@pensar/apex 2.2.0-canary.85a9da57 → 2.2.0-canary.9a2febe4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/{agent-9j0t23gh.js → agent-jgjybz1n.js} +7 -7
- package/build/{agent-n467bw8f.js → agent-k45ne7sv.js} +9 -9
- package/build/agent-xgc74kbv.js +19 -0
- package/build/{apps-fgh1j83g.js → apps-g798rjfk.js} +16 -16
- package/build/{auth-mrtqpn8r.js → auth-5f8vv91e.js} +16 -16
- package/build/authentication-x59g8700.js +19 -0
- package/build/blackboxAgent-shd4qagm.js +19 -0
- package/build/{blackboxPentest-9d2hr7xv.js → blackboxPentest-d855jz1c.js} +14 -14
- package/build/{cli-whg4krbb.js → cli-8gv5fr2e.js} +51 -25
- package/build/{cli-draweqwg.js → cli-9czjkypb.js} +1 -1
- package/build/{cli-69xfj2a5.js → cli-9r34w599.js} +2 -2
- package/build/{cli-m7se6ehn.js → cli-agxy98cy.js} +8 -8
- package/build/{cli-9489ah09.js → cli-dc9hkjxy.js} +1 -1
- package/build/{cli-dq4pfsaf.js → cli-ecryj1ac.js} +4 -4
- package/build/{cli-tqj2cwed.js → cli-f1467gv6.js} +1 -1
- package/build/{cli-zbhf6wnd.js → cli-mkwj11fx.js} +3 -3
- package/build/{cli-n9yjp8w4.js → cli-n3b2j6ny.js} +3922 -55
- package/build/{cli-6azgnarp.js → cli-ngraq4cd.js} +2 -2
- package/build/{cli-wvrke9n9.js → cli-pjrh9qaw.js} +1 -1
- package/build/{cli-sp72n0rn.js → cli-qm4w7r2x.js} +1 -1
- package/build/{cli-anr9cqj2.js → cli-r040hsff.js} +1 -1
- package/build/{cli-ahz5mbyf.js → cli-sjs324ah.js} +1 -1
- package/build/{cli-yjbbecv8.js → cli-v2fgyeby.js} +2 -2
- package/build/{cli-fzhcb5ew.js → cli-vxvwqnsz.js} +2 -2
- package/build/{cli-r7pfx8my.js → cli-zkfskzs2.js} +3 -3
- package/build/cli.js +33 -33
- package/build/{config-9m5vb0vc.js → config-bjkaeps2.js} +3 -3
- package/build/{doctor-pbvg07ep.js → doctor-ka53crep.js} +6 -6
- package/build/{fastStrike-e5hdhz84.js → fastStrike-9y8vcm4e.js} +9 -9
- package/build/{fixes-36phvkst.js → fixes-4zbphchd.js} +16 -16
- package/build/{index-e797mn6q.js → index-12cvbsdg.js} +3 -3
- package/build/{index-vwq3ghts.js → index-1ezyeq2e.js} +4 -4
- package/build/{index-n1ytyz1y.js → index-8vecxw29.js} +8 -8
- package/build/{index-4e2zw6g5.js → index-cwbk0edn.js} +23 -18
- package/build/{index-tznnrk1k.js → index-g6f4qa7x.js} +2 -2
- package/build/{index-gc8f2j76.js → index-nwk6q6s7.js} +6 -6
- package/build/{index-vp4ds92k.js → index-z6nwmwjp.js} +9 -9
- package/build/{issues-c644kscp.js → issues-hpt8dcqk.js} +16 -16
- package/build/{logs-kbekta1x.js → logs-7sbzraj6.js} +16 -16
- package/build/{offesecAgent-ae72yxjj.js → offesecAgent-zh7gt11q.js} +8 -8
- package/build/pentest-gqn794ny.js +29 -0
- package/build/{pentests-4fm9fb8y.js → pentests-qvy26e74.js} +16 -16
- package/build/{targetedPentest-69st5njn.js → targetedPentest-e9282gzp.js} +9 -9
- package/build/{targets-4p21w40t.js → targets-6wctny3k.js} +16 -16
- package/build/threatModel-7qwdhyg6.js +27 -0
- package/build/{uninstall-3ef8qwdm.js → uninstall-gsjm07fz.js} +1 -1
- package/build/{upload-y1fz1kjt.js → upload-a6s9qd5c.js} +6 -6
- package/build/{utils-vzdw0qt6.js → utils-d470qka4.js} +5 -5
- package/package.json +1 -1
- package/build/agent-5nwx2gw3.js +0 -19
- package/build/authentication-gj2vkdy8.js +0 -19
- package/build/blackboxAgent-09tvycba.js +0 -19
- package/build/pentest-b483h0gs.js +0 -29
- package/build/threatModel-tx9z2gf7.js +0 -27
|
@@ -1,23 +1,23 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-n3b2j6ny.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-9czjkypb.js";
|
|
7
7
|
import"./cli-c8131c4q.js";
|
|
8
8
|
import {
|
|
9
9
|
init_dist,
|
|
10
10
|
stepCountIs
|
|
11
|
-
} from "./cli-
|
|
12
|
-
import"./cli-
|
|
11
|
+
} from "./cli-ecryj1ac.js";
|
|
12
|
+
import"./cli-r040hsff.js";
|
|
13
13
|
import {
|
|
14
14
|
exports_external,
|
|
15
15
|
init_zod
|
|
16
16
|
} from "./cli-3k1x5rn3.js";
|
|
17
17
|
import"./cli-gpnb45ck.js";
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
18
|
+
import"./cli-pjrh9qaw.js";
|
|
19
|
+
import"./cli-qm4w7r2x.js";
|
|
20
|
+
import"./cli-sjs324ah.js";
|
|
21
21
|
import"./cli-8rxa073f.js";
|
|
22
22
|
|
|
23
23
|
// src/core/agents/specialized/findingJudge/agent.ts
|
|
@@ -4,19 +4,19 @@ import {
|
|
|
4
4
|
buildPentestActiveTools,
|
|
5
5
|
buildPentestPrompt,
|
|
6
6
|
buildPentestSystemPrompt
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-ngraq4cd.js";
|
|
8
8
|
import"./cli-9fsre5pt.js";
|
|
9
|
-
import"./cli-
|
|
10
|
-
import"./cli-
|
|
11
|
-
import"./cli-
|
|
9
|
+
import"./cli-dc9hkjxy.js";
|
|
10
|
+
import"./cli-n3b2j6ny.js";
|
|
11
|
+
import"./cli-9czjkypb.js";
|
|
12
12
|
import"./cli-c8131c4q.js";
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
13
|
+
import"./cli-ecryj1ac.js";
|
|
14
|
+
import"./cli-r040hsff.js";
|
|
15
15
|
import"./cli-3k1x5rn3.js";
|
|
16
16
|
import"./cli-gpnb45ck.js";
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
17
|
+
import"./cli-pjrh9qaw.js";
|
|
18
|
+
import"./cli-qm4w7r2x.js";
|
|
19
|
+
import"./cli-sjs324ah.js";
|
|
20
20
|
import"./cli-8rxa073f.js";
|
|
21
21
|
export {
|
|
22
22
|
buildPentestSystemPrompt,
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import {
|
|
2
|
+
CodeAgent
|
|
3
|
+
} from "./cli-v2fgyeby.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-dc9hkjxy.js";
|
|
6
|
+
import"./cli-n3b2j6ny.js";
|
|
7
|
+
import"./cli-9czjkypb.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-ecryj1ac.js";
|
|
10
|
+
import"./cli-r040hsff.js";
|
|
11
|
+
import"./cli-3k1x5rn3.js";
|
|
12
|
+
import"./cli-gpnb45ck.js";
|
|
13
|
+
import"./cli-pjrh9qaw.js";
|
|
14
|
+
import"./cli-qm4w7r2x.js";
|
|
15
|
+
import"./cli-sjs324ah.js";
|
|
16
|
+
import"./cli-8rxa073f.js";
|
|
17
|
+
export {
|
|
18
|
+
CodeAgent
|
|
19
|
+
};
|
|
@@ -12,27 +12,27 @@ import {
|
|
|
12
12
|
searchEndpoints,
|
|
13
13
|
updateApp,
|
|
14
14
|
updateEndpoint
|
|
15
|
-
} from "./cli-
|
|
16
|
-
import"./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
21
|
-
import"./cli-
|
|
22
|
-
import"./cli-
|
|
15
|
+
} from "./cli-8gv5fr2e.js";
|
|
16
|
+
import"./cli-agxy98cy.js";
|
|
17
|
+
import"./cli-mkwj11fx.js";
|
|
18
|
+
import"./cli-9r34w599.js";
|
|
19
|
+
import"./cli-ngraq4cd.js";
|
|
20
|
+
import"./cli-zkfskzs2.js";
|
|
21
|
+
import"./cli-v2fgyeby.js";
|
|
22
|
+
import"./cli-vxvwqnsz.js";
|
|
23
23
|
import"./cli-9fsre5pt.js";
|
|
24
|
-
import"./cli-
|
|
25
|
-
import"./cli-
|
|
26
|
-
import"./cli-
|
|
24
|
+
import"./cli-dc9hkjxy.js";
|
|
25
|
+
import"./cli-n3b2j6ny.js";
|
|
26
|
+
import"./cli-9czjkypb.js";
|
|
27
27
|
import"./cli-fw5r7pfj.js";
|
|
28
28
|
import"./cli-c8131c4q.js";
|
|
29
|
-
import"./cli-
|
|
30
|
-
import"./cli-
|
|
29
|
+
import"./cli-ecryj1ac.js";
|
|
30
|
+
import"./cli-r040hsff.js";
|
|
31
31
|
import"./cli-3k1x5rn3.js";
|
|
32
32
|
import"./cli-gpnb45ck.js";
|
|
33
|
-
import"./cli-
|
|
34
|
-
import"./cli-
|
|
35
|
-
import"./cli-
|
|
33
|
+
import"./cli-pjrh9qaw.js";
|
|
34
|
+
import"./cli-qm4w7r2x.js";
|
|
35
|
+
import"./cli-sjs324ah.js";
|
|
36
36
|
import"./cli-8rxa073f.js";
|
|
37
37
|
|
|
38
38
|
// src/cli/apps.ts
|
|
@@ -1,19 +1,19 @@
|
|
|
1
1
|
#!/usr/bin/env bun
|
|
2
|
-
import"./cli-
|
|
3
|
-
import"./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
2
|
+
import"./cli-8gv5fr2e.js";
|
|
3
|
+
import"./cli-agxy98cy.js";
|
|
4
|
+
import"./cli-mkwj11fx.js";
|
|
5
|
+
import"./cli-9r34w599.js";
|
|
6
|
+
import"./cli-ngraq4cd.js";
|
|
7
|
+
import"./cli-zkfskzs2.js";
|
|
8
|
+
import"./cli-v2fgyeby.js";
|
|
9
|
+
import"./cli-vxvwqnsz.js";
|
|
10
10
|
import"./cli-9fsre5pt.js";
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
11
|
+
import"./cli-dc9hkjxy.js";
|
|
12
|
+
import"./cli-n3b2j6ny.js";
|
|
13
|
+
import"./cli-9czjkypb.js";
|
|
14
14
|
import"./cli-fw5r7pfj.js";
|
|
15
15
|
import"./cli-c8131c4q.js";
|
|
16
|
-
import"./cli-
|
|
16
|
+
import"./cli-ecryj1ac.js";
|
|
17
17
|
import {
|
|
18
18
|
disconnect,
|
|
19
19
|
fetchWorkspaces,
|
|
@@ -26,15 +26,15 @@ import {
|
|
|
26
26
|
pollWorkOSToken,
|
|
27
27
|
selectWorkspace,
|
|
28
28
|
startDeviceFlow
|
|
29
|
-
} from "./cli-
|
|
29
|
+
} from "./cli-r040hsff.js";
|
|
30
30
|
import"./cli-3k1x5rn3.js";
|
|
31
31
|
import"./cli-gpnb45ck.js";
|
|
32
32
|
import {
|
|
33
33
|
config,
|
|
34
34
|
init_config
|
|
35
|
-
} from "./cli-
|
|
36
|
-
import"./cli-
|
|
37
|
-
import"./cli-
|
|
35
|
+
} from "./cli-pjrh9qaw.js";
|
|
36
|
+
import"./cli-qm4w7r2x.js";
|
|
37
|
+
import"./cli-sjs324ah.js";
|
|
38
38
|
import {
|
|
39
39
|
__require
|
|
40
40
|
} from "./cli-8rxa073f.js";
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import {
|
|
2
|
+
runAuthenticationAgent
|
|
3
|
+
} from "./cli-zkfskzs2.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-dc9hkjxy.js";
|
|
6
|
+
import"./cli-n3b2j6ny.js";
|
|
7
|
+
import"./cli-9czjkypb.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-ecryj1ac.js";
|
|
10
|
+
import"./cli-r040hsff.js";
|
|
11
|
+
import"./cli-3k1x5rn3.js";
|
|
12
|
+
import"./cli-gpnb45ck.js";
|
|
13
|
+
import"./cli-pjrh9qaw.js";
|
|
14
|
+
import"./cli-qm4w7r2x.js";
|
|
15
|
+
import"./cli-sjs324ah.js";
|
|
16
|
+
import"./cli-8rxa073f.js";
|
|
17
|
+
export {
|
|
18
|
+
runAuthenticationAgent
|
|
19
|
+
};
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
import {
|
|
2
|
+
BlackboxAttackSurfaceAgent
|
|
3
|
+
} from "./cli-mkwj11fx.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-dc9hkjxy.js";
|
|
6
|
+
import"./cli-n3b2j6ny.js";
|
|
7
|
+
import"./cli-9czjkypb.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-ecryj1ac.js";
|
|
10
|
+
import"./cli-r040hsff.js";
|
|
11
|
+
import"./cli-3k1x5rn3.js";
|
|
12
|
+
import"./cli-gpnb45ck.js";
|
|
13
|
+
import"./cli-pjrh9qaw.js";
|
|
14
|
+
import"./cli-qm4w7r2x.js";
|
|
15
|
+
import"./cli-sjs324ah.js";
|
|
16
|
+
import"./cli-8rxa073f.js";
|
|
17
|
+
export {
|
|
18
|
+
BlackboxAttackSurfaceAgent
|
|
19
|
+
};
|
|
@@ -1,24 +1,24 @@
|
|
|
1
1
|
import {
|
|
2
2
|
runPentestWorkflow
|
|
3
|
-
} from "./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
8
|
-
import"./cli-
|
|
3
|
+
} from "./cli-agxy98cy.js";
|
|
4
|
+
import"./cli-mkwj11fx.js";
|
|
5
|
+
import"./cli-9r34w599.js";
|
|
6
|
+
import"./cli-ngraq4cd.js";
|
|
7
|
+
import"./cli-v2fgyeby.js";
|
|
8
|
+
import"./cli-vxvwqnsz.js";
|
|
9
9
|
import"./cli-9fsre5pt.js";
|
|
10
|
-
import"./cli-
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
10
|
+
import"./cli-dc9hkjxy.js";
|
|
11
|
+
import"./cli-n3b2j6ny.js";
|
|
12
|
+
import"./cli-9czjkypb.js";
|
|
13
13
|
import"./cli-fw5r7pfj.js";
|
|
14
14
|
import"./cli-c8131c4q.js";
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
15
|
+
import"./cli-ecryj1ac.js";
|
|
16
|
+
import"./cli-r040hsff.js";
|
|
17
17
|
import"./cli-3k1x5rn3.js";
|
|
18
18
|
import"./cli-gpnb45ck.js";
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
21
|
-
import"./cli-
|
|
19
|
+
import"./cli-pjrh9qaw.js";
|
|
20
|
+
import"./cli-qm4w7r2x.js";
|
|
21
|
+
import"./cli-sjs324ah.js";
|
|
22
22
|
import"./cli-8rxa073f.js";
|
|
23
23
|
|
|
24
24
|
// src/core/api/blackboxPentest.ts
|
|
@@ -4,19 +4,19 @@ import {
|
|
|
4
4
|
OffensiveSecurityAgent,
|
|
5
5
|
SKILL_TOOL_NAMES,
|
|
6
6
|
buildBaseSystemPrompt
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-n3b2j6ny.js";
|
|
8
8
|
import {
|
|
9
9
|
init_dist,
|
|
10
10
|
init_session,
|
|
11
11
|
sessions,
|
|
12
12
|
stepCountIs
|
|
13
|
-
} from "./cli-
|
|
13
|
+
} from "./cli-ecryj1ac.js";
|
|
14
14
|
import {
|
|
15
15
|
ensureValidToken,
|
|
16
16
|
getPensarApiUrl,
|
|
17
17
|
init_auth,
|
|
18
18
|
init_constants
|
|
19
|
-
} from "./cli-
|
|
19
|
+
} from "./cli-r040hsff.js";
|
|
20
20
|
import {
|
|
21
21
|
exports_external,
|
|
22
22
|
init_zod
|
|
@@ -24,7 +24,7 @@ import {
|
|
|
24
24
|
import {
|
|
25
25
|
config,
|
|
26
26
|
init_config
|
|
27
|
-
} from "./cli-
|
|
27
|
+
} from "./cli-pjrh9qaw.js";
|
|
28
28
|
import {
|
|
29
29
|
__commonJS,
|
|
30
30
|
__require
|
|
@@ -7322,46 +7322,60 @@ async function runOffensiveSecurityAgent(input) {
|
|
|
7322
7322
|
return { streamResult: agent.streamResult, session: agent.session };
|
|
7323
7323
|
}
|
|
7324
7324
|
// src/core/agents/specialized/patching/prompts.ts
|
|
7325
|
-
var PREAMBLE2 = `You are an expert security vulnerability patching agent. Your goal is to analyze security vulnerabilities,
|
|
7325
|
+
var PREAMBLE2 = `You are an expert security vulnerability patching agent — an autonomous coding agent specialized in fixing security issues. Your goal is to analyze security vulnerabilities, apply high-quality fixes, verify they don't break existing functionality, and return structured PR metadata.`;
|
|
7326
7326
|
var ORIENT_STEP = `1. **Orient Yourself**:
|
|
7327
7327
|
- Review the AGENTS.md / project documentation provided in your prompt for build, lint, and test commands
|
|
7328
|
-
- Use list_files to explore the repository structure
|
|
7328
|
+
- Use glob / list_files to explore the repository structure (prefer glob for pattern searches like "**/*.ts")
|
|
7329
7329
|
- Read package.json, Makefile, or equivalent to understand the project's toolchain
|
|
7330
|
-
- Identify the lint command, test command, type-check command, and any other verification scripts
|
|
7331
|
-
|
|
7330
|
+
- Identify the lint command, test command, type-check command, and any other verification scripts
|
|
7331
|
+
- Optionally call profile_codebase for a high-level map of the repo`;
|
|
7332
|
+
var TASK_STEP = `2. **Track Work with Tasks**:
|
|
7333
|
+
- Use create_task early to decompose the job into concrete steps (orient, understand, edit, verify, finalize)
|
|
7334
|
+
- Update tasks with update_task as you progress (in_progress → completed / failed)
|
|
7335
|
+
- Use list_tasks when you need to recall what's left
|
|
7336
|
+
- Keep tasks atomic — one clear outcome per task`;
|
|
7337
|
+
var UNDERSTAND_STEP = `3. **Understand the Vulnerability**:
|
|
7332
7338
|
- Carefully read the vulnerability description, CWE mappings, and any dataflow analysis provided
|
|
7333
7339
|
- Understand the root cause: What makes this code vulnerable?
|
|
7334
7340
|
- Identify the attack vector: How would an attacker exploit this?
|
|
7335
|
-
- Consider the context: What is the application trying to do
|
|
7336
|
-
|
|
7341
|
+
- Consider the context: What is the application trying to do?
|
|
7342
|
+
- Use web_search / get_page when you need framework-specific security guidance or CVE details`;
|
|
7343
|
+
var REVIEW_STEP = `4. **Review the Code**:
|
|
7337
7344
|
- Use read_file to read the vulnerable file(s) mentioned in the issue
|
|
7338
|
-
- Use grep
|
|
7345
|
+
- Use grep or run_code_query for structural searches (rg / ast-grep) across related patterns
|
|
7339
7346
|
- Review related files: imports, dependencies, configuration files
|
|
7340
7347
|
- Understand the data flow: Where does user input come from? Where does it go?`;
|
|
7341
|
-
var PLAN_STEP = `
|
|
7348
|
+
var PLAN_STEP = `5. **Plan Your Fix**:
|
|
7342
7349
|
- Identify the exact code that needs to change
|
|
7343
7350
|
- Determine the appropriate security control (input validation, parameterized queries, access control, etc.)
|
|
7344
7351
|
- Consider side effects: Will this break existing functionality?
|
|
7345
7352
|
- Think about edge cases: What other inputs or scenarios need to be handled?
|
|
7346
7353
|
- Look for framework-specific or language-specific best practices
|
|
7347
|
-
- State your complete plan clearly before making changes`;
|
|
7348
|
-
var APPLY_STEP = `
|
|
7349
|
-
-
|
|
7354
|
+
- State your complete plan clearly before making changes, and reflect it in your task list`;
|
|
7355
|
+
var APPLY_STEP = `6. **Apply the Patch**:
|
|
7356
|
+
- Prefer update_file for small, exact string replacements
|
|
7357
|
+
- Prefer apply_patch (unified diff) for multi-hunk or multi-file edits
|
|
7350
7358
|
- Use create_file if you need to add new security utilities or middleware
|
|
7359
|
+
- Use delete_file only when removing obsolete insecure code that is truly unused
|
|
7351
7360
|
- Make minimal, targeted changes — don't refactor unrelated code
|
|
7352
7361
|
- Follow the existing code style and conventions
|
|
7353
7362
|
- Ensure your changes integrate cleanly with the existing codebase`;
|
|
7354
|
-
var
|
|
7363
|
+
var GIT_STEP = `7. **Self-Check with Git**:
|
|
7364
|
+
- Use git_status to see which files changed
|
|
7365
|
+
- Use git_diff to review the exact patch before verification
|
|
7366
|
+
- Do NOT commit, push, or open a PR — the host handles that after you finalize`;
|
|
7367
|
+
var RESTART_STEP = `8. **Restart Dev Environment** (if applicable):
|
|
7355
7368
|
- Use execute_command to restart any dev servers or services so your changes are loaded
|
|
7356
7369
|
- Wait for the services to become healthy`;
|
|
7357
|
-
var VERIFY_STEP = `
|
|
7370
|
+
var VERIFY_STEP = `9. **Verify the Patch**:
|
|
7358
7371
|
- Use execute_command to run the project's lint command (e.g. \`npm run lint\`, \`ruff check\`, \`cargo clippy\`)
|
|
7359
7372
|
- Use execute_command to run the project's type-check command if applicable (e.g. \`npx tsc --noEmit\`, \`mypy\`)
|
|
7360
7373
|
- Use execute_command to run the project's test suite (e.g. \`npm test\`, \`pytest\`, \`cargo test\`)
|
|
7361
7374
|
- If a Proof of Concept (POC) is provided, run it to verify the vulnerability is fixed — the POC should FAIL (non-zero exit code) after a successful patch
|
|
7362
7375
|
- If any check fails, read the error output carefully, fix the issues, and re-run until all checks pass
|
|
7363
7376
|
- If the project has no clear lint/test commands, at minimum verify the changed files parse correctly (e.g. \`node -c file.js\`, \`python -m py_compile file.py\`)`;
|
|
7364
|
-
var FINALIZE_STEP = `
|
|
7377
|
+
var FINALIZE_STEP = `10. **Finalize**:
|
|
7378
|
+
- Mark remaining tasks completed
|
|
7365
7379
|
- Use the response tool to complete the patching process
|
|
7366
7380
|
- Provide a clear, detailed summary of:
|
|
7367
7381
|
* Each file you changed and why
|
|
@@ -7428,12 +7442,18 @@ var SECURITY_BEST_PRACTICES = `# Security Best Practices by Vulnerability Type
|
|
|
7428
7442
|
- Remove sensitive data from client-side code`;
|
|
7429
7443
|
var TOOL_USAGE2 = `# Tool Usage
|
|
7430
7444
|
|
|
7431
|
-
- **
|
|
7445
|
+
- **glob**: Find files by pattern (e.g. "**/*.ts", "**/package.json")
|
|
7446
|
+
- **list_files**: Explore directory structure
|
|
7432
7447
|
- **read_file**: Read file contents to understand code
|
|
7433
|
-
- **grep**: Search for patterns
|
|
7434
|
-
- **
|
|
7435
|
-
- **
|
|
7436
|
-
- **
|
|
7448
|
+
- **grep** / **run_code_query**: Search for patterns (run_code_query supports rg / ast-grep / comby)
|
|
7449
|
+
- **profile_codebase**: High-level codebase map when orientation is hard
|
|
7450
|
+
- **web_search** / **get_page**: Look up CVE details, framework security docs
|
|
7451
|
+
- **create_task** / **update_task** / **list_tasks**: Todo tracking for the run
|
|
7452
|
+
- **update_file**: Small exact search-and-replace edits
|
|
7453
|
+
- **apply_patch**: Multi-hunk / multi-file unified diffs
|
|
7454
|
+
- **create_file** / **delete_file**: Add or remove files when needed
|
|
7455
|
+
- **git_status** / **git_diff**: Self-check changes (do not commit/push/PR)
|
|
7456
|
+
- **execute_command**: Lint, type-check, tests, restart services, run POCs
|
|
7437
7457
|
- **response**: Complete the process with the structured patch result`;
|
|
7438
7458
|
var REQUIREMENTS = `# Critical Requirements
|
|
7439
7459
|
|
|
@@ -7445,6 +7465,7 @@ var REQUIREMENTS = `# Critical Requirements
|
|
|
7445
7465
|
6. **Test the Fix**: If a POC is provided, run it after patching. The POC should FAIL (non-zero exit code) once the vulnerability is fixed.
|
|
7446
7466
|
7. **Be Persistent**: It may take multiple iterations to get the fix right — iterate until the POC fails and tests pass.
|
|
7447
7467
|
8. **Be Complete**: Address the root cause, not just symptoms
|
|
7468
|
+
9. **Stay Autonomous**: You will not receive follow-up messages — finish the job in this run
|
|
7448
7469
|
|
|
7449
7470
|
# Important Notes
|
|
7450
7471
|
|
|
@@ -7455,17 +7476,20 @@ var REQUIREMENTS = `# Critical Requirements
|
|
|
7455
7476
|
- Follow language and framework conventions
|
|
7456
7477
|
- When multiple approaches exist, choose the most secure and idiomatic
|
|
7457
7478
|
- If a fix requires configuration changes or environment variables, note this clearly
|
|
7458
|
-
- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands
|
|
7479
|
+
- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands
|
|
7480
|
+
- Do not commit, push, or open a pull request — the host does that after your response`;
|
|
7459
7481
|
function buildSystemPrompt() {
|
|
7460
7482
|
return [
|
|
7461
7483
|
PREAMBLE2,
|
|
7462
7484
|
"",
|
|
7463
7485
|
"# Process",
|
|
7464
7486
|
"",
|
|
7465
|
-
"You MUST follow this
|
|
7487
|
+
"You MUST follow this autonomous coding-agent process:",
|
|
7466
7488
|
"",
|
|
7467
7489
|
ORIENT_STEP,
|
|
7468
7490
|
"",
|
|
7491
|
+
TASK_STEP,
|
|
7492
|
+
"",
|
|
7469
7493
|
UNDERSTAND_STEP,
|
|
7470
7494
|
"",
|
|
7471
7495
|
REVIEW_STEP,
|
|
@@ -7474,6 +7498,8 @@ function buildSystemPrompt() {
|
|
|
7474
7498
|
"",
|
|
7475
7499
|
APPLY_STEP,
|
|
7476
7500
|
"",
|
|
7501
|
+
GIT_STEP,
|
|
7502
|
+
"",
|
|
7477
7503
|
RESTART_STEP,
|
|
7478
7504
|
"",
|
|
7479
7505
|
VERIFY_STEP,
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
2
|
EvidenceFileEntrySchema
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-dc9hkjxy.js";
|
|
4
4
|
import {
|
|
5
5
|
CweEntrySchema,
|
|
6
6
|
ValidatedCweEntrySchema,
|
|
7
7
|
hasCanonicalName
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-n3b2j6ny.js";
|
|
9
9
|
import {
|
|
10
10
|
exports_external,
|
|
11
11
|
init_zod
|
|
@@ -1,20 +1,20 @@
|
|
|
1
1
|
import {
|
|
2
2
|
BlackboxAttackSurfaceAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-mkwj11fx.js";
|
|
4
4
|
import {
|
|
5
5
|
REPORT_FILENAME_JSON,
|
|
6
6
|
REPORT_FILENAME_MD,
|
|
7
7
|
buildPentestReport,
|
|
8
8
|
renderJson,
|
|
9
9
|
renderMarkdown
|
|
10
|
-
} from "./cli-
|
|
10
|
+
} from "./cli-9r34w599.js";
|
|
11
11
|
import {
|
|
12
12
|
TargetedPentestAgent,
|
|
13
13
|
buildPentestSystemPrompt
|
|
14
|
-
} from "./cli-
|
|
14
|
+
} from "./cli-ngraq4cd.js";
|
|
15
15
|
import {
|
|
16
16
|
CodeAgent
|
|
17
|
-
} from "./cli-
|
|
17
|
+
} from "./cli-v2fgyeby.js";
|
|
18
18
|
import {
|
|
19
19
|
AppsDiscoveryResultSchema,
|
|
20
20
|
DiscoverySummarySchema,
|
|
@@ -22,7 +22,7 @@ import {
|
|
|
22
22
|
WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
|
|
23
23
|
WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
|
|
24
24
|
WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
|
|
25
|
-
} from "./cli-
|
|
25
|
+
} from "./cli-vxvwqnsz.js";
|
|
26
26
|
import {
|
|
27
27
|
FindingsRegistry,
|
|
28
28
|
OffensiveSecurityAgent,
|
|
@@ -31,7 +31,7 @@ import {
|
|
|
31
31
|
pLimit,
|
|
32
32
|
runWithBoundedConcurrency,
|
|
33
33
|
toGrpcPentestContext
|
|
34
|
-
} from "./cli-
|
|
34
|
+
} from "./cli-n3b2j6ny.js";
|
|
35
35
|
import {
|
|
36
36
|
createThreatModelPrompt
|
|
37
37
|
} from "./cli-fw5r7pfj.js";
|
|
@@ -45,7 +45,7 @@ import {
|
|
|
45
45
|
init_structured,
|
|
46
46
|
newSessionId,
|
|
47
47
|
scopedLogger
|
|
48
|
-
} from "./cli-
|
|
48
|
+
} from "./cli-ecryj1ac.js";
|
|
49
49
|
import {
|
|
50
50
|
__require
|
|
51
51
|
} from "./cli-8rxa073f.js";
|
|
@@ -7786,7 +7786,7 @@ async function runPentestSwarm(input) {
|
|
|
7786
7786
|
}
|
|
7787
7787
|
async function runPentestWorkflow(input) {
|
|
7788
7788
|
if (input.fastStrike) {
|
|
7789
|
-
const { runFastStrike } = await import("./fastStrike-
|
|
7789
|
+
const { runFastStrike } = await import("./fastStrike-9y8vcm4e.js");
|
|
7790
7790
|
return runFastStrike(input);
|
|
7791
7791
|
}
|
|
7792
7792
|
const {
|
|
@@ -4,7 +4,7 @@ import {
|
|
|
4
4
|
init_auth,
|
|
5
5
|
init_constants,
|
|
6
6
|
signGatewayRequest
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-r040hsff.js";
|
|
8
8
|
import {
|
|
9
9
|
AISDKError,
|
|
10
10
|
APICallError,
|
|
@@ -87,11 +87,11 @@ import {
|
|
|
87
87
|
import {
|
|
88
88
|
config,
|
|
89
89
|
init_config
|
|
90
|
-
} from "./cli-
|
|
90
|
+
} from "./cli-pjrh9qaw.js";
|
|
91
91
|
import {
|
|
92
92
|
getCurrentVersion,
|
|
93
93
|
init_installation
|
|
94
|
-
} from "./cli-
|
|
94
|
+
} from "./cli-sjs324ah.js";
|
|
95
95
|
import {
|
|
96
96
|
__callDispose,
|
|
97
97
|
__commonJS,
|
|
@@ -47127,7 +47127,7 @@ async function create2(input) {
|
|
|
47127
47127
|
if (normalizedConfig?.headers !== undefined) {
|
|
47128
47128
|
snapshotHeaders = { ...normalizedConfig.headers };
|
|
47129
47129
|
} else {
|
|
47130
|
-
const { config: appConfig } = await import("./index-
|
|
47130
|
+
const { config: appConfig } = await import("./index-12cvbsdg.js");
|
|
47131
47131
|
const cfg = await appConfig.get();
|
|
47132
47132
|
snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
|
|
47133
47133
|
}
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-n3b2j6ny.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-9czjkypb.js";
|
|
7
7
|
import {
|
|
8
8
|
hasToolCall,
|
|
9
9
|
init_dist,
|
|
10
10
|
stepCountIs
|
|
11
|
-
} from "./cli-
|
|
11
|
+
} from "./cli-ecryj1ac.js";
|
|
12
12
|
|
|
13
13
|
// src/core/agents/specialized/attackSurface/blackboxAgent.ts
|
|
14
14
|
init_dist();
|