@pensar/apex 2.1.3-canary.8fbf4df4 → 2.1.3-canary.a2e99e97

package/build/{agent-2xc8h110.js → agent-4vm9m2ft.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-rp597hwq.js";
+} from "./cli-gpvaz7xr.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-em393q4v.js";
+} from "./cli-jx3sh6sh.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-t47pwypw.js";
-import"./cli-5nz8dbg2.js";
+} from "./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-32666wac.js";
-import"./cli-6gvxmjz0.js";
-import"./cli-kswc2h78.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -207,8 +207,10 @@ class FindingJudgeAgent extends OffensiveSecurityAgent {
       eventBus: opts.eventBus,
       sandbox: opts.sandbox,
       enableThinking: opts.enableThinking,
+      thinkingEffort: opts.thinkingEffort,
       openAIReasoningEffort: opts.openAIReasoningEffort,
       subagentId: opts.subagentId ?? "finding-judge",
+      subagentName: opts.subagentName ?? "Finding Judge",
       activeTools: [...FINDING_JUDGE_ACTIVE_TOOLS],
       responseSchema: FindingJudgeOutputSchema,
       stopWhen: stepCountIs(60)

package/build/agent-rt8h17s3.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-b0jq621d.js";
+import"./cli-9fsre5pt.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
+import"./cli-c8131c4q.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/agent-tk933cmw.js

@@ -0,0 +1,27 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt
+} from "./cli-84kpy9q6.js";
+import"./cli-9fsre5pt.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
+import"./cli-c8131c4q.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
+import"./cli-8rxa073f.js";
+export {
+  buildPentestSystemPrompt,
+  buildPentestPrompt,
+  buildPentestActiveTools,
+  TargetedPentestAgent,
+  PentestResponseSchema
+};

package/build/{apps-k1f3qqp4.js → apps-4ydk4b5z.js}

@@ -12,26 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-1ss38kk9.js";
-import"./cli-e7vgd0zd.js";
-import"./cli-yrtv50qd.js";
-import"./cli-ahfgjewh.js";
-import"./cli-jz8d6pcc.js";
-import"./cli-hzmf5xgq.js";
-import"./cli-08h8jy0d.js";
+} from "./cli-8fx3r1dj.js";
+import"./cli-r0rzk777.js";
+import"./cli-z43s0k01.js";
+import"./cli-pmf3g5b8.js";
+import"./cli-84kpy9q6.js";
+import"./cli-192yezw4.js";
+import"./cli-b0jq621d.js";
+import"./cli-rsv7cf68.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8qbrq7q4.js";
-import"./cli-rp597hwq.js";
-import"./cli-em393q4v.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-t47pwypw.js";
-import"./cli-5nz8dbg2.js";
-import"./cli-29yqhrjq.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-32666wac.js";
-import"./cli-6gvxmjz0.js";
-import"./cli-kswc2h78.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-12kdqfzj.js → auth-9wbcvarq.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-1ss38kk9.js";
-import"./cli-e7vgd0zd.js";
-import"./cli-yrtv50qd.js";
-import"./cli-ahfgjewh.js";
-import"./cli-jz8d6pcc.js";
-import"./cli-hzmf5xgq.js";
-import"./cli-08h8jy0d.js";
+import"./cli-8fx3r1dj.js";
+import"./cli-r0rzk777.js";
+import"./cli-z43s0k01.js";
+import"./cli-pmf3g5b8.js";
+import"./cli-84kpy9q6.js";
+import"./cli-192yezw4.js";
+import"./cli-b0jq621d.js";
+import"./cli-rsv7cf68.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8qbrq7q4.js";
-import"./cli-rp597hwq.js";
-import"./cli-em393q4v.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-t47pwypw.js";
+import"./cli-86hen4re.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +26,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-5nz8dbg2.js";
-import"./cli-29yqhrjq.js";
+} from "./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-32666wac.js";
-import"./cli-6gvxmjz0.js";
-import"./cli-kswc2h78.js";
+} from "./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-vah7w9pm.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-192yezw4.js";
+import"./cli-9fsre5pt.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
+import"./cli-c8131c4q.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-sr2bfe3s.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-z43s0k01.js";
+import"./cli-9fsre5pt.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
+import"./cli-c8131c4q.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-4mfnh4q4.js → blackboxPentest-52ed5674.js}

@@ -1,23 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-e7vgd0zd.js";
-import"./cli-yrtv50qd.js";
-import"./cli-ahfgjewh.js";
-import"./cli-hzmf5xgq.js";
-import"./cli-08h8jy0d.js";
+} from "./cli-r0rzk777.js";
+import"./cli-z43s0k01.js";
+import"./cli-pmf3g5b8.js";
+import"./cli-84kpy9q6.js";
+import"./cli-b0jq621d.js";
+import"./cli-rsv7cf68.js";
 import"./cli-9fsre5pt.js";
-import"./cli-8qbrq7q4.js";
-import"./cli-rp597hwq.js";
-import"./cli-em393q4v.js";
+import"./cli-tdgq36q1.js";
+import"./cli-gpvaz7xr.js";
+import"./cli-jx3sh6sh.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-t47pwypw.js";
-import"./cli-5nz8dbg2.js";
-import"./cli-29yqhrjq.js";
+import"./cli-86hen4re.js";
+import"./cli-3x9ygtbv.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-32666wac.js";
-import"./cli-6gvxmjz0.js";
-import"./cli-kswc2h78.js";
+import"./cli-hzw5gtyt.js";
+import"./cli-2yqc0vnm.js";
+import"./cli-f2bq20gj.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-jz8d6pcc.js → cli-192yezw4.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-rp597hwq.js";
+} from "./cli-gpvaz7xr.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-em393q4v.js";
+} from "./cli-jx3sh6sh.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-t47pwypw.js";
+} from "./cli-86hen4re.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -37,9 +37,9 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Available Tools
 
 ## API Authentication
-- \`authenticate_session\` — Submit credentials via form POST, JSON POST, or HTTP Basic auth.
-  Params: loginUrl, username, password, method (form_post|json_post|basic_auth), usernameField, passwordField, additionalFields.
-- \`execute_command\` — Run curl or other shell commands for custom/complex API auth flows.
+- \`execute_command\` — Run curl (or other shell commands) to submit credentials via form POST,
+  JSON POST, or HTTP Basic auth, and to capture the Set-Cookie / token response. Use this for all
+  custom and complex API auth flows.
 
 ## Browser Authentication
 - \`browser_navigate\` — Navigate to login page
@@ -77,11 +77,11 @@ Look for:
 ## Step 2: Authenticate
 
 ### API path (use when target is an API or has a simple form):
-1. Call \`authenticate_session\` with the correct method and credentials.
-   - \`form_post\` for HTML forms
-   - \`json_post\` for JSON APIs
-   - \`basic_auth\` for HTTP Basic
-2. Check the response — if authenticated is true, you have a session cookie.
+1. Use \`execute_command\` with curl to submit the credentials, matching the target's scheme:
+   - \`curl -i -d 'username=...&password=...' <loginUrl>\` for HTML form POST
+   - \`curl -i -H 'Content-Type: application/json' -d '{"username":"...","password":"..."}' <loginUrl>\` for JSON APIs
+   - \`curl -i -u '<user>:<pass>' <url>\` for HTTP Basic
+2. Inspect the response (\`-i\` shows headers) — capture any \`Set-Cookie\` value or token to use as the session credential.
 
 ### Browser path (use for SPAs, OAuth, JS-rendered forms):
 1. \`browser_navigate\` to the login URL
@@ -113,7 +113,7 @@ If both API and browser approaches fail, use \`delegate_to_auth_subagent\` for c
 **First**, call \`complete_authentication\` with:
 - \`success\`: whether auth succeeded
 - \`summary\`: what happened and what credentials/cookies were obtained
-- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or authenticate_session response)
+- \`exportedCookies\`: the cookie string for downstream HTTP requests (from browser_get_cookies cookieHeader or the Set-Cookie header in the curl response)
 - \`exportedHeaders\`: auth headers map, e.g. {"Authorization": "Bearer <token>"} (from browser_evaluate localStorage tokens or API response)
 - \`strategy\`: method used ("browser", "form_post", "json_post", "basic_auth", "bearer")
 - \`authBarrier\`: if a barrier was encountered (captcha, mfa, etc.)
@@ -127,13 +127,21 @@ These are the ONLY way downstream agents receive the session credentials.
 
 # Error Recovery
 
-If authentication fails:
+If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
 1. Try alternative field names (email vs username, passwd vs password)
 2. Check for CSRF token requirements (look in page source or hidden form fields)
 3. Verify the endpoint URL is correct
 4. Try a different method (form_post vs json_post)
 5. If all else fails, call \`complete_authentication\` with success=false
 
+If credentials were provided to you, they are already verified and SHARED — do not modify them or their
+account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
+forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
+\`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
+or self-sign-up to get around a rejected provided credential — that is a different account than the one
+under test and only pollutes results.
+
 ## Rate Limiting
 
 If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "too many requests"):
@@ -179,6 +187,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       context,
       environmentVariables,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     const cm = session.credentialManager;
@@ -193,13 +202,14 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       abortSignal,
       eventBus,
       subagentId,
+      subagentName: opts.subagentName,
       environmentVariables,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       toolChoice: "auto",
       activeTools: [
         "execute_command",
-        "authenticate_session",
         "complete_authentication",
         "browser_navigate",
         "browser_snapshot",
@@ -294,17 +304,25 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
   if (credBlock) {
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
-1. Try authenticate_session first (pass the credentialId — secrets are resolved automatically)
-2. If authenticate_session fails, use browser tools. For browser_fill on password/secret fields,
+1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
+2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
-3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
+
+The credentials above were provided to you and have already been verified — they are SHARED across runs, so
+do not modify them or their account settings. NEVER change the password, complete a password reset /
+forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
+resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
+password change required, MFA required, email not confirmed), call complete_authentication with
+success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+register a new account or self-sign-up to work around a failed login: that is not the credential under test
+and only pollutes results — fail fast with success=false instead.`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism
-2. Attempt authentication with authenticate_session or the browser tools
-3. If that fails, try delegate_to_auth_subagent as a fallback
-4. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+2. Attempt authentication with execute_command (curl) or the browser tools
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
   }
   return parts.join(`
 `);

package/build/{cli-6gvxmjz0.js → cli-2yqc0vnm.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-kswc2h78.js";
+} from "./cli-f2bq20gj.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-29yqhrjq.js → cli-3k1x5rn3.js}

@@ -24438,4 +24438,4 @@ var require_src = __commonJS((exports) => {
   };
 });
 
-export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };
+export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, parseJSON, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };

package/build/{cli-5nz8dbg2.js → cli-3x9ygtbv.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-32666wac.js";
+} from "./cli-hzw5gtyt.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";