@pensar/apex 2.1.2 → 2.1.3-canary.0b888140

package/build/{cli-dqkdnd3c.js → cli-svyns7bq.js}

@@ -4,27 +4,27 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-35czfv00.js";
+} from "./cli-sh1d5f84.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-fyxdrpws.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-hj3t87r2.js";
+} from "./cli-tmdgp58p.js";
 import {
   exports_external,
   init_zod
-} from "./cli-f7d23ded.js";
+} from "./cli-29yqhrjq.js";
 import {
   config,
   init_config
-} from "./cli-9z6vwf30.js";
+} from "./cli-xecc5fgb.js";
 import {
   __commonJS,
   __require
@@ -583,6 +583,8 @@ var require_Alias = __commonJS((exports) => {
       });
     }
     resolve(doc, ctx) {
+      if (ctx?.maxAliasCount === 0)
+        throw new ReferenceError("Alias resolution is disabled");
       let nodes;
       if (ctx?.aliasResolveCache) {
         nodes = ctx.aliasResolveCache;
@@ -1362,6 +1364,7 @@ var require_stringify = __commonJS((exports) => {
       nullStr: "null",
       simpleKeys: false,
       singleQuote: null,
+      trailingComma: false,
       trueStr: "true",
       verifyAliasOrder: true
     }, doc.schema.toStringOptions, options);
@@ -1631,18 +1634,18 @@ var require_merge = __commonJS((exports) => {
   };
   var isMergeKey = (ctx, key) => (merge.identify(key) || identity.isScalar(key) && (!key.type || key.type === Scalar.Scalar.PLAIN) && merge.identify(key.value)) && ctx?.doc.schema.tags.some((tag) => tag.tag === merge.tag && tag.default);
   function addMergeToJSMap(ctx, map, value) {
-    value = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
-    if (identity.isSeq(value))
-      for (const it of value.items)
+    const source = resolveAliasValue(ctx, value);
+    if (identity.isSeq(source))
+      for (const it of source.items)
         mergeValue(ctx, map, it);
-    else if (Array.isArray(value))
-      for (const it of value)
+    else if (Array.isArray(source))
+      for (const it of source)
         mergeValue(ctx, map, it);
     else
-      mergeValue(ctx, map, value);
+      mergeValue(ctx, map, source);
   }
   function mergeValue(ctx, map, value) {
-    const source = ctx && identity.isAlias(value) ? value.resolve(ctx.doc) : value;
+    const source = resolveAliasValue(ctx, value);
     if (!identity.isMap(source))
       throw new Error("Merge sources must be maps or map aliases");
     const srcMap = source.toJSON(null, ctx, Map);
@@ -1663,6 +1666,9 @@ var require_merge = __commonJS((exports) => {
     }
     return map;
   }
+  function resolveAliasValue(ctx, value) {
+    return ctx && identity.isAlias(value) ? value.resolve(ctx.doc, ctx) : value;
+  }
   exports.addMergeToJSMap = addMergeToJSMap;
   exports.isMergeKey = isMergeKey;
   exports.merge = merge;
@@ -1870,13 +1876,20 @@ ${indent}${line}` : `
       if (comment)
         reqNewline = true;
       let str = stringify.stringify(item, itemCtx, () => comment = null);
-      if (i < items.length - 1)
+      reqNewline || (reqNewline = lines.length > linesAtValue || str.includes(`
+`));
+      if (i < items.length - 1) {
         str += ",";
+      } else if (ctx.options.trailingComma) {
+        if (ctx.options.lineWidth > 0) {
+          reqNewline || (reqNewline = lines.reduce((sum, line) => sum + line.length + 2, 2) + (str.length + 2) > ctx.options.lineWidth);
+        }
+        if (reqNewline) {
+          str += ",";
+        }
+      }
       if (comment)
         str += stringifyComment.lineComment(str, itemIndent, commentString(comment));
-      if (!reqNewline && (lines.length > linesAtValue || str.includes(`
-`)))
-        reqNewline = true;
       lines.push(str);
       linesAtValue = lines.length;
     }
@@ -2231,7 +2244,7 @@ var require_stringifyNumber = __commonJS((exports) => {
     if (!isFinite(num))
       return isNaN(num) ? ".nan" : num < 0 ? "-.inf" : ".inf";
     let n = Object.is(value, -0) ? "-0" : JSON.stringify(value);
-    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^\d/.test(n)) {
+    if (!format && minFractionDigits && (!tag || tag === "tag:yaml.org,2002:float") && /^-?\d/.test(n) && !n.includes("e")) {
       let i = n.indexOf(".");
       if (i < 0) {
         i = n.length;
@@ -4456,7 +4469,7 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
           while (next === " " || next === "\t")
             next = source[++i + 1];
         } else if (next === "x" || next === "u" || next === "U") {
-          const length = { x: 2, u: 4, U: 8 }[next];
+          const length = next === "x" ? 2 : next === "u" ? 4 : 8;
           res += parseCharCode(source, i + 1, length, onError);
           i += length;
         } else {
@@ -4525,12 +4538,13 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
     const cc = source.substr(offset, length);
     const ok = cc.length === length && /^[0-9a-fA-F]+$/.test(cc);
     const code = ok ? parseInt(cc, 16) : NaN;
-    if (isNaN(code)) {
+    try {
+      return String.fromCodePoint(code);
+    } catch {
       const raw = source.substr(offset - 2, length + 2);
       onError(offset - 2, "BAD_DQ_ESCAPE", `Invalid escape sequence ${raw}`);
       return raw;
     }
-    return String.fromCodePoint(code);
   }
   exports.resolveFlowScalar = resolveFlowScalar;
 });
@@ -4671,17 +4685,22 @@ var require_compose_node = __commonJS((exports) => {
       case "block-map":
       case "block-seq":
       case "flow-collection":
-        node = composeCollection.composeCollection(CN, ctx, token, props, onError);
-        if (anchor)
-          node.anchor = anchor.source.substring(1);
+        try {
+          node = composeCollection.composeCollection(CN, ctx, token, props, onError);
+          if (anchor)
+            node.anchor = anchor.source.substring(1);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          onError(token, "RESOURCE_EXHAUSTION", message);
+        }
         break;
       default: {
         const message = token.type === "error" ? token.message : `Unsupported token (type: ${token.type})`;
         onError(token, "UNEXPECTED_TOKEN", message);
-        node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError);
         isSrcToken = false;
       }
     }
+    node ?? (node = composeEmptyNode(ctx, token.offset, undefined, null, props, onError));
     if (anchor && node.anchor === "")
       onError(anchor, "BAD_ALIAS", "Anchor cannot be an empty string");
     if (atKey && ctx.options.stringKeys && (!identity.isScalar(node) || typeof node.value !== "string" || node.tag && node.tag !== "tag:yaml.org,2002:str")) {
@@ -4864,8 +4883,10 @@ ${cb}` : comment;
         }
       }
       if (afterDoc) {
-        Array.prototype.push.apply(doc.errors, this.errors);
-        Array.prototype.push.apply(doc.warnings, this.warnings);
+        for (let i = 0;i < this.errors.length; ++i)
+          doc.errors.push(this.errors[i]);
+        for (let i = 0;i < this.warnings.length; ++i)
+          doc.warnings.push(this.warnings[i]);
       } else {
         doc.errors = this.errors;
         doc.warnings = this.warnings;
@@ -5577,7 +5598,7 @@ var require_lexer = __commonJS((exports) => {
         const n = (yield* this.pushCount(1)) + (yield* this.pushSpaces(true));
         this.indentNext = this.indentValue + 1;
         this.indentValue += n;
-        return yield* this.parseBlockStart();
+        return "block-start";
       }
       return "doc";
     }
@@ -5884,26 +5905,37 @@ var require_lexer = __commonJS((exports) => {
       return 0;
     }
     *pushIndicators() {
-      switch (this.charAt(0)) {
-        case "!":
-          return (yield* this.pushTag()) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "&":
-          return (yield* this.pushUntil(isNotAnchorChar)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
-        case "-":
-        case "?":
-        case ":": {
-          const inFlow = this.flowLevel > 0;
-          const ch1 = this.charAt(1);
-          if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
-            if (!inFlow)
-              this.indentNext = this.indentValue + 1;
-            else if (this.flowKey)
-              this.flowKey = false;
-            return (yield* this.pushCount(1)) + (yield* this.pushSpaces(true)) + (yield* this.pushIndicators());
+      let n = 0;
+      loop:
+        while (true) {
+          switch (this.charAt(0)) {
+            case "!":
+              n += yield* this.pushTag();
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "&":
+              n += yield* this.pushUntil(isNotAnchorChar);
+              n += yield* this.pushSpaces(true);
+              continue loop;
+            case "-":
+            case "?":
+            case ":": {
+              const inFlow = this.flowLevel > 0;
+              const ch1 = this.charAt(1);
+              if (isEmpty(ch1) || inFlow && flowIndicatorChars.has(ch1)) {
+                if (!inFlow)
+                  this.indentNext = this.indentValue + 1;
+                else if (this.flowKey)
+                  this.flowKey = false;
+                n += yield* this.pushCount(1);
+                n += yield* this.pushSpaces(true);
+                continue loop;
+              }
+            }
           }
+          break loop;
         }
-      }
-      return 0;
+      return n;
     }
     *pushTag() {
       if (this.charAt(1) === "<") {
@@ -6057,6 +6089,13 @@ var require_parser = __commonJS((exports) => {
     while (prev[++i]?.type === "space") {}
     return prev.splice(i, prev.length);
   }
+  function arrayPushArray(target, source) {
+    if (source.length < 1e5)
+      Array.prototype.push.apply(target, source);
+    else
+      for (let i = 0;i < source.length; ++i)
+        target.push(source[i]);
+  }
   function fixFlowSeqItems(fc) {
     if (fc.start.type === "flow-seq-start") {
       for (const it of fc.items) {
@@ -6066,11 +6105,11 @@ var require_parser = __commonJS((exports) => {
           delete it.key;
           if (isFlowToken(it.value)) {
             if (it.value.end)
-              Array.prototype.push.apply(it.value.end, it.sep);
+              arrayPushArray(it.value.end, it.sep);
             else
               it.value.end = it.sep;
           } else
-            Array.prototype.push.apply(it.start, it.sep);
+            arrayPushArray(it.start, it.sep);
           delete it.sep;
         }
       }
@@ -6410,7 +6449,7 @@ var require_parser = __commonJS((exports) => {
               const prev = map.items[map.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 map.items.pop();
                 return;
@@ -6598,7 +6637,7 @@ var require_parser = __commonJS((exports) => {
               const prev = seq.items[seq.items.length - 2];
               const end = prev?.value?.end;
               if (Array.isArray(end)) {
-                Array.prototype.push.apply(end, it.start);
+                arrayPushArray(end, it.start);
                 end.push(this.sourceToken);
                 seq.items.pop();
                 return;

package/build/{cli-gbkj2has.js → cli-t4aygjwm.js}

@@ -1,15 +1,15 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-sh1d5f84.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-v1aqbv58.js";
+} from "./cli-fyxdrpws.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-f7d23ded.js";
+} from "./cli-29yqhrjq.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();
@@ -400,6 +400,7 @@ class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       domains,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     let capturedResult = null;
@@ -426,6 +427,7 @@ This ends the agent run — make sure all data is included.`,
       subagentId,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       activeTools: [
         "read_file",

package/build/{cli-hj3t87r2.js → cli-tmdgp58p.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-9z6vwf30.js";
+} from "./cli-xecc5fgb.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-9vzc18m5.js → cli-vaafhq79.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-whtdyc0e.js";
+} from "./cli-392r62e5.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-yjbkaqvy.js";
+} from "./cli-6fbhny5y.js";
 import {
   CodeAgent
-} from "./cli-6vs0mtsb.js";
+} from "./cli-xjw661db.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-gbkj2has.js";
+} from "./cli-t4aygjwm.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-tw3fe8bj.js";
+} from "./cli-c8n6gjbg.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -26,8 +26,9 @@ import {
   PLAN_MODE_TOOL_NAMES,
   ValidatedCweEntrySchema,
   hasCanonicalName,
+  pLimit,
   runWithBoundedConcurrency
-} from "./cli-35czfv00.js";
+} from "./cli-sh1d5f84.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -36,13 +37,14 @@ import {
   hasToolCall,
   init_dist,
   init_lazyLogger,
+  init_session,
   init_structured,
   scopedLogger
-} from "./cli-v1aqbv58.js";
+} from "./cli-fyxdrpws.js";
 import {
   exports_external,
   init_zod
-} from "./cli-f7d23ded.js";
+} from "./cli-29yqhrjq.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -360,11 +362,13 @@ init_lazyLogger();
 // src/core/session/persistence.ts
 init_structured();
 init_lazyLogger();
+init_session();
 import {
   existsSync as existsSync2,
   mkdirSync,
   readdirSync,
   readFileSync as readFileSync2,
+  renameSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -372,14 +376,14 @@ import { join as join2 } from "node:path";
 var log = scopedLogger(() => createLogger("session:persistence"));
 var SUBAGENTS_DIR = "subagents";
 var MANIFEST_FILE = "agent-manifest.json";
-function loadSubagentMessages(session, agentName) {
-  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, agentName, "messages.json");
+function loadSubagentMessages(session, key) {
+  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, key, "messages.json");
   if (existsSync2(stepPath)) {
     try {
       return JSON.parse(readFileSync2(stepPath, "utf-8"));
     } catch {}
   }
-  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${agentName}.json`);
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
   if (!existsSync2(snapshotPath))
     return [];
   try {
@@ -523,6 +527,9 @@ function parseSubagentFilename(filename) {
   if (filename.startsWith("orchestrator-")) {
     return { agentType: "pentest", name: "Orchestrator Summary" };
   }
+  if (filename.startsWith("ses_")) {
+    return { agentType: "pentest", name: "Pentest Worker" };
+  }
   return { agentType: "pentest", name: filename.split("-")[0] || "Unknown" };
 }
 function unwrapAiSdkToolOutput(output) {
@@ -833,8 +840,10 @@ async function runEndpointDocumentationAgent(opts) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     projectThreatModel,
-    parentSubagentId
+    parentSubagentId,
+    agentLimiter
   } = opts;
   const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
   const displayMethod = getDocumentMethod(endpoint);
@@ -871,12 +880,13 @@ async function runEndpointDocumentationAgent(opts) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: DiscoverySummarySchema,
     excludeTools: ["document_app", "list_files", "grep"],
     projectThreatModel
   });
   try {
-    await agent.consume();
+    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
     eventBus?.emit("subagent-complete", {
       subagentId,
       status: "completed",
@@ -6195,6 +6205,7 @@ init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("whitebox-workflow"));
 var DEFAULT_CONCURRENCY = 5;
+var MAX_CONCURRENT_AGENTS = 12;
 var TASK_TYPE_LABELS = {
   pages: "Pages",
   apiEndpoints: "API Endpoints",
@@ -6225,11 +6236,15 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     domains,
     projectThreatModel,
     environments,
-    surfaceIntegrationEnabled = true
+    surfaceIntegrationEnabled = true,
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
   } = input;
+  const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
+  const agentLimiter = (fn) => agentSlots(fn);
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6245,6 +6260,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     onCacheMetrics,
     openAIReasoningEffort,
     enableThinking,
+    thinkingEffort,
     responseSchema: AppsDiscoveryResultSchema,
     projectThreatModel,
     excludeTools: ["document_endpoint"]
@@ -6256,7 +6272,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     name: "Whitebox Apps Discovery",
     input: { codebasePath }
   });
-  const appsResult = await appsAgent.consume();
+  const appsResult = await agentLimiter(() => appsAgent.consume());
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -6335,12 +6351,13 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       onCacheMetrics,
       openAIReasoningEffort,
       enableThinking,
+      thinkingEffort,
       responseSchema: DiscoverySummarySchema,
       excludeTools: ["document_app"],
       projectThreatModel
     });
     try {
-      await agent.consume();
+      await agentLimiter(() => agent.consume());
       log4.debug(`Phase 2: agent "${subagentId}" completed`);
       eventBus?.emit("subagent-complete", {
         subagentId,
@@ -6390,8 +6407,10 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             onCacheMetrics,
             openAIReasoningEffort,
             enableThinking,
+            thinkingEffort,
             projectThreatModel,
-            parentSubagentId: appNodeId
+            parentSubagentId: appNodeId,
+            agentLimiter
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);
@@ -6852,6 +6871,7 @@ async function runPentestSwarm(input) {
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     display
   } = input;
@@ -6902,6 +6922,7 @@ async function runPentestSwarm(input) {
           planSubagentId: subagentId,
           eventBus,
           enableThinking,
+          thinkingEffort,
           openAIReasoningEffort,
           display
         });
@@ -6926,6 +6947,7 @@ async function runPentestSwarm(input) {
         eventBus,
         subagentId,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort,
         display
       });
@@ -6982,6 +7004,7 @@ async function runPentestWorkflow(input) {
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     prompt,
     threatModel,
@@ -7119,6 +7142,7 @@ ${combined}` : combined;
         eventBus,
         onStepFinish: wrappedOnStepFinish,
         enableThinking,
+        thinkingEffort,
         openAIReasoningEffort
       });
     }

package/build/{cli-9z6vwf30.js → cli-xecc5fgb.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-xnnkeg5p.js";
+} from "./cli-4q0ztagc.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-6vs0mtsb.js → cli-xjw661db.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-sh1d5f84.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-v1aqbv58.js";
+} from "./cli-fyxdrpws.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();
@@ -79,6 +79,7 @@ class CodeAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       excludeTools,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel
     } = opts;
@@ -124,6 +125,7 @@ class CodeAgent extends OffensiveSecurityAgent {
       subagentId,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel,
       stopWhen: stopWhen ?? stepCountIs(1e4),