@pensar/apex 2.1.2 → 2.1.3-canary.00ba2e1a

package/build/{cli-0gk2x2sc.js → cli-ha4xts0m.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-z6s0jf9r.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-6wwpk9d9.js";
+} from "./cli-dvgf3h1w.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-v1aqbv58.js";
+} from "./cli-nhhyvhb8.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -37,9 +37,9 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Available Tools
 
 ## API Authentication
-- \`authenticate_session\` — Submit credentials via form POST, JSON POST, or HTTP Basic auth.
-  Params: loginUrl, username, password, method (form_post|json_post|basic_auth), usernameField, passwordField, additionalFields.
-- \`execute_command\` — Run curl or other shell commands for custom/complex API auth flows.
+- \`execute_command\` — Run curl (or other shell commands) to submit credentials via form POST,
+  JSON POST, or HTTP Basic auth, and to capture the Set-Cookie / token response. Use this for all
+  custom and complex API auth flows.
 
 ## Browser Authentication
 - \`browser_navigate\` — Navigate to login page
@@ -77,11 +77,11 @@ Look for:
 ## Step 2: Authenticate
 
 ### API path (use when target is an API or has a simple form):
-1. Call \`authenticate_session\` with the correct method and credentials.
-   - \`form_post\` for HTML forms
-   - \`json_post\` for JSON APIs
-   - \`basic_auth\` for HTTP Basic
-2. Check the response — if authenticated is true, you have a session cookie.
+1. Use \`execute_command\` with curl to submit the credentials, matching the target's scheme:
+   - \`curl -i -d 'username=...&password=...' <loginUrl>\` for HTML form POST
+   - \`curl -i -H 'Content-Type: application/json' -d '{"username":"...","password":"..."}' <loginUrl>\` for JSON APIs
+   - \`curl -i -u '<user>:<pass>' <url>\` for HTTP Basic
+2. Inspect the response (\`-i\` shows headers) — capture any \`Set-Cookie\` value or token to use as the session credential.
 
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
@@ -113,7 +113,7 @@ If both API and browser approaches fail, use \`delegate_to_auth_subagent\` for c
 **First**, call \`complete_authentication\` with:
 - \`success\`: whether auth succeeded
 - \`summary\`: what happened and what credentials/cookies were obtained
-- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or authenticate_session response)
+- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or the Set-Cookie header in the curl response)
 - \`exportedHeaders\`: auth headers map, e.g. {"Authorization": "Bearer <token>"} (from browser_evaluate localStorage tokens or API response)
 - \`strategy\`: method used ("browser", "form_post", "json_post", "basic_auth", "bearer")
 - \`authBarrier\`: if a barrier was encountered (captcha, mfa, etc.)
@@ -179,6 +179,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       context,
       environmentVariables,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     const cm = session.credentialManager;
@@ -195,11 +196,11 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       subagentId,
       environmentVariables,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       toolChoice: "auto",
       activeTools: [
         "execute_command",
-        "authenticate_session",
         "complete_authentication",
         "browser_navigate",
         "browser_snapshot",
@@ -294,17 +295,16 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
   if (credBlock) {
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
-1. Try authenticate_session first (pass the credentialId — secrets are resolved automatically)
-2. If authenticate_session fails, use browser tools. For browser_fill on password/secret fields,
+1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
+2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism
-2. Attempt authentication with authenticate_session or the browser tools
-3. If that fails, try delegate_to_auth_subagent as a fallback
-4. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+2. Attempt authentication with execute_command (curl) or the browser tools
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   }
   return parts.join(`
 `);

package/build/{cli-dqkdnd3c.js → cli-k855rfjy.js}

@@ -4,27 +4,27 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-35czfv00.js";
+} from "./cli-z6s0jf9r.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-nhhyvhb8.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-hj3t87r2.js";
+} from "./cli-f22qgya7.js";
 import {
   exports_external,
   init_zod
-} from "./cli-f7d23ded.js";
+} from "./cli-3k1x5rn3.js";
 import {
   config,
   init_config
-} from "./cli-9z6vwf30.js";
+} from "./cli-xaf3mx2a.js";
 import {
   __commonJS,
   __require
@@ -583,6 +583,8 @@ var require_Alias = __commonJS((exports) => {
       });
     }
     resolve(doc, ctx) {
+      if (ctx?.maxAliasCount === 0)
+        throw new ReferenceError("Alias resolution is disabled");
       let nodes;
       if (ctx?.aliasResolveCache) {
         nodes = ctx.aliasResolveCache;
@@ -1362,6 +1364,7 @@ var require_stringify = __commonJS((exports) => {
       nullStr: "null",
       simpleKeys: false,
       singleQuote: null,
+      trailingComma: false,
       trueStr: "true",
       verifyAliasOrder: true
     }, doc.schema.toStringOptions, options);
@@ -1631,18 +1634,18 @@ var require_merge = __commonJS((exports) => {
   };
   var isMergeKey = (ctx, key) => (merge.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
   function addMergeToJSMap(ctx, map, value) {
-    value = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
-    if (identity.isSeq(value))
-      for (const it of value.items)
+    const source = resolveAliasValue(ctx, value);
+    if (identity.isSeq(source))
+      for (const it of source.items)
         mergeValue(ctx, map, it);
-    else if (Array.isArray(value))
-      for (const it of value)
+    else if (Array.isArray(source))
+      for (const it of source)
         mergeValue(ctx, map, it);
     else
-      mergeValue(ctx, map, value);
+      mergeValue(ctx, map, source);
   }
   function mergeValue(ctx, map, value) {
-    const source = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
+    const source = resolveAliasValue(ctx, value);
     if (!identity.isMap(source))
       throw new Error("Merge sources must be maps or map aliases");
     const srcMap = source.toJSON(null, ctx, Map);
@@ -1663,6 +1666,9 @@ var require_merge = __commonJS((exports) => {
     }
     return map;
   }
+  function resolveAliasValue(ctx, value) {
+    return ctx && identity.isAlias(value) ? value.resolve(ctx.doc, ctx) : value;
+  }
   exports.addMergeToJSMap = addMergeToJSMap;
   exports.isMergeKey = isMergeKey;
   exports.merge = merge;
@@ -1870,13 +1876,20 @@ ${indent}${line}` : `
       if (comment)
         reqNewline = true;
       let str = stringify.stringify(item, itemCtx, () => comment = null);
-      if (i < items.length - 1)
+      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+`));
+      if (i < items.length - 1) {
         str += ",";
+      } else if (ctx.options.trailingComma) {
+        if (ctx.options.lineWidth > 0) {
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+        }
+        if (reqNewline) {
+          str += ",";
+        }
+      }
       if (comment)
         str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      if (!reqNewline && (lines.length > linesAtValue || str.includes(`
-`)))
-        reqNewline = true;
       lines.push(str);
       linesAtValue = lines.length;
     }
@@ -2231,7 +2244,7 @@ var require_stringifyNumber = __commonJS((exports) => {
     if (!isFinite(num))
       return isNaN(num) ? ".nan" : num < 0 ? "-.inf" : ".inf";
     let n = Object.is(value, -0) ? "-0" : JSON.stringify(value);
-    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^\d/.test(n)) {
+    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^-?\d/.test(n) && !n.includes("e")) {
       let i = n.indexOf(".");
       if (i < 0) {
         i = n.length;
@@ -4456,7 +4469,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
           while (next === " " || next === "\t")
             next = source[++i + 1];
         } else if (next === "x" || next === "u" || next === "U") {
-          const length = { x: 2, u: 4, U: 8 }[next];
+          const length = next === "x" ? 2 : next === "u" ? 4 : 8;
           res += parseCharCode(source, i + 1, length, onError);
           i += length;
         } else {
@@ -4525,12 +4538,13 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
     const cc = source.substr(offset, length);
     const ok = cc.length === length && /^[0-9a-fA-F]+$/.test(cc);
     const code = ok ? parseInt(cc, 16) : NaN;
-    if (isNaN(code)) {
+    try {
+      return String.fromCodePoint(code);
+    } catch {
       const raw = source.substr(offset - 2, length + 2);
       onError(offset - 2, "BAD_DQ_ESCAPE", `Invalid escape sequence ${raw}`);
       return raw;
     }
-    return String.fromCodePoint(code);
   }
   exports.resolveFlowScalar = resolveFlowScalar;
 });
@@ -4671,17 +4685,22 @@ var require_compose_node = __commonJS((exports) => {
       case "block-map":
       case "block-seq":
       case "flow-collection":
-        node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-        if (anchor)
-          node.anchor = anchor.source.substring(1);
+        try {
+          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+          if (anchor)
+            node.anchor = anchor.source.substring(1);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          onError(token, "RESOURCE_EXHAUSTION", message);
+        }
         break;
       default: {
         const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
         onError(token, "UNEXPECTED_TOKEN", message);
-        node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError);
         isSrcToken = false;
       }
     }
+    node ?? (node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError));
     if (anchor && node.anchor === "")
       onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
     if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -4864,8 +4883,10 @@ ${cb}` : comment;
         }
       }
       if (afterDoc) {
-        Array.prototype.push.apply(doc.errors, this.errors);
-        Array.prototype.push.apply(doc.warnings, this.warnings);
+        for (let i = 0;i < this.errors.length; ++i)
+          doc.errors.push(this.errors[i]);
+        for (let i = 0;i < this.warnings.length; ++i)
+          doc.warnings.push(this.warnings[i]);
       } else {
         doc.errors = this.errors;
         doc.warnings = this.warnings;
@@ -5577,7 +5598,7 @@ var require_lexer = __commonJS((exports) => {
         const n = (yield* this.pushCount(1)) + (yield* this.pushSpaces(true));
         this.indentNext = this.indentValue + 1;
         this.indentValue += n;
-        return yield* this.parseBlockStart();
+        return "block-start";
       }
       return "doc";
     }
@@ -5884,26 +5905,37 @@ var require_lexer = __commonJS((exports) => {
       return 0;
     }
     *pushIndicators() {
-      switch (this.charAt(0)) {
-        case "!":
-          return (yield* this.pushTag()) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "&":
-          return (yield* this.pushUntil(isNotAnchorChar)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "-":
-        case "?":
-        case ":": {
-          const inFlow = this.flowLevel > 0;
-          const ch1 = this.charAt(1);
-          if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
-            if (!inFlow)
-              this.indentNext = this.indentValue + 1;
-            else if (this.flowKey)
-              this.flowKey = false;
-            return (yield* this.pushCount(1)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
+      let n = 0;
+      loop:
+        while (true) {
+          switch (this.charAt(0)) {
+            case "!":
+              n += yield* this.pushTag();
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "&":
+              n += yield* this.pushUntil(isNotAnchorChar);
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "-":
+            case "?":
+            case ":": {
+              const inFlow = this.flowLevel > 0;
+              const ch1 = this.charAt(1);
+              if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
+                if (!inFlow)
+                  this.indentNext = this.indentValue + 1;
+                else if (this.flowKey)
+                  this.flowKey = false;
+                n += yield* this.pushCount(1);
+                n += yield* this.pushSpaces(true);
+                continue loop;
+              }
+            }
           }
+          break loop;
         }
-      }
-      return 0;
+      return n;
     }
     *pushTag() {
       if (this.charAt(1) === "<") {
@@ -6057,6 +6089,13 @@ var require_parser = __commonJS((exports) => {
     while (prev[++i]?.type === "space") {}
     return prev.splice(i, prev.length);
   }
+  function arrayPushArray(target, source) {
+    if (source.length < 1e5)
+      Array.prototype.push.apply(target, source);
+    else
+      for (let i = 0;i < source.length; ++i)
+        target.push(source[i]);
+  }
   function fixFlowSeqItems(fc) {
     if (fc.start.type === "flow-seq-start") {
       for (const it of fc.items) {
@@ -6066,11 +6105,11 @@ var require_parser = __commonJS((exports) => {
           delete it.key;
           if (isFlowToken(it.value)) {
             if (it.value.end)
-              Array.prototype.push.apply(it.value.end, it.sep);
+              arrayPushArray(it.value.end, it.sep);
             else
               it.value.end = it.sep;
           } else
-            Array.prototype.push.apply(it.start, it.sep);
+            arrayPushArray(it.start, it.sep);
           delete it.sep;
         }
       }
@@ -6410,7 +6449,7 @@ var require_parser = __commonJS((exports) => {
               const prev = map.items[map.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 map.items.pop();
                 return;
@@ -6598,7 +6637,7 @@ var require_parser = __commonJS((exports) => {
               const prev = seq.items[seq.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 seq.items.pop();
                 return;