@pensar/apex 2.1.3-canary.c29a6d5f → 2.1.3-canary.d077a8a6

package/build/{agent-fhb27d3x.js → agent-ryr70127.js}

@@ -4,19 +4,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-wpbndpqw.js";
+} from "./cli-ctf5z8k8.js";
 import"./cli-9fsre5pt.js";
-import"./cli-zh3h7edf.js";
-import"./cli-h755vy5d.js";
-import"./cli-7xa87xp5.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
 import"./cli-c8131c4q.js";
-import"./cli-z28e95kb.js";
-import"./cli-83e04t4w.js";
-import"./cli-29yqhrjq.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-npjwa2p2.js";
-import"./cli-n2fydqe6.js";
-import"./cli-fsh5xtwc.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/{agent-vv9emy13.js → agent-zavj8ggy.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-h755vy5d.js";
+} from "./cli-cdph6mnt.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7xa87xp5.js";
+} from "./cli-mtmaq8hk.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z28e95kb.js";
-import"./cli-83e04t4w.js";
+} from "./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-npjwa2p2.js";
-import"./cli-n2fydqe6.js";
-import"./cli-fsh5xtwc.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -207,8 +207,10 @@ class FindingJudgeAgent extends OffensiveSecurityAgent {
       eventBus: opts.eventBus,
       sandbox: opts.sandbox,
       enableThinking: opts.enableThinking,
+      thinkingEffort: opts.thinkingEffort,
       openAIReasoningEffort: opts.openAIReasoningEffort,
       subagentId: opts.subagentId ?? "finding-judge",
+      subagentName: opts.subagentName ?? "Finding Judge",
       activeTools: [...FINDING_JUDGE_ACTIVE_TOOLS],
       responseSchema: FindingJudgeOutputSchema,
       stopWhen: stepCountIs(60)

package/build/agent-zkrbrex4.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-6x5hw0v4.js";
+import"./cli-9fsre5pt.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
+import"./cli-c8131c4q.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{apps-47gnmvak.js → apps-qw9xv347.js}

@@ -12,26 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-cpq1jcs6.js";
-import"./cli-r6d1wjez.js";
-import"./cli-9r82zqyt.js";
-import"./cli-wpbndpqw.js";
-import"./cli-5fy5jnkg.js";
-import"./cli-zakpws88.js";
-import"./cli-wes0px10.js";
+} from "./cli-9j698fts.js";
+import"./cli-x62pyzh3.js";
+import"./cli-tb324t2j.js";
+import"./cli-cqagtj33.js";
+import"./cli-ctf5z8k8.js";
+import"./cli-2xyfk078.js";
+import"./cli-6x5hw0v4.js";
+import"./cli-vwgq4wrv.js";
 import"./cli-9fsre5pt.js";
-import"./cli-zh3h7edf.js";
-import"./cli-h755vy5d.js";
-import"./cli-7xa87xp5.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z28e95kb.js";
-import"./cli-83e04t4w.js";
-import"./cli-29yqhrjq.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-npjwa2p2.js";
-import"./cli-n2fydqe6.js";
-import"./cli-fsh5xtwc.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-1thx2zdn.js → auth-spfb1pg8.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-cpq1jcs6.js";
-import"./cli-r6d1wjez.js";
-import"./cli-9r82zqyt.js";
-import"./cli-wpbndpqw.js";
-import"./cli-5fy5jnkg.js";
-import"./cli-zakpws88.js";
-import"./cli-wes0px10.js";
+import"./cli-9j698fts.js";
+import"./cli-x62pyzh3.js";
+import"./cli-tb324t2j.js";
+import"./cli-cqagtj33.js";
+import"./cli-ctf5z8k8.js";
+import"./cli-2xyfk078.js";
+import"./cli-6x5hw0v4.js";
+import"./cli-vwgq4wrv.js";
 import"./cli-9fsre5pt.js";
-import"./cli-zh3h7edf.js";
-import"./cli-h755vy5d.js";
-import"./cli-7xa87xp5.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z28e95kb.js";
+import"./cli-z95mzxhp.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +26,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-83e04t4w.js";
-import"./cli-29yqhrjq.js";
+} from "./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-npjwa2p2.js";
-import"./cli-n2fydqe6.js";
-import"./cli-fsh5xtwc.js";
+} from "./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-948n9tyb.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-2xyfk078.js";
+import"./cli-9fsre5pt.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
+import"./cli-c8131c4q.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-t85ghnh8.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-tb324t2j.js";
+import"./cli-9fsre5pt.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
+import"./cli-c8131c4q.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-5n68qgwj.js → blackboxPentest-qzzsbw0g.js}

@@ -1,23 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-r6d1wjez.js";
-import"./cli-9r82zqyt.js";
-import"./cli-wpbndpqw.js";
-import"./cli-zakpws88.js";
-import"./cli-wes0px10.js";
+} from "./cli-x62pyzh3.js";
+import"./cli-tb324t2j.js";
+import"./cli-cqagtj33.js";
+import"./cli-ctf5z8k8.js";
+import"./cli-6x5hw0v4.js";
+import"./cli-vwgq4wrv.js";
 import"./cli-9fsre5pt.js";
-import"./cli-zh3h7edf.js";
-import"./cli-h755vy5d.js";
-import"./cli-7xa87xp5.js";
+import"./cli-scxzsytj.js";
+import"./cli-cdph6mnt.js";
+import"./cli-mtmaq8hk.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-z28e95kb.js";
-import"./cli-83e04t4w.js";
-import"./cli-29yqhrjq.js";
+import"./cli-z95mzxhp.js";
+import"./cli-903jmfa0.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-npjwa2p2.js";
-import"./cli-n2fydqe6.js";
-import"./cli-fsh5xtwc.js";
+import"./cli-4xj35yt0.js";
+import"./cli-wzdaq5z5.js";
+import"./cli-qmv6krh4.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-5fy5jnkg.js → cli-2xyfk078.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-h755vy5d.js";
+} from "./cli-cdph6mnt.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7xa87xp5.js";
+} from "./cli-mtmaq8hk.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-z28e95kb.js";
+} from "./cli-z95mzxhp.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -127,13 +127,21 @@ These are the ONLY way downstream agents receive the session credentials.
 
 # Error Recovery
 
-If authentication fails:
+If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
 1. Try alternative field names (email vs username, passwd vs password)
 2. Check for CSRF token requirements (look in page source or hidden form fields)
 3. Verify the endpoint URL is correct
 4. Try a different method (form_post vs json_post)
 5. If all else fails, call \`complete_authentication\` with success=false
 
+If credentials were provided to you, they are already verified and SHARED — do not modify them or their
+account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
+forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
+\`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
+or self-sign-up to get around a rejected provided credential — that is a different account than the one
+under test and only pollutes results.
+
 ## Rate Limiting
 
 If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "too many requests"):
@@ -178,7 +186,9 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       subagentId,
       context,
       environmentVariables,
+      secretValues,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     const cm = session.credentialManager;
@@ -193,8 +203,11 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
       abortSignal,
       eventBus,
       subagentId,
+      subagentName: opts.subagentName,
       environmentVariables,
+      secretValues,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       toolChoice: "auto",
       activeTools: [
@@ -297,7 +310,16 @@ You have credentials available via credential IDs — authenticate immediately.
 2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
-3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
+3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
+
+The credentials above were provided to you and have already been verified — they are SHARED across runs, so
+do not modify them or their account settings. NEVER change the password, complete a password reset /
+forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
+resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
+password change required, MFA required, email not confirmed), call complete_authentication with
+success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+register a new account or self-sign-up to work around a failed login: that is not the credential under test
+and only pollutes results — fail fast with success=false instead.`);
   } else {
     parts.push(`INSTRUCTIONS:
 1. Probe the target with execute_command (curl) to determine the auth mechanism

package/build/{cli-29yqhrjq.js → cli-3k1x5rn3.js}

@@ -24438,4 +24438,4 @@ var require_src = __commonJS((exports) => {
   };
 });
 
-export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };
+export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, parseJSON, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };

package/build/{cli-npjwa2p2.js → cli-4xj35yt0.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-n2fydqe6.js";
+} from "./cli-wzdaq5z5.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-zakpws88.js → cli-6x5hw0v4.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-h755vy5d.js";
+} from "./cli-cdph6mnt.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-z28e95kb.js";
+} from "./cli-z95mzxhp.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();
@@ -79,6 +79,7 @@ class CodeAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       excludeTools,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel
     } = opts;
@@ -122,8 +123,10 @@ class CodeAgent extends OffensiveSecurityAgent {
       abortSignal,
       eventBus,
       subagentId,
+      subagentName: opts.subagentName,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       projectThreatModel,
       stopWhen: stopWhen ?? stepCountIs(1e4),

package/build/{cli-83e04t4w.js → cli-903jmfa0.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-npjwa2p2.js";
+} from "./cli-4xj35yt0.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-cpq1jcs6.js → cli-9j698fts.js}

@@ -4,27 +4,27 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-h755vy5d.js";
+} from "./cli-cdph6mnt.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-z28e95kb.js";
+} from "./cli-z95mzxhp.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-83e04t4w.js";
+} from "./cli-903jmfa0.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import {
   config,
   init_config
-} from "./cli-npjwa2p2.js";
+} from "./cli-4xj35yt0.js";
 import {
   __commonJS,
   __require
@@ -7132,6 +7132,9 @@ async function getIssue(issueId) {
 async function updateIssue(issueId, data) {
   return apiRequest("PATCH", `/issues/${issueId}`, data);
 }
+async function retestIssue(issueId) {
+  return apiRequest("POST", `/issues/${issueId}/retest`);
+}
 async function listFixes(issueId) {
   return apiRequest("GET", `/issues/${issueId}/fixes`);
 }
@@ -8304,4 +8307,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };