@pensar/apex 2.1.2 → 2.1.3-canary.082299eb

package/build/cli.js

@@ -14,16 +14,16 @@ import {
   init_toolset,
   init_utils,
   logger
-} from "./cli-v1aqbv58.js";
-import"./cli-hj3t87r2.js";
-import"./cli-f7d23ded.js";
+} from "./cli-d28z7z1b.js";
+import"./cli-0kg01x44.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-9z6vwf30.js";
-import"./cli-xnnkeg5p.js";
+import"./cli-7bzzjw1f.js";
+import"./cli-bp7f8nyk.js";
 import {
   init_package,
   package_default
-} from "./cli-ks60cc3h.js";
+} from "./cli-f5javz2k.js";
 import {
   __require,
   __toESM
@@ -35,50 +35,50 @@ var package_default2 = {
     pensar: "./bin/pensar.js"
   },
   dependencies: {
-    "@ai-sdk/amazon-bedrock": "^4.0.113",
-    "@ai-sdk/anthropic": "^3.0.81",
-    "@ai-sdk/google": "^3.0.37",
+    "@ai-sdk/amazon-bedrock": "^4.0.119",
+    "@ai-sdk/anthropic": "^3.0.85",
+    "@ai-sdk/google": "^3.0.83",
     "@ai-sdk/openai": "3.0.46",
-    "@ai-sdk/openai-compatible": "^2.0.35",
-    "@ai-sdk/provider": "^3.0.8",
-    "@daytonaio/sdk": "^0.112.1",
-    "@googleapis/gmail": "^16.1.1",
+    "@ai-sdk/openai-compatible": "^2.0.51",
+    "@ai-sdk/provider": "^3.0.10",
+    "@daytonaio/sdk": "^0.112.3",
+    "@googleapis/gmail": "^16.1.2",
     "@microsoft/microsoft-graph-client": "^3.0.7",
-    "@modelcontextprotocol/sdk": "^1.0.0",
-    "@openrouter/ai-sdk-provider": "^2.2.3",
-    "@opentelemetry/api": "^1.9.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@openrouter/ai-sdk-provider": "^2.9.1",
+    "@opentelemetry/api": "^1.9.1",
     "@opentui/core": "^0.1.107",
     "@opentui/react": "^0.1.107",
     "@pensar/surface": "0.2.2",
     "@playwright/mcp": "^0.0.54",
-    ai: "^6.0.105",
+    ai: "^6.0.208",
     "camoufox-js": "^0.11.1",
-    glob: "^13.0.0",
+    glob: "^13.0.6",
     "highlight.js": "^11.11.1",
-    imapflow: "^1.2.10",
-    mailparser: "^3.9.3",
-    marked: "^16.4.0",
+    imapflow: "^1.4.2",
+    mailparser: "^3.9.11",
+    marked: "^16.4.2",
     "mime-types": "^3.0.2",
-    nodemailer: "^8.0.7",
-    "p-limit": "^7.2.0",
-    react: "^19.2.0",
-    sharp: "^0.34.4",
-    tldts: "^7.0.28",
-    yaml: "^2.8.2",
-    zod: "^4.1.12"
+    nodemailer: "^8.0.11",
+    "p-limit": "^7.3.0",
+    react: "^19.2.7",
+    sharp: "^0.34.5",
+    tldts: "^7.4.3",
+    yaml: "^2.9.0",
+    zod: "^4.4.3"
   },
   description: "AI-powered penetration testing CLI tool with terminal UI",
   devDependencies: {
     "@biomejs/biome": "2.4.14",
-    "@types/bun": "^1.3.0",
+    "@types/bun": "^1.3.14",
     "@types/mailparser": "^3.4.6",
     "@types/mime-types": "^3.0.1",
-    "@types/nodemailer": "^8.0.0",
-    "@types/react": "^19.2.6",
-    dotenv: "^17.2.3",
-    knip: "^6.12.0",
-    prettier: "^3.8.1",
-    vitest: "^2.1.8"
+    "@types/nodemailer": "^8.0.1",
+    "@types/react": "^19.2.17",
+    dotenv: "^17.4.2",
+    knip: "^6.17.1",
+    prettier: "^3.8.4",
+    vitest: "^2.1.9"
   },
   engines: {
     bun: ">=1.0.0",
@@ -144,7 +144,7 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.1.2"
+  version: "2.1.3-canary.082299eb"
 };
 
 // src/core/ai/index.ts
@@ -257,7 +257,7 @@ class AgentEventBus {
     }
     return this;
   }
-  static attachChild(child, parent, subagentId) {
+  static attachChild(child, parent, childSessionId) {
     if (!parent)
       return;
     for (const key of CHILD_BUS_FORWARDED_EVENTS) {
@@ -266,28 +266,37 @@ class AgentEventBus {
         const p = payload;
         const isLifecycle = forwardKey === "subagent-spawn" || forwardKey === "subagent-complete";
         if (isLifecycle) {
-          if (p.parentSubagentId) {
-            parent.emit(forwardKey, payload);
-          } else {
-            parent.emit(forwardKey, {
-              ...p,
-              parentSubagentId: subagentId
-            });
-          }
+          const next2 = { ...p };
+          if (!p.parentSubagentId)
+            next2.parentSubagentId = childSessionId;
+          if (!p.parentSessionId)
+            next2.parentSessionId = childSessionId;
+          parent.emit(forwardKey, next2);
           return;
         }
-        if (!p.subagentId) {
-          parent.emit(forwardKey, { ...p, subagentId });
-        } else {
-          parent.emit(forwardKey, payload);
-        }
+        const next = { ...p };
+        if (!p.subagentId)
+          next.subagentId = childSessionId;
+        if (!p.sessionId)
+          next.sessionId = childSessionId;
+        parent.emit(forwardKey, next);
       });
     }
   }
-  emitStreamPart(chunk, subagentId) {
+  emitStreamPart(chunk, ids) {
+    const ctx = typeof ids === "string" ? { subagentId: ids } : ids ?? {};
+    const subagentId = ctx.subagentId;
+    const sessionId = ctx.sessionId;
+    const messageId = ctx.messageId;
     switch (chunk.type) {
       case "text-delta":
-        this.emit("text-delta", { text: chunk.text, subagentId });
+        this.emit("text-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.textPartId
+        });
         break;
       case "reasoning-start":
         this.emit("reasoning-start", { subagentId });
@@ -302,14 +311,20 @@ class AgentEventBus {
         this.emit("tool-call-start", {
           toolCallId: chunk.id,
           toolName: chunk.toolName,
-          subagentId
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(chunk.id)
         });
         break;
       case "tool-input-delta":
         this.emit("tool-call-delta", {
           toolCallId: chunk.id,
           argsTextDelta: chunk.delta,
-          subagentId
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(chunk.id)
         });
         break;
       case "tool-call": {
@@ -318,7 +333,10 @@ class AgentEventBus {
           toolCallId: tc.toolCallId,
           toolName: tc.toolName,
           args: tc.args ?? tc.input,
-          subagentId
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(tc.toolCallId)
         });
         break;
       }
@@ -328,7 +346,10 @@ class AgentEventBus {
           toolCallId: tr.toolCallId,
           toolName: tr.toolName,
           result: tr.result ?? tr.output,
-          subagentId
+          subagentId,
+          sessionId,
+          messageId,
+          partId: ctx.toolPartId?.(tr.toolCallId)
         });
         break;
       }
@@ -477,6 +498,7 @@ You can upgrade manually by running:
 // src/core/logger/index.ts
 init_session();
 init_structured();
+init_structured();
 import os from "node:os";
 import path from "node:path";
 var ERROR_LOG_PATH = path.join(os.homedir(), ".pensar", "error.log");
@@ -565,7 +587,7 @@ function attachCliAgentStreamListeners(bus) {
 async function createInstrumentedBus(session) {
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-ymvhkyq5.js");
+  const { attachWandbToEventBus } = await import("./upload-pjr2zgys.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -582,7 +604,7 @@ async function resolveCliHeaders() {
   const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-sqjve2bm.js");
+    const { config: appConfig } = await import("./index-xzb9yxtf.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -616,8 +638,8 @@ async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-sqjve2bm.js");
-  const { getDefaultModelForConfig } = await import("./utils-d1ed6jzf.js");
+  const { config: appConfig } = await import("./index-xzb9yxtf.js");
+  const { getDefaultModelForConfig } = await import("./utils-v0mj3yrn.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -671,6 +693,8 @@ pentest options:
   --model <model>          AI model (default: auto-selected from configured provider)
   --extended-thinking       Enable extended thinking for supported models
   --task-driven             Enable task-driven architecture (experimental)
+  --fast-strike            Single-operator fast strike: skip attack-surface/swarm
+                           phases, one tight recon\u2192exploit loop against the target
   --prompt <text|@file>    Guidance for the pentest agent (inline text or @filepath)
   --threat-model <text|@file>  Threat model to guide the pentest (inline or @filepath)
   --header "Name: Value"   Custom HTTP header (repeatable)
@@ -701,11 +725,11 @@ Global options:
 `);
 }
 async function runPentest() {
-  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runPentestAgent } = await import("./blackboxPentest-2edr9rj3.js");
-  const { sessions: sessions2 } = await import("./index-c6qz0gve.js");
-  const { config: appConfig } = await import("./index-sqjve2bm.js");
+  const { runPentestAgent } = await import("./blackboxPentest-b1dqrv93.js");
+  const { sessions: sessions2 } = await import("./index-h6rxj451.js");
+  const { config: appConfig } = await import("./index-xzb9yxtf.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -713,6 +737,7 @@ async function runPentest() {
   const threatModelRaw = getArg("--threat-model");
   const enableThinking = hasFlag("--extended-thinking");
   const taskDriven = hasFlag("--task-driven");
+  const fastStrike = hasFlag("--fast-strike");
   const resolvedTm = threatModelRaw ? resolveThreatModelPrompt(threatModelRaw) : undefined;
   const resolvedPrompt = promptRaw ? resolveFlagValue(promptRaw) : undefined;
   const prompt = combinePromptParts(resolvedTm, resolvedPrompt);
@@ -723,6 +748,9 @@ async function runPentest() {
   if (modeWarning) {
     console.warn(modeWarning);
   }
+  if (taskDriven && fastStrike) {
+    console.warn("Warning: --task-driven has no effect with --fast-strike (task tools are excluded).");
+  }
   const sep = "=".repeat(60);
   console.log(`${sep}
 PENTEST ORCHESTRATION
@@ -732,14 +760,15 @@ Cwd:     ${cwd} (whitebox)` : ""}${exfilMode ? `
 Mode:    exfil` : ""}
 Model:   ${model}${enableThinking ? `
 Thinking: enabled` : ""}${taskDriven ? `
-Task-driven: enabled` : ""}${headers ? `
+Task-driven: enabled` : ""}${fastStrike ? `
+Fast strike: enabled` : ""}${headers ? `
 Headers: ${Object.keys(headers).length} configured` : ""}
 `);
   const session = await sessions2.create({
     name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
     targets: [target],
     config: {
-      ...cwd ? { cwd } : {},
+      ...cwd ? { codebasePath: cwd } : {},
       ...exfilMode ? { exfilMode: true } : {},
       ...prompt ? { prompt } : {},
       ...taskDriven ? { taskDriven: true } : {},
@@ -755,6 +784,7 @@ Headers: ${Object.keys(headers).length} configured` : ""}
       session,
       model,
       enableThinking,
+      ...fastStrike ? { fastStrike: true } : {},
       surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
       authConfig: buildAuthConfig(pensarConfig),
       eventBus: pentestBus
@@ -773,11 +803,11 @@ Report:    ${reportPath}` : ""}`);
   process.exit(0);
 }
 async function runTargetedPentest() {
-  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-ws0a7frk.js");
-  const { sessions: sessions2 } = await import("./index-c6qz0gve.js");
-  const { config: appConfig } = await import("./index-sqjve2bm.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-m3ypnmfk.js");
+  const { sessions: sessions2 } = await import("./index-h6rxj451.js");
+  const { config: appConfig } = await import("./index-xzb9yxtf.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -827,10 +857,10 @@ POCs:      ${pocsPath}`);
   process.exit(0);
 }
 async function runThreatModel() {
-  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runThreatModelWorkflow } = await import("./threatModel-z9b213x8.js");
-  const { config: appConfig } = await import("./index-sqjve2bm.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-p8khw8tr.js");
+  const { config: appConfig } = await import("./index-xzb9yxtf.js");
   const path2 = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
@@ -864,16 +894,16 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { config } = await import("./main-3zneyg7p.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-hsej0pfc.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-c6qz0gve.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-s8gw83d6.js");
-  const { config: appConfig } = await import("./index-sqjve2bm.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-767xjskr.js");
+  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-h6rxj451.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-m9djasp6.js");
+  const { config: appConfig } = await import("./index-xzb9yxtf.js");
   const { createInterface } = await import("readline");
   const { readFileSync: readFileSync2, existsSync } = await import("fs");
   const path2 = await import("path");
-  const { stepCountIs } = await import("./index-mgng15va.js");
+  const { stepCountIs } = await import("./index-gq9h8j5j.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -983,35 +1013,35 @@ if (hasFlag("-p") || command === "--prompt") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-5stxpmga.js");
+  await import("./auth-cm0s3an4.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-1j469qj7.js");
+  await import("./uninstall-acg2vcpm.js");
 } else if (command === "apps") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./apps-j0bwey0w.js");
+  await import("./apps-c4rdprzp.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-hyx3c3qa.js");
+  await import("./pentests-7zy73b60.js");
 } else if (command === "targets") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./targets-9cqrshet.js");
+  await import("./targets-nay3vmqy.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-5anqrh2j.js");
+  await import("./issues-35784nvy.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-qf4s92z2.js");
+  await import("./fixes-kza6ej38.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-q6ankt6m.js");
+  await import("./logs-14xzc32f.js");
 } else if (command === "config") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./config-s5ryv5ez.js");
+  await import("./config-6hkn23py.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-f08gegwc.js");
+  const { runDoctor } = await import("./doctor-0prby1f0.js");
   await runDoctor();
 } else if (args.length === 0) {
   if (process.env.PENSAR_NO_TUI === "1") {
@@ -1019,7 +1049,7 @@ if (hasFlag("-p") || command === "--prompt") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-gakk2t5q.js");
+  await import("./index-vjh370rj.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{config-s5ryv5ez.js → config-6hkn23py.js}

@@ -11,9 +11,9 @@ import {
 import {
   config,
   init_config
-} from "./cli-9z6vwf30.js";
-import"./cli-xnnkeg5p.js";
-import"./cli-ks60cc3h.js";
+} from "./cli-7bzzjw1f.js";
+import"./cli-bp7f8nyk.js";
+import"./cli-f5javz2k.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/config.ts

package/build/{doctor-f08gegwc.js → doctor-0prby1f0.js}

@@ -1,13 +1,13 @@
 import {
   toolExists
-} from "./cli-6wwpk9d9.js";
-import"./cli-v1aqbv58.js";
-import"./cli-hj3t87r2.js";
-import"./cli-f7d23ded.js";
+} from "./cli-35rkgbhd.js";
+import"./cli-d28z7z1b.js";
+import"./cli-0kg01x44.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-9z6vwf30.js";
-import"./cli-xnnkeg5p.js";
-import"./cli-ks60cc3h.js";
+import"./cli-7bzzjw1f.js";
+import"./cli-bp7f8nyk.js";
+import"./cli-f5javz2k.js";
 import"./cli-8rxa073f.js";
 
 // src/core/doctor.ts

package/build/fastStrike-qts85kag.js

@@ -0,0 +1,156 @@
+import {
+  REPORT_FILENAME_JSON,
+  REPORT_FILENAME_MD,
+  buildPentestReport,
+  renderJson,
+  renderMarkdown
+} from "./cli-sekg25pa.js";
+import"./cli-9fsre5pt.js";
+import"./cli-7g8n2kkk.js";
+import {
+  FindingsRegistry,
+  OffensiveSecurityAgent
+} from "./cli-w5vt3svr.js";
+import"./cli-35rkgbhd.js";
+import {
+  createThreatModelPrompt
+} from "./cli-fw5r7pfj.js";
+import"./cli-c8131c4q.js";
+import"./cli-d28z7z1b.js";
+import"./cli-0kg01x44.js";
+import {
+  exports_external,
+  init_zod
+} from "./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-7bzzjw1f.js";
+import"./cli-bp7f8nyk.js";
+import"./cli-f5javz2k.js";
+import"./cli-8rxa073f.js";
+
+// src/core/workflows/fastStrike.ts
+init_zod();
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+var FastStrikeResult = exports_external.object({
+  solved: exports_external.boolean().describe("True if the objective was achieved — a vulnerability was confirmed and, where applicable, the flag or sensitive data was extracted."),
+  summary: exports_external.string().describe("Concise account of the vulnerability exploited, the exact steps that worked, and any flag or sensitive data recovered.")
+});
+var FAST_STRIKE_SYSTEM_PROMPT = `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
+
+Run this loop, tightly:
+
+1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
+2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
+3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
+4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
+5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
+6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
+
+Rules:
+- You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
+- Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
+- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
+- Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
+async function runFastStrike(input) {
+  const {
+    target,
+    cwd,
+    model,
+    session,
+    authConfig,
+    abortSignal,
+    eventBus,
+    onStepFinish,
+    enableThinking,
+    openAIReasoningEffort,
+    prompt,
+    threatModel
+  } = input;
+  if (cwd) {
+    if (!session.config) {
+      session.config = {};
+    }
+    session.config.codebasePath ??= cwd;
+  }
+  if (prompt || threatModel) {
+    const parts = [];
+    if (threatModel)
+      parts.push(createThreatModelPrompt(threatModel));
+    if (prompt)
+      parts.push(prompt);
+    const combined = parts.join(`
+
+`);
+    if (!session.config) {
+      session.config = {};
+    }
+    session.config.prompt = session.config?.prompt ? `${session.config?.prompt}
+
+${combined}` : combined;
+  }
+  const operatorGuidance = session.config?.prompt;
+  const mode = cwd ? "whitebox" : "blackbox";
+  eventBus?.emit("workflow-phase-start", {
+    phase: "pentesting",
+    label: "Fast Strike",
+    metadata: { target }
+  });
+  const findingsRegistry = FindingsRegistry.fromDirectory(session.findingsPath, { model, authConfig, abortSignal });
+  const promptParts = [`Target: ${target}`];
+  if (operatorGuidance)
+    promptParts.push(operatorGuidance);
+  promptParts.push("Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.");
+  const agent = new OffensiveSecurityAgent({
+    system: FAST_STRIKE_SYSTEM_PROMPT,
+    prompt: promptParts.join(`
+
+`),
+    model,
+    session,
+    target,
+    mode: "fast-strike",
+    activeTools: [],
+    responseSchema: FastStrikeResult,
+    findingsRegistry,
+    subagentId: "fast-strike",
+    authConfig,
+    abortSignal,
+    eventBus,
+    onStepFinish,
+    enableThinking,
+    openAIReasoningEffort
+  });
+  const strikeResult = await agent.consume();
+  if (abortSignal?.aborted) {
+    throw new DOMException("Pentest aborted by user", "AbortError");
+  }
+  await findingsRegistry.groupByRootCause();
+  const findings = [...findingsRegistry.getFindings()];
+  const report = buildPentestReport(findings, {
+    target,
+    model,
+    sessionId: session.id,
+    mode
+  });
+  const mdPath = join(session.rootPath, REPORT_FILENAME_MD);
+  const jsonPath = join(session.rootPath, REPORT_FILENAME_JSON);
+  writeFileSync(mdPath, renderMarkdown(report));
+  writeFileSync(jsonPath, renderJson(report));
+  eventBus?.emit("workflow-phase-complete", {
+    phase: "pentesting",
+    summary: {
+      findingsCount: findings.length,
+      ...strikeResult ? { solved: strikeResult.solved, operatorSummary: strikeResult.summary } : {}
+    }
+  });
+  return {
+    findings,
+    findingsPath: session.findingsPath,
+    pocsPath: session.pocsPath,
+    reportPath: mdPath
+  };
+}
+export {
+  runFastStrike
+};

package/build/{fixes-qf4s92z2.js → fixes-kza6ej38.js}

@@ -2,26 +2,27 @@
 import {
   getFix,
   listFixes
-} from "./cli-dqkdnd3c.js";
-import"./cli-9vzc18m5.js";
-import"./cli-whtdyc0e.js";
-import"./cli-yjbkaqvy.js";
-import"./cli-0gk2x2sc.js";
-import"./cli-6vs0mtsb.js";
-import"./cli-gbkj2has.js";
+} from "./cli-db434rd0.js";
+import"./cli-y4csaqh2.js";
+import"./cli-qdvef4qc.js";
+import"./cli-sekg25pa.js";
+import"./cli-8256tzw9.js";
+import"./cli-wdahap6k.js";
+import"./cli-nn5rxhvz.js";
+import"./cli-nfnfwfcn.js";
 import"./cli-9fsre5pt.js";
-import"./cli-tw3fe8bj.js";
-import"./cli-35czfv00.js";
-import"./cli-6wwpk9d9.js";
+import"./cli-7g8n2kkk.js";
+import"./cli-w5vt3svr.js";
+import"./cli-35rkgbhd.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-v1aqbv58.js";
-import"./cli-hj3t87r2.js";
-import"./cli-f7d23ded.js";
+import"./cli-d28z7z1b.js";
+import"./cli-0kg01x44.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-9z6vwf30.js";
-import"./cli-xnnkeg5p.js";
-import"./cli-ks60cc3h.js";
+import"./cli-7bzzjw1f.js";
+import"./cli-bp7f8nyk.js";
+import"./cli-f5javz2k.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/fixes.ts