@pensar/apex 2.1.3-canary.5d85cfd8 → 2.1.3-canary.8fbf4df4

package/build/{agent-f1vdsgav.js → agent-2xc8h110.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-2xxvqdh0.js";
+} from "./cli-em393q4v.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-zjjmy6m2.js";
-import"./cli-fjay3f43.js";
+} from "./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
 import {
   exports_external,
   init_zod
 } from "./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pnexmyky.js";
-import"./cli-t0xxwv91.js";
-import"./cli-a6ga7egy.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/agent-6n0qsz43.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-hzmf5xgq.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
+import"./cli-c8131c4q.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-c1f9g7z5.js → agent-71xbavry.js}

@@ -3,19 +3,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-sgn1z0m0.js";
+} from "./cli-ahfgjewh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8xdm8ce2.js";
-import"./cli-jg3gsjb5.js";
-import"./cli-2xxvqdh0.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
 import"./cli-c8131c4q.js";
-import"./cli-zjjmy6m2.js";
-import"./cli-fjay3f43.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pnexmyky.js";
-import"./cli-t0xxwv91.js";
-import"./cli-a6ga7egy.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{apps-1jyvn2rb.js → apps-k1f3qqp4.js}

@@ -12,26 +12,26 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-aenmh1mw.js";
-import"./cli-adp3b26w.js";
-import"./cli-8z6221m3.js";
-import"./cli-sgn1z0m0.js";
-import"./cli-s553q3az.js";
-import"./cli-21ypdr28.js";
-import"./cli-p2nh3a9n.js";
+} from "./cli-1ss38kk9.js";
+import"./cli-e7vgd0zd.js";
+import"./cli-yrtv50qd.js";
+import"./cli-ahfgjewh.js";
+import"./cli-jz8d6pcc.js";
+import"./cli-hzmf5xgq.js";
+import"./cli-08h8jy0d.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8xdm8ce2.js";
-import"./cli-jg3gsjb5.js";
-import"./cli-2xxvqdh0.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zjjmy6m2.js";
-import"./cli-fjay3f43.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pnexmyky.js";
-import"./cli-t0xxwv91.js";
-import"./cli-a6ga7egy.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-k16afcmp.js → auth-12kdqfzj.js}

@@ -1,18 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-aenmh1mw.js";
-import"./cli-adp3b26w.js";
-import"./cli-8z6221m3.js";
-import"./cli-sgn1z0m0.js";
-import"./cli-s553q3az.js";
-import"./cli-21ypdr28.js";
-import"./cli-p2nh3a9n.js";
+import"./cli-1ss38kk9.js";
+import"./cli-e7vgd0zd.js";
+import"./cli-yrtv50qd.js";
+import"./cli-ahfgjewh.js";
+import"./cli-jz8d6pcc.js";
+import"./cli-hzmf5xgq.js";
+import"./cli-08h8jy0d.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8xdm8ce2.js";
-import"./cli-jg3gsjb5.js";
-import"./cli-2xxvqdh0.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zjjmy6m2.js";
+import"./cli-t47pwypw.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +25,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-fjay3f43.js";
+} from "./cli-5nz8dbg2.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-pnexmyky.js";
-import"./cli-t0xxwv91.js";
-import"./cli-a6ga7egy.js";
+} from "./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-vvh0mzr4.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-jz8d6pcc.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
+import"./cli-c8131c4q.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-5wvhzcrt.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-yrtv50qd.js";
+import"./cli-9fsre5pt.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
+import"./cli-c8131c4q.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
+import"./cli-29yqhrjq.js";
+import"./cli-gpnb45ck.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-byrj8vpc.js → blackboxPentest-4mfnh4q4.js}

@@ -1,23 +1,23 @@
 import {
   runPentestWorkflow
-} from "./cli-adp3b26w.js";
-import"./cli-8z6221m3.js";
-import"./cli-sgn1z0m0.js";
-import"./cli-21ypdr28.js";
-import"./cli-p2nh3a9n.js";
+} from "./cli-e7vgd0zd.js";
+import"./cli-yrtv50qd.js";
+import"./cli-ahfgjewh.js";
+import"./cli-hzmf5xgq.js";
+import"./cli-08h8jy0d.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8xdm8ce2.js";
-import"./cli-jg3gsjb5.js";
-import"./cli-2xxvqdh0.js";
+import"./cli-8qbrq7q4.js";
+import"./cli-rp597hwq.js";
+import"./cli-em393q4v.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zjjmy6m2.js";
-import"./cli-fjay3f43.js";
+import"./cli-t47pwypw.js";
+import"./cli-5nz8dbg2.js";
 import"./cli-29yqhrjq.js";
 import"./cli-gpnb45ck.js";
-import"./cli-pnexmyky.js";
-import"./cli-t0xxwv91.js";
-import"./cli-a6ga7egy.js";
+import"./cli-32666wac.js";
+import"./cli-6gvxmjz0.js";
+import"./cli-kswc2h78.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-p2nh3a9n.js → cli-08h8jy0d.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 import {
   exports_external,
   init_zod,

package/build/{cli-aenmh1mw.js → cli-1ss38kk9.js}

@@ -4,19 +4,19 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-fjay3f43.js";
+} from "./cli-5nz8dbg2.js";
 import {
   exports_external,
   init_zod
@@ -24,7 +24,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-pnexmyky.js";
+} from "./cli-32666wac.js";
 import {
   __commonJS,
   __require

package/build/{cli-pnexmyky.js → cli-32666wac.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-t0xxwv91.js";
+} from "./cli-6gvxmjz0.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-fjay3f43.js → cli-5nz8dbg2.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-pnexmyky.js";
+} from "./cli-32666wac.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-qqt6gnk8.js → cli-6254rzx7.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-t0xxwv91.js → cli-6gvxmjz0.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-a6ga7egy.js";
+} from "./cli-kswc2h78.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-8xdm8ce2.js → cli-8qbrq7q4.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   exports_external,
   init_zod

package/build/{cli-sgn1z0m0.js → cli-ahfgjewh.js}

@@ -5,7 +5,7 @@ import {
   createReportErrorTool,
   isMemoryEnabled,
   readPlan
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   createLogger,
   hasToolCall,
@@ -13,7 +13,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 import {
   exports_external,
   init_zod

package/build/{cli-adp3b26w.js → cli-e7vgd0zd.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-8z6221m3.js";
+} from "./cli-yrtv50qd.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-sgn1z0m0.js";
+} from "./cli-ahfgjewh.js";
 import {
   CodeAgent
-} from "./cli-21ypdr28.js";
+} from "./cli-hzmf5xgq.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -15,10 +15,10 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-p2nh3a9n.js";
+} from "./cli-08h8jy0d.js";
 import {
   EvidenceFileEntrySchema
-} from "./cli-8xdm8ce2.js";
+} from "./cli-8qbrq7q4.js";
 import {
   CweEntrySchema,
   FindingsRegistry,
@@ -28,7 +28,7 @@ import {
   hasCanonicalName,
   pLimit,
   runWithBoundedConcurrency
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -39,7 +39,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 import {
   exports_external,
   init_zod

package/build/{cli-2xxvqdh0.js → cli-em393q4v.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-21ypdr28.js → cli-hzmf5xgq.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-s553q3az.js → cli-jz8d6pcc.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-jg3gsjb5.js";
+} from "./cli-rp597hwq.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-2xxvqdh0.js";
+} from "./cli-em393q4v.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zjjmy6m2.js";
+} from "./cli-t47pwypw.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -37,9 +37,9 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Available Tools
 
 ## API Authentication
-- \`execute_command\` — Run curl (or other shell commands) to submit credentials via form POST,
-  JSON POST, or HTTP Basic auth, and to capture the Set-Cookie / token response. Use this for all
-  custom and complex API auth flows.
+- \`authenticate_session\` — Submit credentials via form POST, JSON POST, or HTTP Basic auth.
+  Params: loginUrl, username, password, method (form_post|json_post|basic_auth), usernameField, passwordField, additionalFields.
+- \`execute_command\` — Run curl or other shell commands for custom/complex API auth flows.
 
 ## Browser Authentication
 - \`browser_navigate\` — Navigate to login page
@@ -77,11 +77,11 @@ Look for:
 ## Step 2: Authenticate
 
 ### API path (use when target is an API or has a simple form):
-1. Use \`execute_command\` with curl to submit the credentials, matching the target's scheme:
-   - \`curl -i -d 'username=...&password=...' <loginUrl>\` for HTML form POST
-   - \`curl -i -H 'Content-Type: application/json' -d '{"username":"...","password":"..."}' <loginUrl>\` for JSON APIs
-   - \`curl -i -u '<user>:<pass>' <url>\` for HTTP Basic
-2. Inspect the response (\`-i\` shows headers) — capture any \`Set-Cookie\` value or token to use as the session credential.
+1. Call \`authenticate_session\` with the correct method and credentials.
+   - \`form_post\` for HTML forms
+   - \`json_post\` for JSON APIs
+   - \`basic_auth\` for HTTP Basic
+2. Check the response — if authenticated is true, you have a session cookie.
 
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
@@ -113,7 +113,7 @@ If both API and browser approaches fail, use \`delegate_to_auth_subagent\` for c
 **First**, call \`complete_authentication\` with:
 - \`success\`: whether auth succeeded
 - \`summary\`: what happened and what credentials/cookies were obtained
-- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or the Set-Cookie header in the curl response)
+- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or authenticate_session response)
 - \`exportedHeaders\`: auth headers map, e.g. {"Authorization": "Bearer <token>"} (from browser_evaluate localStorage tokens or API response)
 - \`strategy\`: method used ("browser", "form_post", "json_post", "basic_auth", "bearer")
 - \`authBarrier\`: if a barrier was encountered (captcha, mfa, etc.)
@@ -199,6 +199,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       toolChoice: "auto",
       activeTools: [
         "execute_command",
+        "authenticate_session",
         "complete_authentication",
         "browser_navigate",
         "browser_snapshot",
@@ -293,16 +294,17 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
   if (credBlock) {
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
-1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
-2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
+1. Try authenticate_session first (pass the credentialId — secrets are resolved automatically)
+2. If authenticate_session fails, use browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism
-2. Attempt authentication with execute_command (curl) or the browser tools
-3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+2. Attempt authentication with authenticate_session or the browser tools
+3. If that fails, try delegate_to_auth_subagent as a fallback
+4. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   }
   return parts.join(`
 `);

package/build/{cli-a6ga7egy.js → cli-kswc2h78.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.3-canary.5d85cfd8"
+    version: "2.1.3-canary.8fbf4df4"
   };
 });