@pensar/apex 2.2.0-canary.d6258ef8 → 2.3.0-canary.f43660dd

package/build/{agent-frsp4e9f.js → agent-54zbjp5g.js}

@@ -4,19 +4,19 @@ import {
   buildPentestActiveTools,
   buildPentestPrompt,
   buildPentestSystemPrompt
-} from "./cli-zw2vjs4v.js";
+} from "./cli-jz6ak250.js";
 import"./cli-9fsre5pt.js";
-import"./cli-gr20jztt.js";
-import"./cli-8dgnq80w.js";
-import"./cli-w8evvv3q.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
 import"./cli-c8131c4q.js";
-import"./cli-h6czbkax.js";
-import"./cli-z7h336ft.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-d5w0q9np.js";
-import"./cli-g200wfvt.js";
-import"./cli-q5f1hbhm.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
 import"./cli-8rxa073f.js";
 export {
   buildPentestSystemPrompt,

package/build/agent-dmfqxetq.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-crbamax1.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
+import"./cli-c8131c4q.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-qp259717.js → agent-nr5eq27w.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-8dgnq80w.js";
+} from "./cli-tzaxpbx8.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-w8evvv3q.js";
+} from "./cli-5b7x19aa.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-h6czbkax.js";
-import"./cli-z7h336ft.js";
+} from "./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-d5w0q9np.js";
-import"./cli-g200wfvt.js";
-import"./cli-q5f1hbhm.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/{apps-qxqkv051.js → apps-yhq3vem2.js}

@@ -12,27 +12,27 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-6tvsa4qw.js";
-import"./cli-h3128sv8.js";
-import"./cli-tvv03x9s.js";
-import"./cli-e4vp401h.js";
-import"./cli-zw2vjs4v.js";
-import"./cli-j1p3f9rw.js";
-import"./cli-cs6sg81e.js";
-import"./cli-2g238meq.js";
+} from "./cli-8nmjfxpb.js";
+import"./cli-5vskcg6x.js";
+import"./cli-kkkxevak.js";
+import"./cli-3m2x8w2t.js";
+import"./cli-jz6ak250.js";
+import"./cli-y177s333.js";
+import"./cli-crbamax1.js";
+import"./cli-c5e9y4f7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-gr20jztt.js";
-import"./cli-8dgnq80w.js";
-import"./cli-w8evvv3q.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-h6czbkax.js";
-import"./cli-z7h336ft.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-d5w0q9np.js";
-import"./cli-g200wfvt.js";
-import"./cli-q5f1hbhm.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-t59cz517.js → auth-kag9cbnd.js}

@@ -1,20 +1,21 @@
 #!/usr/bin/env bun
-import"./cli-6tvsa4qw.js";
-import"./cli-h3128sv8.js";
-import"./cli-tvv03x9s.js";
-import"./cli-e4vp401h.js";
-import"./cli-zw2vjs4v.js";
-import"./cli-j1p3f9rw.js";
-import"./cli-cs6sg81e.js";
-import"./cli-2g238meq.js";
+import"./cli-8nmjfxpb.js";
+import"./cli-5vskcg6x.js";
+import"./cli-kkkxevak.js";
+import"./cli-3m2x8w2t.js";
+import"./cli-jz6ak250.js";
+import"./cli-y177s333.js";
+import"./cli-crbamax1.js";
+import"./cli-c5e9y4f7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-gr20jztt.js";
-import"./cli-8dgnq80w.js";
-import"./cli-w8evvv3q.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-h6czbkax.js";
+import"./cli-kpabqavj.js";
 import {
+  createWorkspaceSelection,
   disconnect,
   fetchWorkspaces,
   getPensarApiUrl,
@@ -24,17 +25,18 @@ import {
   pollForWorkspaceCreation,
   pollLegacyToken,
   pollWorkOSToken,
+  pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-z7h336ft.js";
+} from "./cli-mg5hqzfk.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-d5w0q9np.js";
-import"./cli-g200wfvt.js";
-import"./cli-q5f1hbhm.js";
+} from "./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
 import {
   __require
 } from "./cli-8rxa073f.js";
@@ -70,26 +72,16 @@ function prompt(question) {
     });
   });
 }
-async function promptWorkspaceSelection(workspaces) {
+async function selectWorkspaceInBrowser(apiUrl, accessToken) {
+  const selection = await createWorkspaceSelection(apiUrl, accessToken);
+  openUrl(selection.selectionUrl);
   console.log(`
-Select a workspace:
-`);
-  workspaces.forEach((ws, i) => {
-    console.log(`  ${i + 1}. ${ws.name} (${ws.slug}) — $${ws.balance.toFixed(2)}`);
-  });
-  const answer = await prompt(`
-Enter number (1-${workspaces.length}): `);
-  const index = parseInt(answer, 10) - 1;
-  if (Number.isNaN(index) || index < 0 || index >= workspaces.length) {
-    console.error("Invalid selection.");
-    process.exit(1);
-  }
-  const workspace = workspaces[index];
-  if (!workspace) {
-    console.error("Invalid selection.");
-    process.exit(1);
-  }
-  return workspace;
+You have multiple workspaces. Choose one in your browser to continue.
+If the browser didn't open, visit:
+  ${selection.selectionUrl}
+
+Waiting for workspace selection...`);
+  return pollWorkspaceSelection(apiUrl, accessToken, selection.selectionId);
 }
 async function login() {
   const appConfig = await config.get();
@@ -187,17 +179,18 @@ If the browser didn't open, visit: ${consoleUrl}/create-workspace?redirect=/cred
     console.log("Waiting for workspace creation...");
     workspaces = await pollForWorkspaceCreation(apiUrl, accessToken);
   }
-  let workspace;
+  let workspaceId;
   if (workspaces.length === 1) {
     const onlyWorkspace = workspaces[0];
     if (!onlyWorkspace) {
       throw new Error("No workspace available after workspace lookup");
     }
-    workspace = onlyWorkspace;
+    workspaceId = onlyWorkspace.id;
   } else {
-    workspace = await promptWorkspaceSelection(workspaces);
+    workspaceId = await selectWorkspaceInBrowser(apiUrl, accessToken);
   }
-  const result = await selectWorkspace(apiUrl, accessToken, workspace.id);
+  const result = await selectWorkspace(apiUrl, accessToken, workspaceId);
+  const workspace = result.workspace;
   await config.update({
     workspaceId: workspace.id,
     workspaceSlug: workspace.slug,

package/build/authentication-hx4920t3.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-y177s333.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
+import"./cli-c8131c4q.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-ga9cc2sv.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-kkkxevak.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
+import"./cli-c8131c4q.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-tfw4qs8h.js → blackboxPentest-hac0kjq7.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-h3128sv8.js";
-import"./cli-tvv03x9s.js";
-import"./cli-e4vp401h.js";
-import"./cli-zw2vjs4v.js";
-import"./cli-cs6sg81e.js";
-import"./cli-2g238meq.js";
+} from "./cli-5vskcg6x.js";
+import"./cli-kkkxevak.js";
+import"./cli-3m2x8w2t.js";
+import"./cli-jz6ak250.js";
+import"./cli-crbamax1.js";
+import"./cli-c5e9y4f7.js";
 import"./cli-9fsre5pt.js";
-import"./cli-gr20jztt.js";
-import"./cli-8dgnq80w.js";
-import"./cli-w8evvv3q.js";
+import"./cli-ez994rr8.js";
+import"./cli-tzaxpbx8.js";
+import"./cli-5b7x19aa.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-h6czbkax.js";
-import"./cli-z7h336ft.js";
+import"./cli-kpabqavj.js";
+import"./cli-mg5hqzfk.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-d5w0q9np.js";
-import"./cli-g200wfvt.js";
-import"./cli-q5f1hbhm.js";
+import"./cli-bpd40kwt.js";
+import"./cli-0cw9k1tw.js";
+import"./cli-nw87xhd7.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-g200wfvt.js → cli-0cw9k1tw.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-q5f1hbhm.js";
+} from "./cli-nw87xhd7.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";
@@ -38,6 +38,7 @@ function applyEnvFallbacks(parsedConfig) {
     ...parsedConfig,
     responsibleUseAccepted: parsedConfig.responsibleUseAccepted ?? false,
     defaultHeaders: parsedConfig.defaultHeaders ?? DEFAULT_CONFIG.defaultHeaders,
+    strikeMode: parsedConfig.strikeMode ?? DEFAULT_CONFIG.strikeMode,
     surfaceIntegrationEnabled: parsedConfig.surfaceIntegrationEnabled ?? parseBoolEnv(process.env.PENSAR_SURFACE_INTEGRATION),
     version,
     openAiAPIKey: parsedConfig.openAiAPIKey ?? process.env.OPENAI_API_KEY,
@@ -78,7 +79,8 @@ var init_config = __esm(() => {
   init_installation();
   DEFAULT_CONFIG = {
     responsibleUseAccepted: false,
-    defaultHeaders: { "User-Agent": "pensar-apex" }
+    defaultHeaders: { "User-Agent": "pensar-apex" },
+    strikeMode: false
   };
 });
 

package/build/{cli-e4vp401h.js → cli-3m2x8w2t.js}

@@ -1,11 +1,11 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-gr20jztt.js";
+} from "./cli-ez994rr8.js";
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-8dgnq80w.js";
+} from "./cli-tzaxpbx8.js";
 import {
   exports_external,
   init_zod

package/build/{cli-w8evvv3q.js → cli-5b7x19aa.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-h6czbkax.js";
+} from "./cli-kpabqavj.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-1pvfb9z0.js → cli-5dj8fc52.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-h6czbkax.js";
+} from "./cli-kpabqavj.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-h3128sv8.js → cli-5vskcg6x.js}

@@ -1,20 +1,20 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-tvv03x9s.js";
+} from "./cli-kkkxevak.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-e4vp401h.js";
+} from "./cli-3m2x8w2t.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-zw2vjs4v.js";
+} from "./cli-jz6ak250.js";
 import {
   CodeAgent
-} from "./cli-cs6sg81e.js";
+} from "./cli-crbamax1.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -22,7 +22,7 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-2g238meq.js";
+} from "./cli-c5e9y4f7.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-8dgnq80w.js";
+} from "./cli-tzaxpbx8.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,7 +45,7 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-h6czbkax.js";
+} from "./cli-kpabqavj.js";
 import {
   __require
 } from "./cli-8rxa073f.js";
@@ -7786,7 +7786,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-5fwva78y.js");
+    const { runFastStrike } = await import("./fastStrike-r2nnp14k.js");
     return runFastStrike(input);
   }
   const {

package/build/{cli-6tvsa4qw.js → cli-8nmjfxpb.js}

@@ -4,19 +4,19 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-8dgnq80w.js";
+} from "./cli-tzaxpbx8.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-h6czbkax.js";
+} from "./cli-kpabqavj.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-z7h336ft.js";
+} from "./cli-mg5hqzfk.js";
 import {
   exports_external,
   init_zod
@@ -24,7 +24,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-d5w0q9np.js";
+} from "./cli-bpd40kwt.js";
 import {
   __commonJS,
   __require
@@ -7135,6 +7135,12 @@ async function updateIssue(issueId, data) {
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
+async function linkPullRequest(issueId, url) {
+  return apiRequest("POST", `/issues/${issueId}/pull-requests`, { url });
+}
+async function listIssuePullRequests(issueId) {
+  return apiRequest("GET", `/issues/${issueId}/pull-requests`);
+}
 async function listFixes(issueId) {
   return apiRequest("GET", `/issues/${issueId}/fixes`);
 }
@@ -7322,46 +7328,60 @@ async function runOffensiveSecurityAgent(input) {
   return { streamResult: agent.streamResult, session: agent.session };
 }
 // src/core/agents/specialized/patching/prompts.ts
-var PREAMBLE2 = `You are an expert security vulnerability patching agent. Your goal is to analyze security vulnerabilities, provide high-quality fixes, and verify the fixes don't break existing functionality.`;
+var PREAMBLE2 = `You are an expert security vulnerability patching agent — an autonomous coding agent specialized in fixing security issues. Your goal is to analyze security vulnerabilities, apply high-quality fixes, verify they don't break existing functionality, and return structured PR metadata.`;
 var ORIENT_STEP = `1. **Orient Yourself**:
    - Review the AGENTS.md / project documentation provided in your prompt for build, lint, and test commands
-   - Use list_files to explore the repository structure
+   - Use glob / list_files to explore the repository structure (prefer glob for pattern searches like "**/*.ts")
    - Read package.json, Makefile, or equivalent to understand the project's toolchain
-   - Identify the lint command, test command, type-check command, and any other verification scripts`;
-var UNDERSTAND_STEP = `2. **Understand the Vulnerability**: 
+   - Identify the lint command, test command, type-check command, and any other verification scripts
+   - Optionally call profile_codebase for a high-level map of the repo`;
+var TASK_STEP = `2. **Track Work with Tasks**:
+   - Use create_task early to decompose the job into concrete steps (orient, understand, edit, verify, finalize)
+   - Update tasks with update_task as you progress (in_progress → completed / failed)
+   - Use list_tasks when you need to recall what's left
+   - Keep tasks atomic — one clear outcome per task`;
+var UNDERSTAND_STEP = `3. **Understand the Vulnerability**:
    - Carefully read the vulnerability description, CWE mappings, and any dataflow analysis provided
    - Understand the root cause: What makes this code vulnerable?
    - Identify the attack vector: How would an attacker exploit this?
-   - Consider the context: What is the application trying to do?`;
-var REVIEW_STEP = `3. **Review the Code**:
+   - Consider the context: What is the application trying to do?
+   - Use web_search / get_page when you need framework-specific security guidance or CVE details`;
+var REVIEW_STEP = `4. **Review the Code**:
    - Use read_file to read the vulnerable file(s) mentioned in the issue
-   - Use grep to search for related code patterns, similar vulnerabilities, or existing security controls
+   - Use grep or run_code_query for structural searches (rg / ast-grep) across related patterns
    - Review related files: imports, dependencies, configuration files
    - Understand the data flow: Where does user input come from? Where does it go?`;
-var PLAN_STEP = `4. **Plan Your Fix**:
+var PLAN_STEP = `5. **Plan Your Fix**:
    - Identify the exact code that needs to change
    - Determine the appropriate security control (input validation, parameterized queries, access control, etc.)
    - Consider side effects: Will this break existing functionality?
    - Think about edge cases: What other inputs or scenarios need to be handled?
    - Look for framework-specific or language-specific best practices
-   - State your complete plan clearly before making changes`;
-var APPLY_STEP = `5. **Apply the Patch**:
-   - Use update_file to modify existing files with your security fixes
+   - State your complete plan clearly before making changes, and reflect it in your task list`;
+var APPLY_STEP = `6. **Apply the Patch**:
+   - Prefer update_file for small, exact string replacements
+   - Prefer apply_patch (unified diff) for multi-hunk or multi-file edits
    - Use create_file if you need to add new security utilities or middleware
+   - Use delete_file only when removing obsolete insecure code that is truly unused
    - Make minimal, targeted changes — don't refactor unrelated code
    - Follow the existing code style and conventions
    - Ensure your changes integrate cleanly with the existing codebase`;
-var RESTART_STEP = `6. **Restart Dev Environment** (if applicable):
+var GIT_STEP = `7. **Self-Check with Git**:
+   - Use git_status to see which files changed
+   - Use git_diff to review the exact patch before verification
+   - Do NOT commit, push, or open a PR — the host handles that after you finalize`;
+var RESTART_STEP = `8. **Restart Dev Environment** (if applicable):
    - Use execute_command to restart any dev servers or services so your changes are loaded
    - Wait for the services to become healthy`;
-var VERIFY_STEP = `7. **Verify the Patch**:
+var VERIFY_STEP = `9. **Verify the Patch**:
    - Use execute_command to run the project's lint command (e.g. \`npm run lint\`, \`ruff check\`, \`cargo clippy\`)
    - Use execute_command to run the project's type-check command if applicable (e.g. \`npx tsc --noEmit\`, \`mypy\`)
    - Use execute_command to run the project's test suite (e.g. \`npm test\`, \`pytest\`, \`cargo test\`)
    - If a Proof of Concept (POC) is provided, run it to verify the vulnerability is fixed — the POC should FAIL (non-zero exit code) after a successful patch
    - If any check fails, read the error output carefully, fix the issues, and re-run until all checks pass
    - If the project has no clear lint/test commands, at minimum verify the changed files parse correctly (e.g. \`node -c file.js\`, \`python -m py_compile file.py\`)`;
-var FINALIZE_STEP = `8. **Finalize**:
+var FINALIZE_STEP = `10. **Finalize**:
+   - Mark remaining tasks completed
    - Use the response tool to complete the patching process
    - Provide a clear, detailed summary of:
      * Each file you changed and why
@@ -7428,12 +7448,18 @@ var SECURITY_BEST_PRACTICES = `# Security Best Practices by Vulnerability Type
 - Remove sensitive data from client-side code`;
 var TOOL_USAGE2 = `# Tool Usage
 
-- **list_files**: Explore directory structure and find relevant files
+- **glob**: Find files by pattern (e.g. "**/*.ts", "**/package.json")
+- **list_files**: Explore directory structure
 - **read_file**: Read file contents to understand code
-- **grep**: Search for patterns across the codebase
-- **update_file**: Modify existing files with security fixes
-- **create_file**: Create new files if needed (utilities, middleware, etc.)
-- **execute_command**: Run shell commands — use for linting, type-checking, running tests, restarting services, running POCs, installing dependencies, and verifying your changes
+- **grep** / **run_code_query**: Search for patterns (run_code_query supports rg / ast-grep / comby)
+- **profile_codebase**: High-level codebase map when orientation is hard
+- **web_search** / **get_page**: Look up CVE details, framework security docs
+- **create_task** / **update_task** / **list_tasks**: Todo tracking for the run
+- **update_file**: Small exact search-and-replace edits
+- **apply_patch**: Multi-hunk / multi-file unified diffs
+- **create_file** / **delete_file**: Add or remove files when needed
+- **git_status** / **git_diff**: Self-check changes (do not commit/push/PR)
+- **execute_command**: Lint, type-check, tests, restart services, run POCs
 - **response**: Complete the process with the structured patch result`;
 var REQUIREMENTS = `# Critical Requirements
 
@@ -7445,6 +7471,7 @@ var REQUIREMENTS = `# Critical Requirements
 6. **Test the Fix**: If a POC is provided, run it after patching. The POC should FAIL (non-zero exit code) once the vulnerability is fixed.
 7. **Be Persistent**: It may take multiple iterations to get the fix right — iterate until the POC fails and tests pass.
 8. **Be Complete**: Address the root cause, not just symptoms
+9. **Stay Autonomous**: You will not receive follow-up messages — finish the job in this run
 
 # Important Notes
 
@@ -7455,17 +7482,20 @@ var REQUIREMENTS = `# Critical Requirements
 - Follow language and framework conventions
 - When multiple approaches exist, choose the most secure and idiomatic
 - If a fix requires configuration changes or environment variables, note this clearly
-- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands`;
+- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands
+- Do not commit, push, or open a pull request — the host does that after your response`;
 function buildSystemPrompt() {
   return [
     PREAMBLE2,
     "",
     "# Process",
     "",
-    "You MUST follow this prescriptive process:",
+    "You MUST follow this autonomous coding-agent process:",
     "",
     ORIENT_STEP,
     "",
+    TASK_STEP,
+    "",
     UNDERSTAND_STEP,
     "",
     REVIEW_STEP,
@@ -7474,6 +7504,8 @@ function buildSystemPrompt() {
     "",
     APPLY_STEP,
     "",
+    GIT_STEP,
+    "",
     RESTART_STEP,
     "",
     VERIFY_STEP,
@@ -8307,4 +8339,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };

package/build/{cli-d5w0q9np.js → cli-bpd40kwt.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-g200wfvt.js";
+} from "./cli-0cw9k1tw.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";

package/build/{cli-2g238meq.js → cli-c5e9y4f7.js}

@@ -2,11 +2,11 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-8dgnq80w.js";
+} from "./cli-tzaxpbx8.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-h6czbkax.js";
+} from "./cli-kpabqavj.js";
 import {
   exports_external,
   init_zod,