@pensar/apex 2.0.1 → 2.0.2-canary.9e4e15cf

package/build/{agent-x7n47c84.js → agent-1jp62njk.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-w2st266h.js";
+} from "./cli-jh6k2m9z.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-6nhperp2.js → agent-1zfxfgfr.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-qdh225p7.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-w1nb1y6h.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+} from "./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
 import {
   exports_external1 as exports_external,
   init_zod
 } from "./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -65,6 +65,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - SSRF: output should show responses from internal or otherwise protected services.
 - Path traversal: output should show file contents outside the intended path.
 - IDOR: output should show access to another user's/account's resource while authentication exists.
+- Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
 - Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
@@ -92,6 +93,7 @@ Reject or lower confidence when:
 - Classify as informational when the observation is real but not currently exploitable or not security-impacting.
 - Classify as expected-behavior when the behavior is clearly by design.
 - Reject when the PoC fabricates evidence, does not demonstrate the claim, or the demonstrated impact fundamentally mismatches the finding.
+- Guard against overstated confidentiality impact: when the demonstrated result is weaker than the claimed impact (e.g. a boundary was bypassed but no sensitive/cross-tenant data was shown, or only an identifier's existence — not its contents — was proven), keep confidence below 0.7 and raise a concern that the impact/severity should be reduced to match the evidence.
 
 ## Response Requirements
 

package/build/agent-ssm6x6qs.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-jd0bfde5.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
+import"./cli-c8131c4q.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-2ac4vt09.js → apps-2qd57k2z.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-xcr4rax4.js";
+import"./cli-e450tvx3.js";
+import"./cli-3n78e7hs.js";
+import"./cli-jh6k2m9z.js";
+import"./cli-ppq4kh08.js";
+import"./cli-jd0bfde5.js";
+import"./cli-za4t23gh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts
@@ -152,6 +152,8 @@ Search options (scoped to the workspace):
   --offset <n>                 Page offset
 
 Endpoint fields (create requires --endpoint and --description):
+  --app <id>                   endpoint-update only: move the endpoint to a
+                               different application (UUID) in the workspace
   --endpoint <text>            Endpoint path / URL / route
   --description <text>         Endpoint description
   --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
@@ -254,6 +256,9 @@ function parseEndpointCreateOptions(argv) {
 }
 function parseEndpointUpdateOptions(argv) {
   const update = {};
+  const applicationId = getFlag("--app", argv);
+  if (applicationId !== undefined)
+    update.applicationId = applicationId;
   const endpoint = getFlag("--endpoint", argv);
   if (endpoint !== undefined)
     update.endpoint = endpoint;

package/build/{auth-bmt98hz0.js → auth-bwb51krx.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-pyzw545d.js";
-import"./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-fa7nrded.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+import"./cli-xcr4rax4.js";
+import"./cli-e450tvx3.js";
+import"./cli-3n78e7hs.js";
+import"./cli-jh6k2m9z.js";
+import"./cli-ppq4kh08.js";
+import"./cli-jd0bfde5.js";
+import"./cli-za4t23gh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
+import"./cli-dk63pna5.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-8g5cwvbm.js";
+} from "./cli-p904s2yj.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+} from "./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-3p84dzrr.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-ppq4kh08.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
+import"./cli-c8131c4q.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-dn68r23n.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-3n78e7hs.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
+import"./cli-c8131c4q.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
+import"./cli-e6rgwtpb.js";
+import"./cli-gpnb45ck.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-xngbtdxb.js → blackboxPentest-txe2h6h0.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-mfzkhttr.js";
-import"./cli-fxtbkw2f.js";
-import"./cli-w2st266h.js";
-import"./cli-f93g10xk.js";
-import"./cli-ddtmgbqv.js";
+} from "./cli-e450tvx3.js";
+import"./cli-3n78e7hs.js";
+import"./cli-jh6k2m9z.js";
+import"./cli-jd0bfde5.js";
+import"./cli-za4t23gh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-hk03x6fq.js";
-import"./cli-zpdmnz8c.js";
-import"./cli-cc13ydyx.js";
+import"./cli-8pw332mm.js";
+import"./cli-qdh225p7.js";
+import"./cli-w1nb1y6h.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z1dapp7v.js";
-import"./cli-8g5cwvbm.js";
+import"./cli-dk63pna5.js";
+import"./cli-p904s2yj.js";
 import"./cli-e6rgwtpb.js";
 import"./cli-gpnb45ck.js";
-import"./cli-eptabm2j.js";
-import"./cli-88bhxzr1.js";
-import"./cli-0yptvbbm.js";
+import"./cli-kxpba6jy.js";
+import"./cli-kj5vjbnd.js";
+import"./cli-0t1j4jh4.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-0yptvbbm.js → cli-0t1j4jh4.js}

@@ -25,9 +25,10 @@ var init_package = __esm(() => {
       "@opentelemetry/api": "^1.9.0",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
-      "@pensar/surface": "0.2.1",
+      "@pensar/surface": "0.2.2",
       "@playwright/mcp": "^0.0.54",
       ai: "^6.0.105",
+      "camoufox-js": "^0.11.1",
       glob: "^13.0.0",
       "highlight.js": "^11.11.1",
       imapflow: "^1.2.10",
@@ -91,13 +92,13 @@ var init_package = __esm(() => {
       url: "https://github.com/pensarai/apex.git"
     },
     scripts: {
-      build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave",
+      build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
       "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
-      "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --outfile pensar",
-      "build:binary:linux-arm64": "bun build src/cli.ts --compile --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
-      "build:binary:linux-x64": "bun build src/cli.ts --compile --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
-      "build:binary:macos-arm64": "bun build src/cli.ts --compile --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
-      "build:binary:macos-x64": "bun build src/cli.ts --compile --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
+      "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
+      "build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
+      "build:binary:linux-x64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-x64 --outfile dist/pensar-linux-x64",
+      "build:binary:macos-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-darwin-arm64 --outfile dist/pensar-darwin-arm64",
+      "build:binary:macos-x64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-darwin-x64 --outfile dist/pensar-darwin-x64",
       check: "biome check --write",
       "check:ci": "biome check",
       "daytona-benchmark": "bun run scripts/daytona-benchmark.ts",
@@ -119,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.0.1"
+    version: "2.0.2-canary.9e4e15cf"
   };
 });
 

package/build/{cli-fxtbkw2f.js → cli-3n78e7hs.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-qdh225p7.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-cc13ydyx.js";
+} from "./cli-w1nb1y6h.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-z1dapp7v.js";
+} from "./cli-dk63pna5.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/{cli-hk03x6fq.js → cli-8pw332mm.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-zpdmnz8c.js";
+} from "./cli-qdh225p7.js";
 import {
   exports_external1 as exports_external,
   init_zod
@@ -46,6 +46,7 @@ var ApexFindingObject = exports_external.object({
   cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
   evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
 });
 

package/build/{cli-z1dapp7v.js → cli-dk63pna5.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-8g5cwvbm.js";
+} from "./cli-p904s2yj.js";
 import {
   AISDKError,
   APICallError,
@@ -63,11 +63,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-eptabm2j.js";
+} from "./cli-kxpba6jy.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-0yptvbbm.js";
+} from "./cli-0t1j4jh4.js";
 import {
   __callDispose,
   __commonJS,
@@ -7747,6 +7747,24 @@ var init_bedrock = __esm(() => {
       provider: "bedrock",
       contextLength: 64000
     },
+    {
+      id: "deepseek.v3-v1:0",
+      name: "DeepSeek V3.1 (Bedrock)",
+      provider: "bedrock",
+      contextLength: 128000
+    },
+    {
+      id: "qwen.qwen3-coder-480b-a35b-v1:0",
+      name: "Qwen3 Coder 480B A35B Instruct (Bedrock)",
+      provider: "bedrock",
+      contextLength: 131072
+    },
+    {
+      id: "zai.glm-5",
+      name: "Z.AI GLM 5 (Bedrock)",
+      provider: "bedrock",
+      contextLength: 200000
+    },
     {
       id: "us.mistral.pixtral-large-2502-v1:0",
       name: "Pixtral Large-2502 (US)",
@@ -8696,6 +8714,9 @@ function getModelInfo(model) {
     provider: "local"
   };
 }
+function prefersSequentialToolCalls(model) {
+  return /(^|[./:-])deepseek([./:-]|$)/i.test(model);
+}
 function getMaxOutputTokens(modelId) {
   const fromPattern = lookupOutputBudgetByPattern(modelId);
   const ctx = AVAILABLE_MODELS.find((m) => m.id === modelId)?.contextLength;
@@ -8760,9 +8781,15 @@ function lookupOutputBudgetByPattern(modelId) {
   if (modelId.includes("minimax-m3")) {
     return 128000;
   }
-  if (modelId.includes("glm-5.2")) {
+  if (modelId.includes("glm-5")) {
     return 131072;
   }
+  if (modelId.includes("deepseek")) {
+    return 8192;
+  }
+  if (modelId.includes("qwen")) {
+    return 16000;
+  }
   return 4096;
 }
 var AVAILABLE_MODELS;
@@ -42375,6 +42402,14 @@ function checkIfRateLimitError(error) {
   const errorString = errorMessage || errorName ? "" : String(error).toLowerCase();
   return errorMessage.includes("too many tokens") || errorMessage.includes("rate limit") || errorMessage.includes("request rate") || errorMessage.includes("throttl") || errorMessage.includes("overloaded") || errorMessage.includes("too many requests") || errorMessage.includes("please wait") || errorMessage.includes("service unavailable") || errorName.includes("throttl") || errorName.includes("toomanyrequests") || errorName.includes("serviceunavailable") || errorCode === "rate_limit_exceeded" || errorCode === "throttling" || errorCode === "429" || httpStatus === 429 || httpStatus === 529 || httpStatus === 503 || errorString.includes("throttl") || errorString.includes("too many") || errorString.includes("request rate");
 }
+function applySequentialToolCallPolicy(system, tools, model) {
+  if (tools && Object.keys(tools).length > 0 && prefersSequentialToolCalls(model)) {
+    return `${system ? `${system}
+
+` : ""}${SEQUENTIAL_TOOL_CALL_INSTRUCTION}`;
+  }
+  return system;
+}
 async function* withIdleTimeout(stream, idleMs, isIdleTimerActive) {
   const iterator = stream[Symbol.asyncIterator]();
   try {
@@ -42497,7 +42532,7 @@ function wrapStreamWithErrorHandler(originalStream, messagesContainer, opts, mod
                 const fitted = fitMessagesToContext(currentMessages, {
                   contextWindow: getContextWindow(opts.model),
                   maxOutputTokens: getMaxOutputTokens(opts.model),
-                  system: opts.system,
+                  system: applySequentialToolCallPolicy(opts.system, opts.tools, opts.model),
                   tools: opts.tools,
                   sessionPath: opts.sessionPath
                 });
@@ -42632,13 +42667,14 @@ function streamResponse(opts) {
   };
   const providerModel = getProviderModel(model, authConfig);
   const useAnthropicCaching = isAnthropicProvider(model);
+  const systemWithToolPolicy = applySequentialToolCallPolicy(system, tools, model);
   let fittedMessages = messages;
   let proactiveFitFailed = false;
   if (messages && messages.length > 0) {
     const fitted = fitMessagesToContext(messages, {
       contextWindow: getContextWindow(model),
       maxOutputTokens: getMaxOutputTokens(model),
-      system,
+      system: systemWithToolPolicy,
       tools,
       sessionPath: opts.sessionPath
     });
@@ -42655,13 +42691,13 @@ function streamResponse(opts) {
     }
     return wrapStreamWithErrorHandler(createSummarizationStream(fittedMessages, opts, providerModel), messagesContainer, opts, providerModel, silent);
   }
-  let effectiveSystem = system;
+  let effectiveSystem = systemWithToolPolicy;
   let effectiveMessages = fittedMessages;
-  if (useAnthropicCaching && system) {
+  if (useAnthropicCaching && systemWithToolPolicy) {
     const baseMessages = fittedMessages ?? [
       { role: "user", content: prompt }
     ];
-    effectiveMessages = withCachedSystemPrompt(system, baseMessages);
+    effectiveMessages = withCachedSystemPrompt(systemWithToolPolicy, baseMessages);
     effectiveSystem = undefined;
   }
   const useThinking = enableThinking && isAnthropicProvider(model) && modelSupportsThinking(model);
@@ -42920,7 +42956,7 @@ async function generateObjectResponse(opts) {
   }
   throw lastError;
 }
-var log, DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
+var log, DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, SEQUENTIAL_TOOL_CALL_INSTRUCTION, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
 var init_ai = __esm(() => {
   init_dist4();
   init_structured();
@@ -42947,6 +42983,7 @@ var init_ai = __esm(() => {
     "gpt-5.5",
     "gpt-5.5-2026-04-23"
   ]);
+  SEQUENTIAL_TOOL_CALL_INSTRUCTION = "CRITICAL TOOL-CALLING RULE: Emit EXACTLY ONE tool call per response. " + "Never emit more than one tool call in a single turn. After each tool call, " + "wait for its result before making the next one. Emitting multiple tool " + "calls in one turn corrupts their arguments.";
   STREAM_IDLE_TIMEOUT_MS = 5 * 60 * 1000;
   StreamIdleTimeoutError = class StreamIdleTimeoutError extends Error {
     constructor(idleMs) {
@@ -43797,7 +43834,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-9d2es97h.js");
+    const { config: appConfig } = await import("./index-t3rffyf8.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }

package/build/{cli-mfzkhttr.js → cli-e450tvx3.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-fxtbkw2f.js";
+} from "./cli-3n78e7hs.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-w2st266h.js";
+} from "./cli-jh6k2m9z.js";
 import {
   CodeAgent
-} from "./cli-f93g10xk.js";
+} from "./cli-jd0bfde5.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-ddtmgbqv.js";
+} from "./cli-za4t23gh.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-hk03x6fq.js";
+} from "./cli-8pw332mm.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -27,7 +27,7 @@ import {
   ValidatedCweEntrySchema,
   hasCanonicalName,
   runWithBoundedConcurrency
-} from "./cli-zpdmnz8c.js";
+} from "./cli-qdh225p7.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -38,7 +38,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z1dapp7v.js";
+} from "./cli-dk63pna5.js";
 import {
   exports_external1 as exports_external,
   init_zod
@@ -110,6 +110,7 @@ var PentestReportFindingSchema = exports_external.object({
   cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
   evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
 });
 var PentestReportSchema = exports_external.object({
@@ -168,6 +169,7 @@ function buildPentestReport(findings, context) {
       cwes: f.cwes,
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
+      rootCauseLead: f.rootCauseLead,
       evidenceFiles: f.evidenceFiles
     }))
   };
@@ -4128,7 +4130,7 @@ var django = {
       return name === "urls.py" || name === "routes.py";
     });
     const includePrefixes = {};
-    const pathIncludeRe = /path\s*\(\s*['"]([^'"]*)['"]\s*,\s*include\s*\(\s*['"]([^'"]+)['"]/g;
+    const pathIncludeRe = /(?:path|re_path)\s*\(\s*[rRbBuUfF]*['"]([^'"]*)['"]\s*,\s*include\s*\(\s*[rRbBuUfF]*['"]([^'"]+)['"]/g;
     for (const f of urlFiles) {
       const content = ctx.readFile(f);
       if (!content)
@@ -4137,7 +4139,7 @@ var django = {
         includePrefixes[m[2]] = m[1];
       }
     }
-    const directPathRe = /path\s*\(\s*['"]([^'"]*)['"]\s*,\s*(?!include)(\w[\w.]*)/g;
+    const directPathRe = /(?:path|re_path)\s*\(\s*[rRbBuUfF]*['"]([^'"]*)['"]\s*,\s*(?!include)(\w[\w.]*)/g;
     const apiViewRe = /@api_view\s*\(\s*\[([^\]]*)\]\s*\)(.*?)def\s+(\w+)\s*\(/gs;
     for (const f of urlFiles) {
       const content = ctx.readFile(f);

package/build/{cli-f93g10xk.js → cli-jd0bfde5.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-zpdmnz8c.js";
+} from "./cli-qdh225p7.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z1dapp7v.js";
+} from "./cli-dk63pna5.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();