@pensar/apex 2.2.0-canary.85a9da57 → 2.2.0-canary.9a2febe4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/build/{agent-9j0t23gh.js → agent-jgjybz1n.js} +7 -7
  2. package/build/{agent-n467bw8f.js → agent-k45ne7sv.js} +9 -9
  3. package/build/agent-xgc74kbv.js +19 -0
  4. package/build/{apps-fgh1j83g.js → apps-g798rjfk.js} +16 -16
  5. package/build/{auth-mrtqpn8r.js → auth-5f8vv91e.js} +16 -16
  6. package/build/authentication-x59g8700.js +19 -0
  7. package/build/blackboxAgent-shd4qagm.js +19 -0
  8. package/build/{blackboxPentest-9d2hr7xv.js → blackboxPentest-d855jz1c.js} +14 -14
  9. package/build/{cli-whg4krbb.js → cli-8gv5fr2e.js} +51 -25
  10. package/build/{cli-draweqwg.js → cli-9czjkypb.js} +1 -1
  11. package/build/{cli-69xfj2a5.js → cli-9r34w599.js} +2 -2
  12. package/build/{cli-m7se6ehn.js → cli-agxy98cy.js} +8 -8
  13. package/build/{cli-9489ah09.js → cli-dc9hkjxy.js} +1 -1
  14. package/build/{cli-dq4pfsaf.js → cli-ecryj1ac.js} +4 -4
  15. package/build/{cli-tqj2cwed.js → cli-f1467gv6.js} +1 -1
  16. package/build/{cli-zbhf6wnd.js → cli-mkwj11fx.js} +3 -3
  17. package/build/{cli-n9yjp8w4.js → cli-n3b2j6ny.js} +3922 -55
  18. package/build/{cli-6azgnarp.js → cli-ngraq4cd.js} +2 -2
  19. package/build/{cli-wvrke9n9.js → cli-pjrh9qaw.js} +1 -1
  20. package/build/{cli-sp72n0rn.js → cli-qm4w7r2x.js} +1 -1
  21. package/build/{cli-anr9cqj2.js → cli-r040hsff.js} +1 -1
  22. package/build/{cli-ahz5mbyf.js → cli-sjs324ah.js} +1 -1
  23. package/build/{cli-yjbbecv8.js → cli-v2fgyeby.js} +2 -2
  24. package/build/{cli-fzhcb5ew.js → cli-vxvwqnsz.js} +2 -2
  25. package/build/{cli-r7pfx8my.js → cli-zkfskzs2.js} +3 -3
  26. package/build/cli.js +33 -33
  27. package/build/{config-9m5vb0vc.js → config-bjkaeps2.js} +3 -3
  28. package/build/{doctor-pbvg07ep.js → doctor-ka53crep.js} +6 -6
  29. package/build/{fastStrike-e5hdhz84.js → fastStrike-9y8vcm4e.js} +9 -9
  30. package/build/{fixes-36phvkst.js → fixes-4zbphchd.js} +16 -16
  31. package/build/{index-e797mn6q.js → index-12cvbsdg.js} +3 -3
  32. package/build/{index-vwq3ghts.js → index-1ezyeq2e.js} +4 -4
  33. package/build/{index-n1ytyz1y.js → index-8vecxw29.js} +8 -8
  34. package/build/{index-4e2zw6g5.js → index-cwbk0edn.js} +23 -18
  35. package/build/{index-tznnrk1k.js → index-g6f4qa7x.js} +2 -2
  36. package/build/{index-gc8f2j76.js → index-nwk6q6s7.js} +6 -6
  37. package/build/{index-vp4ds92k.js → index-z6nwmwjp.js} +9 -9
  38. package/build/{issues-c644kscp.js → issues-hpt8dcqk.js} +16 -16
  39. package/build/{logs-kbekta1x.js → logs-7sbzraj6.js} +16 -16
  40. package/build/{offesecAgent-ae72yxjj.js → offesecAgent-zh7gt11q.js} +8 -8
  41. package/build/pentest-gqn794ny.js +29 -0
  42. package/build/{pentests-4fm9fb8y.js → pentests-qvy26e74.js} +16 -16
  43. package/build/{targetedPentest-69st5njn.js → targetedPentest-e9282gzp.js} +9 -9
  44. package/build/{targets-4p21w40t.js → targets-6wctny3k.js} +16 -16
  45. package/build/threatModel-7qwdhyg6.js +27 -0
  46. package/build/{uninstall-3ef8qwdm.js → uninstall-gsjm07fz.js} +1 -1
  47. package/build/{upload-y1fz1kjt.js → upload-a6s9qd5c.js} +6 -6
  48. package/build/{utils-vzdw0qt6.js → utils-d470qka4.js} +5 -5
  49. package/package.json +1 -1
  50. package/build/agent-5nwx2gw3.js +0 -19
  51. package/build/authentication-gj2vkdy8.js +0 -19
  52. package/build/blackboxAgent-09tvycba.js +0 -19
  53. package/build/pentest-b483h0gs.js +0 -29
  54. package/build/threatModel-tx9z2gf7.js +0 -27
@@ -1,23 +1,23 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-n9yjp8w4.js";
3
+ } from "./cli-n3b2j6ny.js";
4
4
  import {
5
5
  detectOSAndEnhancePrompt
6
- } from "./cli-draweqwg.js";
6
+ } from "./cli-9czjkypb.js";
7
7
  import"./cli-c8131c4q.js";
8
8
  import {
9
9
  init_dist,
10
10
  stepCountIs
11
- } from "./cli-dq4pfsaf.js";
12
- import"./cli-anr9cqj2.js";
11
+ } from "./cli-ecryj1ac.js";
12
+ import"./cli-r040hsff.js";
13
13
  import {
14
14
  exports_external,
15
15
  init_zod
16
16
  } from "./cli-3k1x5rn3.js";
17
17
  import"./cli-gpnb45ck.js";
18
- import"./cli-wvrke9n9.js";
19
- import"./cli-sp72n0rn.js";
20
- import"./cli-ahz5mbyf.js";
18
+ import"./cli-pjrh9qaw.js";
19
+ import"./cli-qm4w7r2x.js";
20
+ import"./cli-sjs324ah.js";
21
21
  import"./cli-8rxa073f.js";
22
22
 
23
23
  // src/core/agents/specialized/findingJudge/agent.ts
@@ -4,19 +4,19 @@ import {
4
4
  buildPentestActiveTools,
5
5
  buildPentestPrompt,
6
6
  buildPentestSystemPrompt
7
- } from "./cli-6azgnarp.js";
7
+ } from "./cli-ngraq4cd.js";
8
8
  import"./cli-9fsre5pt.js";
9
- import"./cli-9489ah09.js";
10
- import"./cli-n9yjp8w4.js";
11
- import"./cli-draweqwg.js";
9
+ import"./cli-dc9hkjxy.js";
10
+ import"./cli-n3b2j6ny.js";
11
+ import"./cli-9czjkypb.js";
12
12
  import"./cli-c8131c4q.js";
13
- import"./cli-dq4pfsaf.js";
14
- import"./cli-anr9cqj2.js";
13
+ import"./cli-ecryj1ac.js";
14
+ import"./cli-r040hsff.js";
15
15
  import"./cli-3k1x5rn3.js";
16
16
  import"./cli-gpnb45ck.js";
17
- import"./cli-wvrke9n9.js";
18
- import"./cli-sp72n0rn.js";
19
- import"./cli-ahz5mbyf.js";
17
+ import"./cli-pjrh9qaw.js";
18
+ import"./cli-qm4w7r2x.js";
19
+ import"./cli-sjs324ah.js";
20
20
  import"./cli-8rxa073f.js";
21
21
  export {
22
22
  buildPentestSystemPrompt,
@@ -0,0 +1,19 @@
1
+ import {
2
+ CodeAgent
3
+ } from "./cli-v2fgyeby.js";
4
+ import"./cli-9fsre5pt.js";
5
+ import"./cli-dc9hkjxy.js";
6
+ import"./cli-n3b2j6ny.js";
7
+ import"./cli-9czjkypb.js";
8
+ import"./cli-c8131c4q.js";
9
+ import"./cli-ecryj1ac.js";
10
+ import"./cli-r040hsff.js";
11
+ import"./cli-3k1x5rn3.js";
12
+ import"./cli-gpnb45ck.js";
13
+ import"./cli-pjrh9qaw.js";
14
+ import"./cli-qm4w7r2x.js";
15
+ import"./cli-sjs324ah.js";
16
+ import"./cli-8rxa073f.js";
17
+ export {
18
+ CodeAgent
19
+ };
@@ -12,27 +12,27 @@ import {
12
12
  searchEndpoints,
13
13
  updateApp,
14
14
  updateEndpoint
15
- } from "./cli-whg4krbb.js";
16
- import"./cli-m7se6ehn.js";
17
- import"./cli-zbhf6wnd.js";
18
- import"./cli-69xfj2a5.js";
19
- import"./cli-6azgnarp.js";
20
- import"./cli-r7pfx8my.js";
21
- import"./cli-yjbbecv8.js";
22
- import"./cli-fzhcb5ew.js";
15
+ } from "./cli-8gv5fr2e.js";
16
+ import"./cli-agxy98cy.js";
17
+ import"./cli-mkwj11fx.js";
18
+ import"./cli-9r34w599.js";
19
+ import"./cli-ngraq4cd.js";
20
+ import"./cli-zkfskzs2.js";
21
+ import"./cli-v2fgyeby.js";
22
+ import"./cli-vxvwqnsz.js";
23
23
  import"./cli-9fsre5pt.js";
24
- import"./cli-9489ah09.js";
25
- import"./cli-n9yjp8w4.js";
26
- import"./cli-draweqwg.js";
24
+ import"./cli-dc9hkjxy.js";
25
+ import"./cli-n3b2j6ny.js";
26
+ import"./cli-9czjkypb.js";
27
27
  import"./cli-fw5r7pfj.js";
28
28
  import"./cli-c8131c4q.js";
29
- import"./cli-dq4pfsaf.js";
30
- import"./cli-anr9cqj2.js";
29
+ import"./cli-ecryj1ac.js";
30
+ import"./cli-r040hsff.js";
31
31
  import"./cli-3k1x5rn3.js";
32
32
  import"./cli-gpnb45ck.js";
33
- import"./cli-wvrke9n9.js";
34
- import"./cli-sp72n0rn.js";
35
- import"./cli-ahz5mbyf.js";
33
+ import"./cli-pjrh9qaw.js";
34
+ import"./cli-qm4w7r2x.js";
35
+ import"./cli-sjs324ah.js";
36
36
  import"./cli-8rxa073f.js";
37
37
 
38
38
  // src/cli/apps.ts
@@ -1,19 +1,19 @@
1
1
  #!/usr/bin/env bun
2
- import"./cli-whg4krbb.js";
3
- import"./cli-m7se6ehn.js";
4
- import"./cli-zbhf6wnd.js";
5
- import"./cli-69xfj2a5.js";
6
- import"./cli-6azgnarp.js";
7
- import"./cli-r7pfx8my.js";
8
- import"./cli-yjbbecv8.js";
9
- import"./cli-fzhcb5ew.js";
2
+ import"./cli-8gv5fr2e.js";
3
+ import"./cli-agxy98cy.js";
4
+ import"./cli-mkwj11fx.js";
5
+ import"./cli-9r34w599.js";
6
+ import"./cli-ngraq4cd.js";
7
+ import"./cli-zkfskzs2.js";
8
+ import"./cli-v2fgyeby.js";
9
+ import"./cli-vxvwqnsz.js";
10
10
  import"./cli-9fsre5pt.js";
11
- import"./cli-9489ah09.js";
12
- import"./cli-n9yjp8w4.js";
13
- import"./cli-draweqwg.js";
11
+ import"./cli-dc9hkjxy.js";
12
+ import"./cli-n3b2j6ny.js";
13
+ import"./cli-9czjkypb.js";
14
14
  import"./cli-fw5r7pfj.js";
15
15
  import"./cli-c8131c4q.js";
16
- import"./cli-dq4pfsaf.js";
16
+ import"./cli-ecryj1ac.js";
17
17
  import {
18
18
  disconnect,
19
19
  fetchWorkspaces,
@@ -26,15 +26,15 @@ import {
26
26
  pollWorkOSToken,
27
27
  selectWorkspace,
28
28
  startDeviceFlow
29
- } from "./cli-anr9cqj2.js";
29
+ } from "./cli-r040hsff.js";
30
30
  import"./cli-3k1x5rn3.js";
31
31
  import"./cli-gpnb45ck.js";
32
32
  import {
33
33
  config,
34
34
  init_config
35
- } from "./cli-wvrke9n9.js";
36
- import"./cli-sp72n0rn.js";
37
- import"./cli-ahz5mbyf.js";
35
+ } from "./cli-pjrh9qaw.js";
36
+ import"./cli-qm4w7r2x.js";
37
+ import"./cli-sjs324ah.js";
38
38
  import {
39
39
  __require
40
40
  } from "./cli-8rxa073f.js";
@@ -0,0 +1,19 @@
1
+ import {
2
+ runAuthenticationAgent
3
+ } from "./cli-zkfskzs2.js";
4
+ import"./cli-9fsre5pt.js";
5
+ import"./cli-dc9hkjxy.js";
6
+ import"./cli-n3b2j6ny.js";
7
+ import"./cli-9czjkypb.js";
8
+ import"./cli-c8131c4q.js";
9
+ import"./cli-ecryj1ac.js";
10
+ import"./cli-r040hsff.js";
11
+ import"./cli-3k1x5rn3.js";
12
+ import"./cli-gpnb45ck.js";
13
+ import"./cli-pjrh9qaw.js";
14
+ import"./cli-qm4w7r2x.js";
15
+ import"./cli-sjs324ah.js";
16
+ import"./cli-8rxa073f.js";
17
+ export {
18
+ runAuthenticationAgent
19
+ };
@@ -0,0 +1,19 @@
1
+ import {
2
+ BlackboxAttackSurfaceAgent
3
+ } from "./cli-mkwj11fx.js";
4
+ import"./cli-9fsre5pt.js";
5
+ import"./cli-dc9hkjxy.js";
6
+ import"./cli-n3b2j6ny.js";
7
+ import"./cli-9czjkypb.js";
8
+ import"./cli-c8131c4q.js";
9
+ import"./cli-ecryj1ac.js";
10
+ import"./cli-r040hsff.js";
11
+ import"./cli-3k1x5rn3.js";
12
+ import"./cli-gpnb45ck.js";
13
+ import"./cli-pjrh9qaw.js";
14
+ import"./cli-qm4w7r2x.js";
15
+ import"./cli-sjs324ah.js";
16
+ import"./cli-8rxa073f.js";
17
+ export {
18
+ BlackboxAttackSurfaceAgent
19
+ };
@@ -1,24 +1,24 @@
1
1
  import {
2
2
  runPentestWorkflow
3
- } from "./cli-m7se6ehn.js";
4
- import"./cli-zbhf6wnd.js";
5
- import"./cli-69xfj2a5.js";
6
- import"./cli-6azgnarp.js";
7
- import"./cli-yjbbecv8.js";
8
- import"./cli-fzhcb5ew.js";
3
+ } from "./cli-agxy98cy.js";
4
+ import"./cli-mkwj11fx.js";
5
+ import"./cli-9r34w599.js";
6
+ import"./cli-ngraq4cd.js";
7
+ import"./cli-v2fgyeby.js";
8
+ import"./cli-vxvwqnsz.js";
9
9
  import"./cli-9fsre5pt.js";
10
- import"./cli-9489ah09.js";
11
- import"./cli-n9yjp8w4.js";
12
- import"./cli-draweqwg.js";
10
+ import"./cli-dc9hkjxy.js";
11
+ import"./cli-n3b2j6ny.js";
12
+ import"./cli-9czjkypb.js";
13
13
  import"./cli-fw5r7pfj.js";
14
14
  import"./cli-c8131c4q.js";
15
- import"./cli-dq4pfsaf.js";
16
- import"./cli-anr9cqj2.js";
15
+ import"./cli-ecryj1ac.js";
16
+ import"./cli-r040hsff.js";
17
17
  import"./cli-3k1x5rn3.js";
18
18
  import"./cli-gpnb45ck.js";
19
- import"./cli-wvrke9n9.js";
20
- import"./cli-sp72n0rn.js";
21
- import"./cli-ahz5mbyf.js";
19
+ import"./cli-pjrh9qaw.js";
20
+ import"./cli-qm4w7r2x.js";
21
+ import"./cli-sjs324ah.js";
22
22
  import"./cli-8rxa073f.js";
23
23
 
24
24
  // src/core/api/blackboxPentest.ts
@@ -4,19 +4,19 @@ import {
4
4
  OffensiveSecurityAgent,
5
5
  SKILL_TOOL_NAMES,
6
6
  buildBaseSystemPrompt
7
- } from "./cli-n9yjp8w4.js";
7
+ } from "./cli-n3b2j6ny.js";
8
8
  import {
9
9
  init_dist,
10
10
  init_session,
11
11
  sessions,
12
12
  stepCountIs
13
- } from "./cli-dq4pfsaf.js";
13
+ } from "./cli-ecryj1ac.js";
14
14
  import {
15
15
  ensureValidToken,
16
16
  getPensarApiUrl,
17
17
  init_auth,
18
18
  init_constants
19
- } from "./cli-anr9cqj2.js";
19
+ } from "./cli-r040hsff.js";
20
20
  import {
21
21
  exports_external,
22
22
  init_zod
@@ -24,7 +24,7 @@ import {
24
24
  import {
25
25
  config,
26
26
  init_config
27
- } from "./cli-wvrke9n9.js";
27
+ } from "./cli-pjrh9qaw.js";
28
28
  import {
29
29
  __commonJS,
30
30
  __require
@@ -7322,46 +7322,60 @@ async function runOffensiveSecurityAgent(input) {
7322
7322
  return { streamResult: agent.streamResult, session: agent.session };
7323
7323
  }
7324
7324
  // src/core/agents/specialized/patching/prompts.ts
7325
- var PREAMBLE2 = `You are an expert security vulnerability patching agent. Your goal is to analyze security vulnerabilities, provide high-quality fixes, and verify the fixes don't break existing functionality.`;
7325
+ var PREAMBLE2 = `You are an expert security vulnerability patching agent — an autonomous coding agent specialized in fixing security issues. Your goal is to analyze security vulnerabilities, apply high-quality fixes, verify they don't break existing functionality, and return structured PR metadata.`;
7326
7326
  var ORIENT_STEP = `1. **Orient Yourself**:
7327
7327
  - Review the AGENTS.md / project documentation provided in your prompt for build, lint, and test commands
7328
- - Use list_files to explore the repository structure
7328
+ - Use glob / list_files to explore the repository structure (prefer glob for pattern searches like "**/*.ts")
7329
7329
  - Read package.json, Makefile, or equivalent to understand the project's toolchain
7330
- - Identify the lint command, test command, type-check command, and any other verification scripts`;
7331
- var UNDERSTAND_STEP = `2. **Understand the Vulnerability**:
7330
+ - Identify the lint command, test command, type-check command, and any other verification scripts
7331
+ - Optionally call profile_codebase for a high-level map of the repo`;
7332
+ var TASK_STEP = `2. **Track Work with Tasks**:
7333
+ - Use create_task early to decompose the job into concrete steps (orient, understand, edit, verify, finalize)
7334
+ - Update tasks with update_task as you progress (in_progress → completed / failed)
7335
+ - Use list_tasks when you need to recall what's left
7336
+ - Keep tasks atomic — one clear outcome per task`;
7337
+ var UNDERSTAND_STEP = `3. **Understand the Vulnerability**:
7332
7338
  - Carefully read the vulnerability description, CWE mappings, and any dataflow analysis provided
7333
7339
  - Understand the root cause: What makes this code vulnerable?
7334
7340
  - Identify the attack vector: How would an attacker exploit this?
7335
- - Consider the context: What is the application trying to do?`;
7336
- var REVIEW_STEP = `3. **Review the Code**:
7341
+ - Consider the context: What is the application trying to do?
7342
+ - Use web_search / get_page when you need framework-specific security guidance or CVE details`;
7343
+ var REVIEW_STEP = `4. **Review the Code**:
7337
7344
  - Use read_file to read the vulnerable file(s) mentioned in the issue
7338
- - Use grep to search for related code patterns, similar vulnerabilities, or existing security controls
7345
+ - Use grep or run_code_query for structural searches (rg / ast-grep) across related patterns
7339
7346
  - Review related files: imports, dependencies, configuration files
7340
7347
  - Understand the data flow: Where does user input come from? Where does it go?`;
7341
- var PLAN_STEP = `4. **Plan Your Fix**:
7348
+ var PLAN_STEP = `5. **Plan Your Fix**:
7342
7349
  - Identify the exact code that needs to change
7343
7350
  - Determine the appropriate security control (input validation, parameterized queries, access control, etc.)
7344
7351
  - Consider side effects: Will this break existing functionality?
7345
7352
  - Think about edge cases: What other inputs or scenarios need to be handled?
7346
7353
  - Look for framework-specific or language-specific best practices
7347
- - State your complete plan clearly before making changes`;
7348
- var APPLY_STEP = `5. **Apply the Patch**:
7349
- - Use update_file to modify existing files with your security fixes
7354
+ - State your complete plan clearly before making changes, and reflect it in your task list`;
7355
+ var APPLY_STEP = `6. **Apply the Patch**:
7356
+ - Prefer update_file for small, exact string replacements
7357
+ - Prefer apply_patch (unified diff) for multi-hunk or multi-file edits
7350
7358
  - Use create_file if you need to add new security utilities or middleware
7359
+ - Use delete_file only when removing obsolete insecure code that is truly unused
7351
7360
  - Make minimal, targeted changes — don't refactor unrelated code
7352
7361
  - Follow the existing code style and conventions
7353
7362
  - Ensure your changes integrate cleanly with the existing codebase`;
7354
- var RESTART_STEP = `6. **Restart Dev Environment** (if applicable):
7363
+ var GIT_STEP = `7. **Self-Check with Git**:
7364
+ - Use git_status to see which files changed
7365
+ - Use git_diff to review the exact patch before verification
7366
+ - Do NOT commit, push, or open a PR — the host handles that after you finalize`;
7367
+ var RESTART_STEP = `8. **Restart Dev Environment** (if applicable):
7355
7368
  - Use execute_command to restart any dev servers or services so your changes are loaded
7356
7369
  - Wait for the services to become healthy`;
7357
- var VERIFY_STEP = `7. **Verify the Patch**:
7370
+ var VERIFY_STEP = `9. **Verify the Patch**:
7358
7371
  - Use execute_command to run the project's lint command (e.g. \`npm run lint\`, \`ruff check\`, \`cargo clippy\`)
7359
7372
  - Use execute_command to run the project's type-check command if applicable (e.g. \`npx tsc --noEmit\`, \`mypy\`)
7360
7373
  - Use execute_command to run the project's test suite (e.g. \`npm test\`, \`pytest\`, \`cargo test\`)
7361
7374
  - If a Proof of Concept (POC) is provided, run it to verify the vulnerability is fixed — the POC should FAIL (non-zero exit code) after a successful patch
7362
7375
  - If any check fails, read the error output carefully, fix the issues, and re-run until all checks pass
7363
7376
  - If the project has no clear lint/test commands, at minimum verify the changed files parse correctly (e.g. \`node -c file.js\`, \`python -m py_compile file.py\`)`;
7364
- var FINALIZE_STEP = `8. **Finalize**:
7377
+ var FINALIZE_STEP = `10. **Finalize**:
7378
+ - Mark remaining tasks completed
7365
7379
  - Use the response tool to complete the patching process
7366
7380
  - Provide a clear, detailed summary of:
7367
7381
  * Each file you changed and why
@@ -7428,12 +7442,18 @@ var SECURITY_BEST_PRACTICES = `# Security Best Practices by Vulnerability Type
7428
7442
  - Remove sensitive data from client-side code`;
7429
7443
  var TOOL_USAGE2 = `# Tool Usage
7430
7444
 
7431
- - **list_files**: Explore directory structure and find relevant files
7445
+ - **glob**: Find files by pattern (e.g. "**/*.ts", "**/package.json")
7446
+ - **list_files**: Explore directory structure
7432
7447
  - **read_file**: Read file contents to understand code
7433
- - **grep**: Search for patterns across the codebase
7434
- - **update_file**: Modify existing files with security fixes
7435
- - **create_file**: Create new files if needed (utilities, middleware, etc.)
7436
- - **execute_command**: Run shell commands use for linting, type-checking, running tests, restarting services, running POCs, installing dependencies, and verifying your changes
7448
+ - **grep** / **run_code_query**: Search for patterns (run_code_query supports rg / ast-grep / comby)
7449
+ - **profile_codebase**: High-level codebase map when orientation is hard
7450
+ - **web_search** / **get_page**: Look up CVE details, framework security docs
7451
+ - **create_task** / **update_task** / **list_tasks**: Todo tracking for the run
7452
+ - **update_file**: Small exact search-and-replace edits
7453
+ - **apply_patch**: Multi-hunk / multi-file unified diffs
7454
+ - **create_file** / **delete_file**: Add or remove files when needed
7455
+ - **git_status** / **git_diff**: Self-check changes (do not commit/push/PR)
7456
+ - **execute_command**: Lint, type-check, tests, restart services, run POCs
7437
7457
  - **response**: Complete the process with the structured patch result`;
7438
7458
  var REQUIREMENTS = `# Critical Requirements
7439
7459
 
@@ -7445,6 +7465,7 @@ var REQUIREMENTS = `# Critical Requirements
7445
7465
  6. **Test the Fix**: If a POC is provided, run it after patching. The POC should FAIL (non-zero exit code) once the vulnerability is fixed.
7446
7466
  7. **Be Persistent**: It may take multiple iterations to get the fix right — iterate until the POC fails and tests pass.
7447
7467
  8. **Be Complete**: Address the root cause, not just symptoms
7468
+ 9. **Stay Autonomous**: You will not receive follow-up messages — finish the job in this run
7448
7469
 
7449
7470
  # Important Notes
7450
7471
 
@@ -7455,17 +7476,20 @@ var REQUIREMENTS = `# Critical Requirements
7455
7476
  - Follow language and framework conventions
7456
7477
  - When multiple approaches exist, choose the most secure and idiomatic
7457
7478
  - If a fix requires configuration changes or environment variables, note this clearly
7458
- - If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands`;
7479
+ - If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands
7480
+ - Do not commit, push, or open a pull request — the host does that after your response`;
7459
7481
  function buildSystemPrompt() {
7460
7482
  return [
7461
7483
  PREAMBLE2,
7462
7484
  "",
7463
7485
  "# Process",
7464
7486
  "",
7465
- "You MUST follow this prescriptive process:",
7487
+ "You MUST follow this autonomous coding-agent process:",
7466
7488
  "",
7467
7489
  ORIENT_STEP,
7468
7490
  "",
7491
+ TASK_STEP,
7492
+ "",
7469
7493
  UNDERSTAND_STEP,
7470
7494
  "",
7471
7495
  REVIEW_STEP,
@@ -7474,6 +7498,8 @@ function buildSystemPrompt() {
7474
7498
  "",
7475
7499
  APPLY_STEP,
7476
7500
  "",
7501
+ GIT_STEP,
7502
+ "",
7477
7503
  RESTART_STEP,
7478
7504
  "",
7479
7505
  VERIFY_STEP,
@@ -3,7 +3,7 @@ import {
3
3
  init_lazyLogger,
4
4
  init_structured,
5
5
  scopedLogger
6
- } from "./cli-dq4pfsaf.js";
6
+ } from "./cli-ecryj1ac.js";
7
7
 
8
8
  // src/core/agents/specialized/utils.ts
9
9
  import { execSync } from "node:child_process";
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  EvidenceFileEntrySchema
3
- } from "./cli-9489ah09.js";
3
+ } from "./cli-dc9hkjxy.js";
4
4
  import {
5
5
  CweEntrySchema,
6
6
  ValidatedCweEntrySchema,
7
7
  hasCanonicalName
8
- } from "./cli-n9yjp8w4.js";
8
+ } from "./cli-n3b2j6ny.js";
9
9
  import {
10
10
  exports_external,
11
11
  init_zod
@@ -1,20 +1,20 @@
1
1
  import {
2
2
  BlackboxAttackSurfaceAgent
3
- } from "./cli-zbhf6wnd.js";
3
+ } from "./cli-mkwj11fx.js";
4
4
  import {
5
5
  REPORT_FILENAME_JSON,
6
6
  REPORT_FILENAME_MD,
7
7
  buildPentestReport,
8
8
  renderJson,
9
9
  renderMarkdown
10
- } from "./cli-69xfj2a5.js";
10
+ } from "./cli-9r34w599.js";
11
11
  import {
12
12
  TargetedPentestAgent,
13
13
  buildPentestSystemPrompt
14
- } from "./cli-6azgnarp.js";
14
+ } from "./cli-ngraq4cd.js";
15
15
  import {
16
16
  CodeAgent
17
- } from "./cli-yjbbecv8.js";
17
+ } from "./cli-v2fgyeby.js";
18
18
  import {
19
19
  AppsDiscoveryResultSchema,
20
20
  DiscoverySummarySchema,
@@ -22,7 +22,7 @@ import {
22
22
  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
23
23
  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
24
24
  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
25
- } from "./cli-fzhcb5ew.js";
25
+ } from "./cli-vxvwqnsz.js";
26
26
  import {
27
27
  FindingsRegistry,
28
28
  OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
31
31
  pLimit,
32
32
  runWithBoundedConcurrency,
33
33
  toGrpcPentestContext
34
- } from "./cli-n9yjp8w4.js";
34
+ } from "./cli-n3b2j6ny.js";
35
35
  import {
36
36
  createThreatModelPrompt
37
37
  } from "./cli-fw5r7pfj.js";
@@ -45,7 +45,7 @@ import {
45
45
  init_structured,
46
46
  newSessionId,
47
47
  scopedLogger
48
- } from "./cli-dq4pfsaf.js";
48
+ } from "./cli-ecryj1ac.js";
49
49
  import {
50
50
  __require
51
51
  } from "./cli-8rxa073f.js";
@@ -7786,7 +7786,7 @@ async function runPentestSwarm(input) {
7786
7786
  }
7787
7787
  async function runPentestWorkflow(input) {
7788
7788
  if (input.fastStrike) {
7789
- const { runFastStrike } = await import("./fastStrike-e5hdhz84.js");
7789
+ const { runFastStrike } = await import("./fastStrike-9y8vcm4e.js");
7790
7790
  return runFastStrike(input);
7791
7791
  }
7792
7792
  const {
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  CweEntrySchema,
3
3
  ValidatedCweEntrySchema
4
- } from "./cli-n9yjp8w4.js";
4
+ } from "./cli-n3b2j6ny.js";
5
5
  import {
6
6
  exports_external,
7
7
  init_zod
@@ -4,7 +4,7 @@ import {
4
4
  init_auth,
5
5
  init_constants,
6
6
  signGatewayRequest
7
- } from "./cli-anr9cqj2.js";
7
+ } from "./cli-r040hsff.js";
8
8
  import {
9
9
  AISDKError,
10
10
  APICallError,
@@ -87,11 +87,11 @@ import {
87
87
  import {
88
88
  config,
89
89
  init_config
90
- } from "./cli-wvrke9n9.js";
90
+ } from "./cli-pjrh9qaw.js";
91
91
  import {
92
92
  getCurrentVersion,
93
93
  init_installation
94
- } from "./cli-ahz5mbyf.js";
94
+ } from "./cli-sjs324ah.js";
95
95
  import {
96
96
  __callDispose,
97
97
  __commonJS,
@@ -47127,7 +47127,7 @@ async function create2(input) {
47127
47127
  if (normalizedConfig?.headers !== undefined) {
47128
47128
  snapshotHeaders = { ...normalizedConfig.headers };
47129
47129
  } else {
47130
- const { config: appConfig } = await import("./index-e797mn6q.js");
47130
+ const { config: appConfig } = await import("./index-12cvbsdg.js");
47131
47131
  const cfg = await appConfig.get();
47132
47132
  snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
47133
47133
  }
@@ -3,7 +3,7 @@ import {
3
3
  init_lazyLogger,
4
4
  init_structured,
5
5
  scopedLogger
6
- } from "./cli-dq4pfsaf.js";
6
+ } from "./cli-ecryj1ac.js";
7
7
 
8
8
  // src/core/integrations/wandb/client.ts
9
9
  init_structured();
@@ -1,14 +1,14 @@
1
1
  import {
2
2
  OffensiveSecurityAgent
3
- } from "./cli-n9yjp8w4.js";
3
+ } from "./cli-n3b2j6ny.js";
4
4
  import {
5
5
  detectOSAndEnhancePrompt
6
- } from "./cli-draweqwg.js";
6
+ } from "./cli-9czjkypb.js";
7
7
  import {
8
8
  hasToolCall,
9
9
  init_dist,
10
10
  stepCountIs
11
- } from "./cli-dq4pfsaf.js";
11
+ } from "./cli-ecryj1ac.js";
12
12
 
13
13
  // src/core/agents/specialized/attackSurface/blackboxAgent.ts
14
14
  init_dist();