@pensar/apex 2.1.3-canary.f633df96 → 2.1.3-canary.fde9cfe4

package/build/{agent-5btrn4s6.js → agent-jnxzjsc4.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-kj5fvcy0.js";
+} from "./cli-de5j66pm.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-zfyyjmv6.js";
+} from "./cli-jk8wkkhn.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-wh90apdt.js";
-import"./cli-3cze5drv.js";
+} from "./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-5dyacfe8.js";
-import"./cli-beye21mw.js";
-import"./cli-vqx1ysq6.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -207,8 +207,10 @@ class FindingJudgeAgent extends OffensiveSecurityAgent {
       eventBus: opts.eventBus,
       sandbox: opts.sandbox,
       enableThinking: opts.enableThinking,
+      thinkingEffort: opts.thinkingEffort,
       openAIReasoningEffort: opts.openAIReasoningEffort,
       subagentId: opts.subagentId ?? "finding-judge",
+      subagentName: opts.subagentName ?? "Finding Judge",
       activeTools: [...FINDING_JUDGE_ACTIVE_TOOLS],
       responseSchema: FindingJudgeOutputSchema,
       stopWhen: stepCountIs(60)

package/build/agent-nyxs29jb.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-5wgfrsqt.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
+import"./cli-c8131c4q.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/agent-zsx42kpx.js

@@ -0,0 +1,27 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt
+} from "./cli-hhh6f02f.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
+import"./cli-c8131c4q.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
+import"./cli-8rxa073f.js";
+export {
+  buildPentestSystemPrompt,
+  buildPentestPrompt,
+  buildPentestActiveTools,
+  TargetedPentestAgent,
+  PentestResponseSchema
+};

package/build/{apps-qvdh8b0j.js → apps-mz3tb1z1.js}

@@ -12,26 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-7j23hw0c.js";
-import"./cli-dt7twf31.js";
-import"./cli-s6jvt5fc.js";
-import"./cli-cayjmxky.js";
-import"./cli-w1cgq7em.js";
-import"./cli-k0v71ccj.js";
-import"./cli-g3mhmh9x.js";
+} from "./cli-7xrww2qg.js";
+import"./cli-s5c6p1ys.js";
+import"./cli-ycz3005y.js";
+import"./cli-102g5mnd.js";
+import"./cli-hhh6f02f.js";
+import"./cli-9gr8h1nv.js";
+import"./cli-5wgfrsqt.js";
+import"./cli-3spypd58.js";
 import"./cli-9fsre5pt.js";
-import"./cli-nryka59e.js";
-import"./cli-kj5fvcy0.js";
-import"./cli-zfyyjmv6.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-wh90apdt.js";
-import"./cli-3cze5drv.js";
-import"./cli-29yqhrjq.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-5dyacfe8.js";
-import"./cli-beye21mw.js";
-import"./cli-vqx1ysq6.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-w49evacx.js → auth-9xfhgqx5.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-7j23hw0c.js";
-import"./cli-dt7twf31.js";
-import"./cli-s6jvt5fc.js";
-import"./cli-cayjmxky.js";
-import"./cli-w1cgq7em.js";
-import"./cli-k0v71ccj.js";
-import"./cli-g3mhmh9x.js";
+import"./cli-7xrww2qg.js";
+import"./cli-s5c6p1ys.js";
+import"./cli-ycz3005y.js";
+import"./cli-102g5mnd.js";
+import"./cli-hhh6f02f.js";
+import"./cli-9gr8h1nv.js";
+import"./cli-5wgfrsqt.js";
+import"./cli-3spypd58.js";
 import"./cli-9fsre5pt.js";
-import"./cli-nryka59e.js";
-import"./cli-kj5fvcy0.js";
-import"./cli-zfyyjmv6.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-wh90apdt.js";
+import"./cli-3r0m9ee1.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +26,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-3cze5drv.js";
-import"./cli-29yqhrjq.js";
+} from "./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-5dyacfe8.js";
-import"./cli-beye21mw.js";
-import"./cli-vqx1ysq6.js";
+} from "./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-fjzbzdhk.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-9gr8h1nv.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
+import"./cli-c8131c4q.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-42h9bp3q.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-ycz3005y.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
+import"./cli-c8131c4q.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-atm1td4f.js → blackboxPentest-93te1j1w.js}

@@ -1,23 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-dt7twf31.js";
-import"./cli-s6jvt5fc.js";
-import"./cli-cayjmxky.js";
-import"./cli-k0v71ccj.js";
-import"./cli-g3mhmh9x.js";
+} from "./cli-s5c6p1ys.js";
+import"./cli-ycz3005y.js";
+import"./cli-102g5mnd.js";
+import"./cli-hhh6f02f.js";
+import"./cli-5wgfrsqt.js";
+import"./cli-3spypd58.js";
 import"./cli-9fsre5pt.js";
-import"./cli-nryka59e.js";
-import"./cli-kj5fvcy0.js";
-import"./cli-zfyyjmv6.js";
+import"./cli-ed3v8kz3.js";
+import"./cli-de5j66pm.js";
+import"./cli-jk8wkkhn.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-wh90apdt.js";
-import"./cli-3cze5drv.js";
-import"./cli-29yqhrjq.js";
+import"./cli-3r0m9ee1.js";
+import"./cli-bhj09mhe.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-5dyacfe8.js";
-import"./cli-beye21mw.js";
-import"./cli-vqx1ysq6.js";
+import"./cli-7dez82r2.js";
+import"./cli-pd7vxk53.js";
+import"./cli-f4659etd.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/cli-102g5mnd.js

@@ -0,0 +1,195 @@
+import {
+  EvidenceFileEntrySchema
+} from "./cli-ed3v8kz3.js";
+import {
+  CweEntrySchema,
+  ValidatedCweEntrySchema,
+  hasCanonicalName
+} from "./cli-de5j66pm.js";
+import {
+  exports_external,
+  init_zod
+} from "./cli-3k1x5rn3.js";
+
+// src/core/report/schemas.ts
+init_zod();
+var PentestReportFindingSchema = exports_external.object({
+  title: exports_external.string(),
+  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: exports_external.string(),
+  impact: exports_external.string(),
+  evidence: exports_external.string(),
+  endpoint: exports_external.string(),
+  pocPath: exports_external.string(),
+  remediation: exports_external.string(),
+  references: exports_external.string().optional(),
+  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: exports_external.string().optional(),
+  relatedFindings: exports_external.array(exports_external.string()).optional(),
+  rootCauseLead: exports_external.boolean().optional(),
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+});
+var PentestReportSchema = exports_external.object({
+  version: exports_external.string().regex(/^1\.\d+$/),
+  metadata: exports_external.object({
+    target: exports_external.string(),
+    model: exports_external.string(),
+    timestamp: exports_external.string(),
+    sessionId: exports_external.string(),
+    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
+  }),
+  summary: exports_external.object({
+    totalFindings: exports_external.number(),
+    bySeverity: exports_external.object({
+      CRITICAL: exports_external.number(),
+      HIGH: exports_external.number(),
+      MEDIUM: exports_external.number(),
+      LOW: exports_external.number()
+    })
+  }),
+  findings: exports_external.array(PentestReportFindingSchema)
+});
+var REPORT_VERSION = "1.0";
+
+// src/core/report/builder.ts
+var SEVERITY_ORDER = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+function buildPentestReport(findings, context) {
+  const sorted = [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+  const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
+  for (const f of findings) {
+    bySeverity[f.severity]++;
+  }
+  return {
+    version: REPORT_VERSION,
+    metadata: {
+      target: context.target,
+      model: context.model,
+      timestamp: new Date().toISOString(),
+      sessionId: context.sessionId,
+      mode: context.mode
+    },
+    summary: {
+      totalFindings: findings.length,
+      bySeverity
+    },
+    findings: sorted.map((f) => ({
+      title: f.title,
+      severity: f.severity,
+      description: f.description,
+      impact: f.impact,
+      evidence: f.evidence,
+      endpoint: f.endpoint,
+      pocPath: f.pocPath,
+      remediation: f.remediation,
+      references: f.references,
+      cwes: f.cwes,
+      rootCauseGroup: f.rootCauseGroup,
+      relatedFindings: f.relatedFindings,
+      rootCauseLead: f.rootCauseLead,
+      evidenceFiles: f.evidenceFiles
+    }))
+  };
+}
+
+// src/core/report/renderers/json.ts
+function renderJson(report) {
+  return JSON.stringify(report, null, 2);
+}
+
+// src/core/report/renderers/markdown.ts
+function renderMarkdown(report) {
+  const { metadata, findings, summary } = report;
+  const header = [
+    `# Pentest Report — ${metadata.target}`,
+    "",
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}  `,
+    `**Model:** ${metadata.model}  `,
+    `**Mode:** ${metadata.mode}`,
+    "",
+    `**Findings:** ${summary.totalFindings}`,
+    ""
+  ];
+  if (findings.length === 0) {
+    return [
+      ...header,
+      "No findings were identified during this assessment.",
+      ""
+    ].join(`
+`);
+  }
+  const body = findings.map((finding) => renderFinding(finding, metadata)).join(`
+`);
+  return [...header, body].join(`
+`);
+}
+function renderFinding(finding, metadata) {
+  const lines = [
+    `# ${finding.title}`,
+    "",
+    `**Severity:** ${finding.severity}  `,
+    `**Target:** ${metadata.target}  `,
+    `**Endpoint:** ${finding.endpoint}  `,
+    `**Date:** ${metadata.timestamp}  `,
+    `**Session:** ${metadata.sessionId}`,
+    "",
+    "## Description",
+    "",
+    finding.description,
+    "",
+    "## Impact",
+    "",
+    finding.impact,
+    "",
+    "## Evidence",
+    "",
+    "```",
+    finding.evidence,
+    "```",
+    "",
+    ...finding.evidenceFiles?.length ? [
+      "## Evidence Files",
+      "",
+      ...finding.evidenceFiles.map((ef) => `- **[${ef.type}]** \`${ef.path}\` — ${ef.description}`),
+      ""
+    ] : [],
+    ...finding.cwes?.length ? [
+      "## CWE Classification",
+      "",
+      ...finding.cwes.map((cwe) => `- **${cwe.id}**${hasCanonicalName(cwe) ? `: ${cwe.name}` : ""} — ${cwe.reasoning}`),
+      ""
+    ] : [],
+    ...finding.rootCauseGroup ? [
+      "## Root Cause Group",
+      "",
+      `**Group:** \`${finding.rootCauseGroup}\``,
+      ...finding.relatedFindings?.length ? [
+        "",
+        "**Related Findings:**",
+        ...finding.relatedFindings.map((rf) => `- ${rf}`)
+      ] : [],
+      ""
+    ] : [],
+    "## POC",
+    "",
+    `Path: \`${finding.pocPath}\``,
+    "",
+    "## Remediation",
+    "",
+    finding.remediation,
+    ...finding.references ? ["", `## References`, "", finding.references] : [],
+    "",
+    "---",
+    "",
+    "*This finding was automatically documented by the Pensar penetration testing agent.*",
+    ""
+  ];
+  return lines.join(`
+`);
+}
+
+// src/core/report/index.ts
+var REPORT_FILENAME_MD = "pentest-report.md";
+var REPORT_FILENAME_JSON = "pentest-report.json";
+
+export { buildPentestReport, renderJson, renderMarkdown, REPORT_FILENAME_MD, REPORT_FILENAME_JSON };

package/build/{cli-29yqhrjq.js → cli-3k1x5rn3.js}

@@ -24438,4 +24438,4 @@ var require_src = __commonJS((exports) => {
   };
 });
 
-export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };
+export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, parseJSON, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };