@pensar/apex 2.1.2 → 2.1.3-canary.00ba2e1a

package/build/{cli-9vzc18m5.js → cli-p16xmetx.js}

@@ -1,13 +1,20 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-whtdyc0e.js";
+} from "./cli-ck490gej.js";
+import {
+  REPORT_FILENAME_JSON,
+  REPORT_FILENAME_MD,
+  buildPentestReport,
+  renderJson,
+  renderMarkdown
+} from "./cli-7bgsh6sd.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-yjbkaqvy.js";
+} from "./cli-6abnvkea.js";
 import {
   CodeAgent
-} from "./cli-6vs0mtsb.js";
+} from "./cli-cyd5hb1t.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,19 +22,14 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-gbkj2has.js";
-import {
-  EvidenceFileEntrySchema
-} from "./cli-tw3fe8bj.js";
+} from "./cli-1svb0r8t.js";
 import {
-  CweEntrySchema,
   FindingsRegistry,
   OffensiveSecurityAgent,
   PLAN_MODE_TOOL_NAMES,
-  ValidatedCweEntrySchema,
-  hasCanonicalName,
+  pLimit,
   runWithBoundedConcurrency
-} from "./cli-35czfv00.js";
+} from "./cli-z6s0jf9r.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -36,13 +38,13 @@ import {
   hasToolCall,
   init_dist,
   init_lazyLogger,
+  init_session,
   init_structured,
   scopedLogger
-} from "./cli-v1aqbv58.js";
+} from "./cli-nhhyvhb8.js";
 import {
-  exports_external,
-  init_zod
-} from "./cli-f7d23ded.js";
+  __require
+} from "./cli-8rxa073f.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -95,185 +97,6 @@ ${objectiveList}
 // src/core/workflows/pentest.ts
 init_structured();
 
-// src/core/report/schemas.ts
-init_zod();
-var PentestReportFindingSchema = exports_external.object({
-  title: exports_external.string(),
-  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
-  description: exports_external.string(),
-  impact: exports_external.string(),
-  evidence: exports_external.string(),
-  endpoint: exports_external.string(),
-  pocPath: exports_external.string(),
-  remediation: exports_external.string(),
-  references: exports_external.string().optional(),
-  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
-  rootCauseGroup: exports_external.string().optional(),
-  relatedFindings: exports_external.array(exports_external.string()).optional(),
-  rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
-});
-var PentestReportSchema = exports_external.object({
-  version: exports_external.string().regex(/^1\.\d+$/),
-  metadata: exports_external.object({
-    target: exports_external.string(),
-    model: exports_external.string(),
-    timestamp: exports_external.string(),
-    sessionId: exports_external.string(),
-    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
-  }),
-  summary: exports_external.object({
-    totalFindings: exports_external.number(),
-    bySeverity: exports_external.object({
-      CRITICAL: exports_external.number(),
-      HIGH: exports_external.number(),
-      MEDIUM: exports_external.number(),
-      LOW: exports_external.number()
-    })
-  }),
-  findings: exports_external.array(PentestReportFindingSchema)
-});
-var REPORT_VERSION = "1.0";
-
-// src/core/report/builder.ts
-var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
-function buildPentestReport(findings, context) {
-  const sorted = [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
-  const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
-  for (const f of findings) {
-    bySeverity[f.severity]++;
-  }
-  return {
-    version: REPORT_VERSION,
-    metadata: {
-      target: context.target,
-      model: context.model,
-      timestamp: new Date().toISOString(),
-      sessionId: context.sessionId,
-      mode: context.mode
-    },
-    summary: {
-      totalFindings: findings.length,
-      bySeverity
-    },
-    findings: sorted.map((f) => ({
-      title: f.title,
-      severity: f.severity,
-      description: f.description,
-      impact: f.impact,
-      evidence: f.evidence,
-      endpoint: f.endpoint,
-      pocPath: f.pocPath,
-      remediation: f.remediation,
-      references: f.references,
-      cwes: f.cwes,
-      rootCauseGroup: f.rootCauseGroup,
-      relatedFindings: f.relatedFindings,
-      rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
-    }))
-  };
-}
-// src/core/report/renderers/json.ts
-function renderJson(report) {
-  return JSON.stringify(report, null, 2);
-}
-// src/core/report/renderers/markdown.ts
-function renderMarkdown(report) {
-  const { metadata, findings, summary } = report;
-  const header = [
-    `# Pentest Report — ${metadata.target}`,
-    "",
-    `**Date:** ${metadata.timestamp}  `,
-    `**Session:** ${metadata.sessionId}  `,
-    `**Model:** ${metadata.model}  `,
-    `**Mode:** ${metadata.mode}`,
-    "",
-    `**Findings:** ${summary.totalFindings}`,
-    ""
-  ];
-  if (findings.length === 0) {
-    return [
-      ...header,
-      "No findings were identified during this assessment.",
-      ""
-    ].join(`
-`);
-  }
-  const body = findings.map((finding) => renderFinding(finding, metadata)).join(`
-`);
-  return [...header, body].join(`
-`);
-}
-function renderFinding(finding, metadata) {
-  const lines = [
-    `# ${finding.title}`,
-    "",
-    `**Severity:** ${finding.severity}  `,
-    `**Target:** ${metadata.target}  `,
-    `**Endpoint:** ${finding.endpoint}  `,
-    `**Date:** ${metadata.timestamp}  `,
-    `**Session:** ${metadata.sessionId}`,
-    "",
-    "## Description",
-    "",
-    finding.description,
-    "",
-    "## Impact",
-    "",
-    finding.impact,
-    "",
-    "## Evidence",
-    "",
-    "```",
-    finding.evidence,
-    "```",
-    "",
-    ...finding.evidenceFiles?.length ? [
-      "## Evidence Files",
-      "",
-      ...finding.evidenceFiles.map((ef) => `- **[${ef.type}]** \`${ef.path}\` — ${ef.description}`),
-      ""
-    ] : [],
-    ...finding.cwes?.length ? [
-      "## CWE Classification",
-      "",
-      ...finding.cwes.map((cwe) => `- **${cwe.id}**${hasCanonicalName(cwe) ? `: ${cwe.name}` : ""} — ${cwe.reasoning}`),
-      ""
-    ] : [],
-    ...finding.rootCauseGroup ? [
-      "## Root Cause Group",
-      "",
-      `**Group:** \`${finding.rootCauseGroup}\``,
-      ...finding.relatedFindings?.length ? [
-        "",
-        "**Related Findings:**",
-        ...finding.relatedFindings.map((rf) => `- ${rf}`)
-      ] : [],
-      ""
-    ] : [],
-    "## POC",
-    "",
-    `Path: \`${finding.pocPath}\``,
-    "",
-    "## Remediation",
-    "",
-    finding.remediation,
-    ...finding.references ? ["", `## References`, "", finding.references] : [],
-    "",
-    "---",
-    "",
-    "*This finding was automatically documented by the Pensar penetration testing agent.*",
-    ""
-  ];
-  return lines.join(`
-`);
-}
-
-// src/core/report/index.ts
-var REPORT_FILENAME_MD = "pentest-report.md";
-var REPORT_FILENAME_JSON = "pentest-report.json";
-
 // src/core/session/execution-metrics.ts
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -360,11 +183,13 @@ init_lazyLogger();
 // src/core/session/persistence.ts
 init_structured();
 init_lazyLogger();
+init_session();
 import {
   existsSync as existsSync2,
   mkdirSync,
   readdirSync,
   readFileSync as readFileSync2,
+  renameSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -372,14 +197,14 @@ import { join as join2 } from "node:path";
 var log = scopedLogger(() => createLogger("session:persistence"));
 var SUBAGENTS_DIR = "subagents";
 var MANIFEST_FILE = "agent-manifest.json";
-function loadSubagentMessages(session, agentName) {
-  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, agentName, "messages.json");
+function loadSubagentMessages(session, key) {
+  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, key, "messages.json");
   if (existsSync2(stepPath)) {
     try {
       return JSON.parse(readFileSync2(stepPath, "utf-8"));
     } catch {}
   }
-  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${agentName}.json`);
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
   if (!existsSync2(snapshotPath))
     return [];
   try {
@@ -523,6 +348,9 @@ function parseSubagentFilename(filename) {
   if (filename.startsWith("orchestrator-")) {
     return { agentType: "pentest", name: "Orchestrator Summary" };
   }
+  if (filename.startsWith("ses_")) {
+    return { agentType: "pentest", name: "Pentest Worker" };
+  }
   return { agentType: "pentest", name: filename.split("-")[0] || "Unknown" };
 }
 function unwrapAiSdkToolOutput(output) {
@@ -833,8 +661,10 @@ async function runEndpointDocumentationAgent(opts) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     projectThreatModel,
-    parentSubagentId
+    parentSubagentId,
+    agentLimiter
   } = opts;
   const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
   const displayMethod = getDocumentMethod(endpoint);
@@ -871,12 +701,13 @@ async function runEndpointDocumentationAgent(opts) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: DiscoverySummarySchema,
     excludeTools: ["document_app", "list_files", "grep"],
     projectThreatModel
   });
   try {
-    await agent.consume();
+    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
     eventBus?.emit("subagent-complete", {
       subagentId,
       status: "completed",
@@ -6195,6 +6026,7 @@ init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("whitebox-workflow"));
 var DEFAULT_CONCURRENCY = 5;
+var MAX_CONCURRENT_AGENTS = 12;
 var TASK_TYPE_LABELS = {
   pages: "Pages",
   apiEndpoints: "API Endpoints",
@@ -6225,11 +6057,15 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     domains,
     projectThreatModel,
     environments,
-    surfaceIntegrationEnabled = true
+    surfaceIntegrationEnabled = true,
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
   } = input;
+  const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
+  const agentLimiter = (fn) => agentSlots(fn);
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6245,6 +6081,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: AppsDiscoveryResultSchema,
     projectThreatModel,
     excludeTools: ["document_endpoint"]
@@ -6256,7 +6093,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     name: "Whitebox Apps Discovery",
     input: { codebasePath }
   });
-  const appsResult = await appsAgent.consume();
+  const appsResult = await agentLimiter(() => appsAgent.consume());
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -6335,12 +6172,13 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       onCacheMetrics,
       openAIReasoningEffort,
       enableThinking,
+      thinkingEffort,
       responseSchema: DiscoverySummarySchema,
       excludeTools: ["document_app"],
       projectThreatModel
     });
     try {
-      await agent.consume();
+      await agentLimiter(() => agent.consume());
       log4.debug(`Phase 2: agent "${subagentId}" completed`);
       eventBus?.emit("subagent-complete", {
         subagentId,
@@ -6390,8 +6228,10 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             onCacheMetrics,
             openAIReasoningEffort,
             enableThinking,
+            thinkingEffort,
             projectThreatModel,
-            parentSubagentId: appNodeId
+            parentSubagentId: appNodeId,
+            agentLimiter
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
@@ -6852,6 +6692,7 @@ async function runPentestSwarm(input) {
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     display
   } = input;
@@ -6902,6 +6743,7 @@ async function runPentestSwarm(input) {
           planSubagentId: subagentId,
           eventBus,
           enableThinking,
+          thinkingEffort,
           openAIReasoningEffort,
           display
         });
@@ -6926,6 +6768,7 @@ async function runPentestSwarm(input) {
         eventBus,
         subagentId,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort,
         display
       });
@@ -6971,6 +6814,10 @@ async function runPentestSwarm(input) {
   return results;
 }
 async function runPentestWorkflow(input) {
+  if (input.fastStrike) {
+    const { runFastStrike } = await import("./fastStrike-x529knb0.js");
+    return runFastStrike(input);
+  }
   const {
     target,
     cwd,
@@ -6982,6 +6829,7 @@ async function runPentestWorkflow(input) {
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     prompt,
     threatModel,
@@ -7119,6 +6967,7 @@ ${combined}` : combined;
         eventBus,
         onStepFinish: wrappedOnStepFinish,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort
       });
     }
@@ -7244,4 +7093,4 @@ async function runBlackboxPhase(opts) {
     throw e;
   }
 }
-export { REPORT_FILENAME_MD, readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };
+export { readExecutionMetrics, writeExecutionMetrics, convertModelMessagesToUI, loadSubagents, DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY, runPentestSwarm, runPentestWorkflow };

package/build/{cli-ks60cc3h.js → cli-qc5a4cq4.js}

@@ -11,50 +11,50 @@ var init_package = __esm(() => {
       pensar: "./bin/pensar.js"
     },
     dependencies: {
-      "@ai-sdk/amazon-bedrock": "^4.0.113",
-      "@ai-sdk/anthropic": "^3.0.81",
-      "@ai-sdk/google": "^3.0.37",
+      "@ai-sdk/amazon-bedrock": "^4.0.119",
+      "@ai-sdk/anthropic": "^3.0.85",
+      "@ai-sdk/google": "^3.0.83",
       "@ai-sdk/openai": "3.0.46",
-      "@ai-sdk/openai-compatible": "^2.0.35",
-      "@ai-sdk/provider": "^3.0.8",
-      "@daytonaio/sdk": "^0.112.1",
-      "@googleapis/gmail": "^16.1.1",
+      "@ai-sdk/openai-compatible": "^2.0.51",
+      "@ai-sdk/provider": "^3.0.10",
+      "@daytonaio/sdk": "^0.112.3",
+      "@googleapis/gmail": "^16.1.2",
       "@microsoft/microsoft-graph-client": "^3.0.7",
-      "@modelcontextprotocol/sdk": "^1.0.0",
-      "@openrouter/ai-sdk-provider": "^2.2.3",
-      "@opentelemetry/api": "^1.9.0",
+      "@modelcontextprotocol/sdk": "^1.29.0",
+      "@openrouter/ai-sdk-provider": "^2.9.1",
+      "@opentelemetry/api": "^1.9.1",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.2.2",
       "@playwright/mcp": "^0.0.54",
-      ai: "^6.0.105",
+      ai: "^6.0.208",
       "camoufox-js": "^0.11.1",
-      glob: "^13.0.0",
+      glob: "^13.0.6",
       "highlight.js": "^11.11.1",
-      imapflow: "^1.2.10",
-      mailparser: "^3.9.3",
-      marked: "^16.4.0",
+      imapflow: "^1.4.2",
+      mailparser: "^3.9.11",
+      marked: "^16.4.2",
       "mime-types": "^3.0.2",
-      nodemailer: "^8.0.7",
-      "p-limit": "^7.2.0",
-      react: "^19.2.0",
-      sharp: "^0.34.4",
-      tldts: "^7.0.28",
-      yaml: "^2.8.2",
-      zod: "^4.1.12"
+      nodemailer: "^8.0.11",
+      "p-limit": "^7.3.0",
+      react: "^19.2.7",
+      sharp: "^0.34.5",
+      tldts: "^7.4.3",
+      yaml: "^2.9.0",
+      zod: "^4.4.3"
     },
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
-      "@types/bun": "^1.3.0",
+      "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
-      "@types/nodemailer": "^8.0.0",
-      "@types/react": "^19.2.6",
-      dotenv: "^17.2.3",
-      knip: "^6.12.0",
-      prettier: "^3.8.1",
-      vitest: "^2.1.8"
+      "@types/nodemailer": "^8.0.1",
+      "@types/react": "^19.2.17",
+      dotenv: "^17.4.2",
+      knip: "^6.17.1",
+      prettier: "^3.8.4",
+      vitest: "^2.1.9"
     },
     engines: {
       bun: ">=1.0.0",
@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.2"
+    version: "2.1.3-canary.00ba2e1a"
   };
 });
 

package/build/{cli-9z6vwf30.js → cli-xaf3mx2a.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-xnnkeg5p.js";
+} from "./cli-5ptphzvg.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";