@pensar/apex 2.0.1 → 2.0.2-canary.1de5ff5b

package/build/{agent-x7n47c84.js → agent-0xj95pts.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-w2st266h.js";
+} from "./cli-5c0rvt4t.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
-import"./cli-e6rgwtpb.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-6nhperp2.js → agent-e7a8ecyn.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-d5vz4kyn.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-p4aht9hv.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+} from "./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
 import {
-  exports_external1 as exports_external,
+  exports_external,
   init_zod
-} from "./cli-e6rgwtpb.js";
+} from "./cli-f7d23ded.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -31,7 +31,7 @@ var MAX_DESCRIPTION_CHARS = 4000;
 function truncate(value, limit) {
   if (value.length <= limit)
     return value;
-  return value.substring(0, limit) + `
+  return `${value.substring(0, limit)}
 ... [truncated]`;
 }
 var FINDING_JUDGE_SYSTEM_PROMPT = `You are a security finding validation specialist running as an agentic verifier inside an automated penetration testing pipeline.
@@ -65,6 +65,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - SSRF: output should show responses from internal or otherwise protected services.
 - Path traversal: output should show file contents outside the intended path.
 - IDOR: output should show access to another user's/account's resource while authentication exists.
+- Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
 - Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
@@ -92,6 +93,7 @@ Reject or lower confidence when:
 - Classify as informational when the observation is real but not currently exploitable or not security-impacting.
 - Classify as expected-behavior when the behavior is clearly by design.
 - Reject when the PoC fabricates evidence, does not demonstrate the claim, or the demonstrated impact fundamentally mismatches the finding.
+- Guard against overstated confidentiality impact: when the demonstrated result is weaker than the claimed impact (e.g. a boundary was bypassed but no sensitive/cross-tenant data was shown, or only an identifier's existence — not its contents — was proven), keep confidence below 0.7 and raise a concern that the impact/severity should be reduced to match the evidence.
 
 ## Response Requirements
 

package/build/agent-tcrb50te.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-wgqxjhky.js";
+import"./cli-9fsre5pt.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
+import"./cli-c8131c4q.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-2ac4vt09.js → apps-p91cynx1.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-pevzp7nj.js";
+import"./cli-jzkfbrnx.js";
+import"./cli-r9v48v8g.js";
+import"./cli-5c0rvt4t.js";
+import"./cli-cbhsy5x3.js";
+import"./cli-wgqxjhky.js";
+import"./cli-mep0ck1r.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
-import"./cli-e6rgwtpb.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts
@@ -152,6 +152,8 @@ Search options (scoped to the workspace):
   --offset <n>                 Page offset
 
 Endpoint fields (create requires --endpoint and --description):
+  --app <id>                   endpoint-update only: move the endpoint to a
+                               different application (UUID) in the workspace
   --endpoint <text>            Endpoint path / URL / route
   --description <text>         Endpoint description
   --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
@@ -254,6 +256,9 @@ function parseEndpointCreateOptions(argv) {
 }
 function parseEndpointUpdateOptions(argv) {
   const update = {};
+  const applicationId = getFlag("--app", argv);
+  if (applicationId !== undefined)
+    update.applicationId = applicationId;
   const endpoint = getFlag("--endpoint", argv);
   if (endpoint !== undefined)
     update.endpoint = endpoint;

package/build/{auth-bmt98hz0.js → auth-snffaqnn.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+import"./cli-pevzp7nj.js";
+import"./cli-jzkfbrnx.js";
+import"./cli-r9v48v8g.js";
+import"./cli-5c0rvt4t.js";
+import"./cli-cbhsy5x3.js";
+import"./cli-wgqxjhky.js";
+import"./cli-mep0ck1r.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
+import"./cli-bxtz3bdv.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-8g5cwvbm.js";
-import"./cli-e6rgwtpb.js";
+} from "./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+} from "./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-8q9a1cpf.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-cbhsy5x3.js";
+import"./cli-9fsre5pt.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
+import"./cli-c8131c4q.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-mwbcawfn.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-r9v48v8g.js";
+import"./cli-9fsre5pt.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
+import"./cli-c8131c4q.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-xngbtdxb.js → blackboxPentest-2v0856w0.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-jzkfbrnx.js";
+import"./cli-r9v48v8g.js";
+import"./cli-5c0rvt4t.js";
+import"./cli-wgqxjhky.js";
+import"./cli-mep0ck1r.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-4x7k2s16.js";
+import"./cli-d5vz4kyn.js";
+import"./cli-p4aht9hv.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
-import"./cli-e6rgwtpb.js";
+import"./cli-bxtz3bdv.js";
+import"./cli-zgpj2mv1.js";
+import"./cli-f7d23ded.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kn9tst6t.js";
+import"./cli-hkegr688.js";
+import"./cli-w55v1bht.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-hk03x6fq.js → cli-4x7k2s16.js}

@@ -1,11 +1,11 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-zpdmnz8c.js";
+} from "./cli-d5vz4kyn.js";
 import {
-  exports_external1 as exports_external,
+  exports_external,
   init_zod
-} from "./cli-e6rgwtpb.js";
+} from "./cli-f7d23ded.js";
 
 // src/core/agents/offSecAgent/types.ts
 init_zod();
@@ -46,6 +46,7 @@ var ApexFindingObject = exports_external.object({
   cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
   evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
 });
 

package/build/{cli-w2st266h.js → cli-5c0rvt4t.js}

@@ -2,23 +2,23 @@ import {
   OffensiveSecurityAgent,
   isMemoryEnabled,
   readPlan
-} from "./cli-zpdmnz8c.js";
+} from "./cli-d5vz4kyn.js";
 import {
   createLogger,
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z1dapp7v.js";
+} from "./cli-bxtz3bdv.js";
 import {
-  exports_external1 as exports_external,
+  exports_external,
   init_zod
-} from "./cli-e6rgwtpb.js";
+} from "./cli-f7d23ded.js";
 
 // src/core/agents/specialized/pentest/agent.ts
 init_zod();
 init_structured();
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 init_lazyLogger();
 var log = scopedLogger(() => createLogger("pentest-agent"));
 var ObjectiveResultSchema = exports_external.object({
@@ -170,6 +170,27 @@ var SECTION_CREDENTIAL_DISCOVERY = `Credential & Secret Discovery:
   - Mention the public identifiers only as supporting context, not as additional secrets
 - When validating an exposed key, verify what access it actually grants. A key that returns 200 on a single endpoint is less severe than a key that provides access to user data, admin functions, or billing APIs.
 - Title findings precisely: "Exposed Backend API Key" is better than "Hardcoded API Keys and AWS Infrastructure Configuration" which conflates secret and non-secret data.`;
+var SECTION_FINDING_QUALITY = `Finding Framing, Titles & Remediation:
+
+Lead with the strongest demonstrated impact:
+- The title and the FIRST sentence of the description must state the strongest impact you actually PROVED, not the weakest observable symptom. If your POC reads file/record contents belonging to another tenant, the finding is "unauthorized cross-tenant data access" / IDOR — NOT "enumeration" or "status-code oracle", even if an oracle is how you first noticed it. Frame around the data you accessed, then mention the oracle/mechanism as the technique.
+- Do not bury a high-impact result inside a low-impact framing. If you can access content, your evidence must show the content you accessed (and that the test identity should not have access to it), not merely that an ID exists.
+
+Title hygiene:
+- A title names the vulnerability class + the affected component or root cause (e.g. "Authorization Bypass Leaks Page Content for All /dev Routes via RSC 307 Body"). 
+- When the root cause is systemic (one shared layout, middleware, or helper affecting many routes), title it for the systemic cause, NOT a single example route. Do not title a class-wide issue after one instance like "/dev/colors" when the body says "any /dev page".
+- No editorial asides or comparisons in titles (e.g. drop "(Distinct from the Egnyte Callback)"). The title must be consistent with the scope stated in the description.
+
+Prove the access-model delta (authorization / IDOR / data-exposure findings):
+- Explicitly state the access model: which identity/role you tested as, and what that identity should vs should not be able to see.
+- Prove the boundary was actually crossed: show that the data returned belongs to a DIFFERENT tenant/user, or is admin-only data a member should not see. A 200 response or a bypassed redirect is NOT sufficient on its own — demonstrate that the exposed data is sensitive and out-of-scope for the test identity.
+- If you bypassed an authorization boundary but the data returned is non-sensitive or plausibly same-tenant/expected-visible, say so plainly in the evidence and impact. This is still a boundary failure worth reporting, but do not overstate the confidentiality impact — let the CVSS reflect what was actually exposed.
+- When you cannot confirm whether exposed data is cross-tenant vs same-tenant, state the uncertainty rather than assuming the worst case.
+
+Remediation quality:
+- Give specific, root-cause remediation — not generic "add an authorization check".
+- For authorization failures, emphasize enforcing the check AT the data-access boundary (in the data-fetching function / handler), not relying solely on layout-, middleware-, or routing-level protection that streaming, prefetch, or direct calls can bypass. Name the anti-pattern when present.
+- OAuth state / CSRF / PKCE: the core requirement is a state value that is unguessable (high-entropy random), bound to the user/session that initiated the flow, single-use, and validated on return — or PKCE as an equivalent fix. Frame these as the primary remediation. HMAC-signing or encrypting the state is valid defense-in-depth, but do NOT present "lacks cryptographic signature" as the core issue when an unguessable, properly-bound, validated state (or PKCE) resolves it.`;
 var SECTION_SECURITY_HEADERS_CORS = `Security Headers & CORS:
 - Do NOT recommend X-XSS-Protection — it is deprecated by all major browsers (Chrome, Firefox, Edge). Recommend Content-Security-Policy instead.
 - CORS analysis must account for the endpoint's authentication model:
@@ -239,6 +260,8 @@ ${SECTION_CREDENTIAL_DISCOVERY}
 
 ${SECTION_SECURITY_HEADERS_CORS}
 
+${SECTION_FINDING_QUALITY}
+
 ${SECTION_STATE_CHECKPOINTING}`;
 var PENTEST_SYSTEM_PROMPT_EXFIL = `You are an expert penetration tester performing a targeted security assessment with the goal of demonstrating full exploit impact.
 
@@ -283,6 +306,8 @@ ${SECTION_CREDENTIAL_DISCOVERY}
 
 ${SECTION_SECURITY_HEADERS_CORS}
 
+${SECTION_FINDING_QUALITY}
+
 ${SECTION_STATE_CHECKPOINTING}`;
 var PENTEST_SYSTEM_PROMPT_TASK_DRIVEN = `You are an expert penetration tester performing a targeted security assessment.
 
@@ -321,6 +346,8 @@ ${SECTION_CREDENTIAL_DISCOVERY}
 
 ${SECTION_SECURITY_HEADERS_CORS}
 
+${SECTION_FINDING_QUALITY}
+
 ${SECTION_STATE_CHECKPOINTING}`;
 var PENTEST_SYSTEM_PROMPT_TASK_DRIVEN_EXFIL = `You are an expert penetration tester performing a targeted security assessment with the goal of demonstrating full exploit impact.
 
@@ -359,6 +386,8 @@ ${SECTION_CREDENTIAL_DISCOVERY}
 
 ${SECTION_SECURITY_HEADERS_CORS}
 
+${SECTION_FINDING_QUALITY}
+
 ${SECTION_STATE_CHECKPOINTING}`;
 function buildPentestSystemPrompt(session, role = "orchestrator") {
   if (role === "orchestrator") {

package/build/{cli-1f5zzrxj.js → cli-bcd6032f.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z1dapp7v.js";
+} from "./cli-bxtz3bdv.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();