@pensar/apex 2.0.1 → 2.0.2-canary.09dbe74f

package/build/{agent-x7n47c84.js → agent-067x1n67.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-w2st266h.js";
+} from "./cli-pppvjz87.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-6nhperp2.js → agent-3n8msbqb.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-2p56h4nq.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-sgrt7t9v.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+} from "./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
 import {
   exports_external1 as exports_external,
   init_zod
 } from "./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -31,7 +31,7 @@ var MAX_DESCRIPTION_CHARS = 4000;
 function truncate(value, limit) {
   if (value.length <= limit)
     return value;
-  return value.substring(0, limit) + `
+  return `${value.substring(0, limit)}
 ... [truncated]`;
 }
 var FINDING_JUDGE_SYSTEM_PROMPT = `You are a security finding validation specialist running as an agentic verifier inside an automated penetration testing pipeline.
@@ -65,6 +65,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - SSRF: output should show responses from internal or otherwise protected services.
 - Path traversal: output should show file contents outside the intended path.
 - IDOR: output should show access to another user's/account's resource while authentication exists.
+- Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
 - Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
@@ -92,6 +93,7 @@ Reject or lower confidence when:
 - Classify as informational when the observation is real but not currently exploitable or not security-impacting.
 - Classify as expected-behavior when the behavior is clearly by design.
 - Reject when the PoC fabricates evidence, does not demonstrate the claim, or the demonstrated impact fundamentally mismatches the finding.
+- Guard against overstated confidentiality impact: when the demonstrated result is weaker than the claimed impact (e.g. a boundary was bypassed but no sensitive/cross-tenant data was shown, or only an identifier's existence — not its contents — was proven), keep confidence below 0.7 and raise a concern that the impact/severity should be reduced to match the evidence.
 
 ## Response Requirements
 

package/build/agent-m3bsrs09.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-mcn1ar96.js";
+import"./cli-9fsre5pt.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
+import"./cli-c8131c4q.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-2ac4vt09.js → apps-7fhwknrj.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-ncecs1a9.js";
+import"./cli-5e5gq617.js";
+import"./cli-pyz8tnrp.js";
+import"./cli-pppvjz87.js";
+import"./cli-2hw7jen3.js";
+import"./cli-mcn1ar96.js";
+import"./cli-8q9kr0x9.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts
@@ -152,6 +152,8 @@ Search options (scoped to the workspace):
   --offset <n>                 Page offset
 
 Endpoint fields (create requires --endpoint and --description):
+  --app <id>                   endpoint-update only: move the endpoint to a
+                               different application (UUID) in the workspace
   --endpoint <text>            Endpoint path / URL / route
   --description <text>         Endpoint description
   --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
@@ -254,6 +256,9 @@ function parseEndpointCreateOptions(argv) {
 }
 function parseEndpointUpdateOptions(argv) {
   const update = {};
+  const applicationId = getFlag("--app", argv);
+  if (applicationId !== undefined)
+    update.applicationId = applicationId;
   const endpoint = getFlag("--endpoint", argv);
   if (endpoint !== undefined)
     update.endpoint = endpoint;

package/build/{auth-bmt98hz0.js → auth-a1z7ew5p.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+import"./cli-ncecs1a9.js";
+import"./cli-5e5gq617.js";
+import"./cli-pyz8tnrp.js";
+import"./cli-pppvjz87.js";
+import"./cli-2hw7jen3.js";
+import"./cli-mcn1ar96.js";
+import"./cli-8q9kr0x9.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
+import"./cli-a3pzv462.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-8g5cwvbm.js";
+} from "./cli-r9yh5mka.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+} from "./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-69q16waz.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-2hw7jen3.js";
+import"./cli-9fsre5pt.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
+import"./cli-c8131c4q.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-80y8j499.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-pyz8tnrp.js";
+import"./cli-9fsre5pt.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
+import"./cli-c8131c4q.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-xngbtdxb.js → blackboxPentest-aay3kx94.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-5e5gq617.js";
+import"./cli-pyz8tnrp.js";
+import"./cli-pppvjz87.js";
+import"./cli-mcn1ar96.js";
+import"./cli-8q9kr0x9.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-117ypqqj.js";
+import"./cli-2p56h4nq.js";
+import"./cli-sgrt7t9v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-a3pzv462.js";
+import"./cli-r9yh5mka.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-eg35gebv.js";
+import"./cli-tt7ps59g.js";
+import"./cli-hh404jw6.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-hk03x6fq.js → cli-117ypqqj.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-zpdmnz8c.js";
+} from "./cli-2p56h4nq.js";
 import {
   exports_external1 as exports_external,
   init_zod
@@ -46,6 +46,7 @@ var ApexFindingObject = exports_external.object({
   cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
   evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
 });
 

package/build/{cli-fa7nrded.js → cli-2hw7jen3.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-2p56h4nq.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-sgrt7t9v.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,14 +11,14 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z1dapp7v.js";
+} from "./cli-a3pzv462.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
 init_structured();
 init_lazyLogger();
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 // src/core/agents/specialized/authenticationAgent/prompts.ts
 var AUTH_SUBAGENT_SYSTEM_PROMPT = `You are an authentication specialist for autonomous penetration testing.