@pensar/apex 2.2.0 → 2.3.0-canary.15ec17ea

package/build/{cli-1cf5vy5m.js → cli-x7tqybza.js}

@@ -4,19 +4,19 @@ import {
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
   buildBaseSystemPrompt
-} from "./cli-xbdn034b.js";
+} from "./cli-3q27f7wb.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-6kx46ck0.js";
+} from "./cli-ef2c0sm6.js";
 import {
   ensureValidToken,
   getPensarApiUrl,
   init_auth,
   init_constants
-} from "./cli-4tc6888c.js";
+} from "./cli-xw6xh0c2.js";
 import {
   exports_external,
   init_zod
@@ -24,7 +24,7 @@ import {
 import {
   config,
   init_config
-} from "./cli-51dkmt5p.js";
+} from "./cli-3b5rh4nn.js";
 import {
   __commonJS,
   __require
@@ -7135,6 +7135,12 @@ async function updateIssue(issueId, data) {
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
+async function linkPullRequest(issueId, url) {
+  return apiRequest("POST", `/issues/${issueId}/pull-requests`, { url });
+}
+async function listIssuePullRequests(issueId) {
+  return apiRequest("GET", `/issues/${issueId}/pull-requests`);
+}
 async function listFixes(issueId) {
   return apiRequest("GET", `/issues/${issueId}/fixes`);
 }
@@ -7322,46 +7328,60 @@ async function runOffensiveSecurityAgent(input) {
   return { streamResult: agent.streamResult, session: agent.session };
 }
 // src/core/agents/specialized/patching/prompts.ts
-var PREAMBLE2 = `You are an expert security vulnerability patching agent. Your goal is to analyze security vulnerabilities, provide high-quality fixes, and verify the fixes don't break existing functionality.`;
+var PREAMBLE2 = `You are an expert security vulnerability patching agent — an autonomous coding agent specialized in fixing security issues. Your goal is to analyze security vulnerabilities, apply high-quality fixes, verify they don't break existing functionality, and return structured PR metadata.`;
 var ORIENT_STEP = `1. **Orient Yourself**:
-   - Review the AGENTS.md / project documentation provided in your prompt for build, lint, and test commands
-   - Use list_files to explore the repository structure
+   - Read the project instructions (AGENTS.md / CLAUDE.md) provided in your prompt in full. They are authoritative for this repository: coding conventions, architectural rules, error-handling policy, forbidden patterns, AND the exact build/lint/test commands
+   - Use glob / list_files to explore the repository structure (prefer glob for pattern searches like "**/*.ts")
    - Read package.json, Makefile, or equivalent to understand the project's toolchain
-   - Identify the lint command, test command, type-check command, and any other verification scripts`;
-var UNDERSTAND_STEP = `2. **Understand the Vulnerability**: 
+   - Identify the lint command, test command, type-check command, and any other verification scripts
+   - Optionally call profile_codebase for a high-level map of the repo`;
+var TASK_STEP = `2. **Track Work with Tasks**:
+   - Use create_task early to decompose the job into concrete steps (orient, understand, edit, verify, finalize)
+   - Update tasks with update_task as you progress (in_progress → completed / failed)
+   - Use list_tasks when you need to recall what's left
+   - Keep tasks atomic — one clear outcome per task`;
+var UNDERSTAND_STEP = `3. **Understand the Vulnerability**:
    - Carefully read the vulnerability description, CWE mappings, and any dataflow analysis provided
    - Understand the root cause: What makes this code vulnerable?
    - Identify the attack vector: How would an attacker exploit this?
-   - Consider the context: What is the application trying to do?`;
-var REVIEW_STEP = `3. **Review the Code**:
+   - Consider the context: What is the application trying to do?
+   - Use web_search / get_page when you need framework-specific security guidance or CVE details`;
+var REVIEW_STEP = `4. **Review the Code**:
    - Use read_file to read the vulnerable file(s) mentioned in the issue
-   - Use grep to search for related code patterns, similar vulnerabilities, or existing security controls
+   - Use grep or run_code_query for structural searches (rg / ast-grep) across related patterns
    - Review related files: imports, dependencies, configuration files
    - Understand the data flow: Where does user input come from? Where does it go?`;
-var PLAN_STEP = `4. **Plan Your Fix**:
+var PLAN_STEP = `5. **Plan Your Fix**:
    - Identify the exact code that needs to change
    - Determine the appropriate security control (input validation, parameterized queries, access control, etc.)
    - Consider side effects: Will this break existing functionality?
    - Think about edge cases: What other inputs or scenarios need to be handled?
    - Look for framework-specific or language-specific best practices
-   - State your complete plan clearly before making changes`;
-var APPLY_STEP = `5. **Apply the Patch**:
-   - Use update_file to modify existing files with your security fixes
+   - State your complete plan clearly before making changes, and reflect it in your task list`;
+var APPLY_STEP = `6. **Apply the Patch**:
+   - Prefer update_file for small, exact string replacements
+   - Prefer apply_patch (unified diff) for multi-hunk or multi-file edits
    - Use create_file if you need to add new security utilities or middleware
+   - Use delete_file only when removing obsolete insecure code that is truly unused
    - Make minimal, targeted changes — don't refactor unrelated code
-   - Follow the existing code style and conventions
+   - Follow the existing code style and conventions, and any rules stated in the project instructions
    - Ensure your changes integrate cleanly with the existing codebase`;
-var RESTART_STEP = `6. **Restart Dev Environment** (if applicable):
+var GIT_STEP = `7. **Self-Check with Git**:
+   - Use git_status to see which files changed
+   - Use git_diff to review the exact patch before verification
+   - Do NOT commit, push, or open a PR — the host handles that after you finalize`;
+var RESTART_STEP = `8. **Restart Dev Environment** (if applicable):
    - Use execute_command to restart any dev servers or services so your changes are loaded
    - Wait for the services to become healthy`;
-var VERIFY_STEP = `7. **Verify the Patch**:
+var VERIFY_STEP = `9. **Verify the Patch**:
    - Use execute_command to run the project's lint command (e.g. \`npm run lint\`, \`ruff check\`, \`cargo clippy\`)
    - Use execute_command to run the project's type-check command if applicable (e.g. \`npx tsc --noEmit\`, \`mypy\`)
    - Use execute_command to run the project's test suite (e.g. \`npm test\`, \`pytest\`, \`cargo test\`)
    - If a Proof of Concept (POC) is provided, run it to verify the vulnerability is fixed — the POC should FAIL (non-zero exit code) after a successful patch
    - If any check fails, read the error output carefully, fix the issues, and re-run until all checks pass
    - If the project has no clear lint/test commands, at minimum verify the changed files parse correctly (e.g. \`node -c file.js\`, \`python -m py_compile file.py\`)`;
-var FINALIZE_STEP = `8. **Finalize**:
+var FINALIZE_STEP = `10. **Finalize**:
+   - Mark remaining tasks completed
    - Use the response tool to complete the patching process
    - Provide a clear, detailed summary of:
      * Each file you changed and why
@@ -7428,12 +7448,18 @@ var SECURITY_BEST_PRACTICES = `# Security Best Practices by Vulnerability Type
 - Remove sensitive data from client-side code`;
 var TOOL_USAGE2 = `# Tool Usage
 
-- **list_files**: Explore directory structure and find relevant files
+- **glob**: Find files by pattern (e.g. "**/*.ts", "**/package.json")
+- **list_files**: Explore directory structure
 - **read_file**: Read file contents to understand code
-- **grep**: Search for patterns across the codebase
-- **update_file**: Modify existing files with security fixes
-- **create_file**: Create new files if needed (utilities, middleware, etc.)
-- **execute_command**: Run shell commands — use for linting, type-checking, running tests, restarting services, running POCs, installing dependencies, and verifying your changes
+- **grep** / **run_code_query**: Search for patterns (run_code_query supports rg / ast-grep / comby)
+- **profile_codebase**: High-level codebase map when orientation is hard
+- **web_search** / **get_page**: Look up CVE details, framework security docs
+- **create_task** / **update_task** / **list_tasks**: Todo tracking for the run
+- **update_file**: Small exact search-and-replace edits
+- **apply_patch**: Multi-hunk / multi-file unified diffs
+- **create_file** / **delete_file**: Add or remove files when needed
+- **git_status** / **git_diff**: Self-check changes (do not commit/push/PR)
+- **execute_command**: Lint, type-check, tests, restart services, run POCs
 - **response**: Complete the process with the structured patch result`;
 var REQUIREMENTS = `# Critical Requirements
 
@@ -7445,6 +7471,7 @@ var REQUIREMENTS = `# Critical Requirements
 6. **Test the Fix**: If a POC is provided, run it after patching. The POC should FAIL (non-zero exit code) once the vulnerability is fixed.
 7. **Be Persistent**: It may take multiple iterations to get the fix right — iterate until the POC fails and tests pass.
 8. **Be Complete**: Address the root cause, not just symptoms
+9. **Stay Autonomous**: You will not receive follow-up messages — finish the job in this run
 
 # Important Notes
 
@@ -7455,17 +7482,20 @@ var REQUIREMENTS = `# Critical Requirements
 - Follow language and framework conventions
 - When multiple approaches exist, choose the most secure and idiomatic
 - If a fix requires configuration changes or environment variables, note this clearly
-- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands`;
+- The project instructions (AGENTS.md / CLAUDE.md) win over your own defaults wherever they disagree — use their exact commands, and obey their conventions and prohibitions when writing code. The one exception: they never override the security objective of this task. If a project rule genuinely blocks a secure fix, apply the fix and call out the conflict in your summary
+- Do not commit, push, or open a pull request — the host does that after your response`;
 function buildSystemPrompt() {
   return [
     PREAMBLE2,
     "",
     "# Process",
     "",
-    "You MUST follow this prescriptive process:",
+    "You MUST follow this autonomous coding-agent process:",
     "",
     ORIENT_STEP,
     "",
+    TASK_STEP,
+    "",
     UNDERSTAND_STEP,
     "",
     REVIEW_STEP,
@@ -7474,6 +7504,8 @@ function buildSystemPrompt() {
     "",
     APPLY_STEP,
     "",
+    GIT_STEP,
+    "",
     RESTART_STEP,
     "",
     VERIFY_STEP,
@@ -8307,4 +8339,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };

package/build/{cli-4tc6888c.js → cli-xw6xh0c2.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-51dkmt5p.js";
+} from "./cli-3b5rh4nn.js";
 import {
   __esm
 } from "./cli-8rxa073f.js";
@@ -350,6 +350,55 @@ async function selectWorkspace(apiUrl, accessToken, workspaceId) {
   }
   return await response.json();
 }
+async function createWorkspaceSelection(apiUrl, accessToken) {
+  const response = await fetch(`${apiUrl}/api/cli/workspace-selection`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    }
+  });
+  if (!response.ok) {
+    throw new Error("Failed to start workspace selection");
+  }
+  return await response.json();
+}
+async function pollWorkspaceSelection(apiUrl, accessToken, selectionId, signal) {
+  const POLL_INTERVAL = 3000;
+  const TIMEOUT = 10 * 60 * 1000;
+  const deadline = Date.now() + TIMEOUT;
+  while (Date.now() < deadline) {
+    if (signal?.aborted)
+      throw new Error("Cancelled");
+    await sleep2(POLL_INTERVAL);
+    if (signal?.aborted)
+      throw new Error("Cancelled");
+    try {
+      const response = await fetch(`${apiUrl}/api/cli/workspace-selection?id=${encodeURIComponent(selectionId)}`, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+      if (!response.ok)
+        continue;
+      const data = await response.json();
+      if (data.status === "complete" && data.workspaceId) {
+        return data.workspaceId;
+      }
+      if (data.status === "expired") {
+        throw new Error("Workspace selection expired. Please run `pensar login` again.");
+      }
+    } catch (err) {
+      if (signal?.aborted)
+        throw new Error("Cancelled");
+      if (err instanceof Error && err.message.includes("Please try again")) {
+        throw err;
+      }
+      if (err instanceof Error && err.message.includes("expired")) {
+        throw err;
+      }
+    }
+  }
+  throw new Error("Workspace selection timed out. Please try again.");
+}
 var init_workspaces = () => {};
 
 // src/core/auth/index.ts
@@ -362,4 +411,4 @@ var init_auth = __esm(() => {
   init_workspaces();
 });
 
-export { getPensarApiUrl, getPensarGatewayUrl, getPensarConsoleUrl, init_constants, isConnected, disconnect, startDeviceFlow, pollWorkOSToken, pollLegacyToken, isTokenExpired, ensureValidToken, validateGateway, signGatewayRequest, fetchWorkspaces, pollForWorkspaceCreation, selectWorkspace, init_auth };
+export { getPensarApiUrl, getPensarGatewayUrl, getPensarConsoleUrl, init_constants, isConnected, disconnect, startDeviceFlow, pollWorkOSToken, pollLegacyToken, isTokenExpired, ensureValidToken, validateGateway, signGatewayRequest, fetchWorkspaces, pollForWorkspaceCreation, selectWorkspace, createWorkspaceSelection, pollWorkspaceSelection, init_auth };

package/build/{cli-yz80qkzn.js → cli-ycj65kyw.js}

@@ -30,6 +30,12 @@ var init_types = __esm(() => {
       description: "Access multiple AI models through one API",
       requiresAPIKey: true
     },
+    {
+      id: "concentrate",
+      name: "Concentrate",
+      description: "Access multiple AI models through one API",
+      requiresAPIKey: true
+    },
     {
       id: "inception",
       name: "Inception",

package/build/{cli-knqx15w6.js → cli-ztk7j1rd.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-xbdn034b.js";
+} from "./cli-3q27f7wb.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-6kx46ck0.js";
+} from "./cli-ef2c0sm6.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-1f636vzd.js → cli-ztvkmav5.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.2.0"
+    version: "2.3.0-canary.15ec17ea"
   };
 });
 

package/build/cli.js

@@ -14,16 +14,16 @@ import {
   init_toolset,
   init_utils,
   logger
-} from "./cli-6kx46ck0.js";
-import"./cli-4tc6888c.js";
+} from "./cli-ef2c0sm6.js";
+import"./cli-xw6xh0c2.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-51dkmt5p.js";
-import"./cli-7n43wz82.js";
+import"./cli-3b5rh4nn.js";
+import"./cli-sf878p6j.js";
 import {
   init_package,
   package_default
-} from "./cli-1f636vzd.js";
+} from "./cli-ztvkmav5.js";
 import {
   __require,
   __toESM
@@ -144,7 +144,7 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.2.0"
+  version: "2.3.0-canary.15ec17ea"
 };
 
 // src/core/ai/index.ts
@@ -299,13 +299,18 @@ class AgentEventBus {
         });
         break;
       case "reasoning-start":
-        this.emit("reasoning-start", { subagentId });
+        this.emit("reasoning-start", { subagentId, sessionId, messageId });
         break;
       case "reasoning-delta":
-        this.emit("reasoning-delta", { text: chunk.text, subagentId });
+        this.emit("reasoning-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId
+        });
         break;
       case "reasoning-end":
-        this.emit("reasoning-end", { subagentId });
+        this.emit("reasoning-end", { subagentId, sessionId, messageId });
         break;
       case "tool-input-start":
         this.emit("tool-call-start", {
@@ -587,7 +592,7 @@ function attachCliAgentStreamListeners(bus) {
 async function createInstrumentedBus(session) {
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-x7etpfp4.js");
+  const { attachWandbToEventBus } = await import("./upload-61bcszx8.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -604,7 +609,7 @@ async function resolveCliHeaders() {
   const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-31rwrakh.js");
+    const { config: appConfig } = await import("./index-kamp2pwf.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -638,8 +643,8 @@ async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-31rwrakh.js");
-  const { getDefaultModelForConfig } = await import("./utils-kw6yh5yn.js");
+  const { config: appConfig } = await import("./index-kamp2pwf.js");
+  const { getDefaultModelForConfig } = await import("./utils-fhqds1ws.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -648,6 +653,7 @@ async function resolveCliModel() {
 ` + `  ANTHROPIC_API_KEY  \u2014 Anthropic direct
 ` + `  OPENAI_API_KEY     \u2014 OpenAI
 ` + `  OPENROUTER_API_KEY \u2014 OpenRouter
+` + `  CONCENTRATE_API_KEY \u2014 Concentrate
 ` + `
 Or run 'pensar login' to connect to Pensar Console.`);
     process.exit(1);
@@ -727,9 +733,9 @@ Global options:
 async function runPentest() {
   const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runPentestAgent } = await import("./blackboxPentest-h28nykk5.js");
-  const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
-  const { config: appConfig } = await import("./index-31rwrakh.js");
+  const { runPentestAgent } = await import("./blackboxPentest-bwj95jra.js");
+  const { sessions: sessions2 } = await import("./index-nwx21gnf.js");
+  const { config: appConfig } = await import("./index-kamp2pwf.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -805,9 +811,9 @@ Report:    ${reportPath}` : ""}`);
 async function runTargetedPentest() {
   const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-3x13kqvc.js");
-  const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
-  const { config: appConfig } = await import("./index-31rwrakh.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-td5hts5a.js");
+  const { sessions: sessions2 } = await import("./index-nwx21gnf.js");
+  const { config: appConfig } = await import("./index-kamp2pwf.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -859,8 +865,8 @@ POCs:      ${pocsPath}`);
 async function runThreatModel() {
   const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runThreatModelWorkflow } = await import("./threatModel-7f02av7y.js");
-  const { config: appConfig } = await import("./index-31rwrakh.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-8ygdfkqx.js");
+  const { config: appConfig } = await import("./index-kamp2pwf.js");
   const path2 = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
@@ -896,10 +902,10 @@ Threat model written to: ${resolvedPath}`);
 async function runOperator() {
   const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-7m9smy0t.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-6dbym5jy.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-4hqbyzf5.js");
-  const { config: appConfig } = await import("./index-31rwrakh.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-x1ap18zc.js");
+  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-nwx21gnf.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-vgp133kt.js");
+  const { config: appConfig } = await import("./index-kamp2pwf.js");
   const { createInterface } = await import("readline");
   const { readFileSync: readFileSync2, existsSync } = await import("fs");
   const path2 = await import("path");
@@ -1013,35 +1019,35 @@ if (hasFlag("-p") || command === "--prompt") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-q73k9bh9.js");
+  await import("./auth-5pqmq5x9.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-p1q5pkx2.js");
+  await import("./uninstall-pszt5mdd.js");
 } else if (command === "apps") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./apps-0es69e2s.js");
+  await import("./apps-f3snzs8b.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-1hcqjyk2.js");
+  await import("./pentests-38363a42.js");
 } else if (command === "targets") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./targets-nqz8w37e.js");
+  await import("./targets-ys9ezcjn.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-wjakj8yy.js");
+  await import("./issues-fdqzva1g.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-1dry8j61.js");
+  await import("./fixes-4gsx59zz.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-ewyzcspy.js");
+  await import("./logs-hy3kvx1m.js");
 } else if (command === "config") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./config-xcf7rc6x.js");
+  await import("./config-4bxc6cvx.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-98zperf9.js");
+  const { runDoctor } = await import("./doctor-njjx9pc4.js");
   await runDoctor();
 } else if (args.length === 0) {
   if (process.env.PENSAR_NO_TUI === "1") {
@@ -1049,7 +1055,7 @@ if (hasFlag("-p") || command === "--prompt") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-0j880wqc.js");
+  await import("./index-tesn1wem.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{config-xcf7rc6x.js → config-4bxc6cvx.js}

@@ -11,9 +11,9 @@ import {
 import {
   config,
   init_config
-} from "./cli-51dkmt5p.js";
-import"./cli-7n43wz82.js";
-import"./cli-1f636vzd.js";
+} from "./cli-3b5rh4nn.js";
+import"./cli-sf878p6j.js";
+import"./cli-ztvkmav5.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/config.ts

package/build/{doctor-98zperf9.js → doctor-njjx9pc4.js}

@@ -1,13 +1,13 @@
 import {
   toolExists
-} from "./cli-s43t5ay0.js";
-import"./cli-6kx46ck0.js";
-import"./cli-4tc6888c.js";
+} from "./cli-vfsxxnmr.js";
+import"./cli-ef2c0sm6.js";
+import"./cli-xw6xh0c2.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-51dkmt5p.js";
-import"./cli-7n43wz82.js";
-import"./cli-1f636vzd.js";
+import"./cli-3b5rh4nn.js";
+import"./cli-sf878p6j.js";
+import"./cli-ztvkmav5.js";
 import"./cli-8rxa073f.js";
 
 // src/core/doctor.ts
@@ -50,6 +50,7 @@ function checkApiKeys() {
     { provider: "OpenAI", env: "OPENAI_API_KEY" },
     { provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
     { provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
+    { provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
     { provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
     { provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
     { provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }

package/build/{fastStrike-9tm6bedh.js → fastStrike-zcyrev2c.js}

@@ -4,28 +4,28 @@ import {
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-2jn8104w.js";
+} from "./cli-b27w98bz.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ptzy9ak5.js";
+import"./cli-vbz5qm07.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent
-} from "./cli-xbdn034b.js";
-import"./cli-s43t5ay0.js";
+} from "./cli-3q27f7wb.js";
+import"./cli-vfsxxnmr.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-6kx46ck0.js";
-import"./cli-4tc6888c.js";
+import"./cli-ef2c0sm6.js";
+import"./cli-xw6xh0c2.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-51dkmt5p.js";
-import"./cli-7n43wz82.js";
-import"./cli-1f636vzd.js";
+import"./cli-3b5rh4nn.js";
+import"./cli-sf878p6j.js";
+import"./cli-ztvkmav5.js";
 import"./cli-8rxa073f.js";
 
 // src/core/workflows/fastStrike.ts
@@ -42,14 +42,15 @@ Run this loop, tightly:
 
 1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
-3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
+3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
+5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
+6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
+- Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
 - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
 async function runFastStrike(input) {
@@ -121,7 +122,25 @@ ${combined}` : combined;
     enableThinking,
     openAIReasoningEffort
   });
-  const strikeResult = await agent.consume();
+  eventBus?.emit("subagent-spawn", {
+    subagentId: "fast-strike",
+    name: "Fast Strike",
+    input: { target }
+  });
+  let strikeResult;
+  try {
+    strikeResult = await agent.consume();
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "completed"
+    });
+  } catch (e) {
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "failed"
+    });
+    throw e;
+  }
   if (abortSignal?.aborted) {
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
@@ -152,5 +171,6 @@ ${combined}` : combined;
   };
 }
 export {
-  runFastStrike
+  runFastStrike,
+  FAST_STRIKE_SYSTEM_PROMPT
 };