`[workspace]\` members, \`go.work\` use directives
-   - Any top-level \`apps/\`, \`packages/\`, \`services/\`, \`cmd/\`, \`functions/\`, \`lambdas/\`, \`workers/\` directories
-3. **Search for additional entry points** you may have missed. Run targeted greps such as:
-   - Framework manifests: \`next.config.*\`, \`vite.config.*\`, \`remix.config.*\`, \`nuxt.config.*\`, \`astro.config.*\`, \`svelte.config.*\`, \`angular.json\`, \`gatsby-config.*\`, \`expo.json\`, \`app.json\`
-   - Backend entry points: \`main.py\`, \`app.py\`, \`manage.py\`, \`wsgi.py\`, \`asgi.py\`, \`server.{ts,js,go,rs}\`, \`main.{go,rs}\`, \`Program.cs\`, \`Startup.cs\`
-   - Dockerfiles and \`docker-compose.y*ml\` services — each service may be a separate app
-   - IaC definitions: \`serverless.y*ml\`, \`sam.y*ml\`, \`template.y*ml\`, \`*.tf\`, \`cdk.json\`, \`sst.config.*\`, \`pulumi.yaml\`
-   - CI/CD deployment configs: \`.github/workflows/\`, \`vercel.json\`, \`netlify.toml\`, \`fly.toml\`, \`railway.toml\`, \`app.yaml\`, \`Procfile\`
-   - Mobile apps: \`ios/\`, \`android/\`, \`*.xcodeproj\`, \`AndroidManifest.xml\`
-   - Browser extensions / desktop apps: \`manifest.json\` (MV2/MV3), \`electron\`, \`tauri.conf.*\`
-   - Background jobs / workers: search for \`worker\`, \`queue\`, \`cron\`, \`scheduler\`, \`BullMQ\`, \`Celery\`, \`Sidekiq\`
-4. **Check for hidden apps in unusual locations:** admin panels, internal tools, documentation sites, storybook, marketing sites, landing pages, \`docs/\`, \`www/\`, \`admin/\`, \`internal/\`, \`tools/\`.
-5. **Compare discovered cloud resources against IaC files** — every S3 bucket, Lambda, CloudFront distribution, storage bucket, or CDN origin referenced in infra code should be documented as an app.
-
-For every candidate you identify in this phase:
-- If it's **already documented** — good, move on.
-- If it's **NOT documented** — spawn another coding agent to analyze it, or document it yourself with \`document_app\` / \`document_endpoint\`. Do not simply note it in the final summary; it must be in the apps list.
-
-Only proceed to Phase 4 once you have explicitly walked through the checks above and confirmed coverage is complete.
-
-## Phase 4: COLLECT AND SUBMIT (do this yourself)
-
-Before calling \`submit_results\`, verify the final coverage checklist:
-- [ ] Every workspace package / service directory is represented by a documented app
-- [ ] Every framework entry point discovered in Phase 3 maps to a documented app
-- [ ] Every Dockerfile / compose service / IaC resource maps to a documented app or cloud resource
-- [ ] Every known domain (if provided) that maps to an app in the repo has been associated via the \`domain\` field — but apps that don't map to a known domain are still documented (known domains are hints, not a scope filter)
-- [ ] Each documented app has its endpoints/pages enumerated (or an explicit note in \`pentestObjectives\` if it is a non-HTTP service)
-
-Then:
-1. Parse the output from all coding agents
-2. Assemble the complete structured result
-3. Call \`submit_results\` with the full data
-
-# Guidelines
-- Be thorough — every endpoint matters. Don't skip files or directories.
-- Delegate aggressively — spawn coding agents for each app to get high-fidelity results.
-- Give coding agents VERY detailed objectives — they work best with specific instructions about what to search for and how to report it.
-- Don't duplicate work — let the coding agents do the deep file-by-file analysis.
-- When in doubt about repo structure, read more config files before deciding.
-- **Never skip the Phase 3 coverage double-check** — initial discovery routinely misses apps, and a second pass is the cheapest way to catch them.
-- **Known domains are association hints, not a scope filter.** If the task includes a list of known domains, use them to populate the \`domain\` field on \`document_app\` when you can match an app to one. Do NOT use them to decide which apps, packages, services, endpoints, or cloud resources are worth documenting — document everything found in the codebase.
-`;
-
-// src/core/agents/specialized/whiteboxAttackSurface/agent.ts
-class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
-  constructor(opts) {
-    const {
-      model,
-      codebasePath,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      attackSurfaceRegistry,
-      domains,
-      enableThinking
-    } = opts;
-    let capturedResult = null;
-    const submitResultsTool = tool({
-      description: `Submit the final whitebox attack surface analysis results.
-
-Call this ONCE at the end with your complete structured findings.
-This ends the agent run — make sure all data is included.`,
-      inputSchema: WhiteboxAttackSurfaceResultSchema,
-      execute: async (results) => {
-        capturedResult = results;
-        return { success: true, message: "Results submitted." };
-      }
-    });
-    super({
-      system: WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT,
-      prompt: buildPrompt(codebasePath, domains, session.config?.prompt),
-      model,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      attackSurfaceRegistry,
-      enableThinking,
-      activeTools: [
-        "read_file",
-        "list_files",
-        "grep",
-        "document_app",
-        "document_endpoint",
-        "spawn_coding_agent",
-        "submit_results"
-      ],
-      extraTools: {
-        submit_results: submitResultsTool
-      },
-      stopWhen: hasToolCall("submit_results"),
-      resolveResult: () => {
-        if (capturedResult) {
-          return capturedResult;
-        }
-        return {
-          repoType: "unknown",
-          packageManager: "unknown",
-          apps: [],
-          summary: {
-            totalApps: 0,
-            totalPages: 0,
-            totalApiEndpoints: 0,
-            totalPentestObjectives: 0
-          }
-        };
-      }
-    });
-  }
-}
-function buildPrompt(codebasePath, domains, operatorPrompt) {
-  const domainSection = domains?.length ? `
-## Known Domains
-The following domains are **hints for association only** — they are known to be operated by the target and should be set on the \`domain\` field of \`document_app\` when you can determine which domain serves a given app.
-
-**IMPORTANT — these domains DO NOT define the scope of discovery:**
-- Discover and document **every** app/service/cloud resource defined in the codebase, regardless of whether it maps to one of these domains.
-- Apps with no known public domain (internal services, background workers, staging-only apps, functions, admin tools, etc.) MUST still be documented. Leave \`domain\` unset or use the canonical resource URL for cloud resources.
-- Do NOT filter out apps, endpoints, subdomains, or cloud resources because they don't appear to belong to one of these domains.
-- Do NOT skip directories, packages, or services because they "look unrelated" to the listed domains.
-
-Known domains:
-${domains.map((d) => `- ${d}`).join(`
-`)}
-` : "";
-  const operatorGuidanceBlock = operatorPrompt ? `
-## Operator Guidance
-${operatorPrompt}
-` : "";
-  return `# Whitebox Attack Surface Analysis
-
-## Codebase
-- **Path:** ${codebasePath}
-${domainSection}${operatorGuidanceBlock}
-## Task
-Analyze this codebase and produce a complete attack surface map:
-1. Identify the repo type and package manager
-2. Discover all apps/services
-3. Discover cloud resources and external infrastructure referenced in the code (S3 buckets, cloud storage, CDN origins, etc.) — document these as apps with the appropriate type
-4. For each app, find all web pages and API endpoints
-5. For each endpoint, generate pentest objectives
-6. **Before submitting**, perform the Phase 3 coverage double-check from the system prompt — re-scan workspace roots, framework configs, Dockerfiles, IaC, and CI/deploy configs for apps you may have missed on the first pass, and document any that were missed.
-
-Use \`spawn_coding_agent\` to delegate app-level analysis for higher fidelity.
-
-When finished, call \`submit_results\` with the complete structured output. Do NOT call \`submit_results\` until you have explicitly completed the coverage double-check.
-
-Begin now.`;
-}
-export {
-  WhiteboxAttackSurfaceAgent
-};

package/build/agent-z2s6h7n2.js

@@ -1,19 +0,0 @@
-import {
-  CodeAgent
-} from "./cli-jg7r7y5n.js";
-import"./cli-3w2syxpv.js";
-import"./cli-tp1tqn3k.js";
-import"./cli-g8t710ew.js";
-import"./cli-3y0dgy56.js";
-import"./cli-k0tckznm.js";
-import"./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
-import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
-import"./cli-03z6pswp.js";
-import"./cli-8rxa073f.js";
-export {
-  CodeAgent
-};

package/build/blackboxAgent-j9pczwym.js

@@ -1,19 +0,0 @@
-import {
-  BlackboxAttackSurfaceAgent
-} from "./cli-k4hrygff.js";
-import"./cli-3w2syxpv.js";
-import"./cli-tp1tqn3k.js";
-import"./cli-g8t710ew.js";
-import"./cli-3y0dgy56.js";
-import"./cli-k0tckznm.js";
-import"./cli-0ghkg3w6.js";
-import"./cli-dqt80sw3.js";
-import"./cli-asyas1xb.js";
-import"./cli-gpnb45ck.js";
-import"./cli-nr1cjfr9.js";
-import"./cli-dj1dgw2n.js";
-import"./cli-03z6pswp.js";
-import"./cli-8rxa073f.js";
-export {
-  BlackboxAttackSurfaceAgent
-};