@pensar/apex 2.1.3-canary.06f4c3eb → 2.1.3-canary.15e34bf1

package/build/agent-3ktj43z9.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-eh6nrt6s.js";
+import"./cli-9fsre5pt.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
+import"./cli-c8131c4q.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-sn33s7wa.js → agent-3s7c1qrd.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-952bzt8m.js";
+} from "./cli-xe08y0nv.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-ts46he50.js → agent-v3d0ssgy.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-4xz6rqg5.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-sganpfnr.js";
+} from "./cli-r5n86ej6.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+} from "./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
 import {
   exports_external,
   init_zod
 } from "./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/{apps-6egm0mw2.js → apps-rk071a9p.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-jn2sxf89.js";
-import"./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-epra15kv.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+} from "./cli-8vaa0frx.js";
+import"./cli-1kgqgq0a.js";
+import"./cli-84pr5q33.js";
+import"./cli-xe08y0nv.js";
+import"./cli-2zbvtnrx.js";
+import"./cli-eh6nrt6s.js";
+import"./cli-49kwknjj.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-qd4f8hgn.js → auth-cnc8b1tj.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-jn2sxf89.js";
-import"./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-epra15kv.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+import"./cli-8vaa0frx.js";
+import"./cli-1kgqgq0a.js";
+import"./cli-84pr5q33.js";
+import"./cli-xe08y0nv.js";
+import"./cli-2zbvtnrx.js";
+import"./cli-eh6nrt6s.js";
+import"./cli-49kwknjj.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
+import"./cli-nm2jskqg.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-80sehbtt.js";
+} from "./cli-dh7tfkre.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+} from "./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-hrwp9bw8.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-2zbvtnrx.js";
+import"./cli-9fsre5pt.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
+import"./cli-c8131c4q.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-fzp5cyvr.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-84pr5q33.js";
+import"./cli-9fsre5pt.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
+import"./cli-c8131c4q.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-fe56bfc1.js → blackboxPentest-b6cpqtkh.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+} from "./cli-1kgqgq0a.js";
+import"./cli-84pr5q33.js";
+import"./cli-xe08y0nv.js";
+import"./cli-eh6nrt6s.js";
+import"./cli-49kwknjj.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-yqtxtvg8.js";
+import"./cli-4xz6rqg5.js";
+import"./cli-r5n86ej6.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-nm2jskqg.js";
+import"./cli-dh7tfkre.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-h7w8nj1x.js";
+import"./cli-td2vwxvv.js";
+import"./cli-7y6dwmn8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-gta3gsva.js → cli-1kgqgq0a.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-8p3trjtv.js";
+} from "./cli-84pr5q33.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-952bzt8m.js";
+} from "./cli-xe08y0nv.js";
 import {
   CodeAgent
-} from "./cli-mt0f9tte.js";
+} from "./cli-eh6nrt6s.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-adgyv55h.js";
+} from "./cli-49kwknjj.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-r2z98y59.js";
+} from "./cli-yqtxtvg8.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -26,8 +26,9 @@ import {
   PLAN_MODE_TOOL_NAMES,
   ValidatedCweEntrySchema,
   hasCanonicalName,
+  pLimit,
   runWithBoundedConcurrency
-} from "./cli-99a9aq3w.js";
+} from "./cli-4xz6rqg5.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -36,9 +37,10 @@ import {
   hasToolCall,
   init_dist,
   init_lazyLogger,
+  init_session,
   init_structured,
   scopedLogger
-} from "./cli-ja43jscc.js";
+} from "./cli-nm2jskqg.js";
 import {
   exports_external,
   init_zod
@@ -360,11 +362,13 @@ init_lazyLogger();
 // src/core/session/persistence.ts
 init_structured();
 init_lazyLogger();
+init_session();
 import {
   existsSync as existsSync2,
   mkdirSync,
   readdirSync,
   readFileSync as readFileSync2,
+  renameSync,
   statSync,
   writeFileSync as writeFileSync2
 } from "node:fs";
@@ -372,14 +376,14 @@ import { join as join2 } from "node:path";
 var log = scopedLogger(() => createLogger("session:persistence"));
 var SUBAGENTS_DIR = "subagents";
 var MANIFEST_FILE = "agent-manifest.json";
-function loadSubagentMessages(session, agentName) {
-  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, agentName, "messages.json");
+function loadSubagentMessages(session, key) {
+  const stepPath = join2(session.rootPath, SUBAGENTS_DIR, key, "messages.json");
   if (existsSync2(stepPath)) {
     try {
       return JSON.parse(readFileSync2(stepPath, "utf-8"));
     } catch {}
   }
-  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${agentName}.json`);
+  const snapshotPath = join2(session.rootPath, SUBAGENTS_DIR, `${key}.json`);
   if (!existsSync2(snapshotPath))
     return [];
   try {
@@ -523,6 +527,9 @@ function parseSubagentFilename(filename) {
   if (filename.startsWith("orchestrator-")) {
     return { agentType: "pentest", name: "Orchestrator Summary" };
   }
+  if (filename.startsWith("ses_")) {
+    return { agentType: "pentest", name: "Pentest Worker" };
+  }
   return { agentType: "pentest", name: filename.split("-")[0] || "Unknown" };
 }
 function unwrapAiSdkToolOutput(output) {
@@ -834,7 +841,8 @@ async function runEndpointDocumentationAgent(opts) {
     openAIReasoningEffort,
     enableThinking,
     projectThreatModel,
-    parentSubagentId
+    parentSubagentId,
+    agentLimiter
   } = opts;
   const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
   const displayMethod = getDocumentMethod(endpoint);
@@ -876,7 +884,7 @@ async function runEndpointDocumentationAgent(opts) {
     projectThreatModel
   });
   try {
-    await agent.consume();
+    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
     eventBus?.emit("subagent-complete", {
       subagentId,
       status: "completed",
@@ -6195,6 +6203,7 @@ init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("whitebox-workflow"));
 var DEFAULT_CONCURRENCY = 5;
+var MAX_CONCURRENT_AGENTS = 12;
 var TASK_TYPE_LABELS = {
   pages: "Pages",
   apiEndpoints: "API Endpoints",
@@ -6228,8 +6237,11 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     domains,
     projectThreatModel,
     environments,
-    surfaceIntegrationEnabled = true
+    surfaceIntegrationEnabled = true,
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
   } = input;
+  const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
+  const agentLimiter = (fn) => agentSlots(fn);
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6256,7 +6268,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     name: "Whitebox Apps Discovery",
     input: { codebasePath }
   });
-  const appsResult = await appsAgent.consume();
+  const appsResult = await agentLimiter(() => appsAgent.consume());
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -6340,7 +6352,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       projectThreatModel
     });
     try {
-      await agent.consume();
+      await agentLimiter(() => agent.consume());
       log4.debug(`Phase 2: agent "${subagentId}" completed`);
       eventBus?.emit("subagent-complete", {
         subagentId,
@@ -6391,7 +6403,8 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             openAIReasoningEffort,
             enableThinking,
             projectThreatModel,
-            parentSubagentId: appNodeId
+            parentSubagentId: appNodeId,
+            agentLimiter
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);

package/build/{cli-epra15kv.js → cli-2zbvtnrx.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-4xz6rqg5.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-sganpfnr.js";
+} from "./cli-r5n86ej6.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-ja43jscc.js";
+} from "./cli-nm2jskqg.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -37,9 +37,9 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Available Tools
 
 ## API Authentication
-- \`authenticate_session\` — Submit credentials via form POST, JSON POST, or HTTP Basic auth.
-  Params: loginUrl, username, password, method (form_post|json_post|basic_auth), usernameField, passwordField, additionalFields.
-- \`execute_command\` — Run curl or other shell commands for custom/complex API auth flows.
+- \`execute_command\` — Run curl (or other shell commands) to submit credentials via form POST,
+  JSON POST, or HTTP Basic auth, and to capture the Set-Cookie / token response. Use this for all
+  custom and complex API auth flows.
 
 ## Browser Authentication
 - \`browser_navigate\` — Navigate to login page
@@ -77,11 +77,11 @@ Look for:
 ## Step 2: Authenticate
 
 ### API path (use when target is an API or has a simple form):
-1. Call \`authenticate_session\` with the correct method and credentials.
-   - \`form_post\` for HTML forms
-   - \`json_post\` for JSON APIs
-   - \`basic_auth\` for HTTP Basic
-2. Check the response — if authenticated is true, you have a session cookie.
+1. Use \`execute_command\` with curl to submit the credentials, matching the target's scheme:
+   - \`curl -i -d 'username=...&password=...' <loginUrl>\` for HTML form POST
+   - \`curl -i -H 'Content-Type: application/json' -d '{"username":"...","password":"..."}' <loginUrl>\` for JSON APIs
+   - \`curl -i -u '<user>:<pass>' <url>\` for HTTP Basic
+2. Inspect the response (\`-i\` shows headers) — capture any \`Set-Cookie\` value or token to use as the session credential.
 
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
@@ -113,7 +113,7 @@ If both API and browser approaches fail, use \`delegate_to_auth_subagent\` for c
 **First**, call \`complete_authentication\` with:
 - \`success\`: whether auth succeeded
 - \`summary\`: what happened and what credentials/cookies were obtained
-- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or authenticate_session response)
+- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or the Set-Cookie header in the curl response)
 - \`exportedHeaders\`: auth headers map, e.g. {"Authorization": "Bearer <token>"} (from browser_evaluate localStorage tokens or API response)
 - \`strategy\`: method used ("browser", "form_post", "json_post", "basic_auth", "bearer")
 - \`authBarrier\`: if a barrier was encountered (captcha, mfa, etc.)
@@ -199,7 +199,6 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       toolChoice: "auto",
       activeTools: [
         "execute_command",
-        "authenticate_session",
         "complete_authentication",
         "browser_navigate",
         "browser_snapshot",
@@ -294,17 +293,16 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
   if (credBlock) {
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
-1. Try authenticate_session first (pass the credentialId — secrets are resolved automatically)
-2. If authenticate_session fails, use browser tools. For browser_fill on password/secret fields,
+1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
+2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism
-2. Attempt authentication with authenticate_session or the browser tools
-3. If that fails, try delegate_to_auth_subagent as a fallback
-4. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+2. Attempt authentication with execute_command (curl) or the browser tools
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   }
   return parts.join(`
 `);

package/build/{cli-adgyv55h.js → cli-49kwknjj.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-4xz6rqg5.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-ja43jscc.js";
+} from "./cli-nm2jskqg.js";
 import {
   exports_external,
   init_zod,