@pensar/apex 2.1.3-canary.a2e99e97 → 2.1.3-canary.a5cb8acd

package/build/{agent-4vm9m2ft.js → agent-54x487zg.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-gpvaz7xr.js";
+} from "./cli-ww1t5xec.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-jx3sh6sh.js";
+} from "./cli-2f4jnxqt.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-86hen4re.js";
-import"./cli-3x9ygtbv.js";
+} from "./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-hzw5gtyt.js";
-import"./cli-2yqc0vnm.js";
-import"./cli-f2bq20gj.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/{agent-tk933cmw.js → agent-reg9f778.js}

@@ -4,19 +4,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-84kpy9q6.js";
+} from "./cli-3v951d59.js";
 import"./cli-9fsre5pt.js";
-import"./cli-tdgq36q1.js";
-import"./cli-gpvaz7xr.js";
-import"./cli-jx3sh6sh.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
 import"./cli-c8131c4q.js";
-import"./cli-86hen4re.js";
-import"./cli-3x9ygtbv.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-hzw5gtyt.js";
-import"./cli-2yqc0vnm.js";
-import"./cli-f2bq20gj.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/agent-xa8apgss.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-qbz3dfr8.js";
+import"./cli-9fsre5pt.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
+import"./cli-c8131c4q.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-4ydk4b5z.js → apps-4y0a12m7.js}

@@ -12,27 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-8fx3r1dj.js";
-import"./cli-r0rzk777.js";
-import"./cli-z43s0k01.js";
-import"./cli-pmf3g5b8.js";
-import"./cli-84kpy9q6.js";
-import"./cli-192yezw4.js";
-import"./cli-b0jq621d.js";
-import"./cli-rsv7cf68.js";
+} from "./cli-jyehjpkn.js";
+import"./cli-g3t5c539.js";
+import"./cli-je9z9d62.js";
+import"./cli-e4qd6ak2.js";
+import"./cli-3v951d59.js";
+import"./cli-6vc9rqa0.js";
+import"./cli-qbz3dfr8.js";
+import"./cli-zrrvpkb7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-tdgq36q1.js";
-import"./cli-gpvaz7xr.js";
-import"./cli-jx3sh6sh.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-86hen4re.js";
-import"./cli-3x9ygtbv.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-hzw5gtyt.js";
-import"./cli-2yqc0vnm.js";
-import"./cli-f2bq20gj.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-9wbcvarq.js → auth-zsxfecae.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-8fx3r1dj.js";
-import"./cli-r0rzk777.js";
-import"./cli-z43s0k01.js";
-import"./cli-pmf3g5b8.js";
-import"./cli-84kpy9q6.js";
-import"./cli-192yezw4.js";
-import"./cli-b0jq621d.js";
-import"./cli-rsv7cf68.js";
+import"./cli-jyehjpkn.js";
+import"./cli-g3t5c539.js";
+import"./cli-je9z9d62.js";
+import"./cli-e4qd6ak2.js";
+import"./cli-3v951d59.js";
+import"./cli-6vc9rqa0.js";
+import"./cli-qbz3dfr8.js";
+import"./cli-zrrvpkb7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-tdgq36q1.js";
-import"./cli-gpvaz7xr.js";
-import"./cli-jx3sh6sh.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-86hen4re.js";
+import"./cli-5mqrms9z.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -26,15 +26,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-3x9ygtbv.js";
+} from "./cli-4vej2x2z.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-hzw5gtyt.js";
-import"./cli-2yqc0vnm.js";
-import"./cli-f2bq20gj.js";
+} from "./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-36ac0897.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-6vc9rqa0.js";
+import"./cli-9fsre5pt.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
+import"./cli-c8131c4q.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-drdxaq73.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-je9z9d62.js";
+import"./cli-9fsre5pt.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
+import"./cli-c8131c4q.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-52ed5674.js → blackboxPentest-an279yvd.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-r0rzk777.js";
-import"./cli-z43s0k01.js";
-import"./cli-pmf3g5b8.js";
-import"./cli-84kpy9q6.js";
-import"./cli-b0jq621d.js";
-import"./cli-rsv7cf68.js";
+} from "./cli-g3t5c539.js";
+import"./cli-je9z9d62.js";
+import"./cli-e4qd6ak2.js";
+import"./cli-3v951d59.js";
+import"./cli-qbz3dfr8.js";
+import"./cli-zrrvpkb7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-tdgq36q1.js";
-import"./cli-gpvaz7xr.js";
-import"./cli-jx3sh6sh.js";
+import"./cli-r58r36mr.js";
+import"./cli-ww1t5xec.js";
+import"./cli-2f4jnxqt.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-86hen4re.js";
-import"./cli-3x9ygtbv.js";
+import"./cli-5mqrms9z.js";
+import"./cli-4vej2x2z.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-hzw5gtyt.js";
-import"./cli-2yqc0vnm.js";
-import"./cli-f2bq20gj.js";
+import"./cli-eaxc6gjs.js";
+import"./cli-2zvg99t3.js";
+import"./cli-b857c2t8.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-jx3sh6sh.js → cli-2f4jnxqt.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-86hen4re.js";
+} from "./cli-5mqrms9z.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-2yqc0vnm.js → cli-2zvg99t3.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-f2bq20gj.js";
+} from "./cli-b857c2t8.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-84kpy9q6.js → cli-3v951d59.js}

@@ -5,7 +5,7 @@ import {
   createReportErrorTool,
   isMemoryEnabled,
   readPlan
-} from "./cli-gpvaz7xr.js";
+} from "./cli-ww1t5xec.js";
 import {
   createLogger,
   hasToolCall,
@@ -13,7 +13,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-86hen4re.js";
+} from "./cli-5mqrms9z.js";
 import {
   exports_external,
   init_zod
@@ -46,6 +46,7 @@ class TargetedPentestAgent extends OffensiveSecurityAgent {
     const {
       model,
       target,
+      grpc,
       objectives,
       session,
       authConfig,
@@ -69,10 +70,11 @@ class TargetedPentestAgent extends OffensiveSecurityAgent {
     let reportedError = null;
     super({
       system: buildPentestSystemPrompt(session, role),
-      prompt: buildPentestPrompt(target, objectives, session, findingsRegistry, context, environmentVariables ? Object.keys(environmentVariables) : undefined, subagentId, role, session.credentialManager?.formatForPrompt()),
+      prompt: buildPentestPrompt(target, objectives, session, findingsRegistry, context, environmentVariables ? Object.keys(environmentVariables) : undefined, subagentId, role, session.credentialManager?.formatForPrompt(), grpc),
       model,
       session,
       target,
+      grpc,
       authConfig,
       onStepFinish,
       onCacheMetrics,
@@ -489,7 +491,7 @@ ${SECTION_MATERIALITY_GUIDANCE}
 ${SECTION_BROWSER_INTERACTION}
 
 ${SECTION_STATE_CHECKPOINTING}`;
-function buildPentestPrompt(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext) {
+function buildPentestPrompt(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext, grpc) {
   const sessionRootPath = session.rootPath;
   const exfilMode = session.config?.exfilMode ?? false;
   const taskDriven = role === "orchestrator" ? false : session.config?.taskDriven ?? false;
@@ -656,6 +658,37 @@ The following is context specific to the application under test. If it contains
 
 ${context}
 ` : "";
+  let grpcSection = "";
+  if (grpc) {
+    const lines = [
+      `
+## gRPC Target`,
+      `This target is a gRPC method, not a plain HTTP endpoint. It rides HTTP/2 with binary protobuf and uses the path \`/package.Service/Method\`.`,
+      `- **Transport:** ${grpc.transport}`,
+      `- **Service:** ${grpc.serviceFqn}`,
+      `- **Method:** ${grpc.method}`
+    ];
+    if (grpc.host)
+      lines.push(`- **Authority (host):** \`${grpc.host}\` — the method's gRPC authority; it differs from the app domain, so use this host directly as \`<authority>\` in the commands below.`);
+    if (grpc.streamingType)
+      lines.push(`- **Streaming:** ${grpc.streamingType}`);
+    if (grpc.schemaSource)
+      lines.push(`- **Schema source:** ${grpc.schemaSource}`);
+    if (grpc.reflectionAvailable !== undefined) {
+      lines.push(`- **Reflection available:** ${grpc.reflectionAvailable}`);
+    }
+    if (grpc.frontingGatewayOperation) {
+      lines.push(`- **Fronting gateway:** ${grpc.frontingGatewayOperation.gatewayType} operation \`${grpc.frontingGatewayOperation.operation}\` — if the direct gRPC authority is unreachable, test through this gateway operation instead.`);
+    } else {
+      lines.push(`- **Fronting gateway:** none — this method is reachable directly but is NOT exposed through the REST/GraphQL gateway. Treat it as a PRIME missing-authorization target: gateway-fronted methods usually get their authz enforced at the gateway, so a shadow method that bypasses the gateway may bypass that authz entirely.`);
+    }
+    lines.push(`
+### gRPC Test Battery (OWASP gRPC Security Cheat Sheet)`, `Use \`grpcurl\`, \`buf\`, and \`protoc\` via \`execute_command\`. Work through this battery for the method above:`, `1. **Schema recovery.** Try reflection first: \`grpcurl -plaintext <authority> list\` / \`describe <service>\`. If reflection is disabled, recover the schema from a \`.proto\` file or protoset (e.g. via \`buf\` or \`protoc\`) before giving up on schema-dependent tests.`, `2. **Transport/content-type fallback.** Native gRPC, grpc-web, and Connect use different content-types over the same or adjacent paths. If one transport looks dead, retry as grpc-web (\`application/grpc-web\`) and Connect (\`application/connect+...\` or JSON) before declaring the endpoint unreachable.`, `3. **Status-code oracle.** Treat gRPC status codes as signal, not noise: 16 UNAUTHENTICATED, 7 PERMISSION_DENIED, 3 INVALID_ARGUMENT, 12 UNIMPLEMENTED. A flip from UNAUTHENTICATED to a data response after adding/removing metadata is a finding.`, `4. **Missing auth per method.** Call the method with valid credentials/metadata, then again with none and with garbage metadata. A successful response without auth is a critical finding.`, `5. **BOLA / IDOR.** Manipulate ID fields inside the request message (account/user/resource IDs) to access another principal's data.`, `6. **Metadata trust.** Test whether the service trusts client-supplied metadata it shouldn't (e.g. \`x-user-id\`, forwarded auth headers) instead of deriving identity server-side.`, `7. **Non-canonical \`:path\` authz bypass.** If authz is enforced by a proxy matching on \`:path\`, try case variants, trailing slashes, or alternate casing of the service/method path to see if the gRPC path parsing bypasses it.`, `8. **Protobuf/message fuzzing.** Send malformed, truncated, and type-mismatched field values; unknown field numbers; and deeply nested/repeated fields to probe deserialization handling.`, `9. **Streaming IDOR.** For client/server/bidi streaming methods, probe whether a stream opened for one principal's resource can be redirected mid-stream to another's.`, `10. **Decompression / size DoS.** Send oversized or highly compressible payloads to check for missing message-size limits or decompression bombs.`, `11. **Transport security.** Confirm whether the channel is plaintext or TLS/mTLS-enforced; plaintext gRPC in production is a finding on its own.`, `
+If the method is unreachable from your network position (common for internal/in-cluster services), a finding is still valid via whitebox reasoning — schema plus routing/config evidence — even without an executed POC.`);
+    grpcSection = `${lines.join(`
+`)}
+`;
+  }
   const envVarSection = envVarNames && envVarNames.length > 0 ? `
 ## Environment Variables
 The following environment variables are pre-loaded in your shell and available in every \`execute_command\` call. Use them in scripts or commands (e.g. \`$${envVarNames[0]}\`) — do NOT hardcode their values.
@@ -666,7 +699,7 @@ ${envVarNames.map((n) => `- \`${n}\``).join(`
 
 ## Target
 - **URL:** ${target}
-${authSection}${credentialSection}
+${grpcSection}${authSection}${credentialSection}
 ${knownFindingsSection}
 ${knowledgeBaseSection}
 ${planSection}${contextSection}${envVarSection}

package/build/{cli-3x9ygtbv.js → cli-4vej2x2z.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-hzw5gtyt.js";
+} from "./cli-eaxc6gjs.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-86hen4re.js → cli-5mqrms9z.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-3x9ygtbv.js";
+} from "./cli-4vej2x2z.js";
 import {
   AISDKError,
   APICallError,
@@ -87,11 +87,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-hzw5gtyt.js";
+} from "./cli-eaxc6gjs.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-f2bq20gj.js";
+} from "./cli-b857c2t8.js";
 import {
   __callDispose,
   __commonJS,
@@ -8583,6 +8583,24 @@ var init_mantle2 = __esm(() => {
 var OPENAI_MODELS;
 var init_openai = __esm(() => {
   OPENAI_MODELS = [
+    {
+      id: "gpt-5.6-sol",
+      name: "GPT-5.6-sol",
+      provider: "openai",
+      contextLength: 1050000
+    },
+    {
+      id: "gpt-5.6-terra",
+      name: "GPT-5.6-terra",
+      provider: "openai",
+      contextLength: 1050000
+    },
+    {
+      id: "gpt-5.6-luna",
+      name: "GPT-5.6-luna",
+      provider: "openai",
+      contextLength: 1050000
+    },
     {
       id: "gpt-5.5",
       name: "GPT-5.5",
@@ -45853,6 +45871,9 @@ function modelSupportsOpenAIReasoning(modelId) {
 function getOpenAIReasoningEfforts(modelId) {
   if (!modelSupportsOpenAIReasoning(modelId))
     return [];
+  if (/^gpt-5\.6(?:\b|-)/.test(modelId)) {
+    return ["low", "medium", "high", "xhigh", "max", "ultra"];
+  }
   if (/^gpt-5\.5(?:\b|-)/.test(modelId)) {
     return ["none", "low", "medium", "high", "xhigh"];
   }
@@ -45862,8 +45883,9 @@ function normalizeOpenAIReasoningEffort(modelId, effort) {
   const efforts = getOpenAIReasoningEfforts(modelId);
   if (efforts.length === 0)
     return;
-  if (effort && efforts.includes(effort))
-    return effort;
+  if (effort && efforts.includes(effort)) {
+    return effort === "ultra" ? "max" : effort;
+  }
   return DEFAULT_OPENAI_REASONING_EFFORT;
 }
 function buildReasoningProviderOptions(model, opts) {
@@ -46243,7 +46265,10 @@ var init_ai = __esm(() => {
     "gpt-5.4-pro",
     "gpt-5.4-pro-2026-03-05",
     "gpt-5.5",
-    "gpt-5.5-2026-04-23"
+    "gpt-5.5-2026-04-23",
+    "gpt-5.6-sol",
+    "gpt-5.6-terra",
+    "gpt-5.6-luna"
   ]);
   stepContextStore = new AsyncLocalStorage;
   SEQUENTIAL_TOOL_CALL_INSTRUCTION = "CRITICAL TOOL-CALLING RULE: Emit EXACTLY ONE tool call per response. " + "Never emit more than one tool call in a single turn. After each tool call, " + "wait for its result before making the next one. Emitting multiple tool " + "calls in one turn corrupts their arguments.";
@@ -47096,7 +47121,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-1trvqqeg.js");
+    const { config: appConfig } = await import("./index-rztngs07.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }

package/build/{cli-192yezw4.js → cli-6vc9rqa0.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-gpvaz7xr.js";
+} from "./cli-ww1t5xec.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-jx3sh6sh.js";
+} from "./cli-2f4jnxqt.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-86hen4re.js";
+} from "./cli-5mqrms9z.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();

package/build/{cli-f2bq20gj.js → cli-b857c2t8.js}

@@ -25,7 +25,7 @@ var init_package = __esm(() => {
       "@opentelemetry/api": "^1.9.1",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
-      "@pensar/surface": "0.2.2",
+      "@pensar/surface": "0.3.0",
       "@playwright/mcp": "^0.0.54",
       ai: "^6.0.208",
       "camoufox-js": "^0.11.1",
@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.1.3-canary.a2e99e97"
+    version: "2.1.3-canary.a5cb8acd"
   };
 });
 

package/build/{cli-pmf3g5b8.js → cli-e4qd6ak2.js}

@@ -1,11 +1,11 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-tdgq36q1.js";
+} from "./cli-r58r36mr.js";
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-gpvaz7xr.js";
+} from "./cli-ww1t5xec.js";
 import {
   exports_external,
   init_zod

package/build/{cli-hzw5gtyt.js → cli-eaxc6gjs.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-2yqc0vnm.js";
+} from "./cli-2zvg99t3.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";