@pensar/apex 2.1.3-canary.fff17bfd → 2.2.0-canary.d6258ef8

package/build/agent-0nxcqdjn.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-cs6sg81e.js";
+import"./cli-9fsre5pt.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
+import"./cli-c8131c4q.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/agent-frsp4e9f.js

@@ -0,0 +1,27 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt
+} from "./cli-zw2vjs4v.js";
+import"./cli-9fsre5pt.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
+import"./cli-c8131c4q.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
+import"./cli-8rxa073f.js";
+export {
+  buildPentestSystemPrompt,
+  buildPentestPrompt,
+  buildPentestActiveTools,
+  TargetedPentestAgent,
+  PentestResponseSchema
+};

package/build/{agent-c06jb5zv.js → agent-qp259717.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-akhax3yn.js";
+} from "./cli-8dgnq80w.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-g6cjpbr9.js";
+} from "./cli-w8evvv3q.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-v34r5t8t.js";
-import"./cli-k941a7ft.js";
+} from "./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-qb3eddc7.js";
-import"./cli-8qb62k90.js";
-import"./cli-f8tgnegf.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -207,8 +207,10 @@ class FindingJudgeAgent extends OffensiveSecurityAgent {
       eventBus: opts.eventBus,
       sandbox: opts.sandbox,
       enableThinking: opts.enableThinking,
+      thinkingEffort: opts.thinkingEffort,
       openAIReasoningEffort: opts.openAIReasoningEffort,
       subagentId: opts.subagentId ?? "finding-judge",
+      subagentName: opts.subagentName ?? "Finding Judge",
       activeTools: [...FINDING_JUDGE_ACTIVE_TOOLS],
       responseSchema: FindingJudgeOutputSchema,
       stopWhen: stepCountIs(60)

package/build/{apps-mxhfapvz.js → apps-qxqkv051.js}

@@ -12,26 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-90dw3gm4.js";
-import"./cli-nth9zebw.js";
-import"./cli-tg7mcs43.js";
-import"./cli-9wd7jy2s.js";
-import"./cli-wkpsqyjc.js";
-import"./cli-fj04wady.js";
-import"./cli-a1acedxf.js";
+} from "./cli-6tvsa4qw.js";
+import"./cli-h3128sv8.js";
+import"./cli-tvv03x9s.js";
+import"./cli-e4vp401h.js";
+import"./cli-zw2vjs4v.js";
+import"./cli-j1p3f9rw.js";
+import"./cli-cs6sg81e.js";
+import"./cli-2g238meq.js";
 import"./cli-9fsre5pt.js";
-import"./cli-9h847y2w.js";
-import"./cli-akhax3yn.js";
-import"./cli-g6cjpbr9.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-v34r5t8t.js";
-import"./cli-k941a7ft.js";
-import"./cli-29yqhrjq.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-qb3eddc7.js";
-import"./cli-8qb62k90.js";
-import"./cli-f8tgnegf.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-9ysskv2q.js → auth-t59cz517.js}

@@ -1,18 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-90dw3gm4.js";
-import"./cli-nth9zebw.js";
-import"./cli-tg7mcs43.js";
-import"./cli-9wd7jy2s.js";
-import"./cli-wkpsqyjc.js";
-import"./cli-fj04wady.js";
-import"./cli-a1acedxf.js";
+import"./cli-6tvsa4qw.js";
+import"./cli-h3128sv8.js";
+import"./cli-tvv03x9s.js";
+import"./cli-e4vp401h.js";
+import"./cli-zw2vjs4v.js";
+import"./cli-j1p3f9rw.js";
+import"./cli-cs6sg81e.js";
+import"./cli-2g238meq.js";
 import"./cli-9fsre5pt.js";
-import"./cli-9h847y2w.js";
-import"./cli-akhax3yn.js";
-import"./cli-g6cjpbr9.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-v34r5t8t.js";
+import"./cli-h6czbkax.js";
 import {
   disconnect,
   fetchWorkspaces,
@@ -25,15 +26,15 @@ import {
   pollWorkOSToken,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-k941a7ft.js";
-import"./cli-29yqhrjq.js";
+} from "./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-qb3eddc7.js";
-import"./cli-8qb62k90.js";
-import"./cli-f8tgnegf.js";
+} from "./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-gtsjh6ch.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-j1p3f9rw.js";
+import"./cli-9fsre5pt.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
+import"./cli-c8131c4q.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-f6grtczx.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-tvv03x9s.js";
+import"./cli-9fsre5pt.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
+import"./cli-c8131c4q.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-pfs3d1nx.js → blackboxPentest-tfw4qs8h.js}

@@ -1,23 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-nth9zebw.js";
-import"./cli-tg7mcs43.js";
-import"./cli-9wd7jy2s.js";
-import"./cli-fj04wady.js";
-import"./cli-a1acedxf.js";
+} from "./cli-h3128sv8.js";
+import"./cli-tvv03x9s.js";
+import"./cli-e4vp401h.js";
+import"./cli-zw2vjs4v.js";
+import"./cli-cs6sg81e.js";
+import"./cli-2g238meq.js";
 import"./cli-9fsre5pt.js";
-import"./cli-9h847y2w.js";
-import"./cli-akhax3yn.js";
-import"./cli-g6cjpbr9.js";
+import"./cli-gr20jztt.js";
+import"./cli-8dgnq80w.js";
+import"./cli-w8evvv3q.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-v34r5t8t.js";
-import"./cli-k941a7ft.js";
-import"./cli-29yqhrjq.js";
+import"./cli-h6czbkax.js";
+import"./cli-z7h336ft.js";
+import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-qb3eddc7.js";
-import"./cli-8qb62k90.js";
-import"./cli-f8tgnegf.js";
+import"./cli-d5w0q9np.js";
+import"./cli-g200wfvt.js";
+import"./cli-q5f1hbhm.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-2cvp6x4p.js → cli-1pvfb9z0.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-v34r5t8t.js";
+} from "./cli-h6czbkax.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-a1acedxf.js → cli-2g238meq.js}

@@ -1,15 +1,17 @@
 import {
+  EndpointTransportEnum,
+  GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-akhax3yn.js";
+} from "./cli-8dgnq80w.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-v34r5t8t.js";
+} from "./cli-h6czbkax.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();
@@ -209,6 +211,7 @@ Your primary search tool. Use it to find route definitions, middleware, controll
 - **Always set \`routePath\`** to the HTTP route (e.g., \`/api/users\`). This is the URL path a client requests — NOT a source-file path.
 - **Always set \`file\`** to the source-code file (e.g., \`src/routes/users.ts\`). This is NOT the HTTP route.
 - **Always set \`handler\`** to the function name, and \`authRequired\` to indicate auth requirements.
+- **gRPC methods:** when an endpoint is a gRPC RPC rather than a plain HTTP route, set \`routePath\` to the wire path \`/package.Service/Method\`, set \`transport\` to \`"grpc"\` (or \`"grpc_web"\`/\`"connect"\`), and populate the \`grpc\` object (\`serviceFqn\`, \`method\`, \`streamingType\`). Carry these same \`transport\`/\`grpc\` fields into the matching endpoint entry in \`submit_results\` — without them the swarm tests the wire path as HTTP instead of running the gRPC methodology.
 
 Call these tools throughout your analysis as you discover apps and endpoints — don't wait until the end.
 
@@ -251,8 +254,9 @@ For each app you identified, spawn a coding agent with a detailed objective. The
    - Source-code file in \`file\` (e.g., \`src/routes/users.ts\`) — this is NOT the route
    - Line number in \`line\`
    - Auth requirement in \`authRequired\`
+   - For gRPC RPCs: \`transport\` (\`"grpc"\`/\`"grpc_web"\`/\`"connect"\`) and a \`grpc\` object (\`serviceFqn\`, \`method\`, \`streamingType\`), with \`routePath\` set to the wire path \`/package.Service/Method\`
 
-**IMPORTANT:** Tell each coding agent to set \`appName\` on every \`document_endpoint\` call so endpoints are organized by application.
+**IMPORTANT:** Tell each coding agent to set \`appName\` on every \`document_endpoint\` call so endpoints are organized by application. Preserve any \`transport\`/\`grpc\` fields the coding agents report on gRPC endpoints when you assemble the final \`submit_results\` payload — dropping them makes the swarm test gRPC wire paths as HTTP.
 
 ## Phase 3: COVERAGE DOUBLE-CHECK (do this yourself — DO NOT SKIP)
 
@@ -328,7 +332,9 @@ var EndpointSchema = exports_external.object({
   description: exports_external.string().optional().describe("Brief description of what this endpoint does"),
   pentestObjectives: exports_external.array(exports_external.string()).default([]).describe("Pentest objectives for this endpoint, derived from the threat model when available " + "(e.g. 'Test for IDOR by enumerating user IDs', 'Test for SQL injection in search parameter')"),
   riskScore: RiskScoreSchema.optional().describe("AI-calculated risk score for prioritizing pentest efforts"),
-  threatModel: exports_external.string().optional().describe("Endpoint-specific threat model describing attack vectors, data sensitivity, and testing priorities")
+  threatModel: exports_external.string().optional().describe("Endpoint-specific threat model describing attack vectors, data sensitivity, and testing priorities"),
+  transport: EndpointTransportEnum.optional().describe("Wire transport; 'grpc'/'grpc_web'/'connect' for gRPC methods, else http"),
+  grpc: GrpcEndpointMetadataSchema.optional().describe("gRPC service/method/streaming metadata when transport is a gRPC variant")
 });
 var AppSchema = exports_external.object({
   name: exports_external.string().describe("Application or service name"),
@@ -400,6 +406,7 @@ class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
       attackSurfaceRegistry,
       domains,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort
     } = opts;
     let capturedResult = null;
@@ -424,8 +431,10 @@ This ends the agent run — make sure all data is included.`,
       abortSignal,
       eventBus,
       subagentId,
+      subagentName: opts.subagentName,
       attackSurfaceRegistry,
       enableThinking,
+      thinkingEffort,
       openAIReasoningEffort,
       activeTools: [
         "read_file",
@@ -488,7 +497,7 @@ Analyze this codebase and produce a complete attack surface map:
 1. Identify the repo type and package manager
 2. Discover all apps/services
 3. Discover cloud resources and external infrastructure referenced in the code (S3 buckets, cloud storage, CDN origins, etc.) — document these as apps with the appropriate type
-4. For each app, find all web pages and API endpoints
+4. For each app, find all web pages and API endpoints (including gRPC methods — set \`transport\` and \`grpc\` on those endpoints so downstream testing uses the gRPC methodology instead of treating the wire path as HTTP)
 5. For each endpoint, generate pentest objectives
 6. **Before submitting**, perform the Phase 3 coverage double-check from the system prompt — re-scan workspace roots, framework configs, Dockerfiles, IaC, and CI/deploy configs for apps you may have missed on the first pass, and document any that were missed.
 

package/build/{cli-29yqhrjq.js → cli-3k1x5rn3.js}

@@ -24438,4 +24438,4 @@ var require_src = __commonJS((exports) => {
   };
 });
 
-export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };
+export { AISDKError, APICallError, EmptyResponseBodyError, getErrorMessage, InvalidArgumentError, InvalidPromptError, InvalidResponseDataError, JSONParseError, LoadAPIKeyError, LoadSettingError, NoContentGeneratedError, NoSuchModelError, TooManyEmbeddingValuesForCallError, TypeValidationError, UnsupportedFunctionalityError, isJSONArray, isJSONObject, init_dist, safeParse, toJSONSchema, init_core2 as init_core, exports_iso, safeParseAsync2 as safeParseAsync, string2 as string, number2 as number, boolean2 as boolean, _null3 as _null, unknown, array, object, looseObject, union, discriminatedUnion, intersection, record, _enum2 as _enum, literal, optional, custom, preprocess, exports_external, init_v4, ZodFirstPartyTypeKind2 as ZodFirstPartyTypeKind, init_v3, EventSourceParserStream, init_stream, combineHeaders, createToolNameMapping, delay, DelayedPromise, extractResponseHeaders, convertBase64ToUint8Array, convertUint8ArrayToBase64, convertToBase64, convertToFormData, cancelResponseBody, DownloadError, fetchWithValidatedRedirects, DEFAULT_MAX_DOWNLOAD_SIZE, readResponseWithSizeLimit, downloadBlob, createIdGenerator, generateId, getErrorMessage2 as getErrorMessage1, isAbortError, getRuntimeEnvironmentUserAgent, normalizeHeaders, withUserAgentSuffix, getFromApi, isNonNullable, isSameOrigin, isUrlSupported, loadApiKey, loadOptionalSetting, loadSetting, lazySchema, jsonSchema, asSchema, zodSchema, validateTypes, safeValidateTypes, parseJSON, safeParseJSON, isParsableJson, parseJsonEventStream, parseProviderOptions, postJsonToApi, postFormDataToApi, tool, dynamicTool, createProviderToolFactory, createProviderToolFactoryWithOutputSchema, resolve, createJsonErrorResponseHandler, createEventSourceResponseHandler, createJsonResponseHandler, stripFileExtension, withoutTrailingSlash, executeTool, init_dist3 as init_dist1, zod_default, init_zod, GatewayError, GatewayAuthenticationError, createGatewayProvider, gateway, init_dist4 as init_dist2, require_src };

package/build/{cli-90dw3gm4.js → cli-6tvsa4qw.js}

@@ -4,27 +4,27 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-akhax3yn.js";
+} from "./cli-8dgnq80w.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-v34r5t8t.js";
+} from "./cli-h6czbkax.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-k941a7ft.js";
+} from "./cli-z7h336ft.js";
 import {
   exports_external,
   init_zod
-} from "./cli-29yqhrjq.js";
+} from "./cli-3k1x5rn3.js";
 import {
   config,
   init_config
-} from "./cli-qb3eddc7.js";
+} from "./cli-d5w0q9np.js";
 import {
   __commonJS,
   __require
@@ -7132,6 +7132,9 @@ async function getIssue(issueId) {
 async function updateIssue(issueId, data) {
   return apiRequest("PATCH", `/issues/${issueId}`, data);
 }
+async function retestIssue(issueId) {
+  return apiRequest("POST", `/issues/${issueId}/retest`);
+}
 async function listFixes(issueId) {
   return apiRequest("GET", `/issues/${issueId}/fixes`);
 }
@@ -8304,4 +8307,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };