@pensar/apex 2.1.3-canary.06f4c3eb → 2.1.3-canary.5d85cfd8

package/build/{agent-sn33s7wa.js → agent-c1f9g7z5.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-952bzt8m.js";
+} from "./cli-sgn1z0m0.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-ts46he50.js → agent-f1vdsgav.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-sganpfnr.js";
+} from "./cli-2xxvqdh0.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+} from "./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
 import {
   exports_external,
   init_zod
 } from "./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/agent-q39cx1dc.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-21ypdr28.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
+import"./cli-c8131c4q.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-6egm0mw2.js → apps-1jyvn2rb.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-jn2sxf89.js";
-import"./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-epra15kv.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+} from "./cli-aenmh1mw.js";
+import"./cli-adp3b26w.js";
+import"./cli-8z6221m3.js";
+import"./cli-sgn1z0m0.js";
+import"./cli-s553q3az.js";
+import"./cli-21ypdr28.js";
+import"./cli-p2nh3a9n.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-qd4f8hgn.js → auth-k16afcmp.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-jn2sxf89.js";
-import"./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-epra15kv.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+import"./cli-aenmh1mw.js";
+import"./cli-adp3b26w.js";
+import"./cli-8z6221m3.js";
+import"./cli-sgn1z0m0.js";
+import"./cli-s553q3az.js";
+import"./cli-21ypdr28.js";
+import"./cli-p2nh3a9n.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
+import"./cli-zjjmy6m2.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-80sehbtt.js";
+} from "./cli-fjay3f43.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+} from "./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-scwkrw70.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-s553q3az.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
+import"./cli-c8131c4q.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-d5epsg48.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-8z6221m3.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
+import"./cli-c8131c4q.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-fe56bfc1.js → blackboxPentest-byrj8vpc.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-gta3gsva.js";
-import"./cli-8p3trjtv.js";
-import"./cli-952bzt8m.js";
-import"./cli-mt0f9tte.js";
-import"./cli-adgyv55h.js";
+} from "./cli-adp3b26w.js";
+import"./cli-8z6221m3.js";
+import"./cli-sgn1z0m0.js";
+import"./cli-21ypdr28.js";
+import"./cli-p2nh3a9n.js";
 import"./cli-9fsre5pt.js";
-import"./cli-r2z98y59.js";
-import"./cli-99a9aq3w.js";
-import"./cli-sganpfnr.js";
+import"./cli-8xdm8ce2.js";
+import"./cli-jg3gsjb5.js";
+import"./cli-2xxvqdh0.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-ja43jscc.js";
-import"./cli-80sehbtt.js";
+import"./cli-zjjmy6m2.js";
+import"./cli-fjay3f43.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pgsqvjqw.js";
-import"./cli-h28cfavt.js";
-import"./cli-5vvb8cby.js";
+import"./cli-pnexmyky.js";
+import"./cli-t0xxwv91.js";
+import"./cli-a6ga7egy.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-mt0f9tte.js → cli-21ypdr28.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-ja43jscc.js";
+} from "./cli-zjjmy6m2.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-sganpfnr.js → cli-2xxvqdh0.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-ja43jscc.js";
+} from "./cli-zjjmy6m2.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-r2z98y59.js → cli-8xdm8ce2.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   exports_external,
   init_zod

package/build/{cli-8p3trjtv.js → cli-8z6221m3.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-sganpfnr.js";
+} from "./cli-2xxvqdh0.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-ja43jscc.js";
+} from "./cli-zjjmy6m2.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -479,7 +479,7 @@ ${authenticationInstructions}
     authBlock = `⚠️ AUTHENTICATION CREDENTIALS PROVIDED — YOU MUST LOG IN FIRST.
 
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
-Then use browser tools to authenticate. Pass the credentialId to authenticate_session or delegate_to_auth_subagent — secrets are resolved automatically.
+Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.

package/build/{cli-5vvb8cby.js → cli-a6ga7egy.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.3-canary.06f4c3eb"
+    version: "2.1.3-canary.5d85cfd8"
   };
 });
 

package/build/{cli-gta3gsva.js → cli-adp3b26w.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-8p3trjtv.js";
+} from "./cli-8z6221m3.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-952bzt8m.js";
+} from "./cli-sgn1z0m0.js";
 import {
   CodeAgent
-} from "./cli-mt0f9tte.js";
+} from "./cli-21ypdr28.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-adgyv55h.js";
+} from "./cli-p2nh3a9n.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-r2z98y59.js";
+} from "./cli-8xdm8ce2.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -26,8 +26,9 @@ import {
   PLAN_MODE_TOOL_NAMES,
   ValidatedCweEntrySchema,
   hasCanonicalName,
+  pLimit,
   runWithBoundedConcurrency
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -38,7 +39,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-ja43jscc.js";
+} from "./cli-zjjmy6m2.js";
 import {
   exports_external,
   init_zod
@@ -834,7 +835,8 @@ async function runEndpointDocumentationAgent(opts) {
     openAIReasoningEffort,
     enableThinking,
     projectThreatModel,
-    parentSubagentId
+    parentSubagentId,
+    agentLimiter
   } = opts;
   const subagentId = `endpoint-doc-${slug(app.name)}-${slug(endpoint.path)}`;
   const displayMethod = getDocumentMethod(endpoint);
@@ -876,7 +878,7 @@ async function runEndpointDocumentationAgent(opts) {
     projectThreatModel
   });
   try {
-    await agent.consume();
+    await (agentLimiter ? agentLimiter(() => agent.consume()) : agent.consume());
     eventBus?.emit("subagent-complete", {
       subagentId,
       status: "completed",
@@ -6195,6 +6197,7 @@ init_structured();
 init_lazyLogger();
 var log4 = scopedLogger(() => createLogger("whitebox-workflow"));
 var DEFAULT_CONCURRENCY = 5;
+var MAX_CONCURRENT_AGENTS = 12;
 var TASK_TYPE_LABELS = {
   pages: "Pages",
   apiEndpoints: "API Endpoints",
@@ -6228,8 +6231,11 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     domains,
     projectThreatModel,
     environments,
-    surfaceIntegrationEnabled = true
+    surfaceIntegrationEnabled = true,
+    maxConcurrentAgents = MAX_CONCURRENT_AGENTS
   } = input;
+  const agentSlots = pLimit(Math.max(1, maxConcurrentAgents));
+  const agentLimiter = (fn) => agentSlots(fn);
   const appsAgent = new CodeAgent({
     codebasePath,
     objective: buildAppsDiscoveryObjective(codebasePath, domains, environments),
@@ -6256,7 +6262,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
     name: "Whitebox Apps Discovery",
     input: { codebasePath }
   });
-  const appsResult = await appsAgent.consume();
+  const appsResult = await agentLimiter(() => appsAgent.consume());
   log4.info(`Phase 1 complete: ${appsResult?.apps.length ?? 0} apps discovered` + (appsResult ? ` (repoType=${appsResult.repoType}, packageManager=${appsResult.packageManager})` : " (no result returned)"));
   if (appsResult?.apps.length) {
     for (const app of appsResult.apps) {
@@ -6340,7 +6346,7 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
       projectThreatModel
     });
     try {
-      await agent.consume();
+      await agentLimiter(() => agent.consume());
       log4.debug(`Phase 2: agent "${subagentId}" completed`);
       eventBus?.emit("subagent-complete", {
         subagentId,
@@ -6391,7 +6397,8 @@ async function runWhiteboxAttackSurfaceWorkflow(input) {
             openAIReasoningEffort,
             enableThinking,
             projectThreatModel,
-            parentSubagentId: appNodeId
+            parentSubagentId: appNodeId,
+            agentLimiter
           });
         } else {
           log4.debug(`${app.name}: fallback (${surfaceResult.reason})`);

package/build/{cli-jn2sxf89.js → cli-aenmh1mw.js}

@@ -4,19 +4,19 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-99a9aq3w.js";
+} from "./cli-jg3gsjb5.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-ja43jscc.js";
+} from "./cli-zjjmy6m2.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-80sehbtt.js";
+} from "./cli-fjay3f43.js";
 import {
   exports_external,
   init_zod
@@ -24,7 +24,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-pgsqvjqw.js";
+} from "./cli-pnexmyky.js";
 import {
   __commonJS,
   __require

package/build/{cli-80sehbtt.js → cli-fjay3f43.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-pgsqvjqw.js";
+} from "./cli-pnexmyky.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";