@pensar/apex 2.1.2 → 2.1.3-canary.15e34bf1

package/build/{cli-0gk2x2sc.js → cli-2zbvtnrx.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-4xz6rqg5.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-6wwpk9d9.js";
+} from "./cli-r5n86ej6.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-v1aqbv58.js";
+} from "./cli-nm2jskqg.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -37,9 +37,9 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Available Tools
 
 ## API Authentication
-- \`authenticate_session\` — Submit credentials via form POST, JSON POST, or HTTP Basic auth.
-  Params: loginUrl, username, password, method (form_post|json_post|basic_auth), usernameField, passwordField, additionalFields.
-- \`execute_command\` — Run curl or other shell commands for custom/complex API auth flows.
+- \`execute_command\` — Run curl (or other shell commands) to submit credentials via form POST,
+  JSON POST, or HTTP Basic auth, and to capture the Set-Cookie / token response. Use this for all
+  custom and complex API auth flows.
 
 ## Browser Authentication
 - \`browser_navigate\` — Navigate to login page
@@ -77,11 +77,11 @@ Look for:
 ## Step 2: Authenticate
 
 ### API path (use when target is an API or has a simple form):
-1. Call \`authenticate_session\` with the correct method and credentials.
-   - \`form_post\` for HTML forms
-   - \`json_post\` for JSON APIs
-   - \`basic_auth\` for HTTP Basic
-2. Check the response — if authenticated is true, you have a session cookie.
+1. Use \`execute_command\` with curl to submit the credentials, matching the target's scheme:
+   - \`curl -i -d 'username=...&password=...' <loginUrl>\` for HTML form POST
+   - \`curl -i -H 'Content-Type: application/json' -d '{"username":"...","password":"..."}' <loginUrl>\` for JSON APIs
+   - \`curl -i -u '<user>:<pass>' <url>\` for HTTP Basic
+2. Inspect the response (\`-i\` shows headers) — capture any \`Set-Cookie\` value or token to use as the session credential.
 
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
@@ -113,7 +113,7 @@ If both API and browser approaches fail, use \`delegate_to_auth_subagent\` for c
 **First**, call \`complete_authentication\` with:
 - \`success\`: whether auth succeeded
 - \`summary\`: what happened and what credentials/cookies were obtained
-- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or authenticate_session response)
+- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or the Set-Cookie header in the curl response)
 - \`exportedHeaders\`: auth headers map, e.g. {"Authorization": "Bearer <token>"} (from browser_evaluate localStorage tokens or API response)
 - \`strategy\`: method used ("browser", "form_post", "json_post", "basic_auth", "bearer")
 - \`authBarrier\`: if a barrier was encountered (captcha, mfa, etc.)
@@ -199,7 +199,6 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       toolChoice: "auto",
       activeTools: [
         "execute_command",
-        "authenticate_session",
         "complete_authentication",
         "browser_navigate",
         "browser_snapshot",
@@ -294,17 +293,16 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
   if (credBlock) {
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
-1. Try authenticate_session first (pass the credentialId — secrets are resolved automatically)
-2. If authenticate_session fails, use browser tools. For browser_fill on password/secret fields,
+1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
+2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism
-2. Attempt authentication with authenticate_session or the browser tools
-3. If that fails, try delegate_to_auth_subagent as a fallback
-4. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+2. Attempt authentication with execute_command (curl) or the browser tools
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   }
   return parts.join(`
 `);

package/build/{cli-gbkj2has.js → cli-49kwknjj.js}

@@ -1,15 +1,15 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-35czfv00.js";
+} from "./cli-4xz6rqg5.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-v1aqbv58.js";
+} from "./cli-nm2jskqg.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-f7d23ded.js";
+} from "./cli-29yqhrjq.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();