@pensar/apex 2.1.3-canary.fff17bfd → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/build/agent-3cdfwxcd.js +19 -0
  2. package/build/agent-q5hwjdtb.js +27 -0
  3. package/build/{agent-c06jb5zv.js → agent-yayy5x2a.js} +10 -8
  4. package/build/{apps-mxhfapvz.js → apps-0es69e2s.js} +17 -16
  5. package/build/{auth-9ysskv2q.js → auth-q73k9bh9.js} +17 -16
  6. package/build/authentication-tqx2brcv.js +19 -0
  7. package/build/blackboxAgent-d0smgqt7.js +19 -0
  8. package/build/{blackboxPentest-pfs3d1nx.js → blackboxPentest-h28nykk5.js} +15 -14
  9. package/build/{cli-90dw3gm4.js → cli-1cf5vy5m.js} +9 -6
  10. package/build/{cli-f8tgnegf.js → cli-1f636vzd.js} +2 -2
  11. package/build/{cli-tg7mcs43.js → cli-1re2kv5v.js} +5 -3
  12. package/build/cli-2jn8104w.js +195 -0
  13. package/build/{cli-29yqhrjq.js → cli-3k1x5rn3.js} +1 -1
  14. package/build/{cli-k941a7ft.js → cli-4tc6888c.js} +1 -1
  15. package/build/{cli-qb3eddc7.js → cli-51dkmt5p.js} +1 -1
  16. package/build/{cli-v34r5t8t.js → cli-6kx46ck0.js} +6186 -513
  17. package/build/{cli-a1acedxf.js → cli-7e5ad5js.js} +15 -6
  18. package/build/{cli-8qb62k90.js → cli-7n43wz82.js} +1 -1
  19. package/build/{cli-fj04wady.js → cli-knqx15w6.js} +5 -2
  20. package/build/{cli-9wd7jy2s.js → cli-n114n8mk.js} +102 -21
  21. package/build/{cli-9h847y2w.js → cli-ptzy9ak5.js} +2 -2
  22. package/build/{cli-g6cjpbr9.js → cli-s43t5ay0.js} +1 -1
  23. package/build/{cli-nth9zebw.js → cli-tz9yg4ew.js} +1147 -336
  24. package/build/{cli-2cvp6x4p.js → cli-vgg6h2ax.js} +1 -1
  25. package/build/{cli-akhax3yn.js → cli-xbdn034b.js} +671 -105
  26. package/build/{cli-wkpsqyjc.js → cli-xpn9tsw0.js} +27 -5
  27. package/build/cli.js +48 -39
  28. package/build/{config-ky5za80x.js → config-xcf7rc6x.js} +3 -3
  29. package/build/{doctor-t94dqmcs.js → doctor-98zperf9.js} +7 -7
  30. package/build/fastStrike-9tm6bedh.js +156 -0
  31. package/build/{fixes-fv2zmk0m.js → fixes-1dry8j61.js} +17 -16
  32. package/build/{index-s2jr2ve2.js → index-0j880wqc.js} +70 -44
  33. package/build/{index-8mgv8hke.js → index-31rwrakh.js} +2 -2
  34. package/build/{index-b7zrdy9b.js → index-34h2nb6x.js} +3 -3
  35. package/build/{index-pmsx73c3.js → index-4hqbyzf5.js} +11 -9
  36. package/build/{index-qshyncep.js → index-6dbym5jy.js} +8 -7
  37. package/build/{index-pycryjc3.js → index-f6ttv7np.js} +4 -4
  38. package/build/{index-n1yh9e86.js → index-gq9h8j5j.js} +1 -1
  39. package/build/{index-rxskwf3k.js → index-pxwwcefn.js} +10 -10
  40. package/build/{issues-bwdnb233.js → issues-wjakj8yy.js} +28 -16
  41. package/build/{logs-2g3rsh9f.js → logs-ewyzcspy.js} +17 -16
  42. package/build/{offesecAgent-4ykghkvs.js → offesecAgent-7m9smy0t.js} +9 -9
  43. package/build/pentest-1cb5t0dt.js +29 -0
  44. package/build/{pentests-d9dt495f.js → pentests-1hcqjyk2.js} +17 -16
  45. package/build/targetedPentest-3x13kqvc.js +56 -0
  46. package/build/{targets-3n7wsm3g.js → targets-nqz8w37e.js} +17 -16
  47. package/build/threatModel-7f02av7y.js +27 -0
  48. package/build/{uninstall-jvjv6d2n.js → uninstall-p1q5pkx2.js} +1 -1
  49. package/build/{upload-x2b8s1xb.js → upload-x7etpfp4.js} +7 -7
  50. package/build/{utils-kx8jqmv0.js → utils-kw6yh5yn.js} +7 -7
  51. package/package.json +2 -2
  52. package/build/agent-7ab546zf.js +0 -19
  53. package/build/agent-dsqssedb.js +0 -25
  54. package/build/authentication-h1zxd74t.js +0 -19
  55. package/build/blackboxAgent-32zwxt6w.js +0 -19
  56. package/build/pentest-91bygv3h.js +0 -28
  57. package/build/targetedPentest-eavq5h7v.js +0 -43
  58. package/build/threatModel-2re9tykx.js +0 -26
@@ -1,9 +1,9 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-akhax3yn.js";
3
+ } from "./cli-xbdn034b.js";
4
4
  import {
5
5
  detectOSAndEnhancePrompt
6
- } from "./cli-g6cjpbr9.js";
6
+ } from "./cli-s43t5ay0.js";
7
7
  import {
8
8
  createLogger,
9
9
  hasToolCall,
@@ -11,7 +11,7 @@ import {
11
11
  init_lazyLogger,
12
12
  init_structured,
13
13
  scopedLogger
14
- } from "./cli-v34r5t8t.js";
14
+ } from "./cli-6kx46ck0.js";
15
15
 
16
16
  // src/core/agents/specialized/authenticationAgent/agent.ts
17
17
  init_dist();
@@ -127,13 +127,21 @@ These are the ONLY way downstream agents receive the session credentials.
127
127
 
128
128
  # Error Recovery
129
129
 
130
- If authentication fails:
130
+ If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
131
131
  1. Try alternative field names (email vs username, passwd vs password)
132
132
  2. Check for CSRF token requirements (look in page source or hidden form fields)
133
133
  3. Verify the endpoint URL is correct
134
134
  4. Try a different method (form_post vs json_post)
135
135
  5. If all else fails, call \`complete_authentication\` with success=false
136
136
 
137
+ If credentials were provided to you, they are already verified and SHARED — do not modify them or their
138
+ account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
139
+ forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
140
+ the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
141
+ \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
142
+ or self-sign-up to get around a rejected provided credential — that is a different account than the one
143
+ under test and only pollutes results.
144
+
137
145
  ## Rate Limiting
138
146
 
139
147
  If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "too many requests"):
@@ -178,7 +186,9 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
178
186
  subagentId,
179
187
  context,
180
188
  environmentVariables,
189
+ secretValues,
181
190
  enableThinking,
191
+ thinkingEffort,
182
192
  openAIReasoningEffort
183
193
  } = opts;
184
194
  const cm = session.credentialManager;
@@ -193,8 +203,11 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
193
203
  abortSignal,
194
204
  eventBus,
195
205
  subagentId,
206
+ subagentName: opts.subagentName,
196
207
  environmentVariables,
208
+ secretValues,
197
209
  enableThinking,
210
+ thinkingEffort,
198
211
  openAIReasoningEffort,
199
212
  toolChoice: "auto",
200
213
  activeTools: [
@@ -297,7 +310,16 @@ You have credentials available via credential IDs — authenticate immediately.
297
310
  2. For browser-based logins, use the browser tools. For browser_fill on password/secret fields,
298
311
  pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
299
312
  the secret is resolved securely at execution time. NEVER type a password directly.
300
- 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run`);
313
+ 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
314
+
315
+ The credentials above were provided to you and have already been verified — they are SHARED across runs, so
316
+ do not modify them or their account settings. NEVER change the password, complete a password reset /
317
+ forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
318
+ resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
319
+ password change required, MFA required, email not confirmed), call complete_authentication with
320
+ success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
321
+ register a new account or self-sign-up to work around a failed login: that is not the credential under test
322
+ and only pollutes results — fail fast with success=false instead.`);
301
323
  } else {
302
324
  parts.push(`INSTRUCTIONS:
303
325
  1. Probe the target with execute_command (curl) to determine the auth mechanism
package/build/cli.js CHANGED
@@ -14,16 +14,16 @@ import {
14
14
  init_toolset,
15
15
  init_utils,
16
16
  logger
17
- } from "./cli-v34r5t8t.js";
18
- import"./cli-k941a7ft.js";
19
- import"./cli-29yqhrjq.js";
17
+ } from "./cli-6kx46ck0.js";
18
+ import"./cli-4tc6888c.js";
19
+ import"./cli-3k1x5rn3.js";
20
20
  import"./cli-gpnb45ck.js";
21
- import"./cli-qb3eddc7.js";
22
- import"./cli-8qb62k90.js";
21
+ import"./cli-51dkmt5p.js";
22
+ import"./cli-7n43wz82.js";
23
23
  import {
24
24
  init_package,
25
25
  package_default
26
- } from "./cli-f8tgnegf.js";
26
+ } from "./cli-1f636vzd.js";
27
27
  import {
28
28
  __require,
29
29
  __toESM
@@ -49,7 +49,7 @@ var package_default2 = {
49
49
  "@opentelemetry/api": "^1.9.1",
50
50
  "@opentui/core": "^0.1.107",
51
51
  "@opentui/react": "^0.1.107",
52
- "@pensar/surface": "0.2.2",
52
+ "@pensar/surface": "0.3.0",
53
53
  "@playwright/mcp": "^0.0.54",
54
54
  ai: "^6.0.208",
55
55
  "camoufox-js": "^0.11.1",
@@ -144,7 +144,7 @@ var package_default2 = {
144
144
  tsc: "tsc --noEmit"
145
145
  },
146
146
  type: "module",
147
- version: "2.1.3-canary.fff17bfd"
147
+ version: "2.2.0"
148
148
  };
149
149
 
150
150
  // src/core/ai/index.ts
@@ -285,7 +285,7 @@ class AgentEventBus {
285
285
  }
286
286
  emitStreamPart(chunk, ids) {
287
287
  const ctx = typeof ids === "string" ? { subagentId: ids } : ids ?? {};
288
- const subagentId = ctx.subagentId ?? ctx.sessionId;
288
+ const subagentId = ctx.subagentId;
289
289
  const sessionId = ctx.sessionId;
290
290
  const messageId = ctx.messageId;
291
291
  switch (chunk.type) {
@@ -498,6 +498,7 @@ You can upgrade manually by running:
498
498
  // src/core/logger/index.ts
499
499
  init_session();
500
500
  init_structured();
501
+ init_structured();
501
502
  import os from "node:os";
502
503
  import path from "node:path";
503
504
  var ERROR_LOG_PATH = path.join(os.homedir(), ".pensar", "error.log");
@@ -586,7 +587,7 @@ function attachCliAgentStreamListeners(bus) {
586
587
  async function createInstrumentedBus(session) {
587
588
  const bus = new AgentEventBus;
588
589
  attachCliAgentStreamListeners(bus);
589
- const { attachWandbToEventBus } = await import("./upload-x2b8s1xb.js");
590
+ const { attachWandbToEventBus } = await import("./upload-x7etpfp4.js");
590
591
  const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
591
592
  console.warn("[wandb] Tracing disabled:", e.message);
592
593
  return null;
@@ -603,7 +604,7 @@ async function resolveCliHeaders() {
603
604
  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
604
605
  const merged = {};
605
606
  if (!noGlobal) {
606
- const { config: appConfig } = await import("./index-8mgv8hke.js");
607
+ const { config: appConfig } = await import("./index-31rwrakh.js");
607
608
  const cfg = await appConfig.get();
608
609
  if (cfg.defaultHeaders) {
609
610
  Object.assign(merged, cfg.defaultHeaders);
@@ -637,8 +638,8 @@ async function resolveCliModel() {
637
638
  const explicit = getArg("--model");
638
639
  if (explicit)
639
640
  return explicit;
640
- const { config: appConfig } = await import("./index-8mgv8hke.js");
641
- const { getDefaultModelForConfig } = await import("./utils-kx8jqmv0.js");
641
+ const { config: appConfig } = await import("./index-31rwrakh.js");
642
+ const { getDefaultModelForConfig } = await import("./utils-kw6yh5yn.js");
642
643
  const pensarConfig = await appConfig.get();
643
644
  const defaultModel = getDefaultModelForConfig(pensarConfig);
644
645
  if (!defaultModel) {
@@ -692,6 +693,8 @@ pentest options:
692
693
  --model <model> AI model (default: auto-selected from configured provider)
693
694
  --extended-thinking Enable extended thinking for supported models
694
695
  --task-driven Enable task-driven architecture (experimental)
696
+ --fast-strike Single-operator fast strike: skip attack-surface/swarm
697
+ phases, one tight recon\u2192exploit loop against the target
695
698
  --prompt <text|@file> Guidance for the pentest agent (inline text or @filepath)
696
699
  --threat-model <text|@file> Threat model to guide the pentest (inline or @filepath)
697
700
  --header "Name: Value" Custom HTTP header (repeatable)
@@ -724,9 +727,9 @@ Global options:
724
727
  async function runPentest() {
725
728
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
726
729
  config();
727
- const { runPentestAgent } = await import("./blackboxPentest-pfs3d1nx.js");
728
- const { sessions: sessions2 } = await import("./index-qshyncep.js");
729
- const { config: appConfig } = await import("./index-8mgv8hke.js");
730
+ const { runPentestAgent } = await import("./blackboxPentest-h28nykk5.js");
731
+ const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
732
+ const { config: appConfig } = await import("./index-31rwrakh.js");
730
733
  const target = getArgRequired("--target");
731
734
  const cwd = getArg("--cwd");
732
735
  const mode = getArg("--mode");
@@ -734,6 +737,7 @@ async function runPentest() {
734
737
  const threatModelRaw = getArg("--threat-model");
735
738
  const enableThinking = hasFlag("--extended-thinking");
736
739
  const taskDriven = hasFlag("--task-driven");
740
+ const fastStrike = hasFlag("--fast-strike");
737
741
  const resolvedTm = threatModelRaw ? resolveThreatModelPrompt(threatModelRaw) : undefined;
738
742
  const resolvedPrompt = promptRaw ? resolveFlagValue(promptRaw) : undefined;
739
743
  const prompt = combinePromptParts(resolvedTm, resolvedPrompt);
@@ -744,6 +748,9 @@ async function runPentest() {
744
748
  if (modeWarning) {
745
749
  console.warn(modeWarning);
746
750
  }
751
+ if (taskDriven && fastStrike) {
752
+ console.warn("Warning: --task-driven has no effect with --fast-strike (task tools are excluded).");
753
+ }
747
754
  const sep = "=".repeat(60);
748
755
  console.log(`${sep}
749
756
  PENTEST ORCHESTRATION
@@ -753,14 +760,15 @@ Cwd: ${cwd} (whitebox)` : ""}${exfilMode ? `
753
760
  Mode: exfil` : ""}
754
761
  Model: ${model}${enableThinking ? `
755
762
  Thinking: enabled` : ""}${taskDriven ? `
756
- Task-driven: enabled` : ""}${headers ? `
763
+ Task-driven: enabled` : ""}${fastStrike ? `
764
+ Fast strike: enabled` : ""}${headers ? `
757
765
  Headers: ${Object.keys(headers).length} configured` : ""}
758
766
  `);
759
767
  const session = await sessions2.create({
760
768
  name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
761
769
  targets: [target],
762
770
  config: {
763
- ...cwd ? { cwd } : {},
771
+ ...cwd ? { codebasePath: cwd } : {},
764
772
  ...exfilMode ? { exfilMode: true } : {},
765
773
  ...prompt ? { prompt } : {},
766
774
  ...taskDriven ? { taskDriven: true } : {},
@@ -776,6 +784,7 @@ Headers: ${Object.keys(headers).length} configured` : ""}
776
784
  session,
777
785
  model,
778
786
  enableThinking,
787
+ ...fastStrike ? { fastStrike: true } : {},
779
788
  surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
780
789
  authConfig: buildAuthConfig(pensarConfig),
781
790
  eventBus: pentestBus
@@ -796,9 +805,9 @@ Report: ${reportPath}` : ""}`);
796
805
  async function runTargetedPentest() {
797
806
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
798
807
  config();
799
- const { runTargetedPentestAgent } = await import("./targetedPentest-eavq5h7v.js");
800
- const { sessions: sessions2 } = await import("./index-qshyncep.js");
801
- const { config: appConfig } = await import("./index-8mgv8hke.js");
808
+ const { runTargetedPentestAgent } = await import("./targetedPentest-3x13kqvc.js");
809
+ const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
810
+ const { config: appConfig } = await import("./index-31rwrakh.js");
802
811
  const target = getArgRequired("--target");
803
812
  const objectives = getAllArgs("--objective");
804
813
  const pensarConfig = await appConfig.get();
@@ -850,8 +859,8 @@ POCs: ${pocsPath}`);
850
859
  async function runThreatModel() {
851
860
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
852
861
  config();
853
- const { runThreatModelWorkflow } = await import("./threatModel-2re9tykx.js");
854
- const { config: appConfig } = await import("./index-8mgv8hke.js");
862
+ const { runThreatModelWorkflow } = await import("./threatModel-7f02av7y.js");
863
+ const { config: appConfig } = await import("./index-31rwrakh.js");
855
864
  const path2 = await import("path");
856
865
  const pensarConfig = await appConfig.get();
857
866
  const model = await resolveCliModel();
@@ -887,14 +896,14 @@ Threat model written to: ${resolvedPath}`);
887
896
  async function runOperator() {
888
897
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
889
898
  config();
890
- const { runOffensiveSecurityAgent } = await import("./offesecAgent-4ykghkvs.js");
891
- const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-qshyncep.js");
892
- const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-pmsx73c3.js");
893
- const { config: appConfig } = await import("./index-8mgv8hke.js");
899
+ const { runOffensiveSecurityAgent } = await import("./offesecAgent-7m9smy0t.js");
900
+ const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-6dbym5jy.js");
901
+ const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-4hqbyzf5.js");
902
+ const { config: appConfig } = await import("./index-31rwrakh.js");
894
903
  const { createInterface } = await import("readline");
895
904
  const { readFileSync: readFileSync2, existsSync } = await import("fs");
896
905
  const path2 = await import("path");
897
- const { stepCountIs } = await import("./index-n1yh9e86.js");
906
+ const { stepCountIs } = await import("./index-gq9h8j5j.js");
898
907
  const promptRaw = getArg("-p") ?? getArg("--prompt");
899
908
  if (!promptRaw) {
900
909
  console.error("Error: -p <prompt> is required");
@@ -1004,35 +1013,35 @@ if (hasFlag("-p") || command === "--prompt") {
1004
1013
  await runTargetedPentest();
1005
1014
  } else if (command === "login" || command === "auth") {
1006
1015
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1007
- await import("./auth-9ysskv2q.js");
1016
+ await import("./auth-q73k9bh9.js");
1008
1017
  } else if (command === "uninstall") {
1009
1018
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1010
- await import("./uninstall-jvjv6d2n.js");
1019
+ await import("./uninstall-p1q5pkx2.js");
1011
1020
  } else if (command === "apps") {
1012
1021
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1013
- await import("./apps-mxhfapvz.js");
1022
+ await import("./apps-0es69e2s.js");
1014
1023
  } else if (command === "pentests") {
1015
1024
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1016
- await import("./pentests-d9dt495f.js");
1025
+ await import("./pentests-1hcqjyk2.js");
1017
1026
  } else if (command === "targets") {
1018
1027
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1019
- await import("./targets-3n7wsm3g.js");
1028
+ await import("./targets-nqz8w37e.js");
1020
1029
  } else if (command === "issues") {
1021
1030
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1022
- await import("./issues-bwdnb233.js");
1031
+ await import("./issues-wjakj8yy.js");
1023
1032
  } else if (command === "fixes") {
1024
1033
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1025
- await import("./fixes-fv2zmk0m.js");
1034
+ await import("./fixes-1dry8j61.js");
1026
1035
  } else if (command === "logs") {
1027
1036
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1028
- await import("./logs-2g3rsh9f.js");
1037
+ await import("./logs-ewyzcspy.js");
1029
1038
  } else if (command === "config") {
1030
1039
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1031
- await import("./config-ky5za80x.js");
1040
+ await import("./config-xcf7rc6x.js");
1032
1041
  } else if (command === "threat-model") {
1033
1042
  await runThreatModel();
1034
1043
  } else if (command === "doctor") {
1035
- const { runDoctor } = await import("./doctor-t94dqmcs.js");
1044
+ const { runDoctor } = await import("./doctor-98zperf9.js");
1036
1045
  await runDoctor();
1037
1046
  } else if (args.length === 0) {
1038
1047
  if (process.env.PENSAR_NO_TUI === "1") {
@@ -1040,7 +1049,7 @@ if (hasFlag("-p") || command === "--prompt") {
1040
1049
  console.error("All other commands work with Node \u2014 run 'pensar --help'.");
1041
1050
  process.exit(1);
1042
1051
  }
1043
- await import("./index-s2jr2ve2.js");
1052
+ await import("./index-0j880wqc.js");
1044
1053
  } else {
1045
1054
  console.error(`Error: Unknown command '${command}'`);
1046
1055
  console.error();
@@ -11,9 +11,9 @@ import {
11
11
  import {
12
12
  config,
13
13
  init_config
14
- } from "./cli-qb3eddc7.js";
15
- import"./cli-8qb62k90.js";
16
- import"./cli-f8tgnegf.js";
14
+ } from "./cli-51dkmt5p.js";
15
+ import"./cli-7n43wz82.js";
16
+ import"./cli-1f636vzd.js";
17
17
  import"./cli-8rxa073f.js";
18
18
 
19
19
  // src/cli/config.ts
@@ -1,13 +1,13 @@
1
1
  import {
2
2
  toolExists
3
- } from "./cli-g6cjpbr9.js";
4
- import"./cli-v34r5t8t.js";
5
- import"./cli-k941a7ft.js";
6
- import"./cli-29yqhrjq.js";
3
+ } from "./cli-s43t5ay0.js";
4
+ import"./cli-6kx46ck0.js";
5
+ import"./cli-4tc6888c.js";
6
+ import"./cli-3k1x5rn3.js";
7
7
  import"./cli-gpnb45ck.js";
8
- import"./cli-qb3eddc7.js";
9
- import"./cli-8qb62k90.js";
10
- import"./cli-f8tgnegf.js";
8
+ import"./cli-51dkmt5p.js";
9
+ import"./cli-7n43wz82.js";
10
+ import"./cli-1f636vzd.js";
11
11
  import"./cli-8rxa073f.js";
12
12
 
13
13
  // src/core/doctor.ts
@@ -0,0 +1,156 @@
1
+ import {
2
+ REPORT_FILENAME_JSON,
3
+ REPORT_FILENAME_MD,
4
+ buildPentestReport,
5
+ renderJson,
6
+ renderMarkdown
7
+ } from "./cli-2jn8104w.js";
8
+ import"./cli-9fsre5pt.js";
9
+ import"./cli-ptzy9ak5.js";
10
+ import {
11
+ FindingsRegistry,
12
+ OffensiveSecurityAgent
13
+ } from "./cli-xbdn034b.js";
14
+ import"./cli-s43t5ay0.js";
15
+ import {
16
+ createThreatModelPrompt
17
+ } from "./cli-fw5r7pfj.js";
18
+ import"./cli-c8131c4q.js";
19
+ import"./cli-6kx46ck0.js";
20
+ import"./cli-4tc6888c.js";
21
+ import {
22
+ exports_external,
23
+ init_zod
24
+ } from "./cli-3k1x5rn3.js";
25
+ import"./cli-gpnb45ck.js";
26
+ import"./cli-51dkmt5p.js";
27
+ import"./cli-7n43wz82.js";
28
+ import"./cli-1f636vzd.js";
29
+ import"./cli-8rxa073f.js";
30
+
31
+ // src/core/workflows/fastStrike.ts
32
+ init_zod();
33
+ import { writeFileSync } from "node:fs";
34
+ import { join } from "node:path";
35
+ var FastStrikeResult = exports_external.object({
36
+ solved: exports_external.boolean().describe("True if the objective was achieved — a vulnerability was confirmed and, where applicable, the flag or sensitive data was extracted."),
37
+ summary: exports_external.string().describe("Concise account of the vulnerability exploited, the exact steps that worked, and any flag or sensitive data recovered.")
38
+ });
39
+ var FAST_STRIKE_SYSTEM_PROMPT = `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
40
+
41
+ Run this loop, tightly:
42
+
43
+ 1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
44
+ 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
45
+ 3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
46
+ 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
47
+ 5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
48
+ 6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
49
+
50
+ Rules:
51
+ - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
52
+ - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
53
+ - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
54
+ - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
55
+ async function runFastStrike(input) {
56
+ const {
57
+ target,
58
+ cwd,
59
+ model,
60
+ session,
61
+ authConfig,
62
+ abortSignal,
63
+ eventBus,
64
+ onStepFinish,
65
+ enableThinking,
66
+ openAIReasoningEffort,
67
+ prompt,
68
+ threatModel
69
+ } = input;
70
+ if (cwd) {
71
+ if (!session.config) {
72
+ session.config = {};
73
+ }
74
+ session.config.codebasePath ??= cwd;
75
+ }
76
+ if (prompt || threatModel) {
77
+ const parts = [];
78
+ if (threatModel)
79
+ parts.push(createThreatModelPrompt(threatModel));
80
+ if (prompt)
81
+ parts.push(prompt);
82
+ const combined = parts.join(`
83
+
84
+ `);
85
+ if (!session.config) {
86
+ session.config = {};
87
+ }
88
+ session.config.prompt = session.config?.prompt ? `${session.config?.prompt}
89
+
90
+ ${combined}` : combined;
91
+ }
92
+ const operatorGuidance = session.config?.prompt;
93
+ const mode = cwd ? "whitebox" : "blackbox";
94
+ eventBus?.emit("workflow-phase-start", {
95
+ phase: "pentesting",
96
+ label: "Fast Strike",
97
+ metadata: { target }
98
+ });
99
+ const findingsRegistry = FindingsRegistry.fromDirectory(session.findingsPath, { model, authConfig, abortSignal });
100
+ const promptParts = [`Target: ${target}`];
101
+ if (operatorGuidance)
102
+ promptParts.push(operatorGuidance);
103
+ promptParts.push("Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.");
104
+ const agent = new OffensiveSecurityAgent({
105
+ system: FAST_STRIKE_SYSTEM_PROMPT,
106
+ prompt: promptParts.join(`
107
+
108
+ `),
109
+ model,
110
+ session,
111
+ target,
112
+ mode: "fast-strike",
113
+ activeTools: [],
114
+ responseSchema: FastStrikeResult,
115
+ findingsRegistry,
116
+ subagentId: "fast-strike",
117
+ authConfig,
118
+ abortSignal,
119
+ eventBus,
120
+ onStepFinish,
121
+ enableThinking,
122
+ openAIReasoningEffort
123
+ });
124
+ const strikeResult = await agent.consume();
125
+ if (abortSignal?.aborted) {
126
+ throw new DOMException("Pentest aborted by user", "AbortError");
127
+ }
128
+ await findingsRegistry.groupByRootCause();
129
+ const findings = [...findingsRegistry.getFindings()];
130
+ const report = buildPentestReport(findings, {
131
+ target,
132
+ model,
133
+ sessionId: session.id,
134
+ mode
135
+ });
136
+ const mdPath = join(session.rootPath, REPORT_FILENAME_MD);
137
+ const jsonPath = join(session.rootPath, REPORT_FILENAME_JSON);
138
+ writeFileSync(mdPath, renderMarkdown(report));
139
+ writeFileSync(jsonPath, renderJson(report));
140
+ eventBus?.emit("workflow-phase-complete", {
141
+ phase: "pentesting",
142
+ summary: {
143
+ findingsCount: findings.length,
144
+ ...strikeResult ? { solved: strikeResult.solved, operatorSummary: strikeResult.summary } : {}
145
+ }
146
+ });
147
+ return {
148
+ findings,
149
+ findingsPath: session.findingsPath,
150
+ pocsPath: session.pocsPath,
151
+ reportPath: mdPath
152
+ };
153
+ }
154
+ export {
155
+ runFastStrike
156
+ };
@@ -2,26 +2,27 @@
2
2
  import {
3
3
  getFix,
4
4
  listFixes
5
- } from "./cli-90dw3gm4.js";
6
- import"./cli-nth9zebw.js";
7
- import"./cli-tg7mcs43.js";
8
- import"./cli-9wd7jy2s.js";
9
- import"./cli-wkpsqyjc.js";
10
- import"./cli-fj04wady.js";
11
- import"./cli-a1acedxf.js";
5
+ } from "./cli-1cf5vy5m.js";
6
+ import"./cli-tz9yg4ew.js";
7
+ import"./cli-1re2kv5v.js";
8
+ import"./cli-2jn8104w.js";
9
+ import"./cli-n114n8mk.js";
10
+ import"./cli-xpn9tsw0.js";
11
+ import"./cli-knqx15w6.js";
12
+ import"./cli-7e5ad5js.js";
12
13
  import"./cli-9fsre5pt.js";
13
- import"./cli-9h847y2w.js";
14
- import"./cli-akhax3yn.js";
15
- import"./cli-g6cjpbr9.js";
14
+ import"./cli-ptzy9ak5.js";
15
+ import"./cli-xbdn034b.js";
16
+ import"./cli-s43t5ay0.js";
16
17
  import"./cli-fw5r7pfj.js";
17
18
  import"./cli-c8131c4q.js";
18
- import"./cli-v34r5t8t.js";
19
- import"./cli-k941a7ft.js";
20
- import"./cli-29yqhrjq.js";
19
+ import"./cli-6kx46ck0.js";
20
+ import"./cli-4tc6888c.js";
21
+ import"./cli-3k1x5rn3.js";
21
22
  import"./cli-gpnb45ck.js";
22
- import"./cli-qb3eddc7.js";
23
- import"./cli-8qb62k90.js";
24
- import"./cli-f8tgnegf.js";
23
+ import"./cli-51dkmt5p.js";
24
+ import"./cli-7n43wz82.js";
25
+ import"./cli-1f636vzd.js";
25
26
  import"./cli-8rxa073f.js";
26
27
 
27
28
  // src/cli/fixes.ts