@pensar/apex 2.1.2 → 2.1.3-canary.0e6728fd

package/build/{cli-9vzc18m5.js → cli-tbtta1qx.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-whtdyc0e.js";
+} from "./cli-2r1wgr70.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-yjbkaqvy.js";
+} from "./cli-gpbm6crd.js";
 import {
   CodeAgent
-} from "./cli-6vs0mtsb.js";
+} from "./cli-s5d8z6v2.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-gbkj2has.js";
+} from "./cli-4kk337yc.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-tw3fe8bj.js";
+} from "./cli-7r4v9hdr.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -26,8 +26,9 @@ import {
   PLAN_MODE_TOOL_NAMES,
   ValidatedCweEntrySchema,
   hasCanonicalName,
+  pLimit,
   runWithBoundedConcurrency
-} from "./cli-35czfv00.js";
+} from "./cli-dqvnva4d.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -36,13 +37,14 @@ import {
   hasToolCall,
   init_dist,
   init_lazyLogger,
+  init_session,
   init_structured,
   scopedLogger
-} from "./cli-v1aqbv58.js";
+} from "./cli-twfafzdw.js";
 import {
   exports_external,
   init_zod
-} from "./cli-f7d23ded.js";
+} from "./cli-29yqhrjq.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -360,11 +362,13 @@ init_lazyLogger();
 // src/core/session/persistence.ts
 init_structured();
 init_lazyLogger();
+init_session();
 import {
   existsSync as existsSync2,
   mkdirSync,
   readdirSync,
   readFileSync as readFileSync2,
+  renameSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -372,14 +376,14 @@ import { join as join2 } from "node:path";
 var log = scopedLogger(() => createLogger("session:persistence"));
 var SUBAGENTS_DIR = "subagents";
 var MANIFEST_FILE = "agent-manifest.json";
-function loadSubagentMessages(session, agentName) {
-  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, agentName, "messages.json");
+function loadSubagentMessages(session, key) {
+  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, key, "messages.json");
   if (existsSync2(stepPath)) {
     try {
       return JSON.parse(readFileSync2(stepPath, "utf-8"));
     } catch {}
   }
-  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${agentName}.json`);
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
   if (!existsSync2(snapshotPath))
     return [];
   try {
@@ -523,6 +527,9 @@ function parseSubagentFilename(filename) {
   if (filename.startsWith("orchestrator-")) {
     return { agentType: "pentest", name: "Orchestrator Summary" };
   }
+  if (filename.startsWith("ses_")) {
+    return { agentType: "pentest", name: "Pentest Worker" };
+  }
   return { agentType: "pentest", name: filename.split("-")[0] || "Unknown" };
 }
 function unwrapAiSdkToolOutput(output) {
@@ -834,7 +841,8 @@ async function runEndpointDocumentationAgent(opts) {
     openAIReasoningEffort,
     enableThinking,
     projectThreatModel,
-    parentSubagentId
+    parentSubagentId,
+    agentLimiter
   } = opts;
   const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
   const displayMethod = getDocumentMethod(endpoint);
@@ -876,7 +884,7 @@ async function runEndpointDocumentationAgent(opts) {
     projectThreatModel
   });
   try {
-    await agent.consume();
+    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
     eventBus?.emit("subagent-complete", {
       subagentId,
       status: "completed",
@@ -6195,6 +6203,7 @@ init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("whitebox-workflow"));
 var DEFAULT_CONCURRENCY = 5;
+var MAX_CONCURRENT_AGENTS = 12;
 var TASK_TYPE_LABELS = {
   pages: "Pages",
   apiEndpoints: "API Endpoints",
@@ -6228,8 +6237,11 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     domains,
     projectThreatModel,
     environments,
-    surfaceIntegrationEnabled = true
+    surfaceIntegrationEnabled = true,
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
   } = input;
+  const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
+  const agentLimiter = (fn) => agentSlots(fn);
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6256,7 +6268,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     name: "Whitebox Apps Discovery",
     input: { codebasePath }
   });
-  const appsResult = await appsAgent.consume();
+  const appsResult = await agentLimiter(() => appsAgent.consume());
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -6340,7 +6352,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       projectThreatModel
     });
     try {
-      await agent.consume();
+      await agentLimiter(() => agent.consume());
       log4.debug(`Phase 2: agent "${subagentId}" completed`);
       eventBus?.emit("subagent-complete", {
         subagentId,
@@ -6391,7 +6403,8 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             openAIReasoningEffort,
             enableThinking,
             projectThreatModel,
-            parentSubagentId: appNodeId
+            parentSubagentId: appNodeId,
+            agentLimiter
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);