@pensar/apex 2.0.1 → 2.0.2-canary.1de5ff5b

package/build/{cli-z1dapp7v.js → cli-bxtz3bdv.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-8g5cwvbm.js";
+} from "./cli-zgpj2mv1.js";
 import {
   AISDKError,
   APICallError,
@@ -32,7 +32,6 @@ import {
   delay,
   executeTool,
   exports_external,
-  exports_external1 as exports_external2,
   gateway,
   getErrorMessage,
   getErrorMessage1 as getErrorMessage2,
@@ -59,15 +58,15 @@ import {
   withUserAgentSuffix,
   zodSchema,
   zod_default
-} from "./cli-e6rgwtpb.js";
+} from "./cli-f7d23ded.js";
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
+} from "./cli-kn9tst6t.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-0yptvbbm.js";
+} from "./cli-w55v1bht.js";
 import {
   __callDispose,
   __commonJS,
@@ -7747,6 +7746,24 @@ var init_bedrock = __esm(() => {
       provider: "bedrock",
       contextLength: 64000
     },
+    {
+      id: "deepseek.v3-v1:0",
+      name: "DeepSeek V3.1 (Bedrock)",
+      provider: "bedrock",
+      contextLength: 128000
+    },
+    {
+      id: "qwen.qwen3-coder-480b-a35b-v1:0",
+      name: "Qwen3 Coder 480B A35B Instruct (Bedrock)",
+      provider: "bedrock",
+      contextLength: 131072
+    },
+    {
+      id: "zai.glm-5",
+      name: "Z.AI GLM 5 (Bedrock)",
+      provider: "bedrock",
+      contextLength: 200000
+    },
     {
       id: "us.mistral.pixtral-large-2502-v1:0",
       name: "Pixtral Large-2502 (US)",
@@ -8696,6 +8713,9 @@ function getModelInfo(model) {
     provider: "local"
   };
 }
+function prefersSequentialToolCalls(model) {
+  return /(^|[./:-])deepseek([./:-]|$)/i.test(model);
+}
 function getMaxOutputTokens(modelId) {
   const fromPattern = lookupOutputBudgetByPattern(modelId);
   const ctx = AVAILABLE_MODELS.find((m) => m.id === modelId)?.contextLength;
@@ -8760,9 +8780,15 @@ function lookupOutputBudgetByPattern(modelId) {
   if (modelId.includes("minimax-m3")) {
     return 128000;
   }
-  if (modelId.includes("glm-5.2")) {
+  if (modelId.includes("glm-5")) {
     return 131072;
   }
+  if (modelId.includes("deepseek")) {
+    return 8192;
+  }
+  if (modelId.includes("qwen")) {
+    return 16000;
+  }
   return 4096;
 }
 var AVAILABLE_MODELS;
@@ -42064,8 +42090,8 @@ var init_caching = __esm(() => {
 });
 
 // src/core/ai/contextManagement.ts
-import { mkdirSync, writeFileSync } from "fs";
-import { join } from "path";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 function truncateWithMarker(text2, max, label) {
   if (text2.length <= max)
     return text2;
@@ -42112,7 +42138,7 @@ function applyToolResultBudget(messages, opts) {
 [... truncated ${originalLength - preview.length} chars — full output saved to ${filePath}]`;
       if (newValue.length >= text2.length)
         return part;
-      if (!persistedIds || !persistedIds.has(toolCallId)) {
+      if (!persistedIds?.has(toolCallId)) {
         if (!tailMatch) {
           if (!dirCreated) {
             mkdirSync(resultsDir, { recursive: true });
@@ -42144,7 +42170,7 @@ function snipOldSteps(messages, opts) {
   let stepCount = 0;
   let cutoffIdx = 0;
   for (let i = messages.length - 1;i >= 0; i--) {
-    if (messages[i].role === "assistant") {
+    if (messages[i]?.role === "assistant") {
       stepCount++;
       if (stepCount === keepRecent) {
         cutoffIdx = i;
@@ -42375,6 +42401,14 @@ function checkIfRateLimitError(error) {
   const errorString = errorMessage || errorName ? "" : String(error).toLowerCase();
   return errorMessage.includes("too many tokens") || errorMessage.includes("rate limit") || errorMessage.includes("request rate") || errorMessage.includes("throttl") || errorMessage.includes("overloaded") || errorMessage.includes("too many requests") || errorMessage.includes("please wait") || errorMessage.includes("service unavailable") || errorName.includes("throttl") || errorName.includes("toomanyrequests") || errorName.includes("serviceunavailable") || errorCode === "rate_limit_exceeded" || errorCode === "throttling" || errorCode === "429" || httpStatus === 429 || httpStatus === 529 || httpStatus === 503 || errorString.includes("throttl") || errorString.includes("too many") || errorString.includes("request rate");
 }
+function applySequentialToolCallPolicy(system, tools, model) {
+  if (tools && Object.keys(tools).length > 0 && prefersSequentialToolCalls(model)) {
+    return `${system ? `${system}
+
+` : ""}${SEQUENTIAL_TOOL_CALL_INSTRUCTION}`;
+  }
+  return system;
+}
 async function* withIdleTimeout(stream, idleMs, isIdleTimerActive) {
   const iterator = stream[Symbol.asyncIterator]();
   try {
@@ -42438,7 +42472,7 @@ function createToolExecutionGate() {
 function wrapStreamWithErrorHandler(originalStream, messagesContainer, opts, model, silent, rateLimitRetryCount = 0, idleResumeCount = 0) {
   let wrappedStream = null;
   const handler = {
-    get(target, prop) {
+    get(_target, prop) {
       if (prop === "fullStream") {
         if (!wrappedStream) {
           const toolGate = createToolExecutionGate();
@@ -42497,7 +42531,7 @@ function wrapStreamWithErrorHandler(originalStream, messagesContainer, opts, mod
                 const fitted = fitMessagesToContext(currentMessages, {
                   contextWindow: getContextWindow(opts.model),
                   maxOutputTokens: getMaxOutputTokens(opts.model),
-                  system: opts.system,
+                  system: applySequentialToolCallPolicy(opts.system, opts.tools, opts.model),
                   tools: opts.tools,
                   sessionPath: opts.sessionPath
                 });
@@ -42632,13 +42666,14 @@ function streamResponse(opts) {
   };
   const providerModel = getProviderModel(model, authConfig);
   const useAnthropicCaching = isAnthropicProvider(model);
+  const systemWithToolPolicy = applySequentialToolCallPolicy(system, tools, model);
   let fittedMessages = messages;
   let proactiveFitFailed = false;
   if (messages && messages.length > 0) {
     const fitted = fitMessagesToContext(messages, {
       contextWindow: getContextWindow(model),
       maxOutputTokens: getMaxOutputTokens(model),
-      system,
+      system: systemWithToolPolicy,
       tools,
       sessionPath: opts.sessionPath
     });
@@ -42655,13 +42690,13 @@ function streamResponse(opts) {
     }
     return wrapStreamWithErrorHandler(createSummarizationStream(fittedMessages, opts, providerModel), messagesContainer, opts, providerModel, silent);
   }
-  let effectiveSystem = system;
+  let effectiveSystem = systemWithToolPolicy;
   let effectiveMessages = fittedMessages;
-  if (useAnthropicCaching && system) {
+  if (useAnthropicCaching && systemWithToolPolicy) {
     const baseMessages = fittedMessages ?? [
       { role: "user", content: prompt }
     ];
-    effectiveMessages = withCachedSystemPrompt(system, baseMessages);
+    effectiveMessages = withCachedSystemPrompt(systemWithToolPolicy, baseMessages);
     effectiveSystem = undefined;
   }
   const useThinking = enableThinking && isAnthropicProvider(model) && modelSupportsThinking(model);
@@ -42752,7 +42787,7 @@ function streamResponse(opts) {
             }
           }
           const tool6 = tools2[toolCall.toolName];
-          if (!tool6 || !tool6.inputSchema) {
+          if (!tool6?.inputSchema) {
             if (!silent) {
               log.warn(`Cannot repair tool call: ${toolCall.toolName} not found or has no schema`);
             }
@@ -42920,7 +42955,7 @@ async function generateObjectResponse(opts) {
   }
   throw lastError;
 }
-var log, DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
+var log, DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, SEQUENTIAL_TOOL_CALL_INSTRUCTION, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
 var init_ai = __esm(() => {
   init_dist4();
   init_structured();
@@ -42947,6 +42982,7 @@ var init_ai = __esm(() => {
     "gpt-5.5",
     "gpt-5.5-2026-04-23"
   ]);
+  SEQUENTIAL_TOOL_CALL_INSTRUCTION = "CRITICAL TOOL-CALLING RULE: Emit EXACTLY ONE tool call per response. " + "Never emit more than one tool call in a single turn. After each tool call, " + "wait for its result before making the next one. Emitting multiple tool " + "calls in one turn corrupts their arguments.";
   STREAM_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
   StreamIdleTimeoutError = class StreamIdleTimeoutError extends Error {
     constructor(idleMs) {
@@ -43089,13 +43125,13 @@ var init_name = __esm(() => {
     "surge",
     "flux"
   ];
-  sessionNameSchema = exports_external2.object({
-    name: exports_external2.string().describe("A short, descriptive session name (2-4 words, lowercase, hyphenated)")
+  sessionNameSchema = exports_external.object({
+    name: exports_external.string().describe("A short, descriptive session name (2-4 words, lowercase, hyphenated)")
   });
 });
 
 // src/core/credentials/manager.ts
-import { randomBytes } from "crypto";
+import { randomBytes } from "node:crypto";
 function generateCredentialId() {
   return `cred_${randomBytes(8).toString("hex")}`;
 }
@@ -43267,7 +43303,7 @@ var init_credentials = __esm(() => {
 });
 
 // src/core/id/id.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes2 } from "node:crypto";
 function schema(prefix) {
   return zod_default.string().startsWith(prefixes[prefix]);
 }
@@ -43504,9 +43540,9 @@ var init_lock = __esm(() => {
 });
 
 // src/core/storage/index.ts
-import fs, { readdir } from "fs/promises";
-import os from "os";
-import path from "path";
+import fs, { readdir } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 function getBaseDir() {
   return process.env.PENSAR_DATA_DIR ?? path.join(os.homedir(), ".pensar");
 }
@@ -43649,17 +43685,17 @@ var init_storage = __esm(() => {
 var ToolsetStateSchema;
 var init_toolset = __esm(() => {
   init_zod();
-  ToolsetStateSchema = exports_external2.object({
-    baseToolsetId: exports_external2.string(),
-    enabledTools: exports_external2.record(exports_external2.string(), exports_external2.boolean()),
-    lastModified: exports_external2.number()
+  ToolsetStateSchema = exports_external.object({
+    baseToolsetId: exports_external.string(),
+    enabledTools: exports_external.record(exports_external.string(), exports_external.boolean()),
+    lastModified: exports_external.number()
   });
 });
 
 // src/core/session/index.ts
-import { existsSync, readFileSync } from "fs";
-import os2 from "os";
-import path2 from "path";
+import { existsSync, readFileSync } from "node:fs";
+import os2 from "node:os";
+import path2 from "node:path";
 function resolveSmtpConfig(explicit) {
   if (explicit)
     return explicit;
@@ -43797,7 +43833,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-9d2es97h.js");
+    const { config: appConfig } = await import("./index-jhrbdyka.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }
@@ -43857,7 +43893,7 @@ async function* list2() {
   const sessionsDir = getSessionsDir();
   let entries;
   try {
-    entries = await import("fs/promises").then((fsp) => fsp.readdir(sessionsDir, { withFileTypes: true }));
+    entries = await import("node:fs/promises").then((fsp) => fsp.readdir(sessionsDir, { withFileTypes: true }));
   } catch {
     return;
   }
@@ -44009,7 +44045,7 @@ var DEFAULT_OUTCOME_GUIDANCE, EXFIL_OUTCOME_GUIDANCE, DEFAULT_HEADER_RECORD, Aut
 }, RemoveInput, remove2 = async (input) => {
   try {
     const sessionDir = getSessionRoot(input.sessionId);
-    const fsp = await import("fs/promises");
+    const fsp = await import("node:fs/promises");
     await fsp.rm(sessionDir, { recursive: true, force: true });
   } catch (e) {
     console.error(e);
@@ -44125,7 +44161,8 @@ var init_session = __esm(() => {
     agentCwd: zod_default.string().optional(),
     prompt: zod_default.string().optional(),
     taskDriven: zod_default.boolean().optional(),
-    requirePlan: zod_default.boolean().optional()
+    requirePlan: zod_default.boolean().optional(),
+    promptInjectionLibrarySource: zod_default.string().optional()
   });
   SessionInfoObject = zod_default.object({
     id: schema("session"),
@@ -44171,9 +44208,9 @@ import {
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync2,
   writeFileSync as writeFileSync2
-} from "fs";
-import os3 from "os";
-import path3 from "path";
+} from "node:fs";
+import os3 from "node:os";
+import path3 from "node:path";
 function pruneErrorLog() {
   if (hasPruned)
     return;
@@ -45237,8 +45274,8 @@ async function summarizeConversation(messages, opts, model) {
     };
   };
   let slicedMessages;
-  if (cleanMessages.length === 1 && typeof cleanMessages[0].content === "string") {
-    const content = cleanMessages[0].content;
+  if (cleanMessages.length === 1 && typeof cleanMessages[0]?.content === "string") {
+    const content = cleanMessages[0]?.content;
     const lines = content.split(`
 `);
     const truncatedContent = lines.slice(-50).join(`

package/build/{cli-fa7nrded.js → cli-cbhsy5x3.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-d5vz4kyn.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-p4aht9hv.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,14 +11,14 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z1dapp7v.js";
+} from "./cli-bxtz3bdv.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
 init_structured();
 init_lazyLogger();
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 // src/core/agents/specialized/authenticationAgent/prompts.ts
 var AUTH_SUBAGENT_SYSTEM_PROMPT = `You are an authentication specialist for autonomous penetration testing.