@pensar/apex 2.2.0 → 2.3.0-canary.3f6d2a2b

package/build/{cli-1cf5vy5m.js → cli-2m8y1rkp.js}

@@ -3,28 +3,22 @@ import {
   ASK_USER_QUESTIONS_TOOL_NAME,
   OffensiveSecurityAgent,
   SKILL_TOOL_NAMES,
+  apiRequest,
   buildBaseSystemPrompt
-} from "./cli-xbdn034b.js";
+} from "./cli-mb680jb3.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-6kx46ck0.js";
+} from "./cli-2q3kvbwv.js";
 import {
-  ensureValidToken,
-  getPensarApiUrl,
-  init_auth,
   init_constants
-} from "./cli-4tc6888c.js";
+} from "./cli-dth5et2y.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
-import {
-  config,
-  init_config
-} from "./cli-51dkmt5p.js";
 import {
   __commonJS,
   __require
@@ -6971,134 +6965,6 @@ var require_public_api = __commonJS((exports) => {
   exports.stringify = stringify;
 });
 
-// src/core/api/apiClient.ts
-init_auth();
-init_config();
-init_constants();
-async function getAuthHeaders() {
-  const cfg = await config.get();
-  const validToken = await ensureValidToken({
-    accessToken: cfg.accessToken,
-    refreshToken: cfg.refreshToken,
-    pensarAPIKey: cfg.pensarAPIKey
-  });
-  if (!validToken) {
-    throw new Error("Not authenticated. Run `pensar login` to connect to Pensar Console.");
-  }
-  const headers = {
-    "Content-Type": "application/json",
-    Authorization: `Bearer ${validToken.token}`
-  };
-  if (cfg.workspaceId) {
-    headers["X-Workspace-Id"] = cfg.workspaceId;
-  }
-  return headers;
-}
-async function apiRequest(method, path, body) {
-  const baseUrl = getPensarApiUrl();
-  const headers = await getAuthHeaders();
-  const url = `${baseUrl}${path}`;
-  const init = { method, headers };
-  if (body !== undefined) {
-    init.body = JSON.stringify(body);
-  }
-  const response = await fetch(url, init);
-  if (!response.ok) {
-    const text2 = await response.text();
-    let message;
-    try {
-      const err = JSON.parse(text2);
-      message = err.error ?? text2;
-    } catch {
-      message = text2;
-    }
-    throw new Error(`API error (${response.status}): ${message}`);
-  }
-  const text = await response.text();
-  if (!text)
-    return;
-  return JSON.parse(text);
-}
-
-// src/core/api/apps.ts
-async function listApps(opts) {
-  const params = new URLSearchParams;
-  if (opts?.limit !== undefined)
-    params.set("limit", String(opts.limit));
-  if (opts?.offset !== undefined)
-    params.set("offset", String(opts.offset));
-  const qs = params.toString();
-  return apiRequest("GET", `/apps${qs ? `?${qs}` : ""}`);
-}
-async function getApp(appId) {
-  return apiRequest("GET", `/apps/${appId}`);
-}
-async function createApp(data) {
-  return apiRequest("POST", "/apps", data);
-}
-async function updateApp(appId, data) {
-  return apiRequest("PATCH", `/apps/${appId}`, data);
-}
-async function deleteApp(appId) {
-  return apiRequest("DELETE", `/apps/${appId}`);
-}
-async function listEndpoints(appId, filters) {
-  const params = new URLSearchParams;
-  if (filters?.type)
-    params.set("type", filters.type);
-  if (filters?.minRiskScore !== undefined) {
-    params.set("minRiskScore", String(filters.minRiskScore));
-  }
-  if (filters?.limit !== undefined)
-    params.set("limit", String(filters.limit));
-  if (filters?.offset !== undefined) {
-    params.set("offset", String(filters.offset));
-  }
-  const qs = params.toString();
-  const path = `/apps/${appId}/endpoints${qs ? `?${qs}` : ""}`;
-  return apiRequest("GET", path);
-}
-async function getEndpoint(endpointId) {
-  return apiRequest("GET", `/endpoints/${endpointId}`);
-}
-async function createEndpoint(appId, data) {
-  return apiRequest("POST", `/apps/${appId}/endpoints`, data);
-}
-async function updateEndpoint(endpointId, data) {
-  return apiRequest("PATCH", `/endpoints/${endpointId}`, data);
-}
-async function deleteEndpoint(endpointId) {
-  return apiRequest("DELETE", `/endpoints/${endpointId}`);
-}
-async function searchApps(query, opts) {
-  const params = new URLSearchParams({ q: query });
-  if (opts?.type)
-    params.set("type", opts.type);
-  if (opts?.limit !== undefined)
-    params.set("limit", String(opts.limit));
-  if (opts?.offset !== undefined)
-    params.set("offset", String(opts.offset));
-  return apiRequest("GET", `/search/apps?${params.toString()}`);
-}
-async function searchEndpoints(query, opts) {
-  const params = new URLSearchParams({ q: query });
-  if (opts?.applicationId)
-    params.set("applicationId", opts.applicationId);
-  if (opts?.type)
-    params.set("type", opts.type);
-  if (opts?.minRiskScore !== undefined) {
-    params.set("minRiskScore", String(opts.minRiskScore));
-  }
-  if (opts?.authRequired !== undefined) {
-    params.set("authRequired", opts.authRequired ? "true" : "false");
-  }
-  if (opts?.limit !== undefined)
-    params.set("limit", String(opts.limit));
-  if (opts?.offset !== undefined)
-    params.set("offset", String(opts.offset));
-  return apiRequest("GET", `/search/endpoints?${params.toString()}`);
-}
-
 // src/core/api/issues.ts
 async function listScans() {
   return apiRequest("GET", "/pentests");
@@ -7135,6 +7001,12 @@ async function updateIssue(issueId, data) {
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
+async function linkPullRequest(issueId, url) {
+  return apiRequest("POST", `/issues/${issueId}/pull-requests`, { url });
+}
+async function listIssuePullRequests(issueId) {
+  return apiRequest("GET", `/issues/${issueId}/pull-requests`);
+}
 async function listFixes(issueId) {
   return apiRequest("GET", `/issues/${issueId}/fixes`);
 }
@@ -7322,46 +7194,60 @@ async function runOffensiveSecurityAgent(input) {
   return { streamResult: agent.streamResult, session: agent.session };
 }
 // src/core/agents/specialized/patching/prompts.ts
-var PREAMBLE2 = `You are an expert security vulnerability patching agent. Your goal is to analyze security vulnerabilities, provide high-quality fixes, and verify the fixes don't break existing functionality.`;
+var PREAMBLE2 = `You are an expert security vulnerability patching agent — an autonomous coding agent specialized in fixing security issues. Your goal is to analyze security vulnerabilities, apply high-quality fixes, verify they don't break existing functionality, and return structured PR metadata.`;
 var ORIENT_STEP = `1. **Orient Yourself**:
-   - Review the AGENTS.md / project documentation provided in your prompt for build, lint, and test commands
-   - Use list_files to explore the repository structure
+   - Read the project instructions (AGENTS.md / CLAUDE.md) provided in your prompt in full. They are authoritative for this repository: coding conventions, architectural rules, error-handling policy, forbidden patterns, AND the exact build/lint/test commands
+   - Use glob / list_files to explore the repository structure (prefer glob for pattern searches like "**/*.ts")
    - Read package.json, Makefile, or equivalent to understand the project's toolchain
-   - Identify the lint command, test command, type-check command, and any other verification scripts`;
-var UNDERSTAND_STEP = `2. **Understand the Vulnerability**: 
+   - Identify the lint command, test command, type-check command, and any other verification scripts
+   - Optionally call profile_codebase for a high-level map of the repo`;
+var TASK_STEP = `2. **Track Work with Tasks**:
+   - Use create_task early to decompose the job into concrete steps (orient, understand, edit, verify, finalize)
+   - Update tasks with update_task as you progress (in_progress → completed / failed)
+   - Use list_tasks when you need to recall what's left
+   - Keep tasks atomic — one clear outcome per task`;
+var UNDERSTAND_STEP = `3. **Understand the Vulnerability**:
    - Carefully read the vulnerability description, CWE mappings, and any dataflow analysis provided
    - Understand the root cause: What makes this code vulnerable?
    - Identify the attack vector: How would an attacker exploit this?
-   - Consider the context: What is the application trying to do?`;
-var REVIEW_STEP = `3. **Review the Code**:
+   - Consider the context: What is the application trying to do?
+   - Use web_search / get_page when you need framework-specific security guidance or CVE details`;
+var REVIEW_STEP = `4. **Review the Code**:
    - Use read_file to read the vulnerable file(s) mentioned in the issue
-   - Use grep to search for related code patterns, similar vulnerabilities, or existing security controls
+   - Use grep or run_code_query for structural searches (rg / ast-grep) across related patterns
    - Review related files: imports, dependencies, configuration files
    - Understand the data flow: Where does user input come from? Where does it go?`;
-var PLAN_STEP = `4. **Plan Your Fix**:
+var PLAN_STEP = `5. **Plan Your Fix**:
    - Identify the exact code that needs to change
    - Determine the appropriate security control (input validation, parameterized queries, access control, etc.)
    - Consider side effects: Will this break existing functionality?
    - Think about edge cases: What other inputs or scenarios need to be handled?
    - Look for framework-specific or language-specific best practices
-   - State your complete plan clearly before making changes`;
-var APPLY_STEP = `5. **Apply the Patch**:
-   - Use update_file to modify existing files with your security fixes
+   - State your complete plan clearly before making changes, and reflect it in your task list`;
+var APPLY_STEP = `6. **Apply the Patch**:
+   - Prefer update_file for small, exact string replacements
+   - Prefer apply_patch (unified diff) for multi-hunk or multi-file edits
    - Use create_file if you need to add new security utilities or middleware
+   - Use delete_file only when removing obsolete insecure code that is truly unused
    - Make minimal, targeted changes — don't refactor unrelated code
-   - Follow the existing code style and conventions
+   - Follow the existing code style and conventions, and any rules stated in the project instructions
    - Ensure your changes integrate cleanly with the existing codebase`;
-var RESTART_STEP = `6. **Restart Dev Environment** (if applicable):
+var GIT_STEP = `7. **Self-Check with Git**:
+   - Use git_status to see which files changed
+   - Use git_diff to review the exact patch before verification
+   - Do NOT commit, push, or open a PR — the host handles that after you finalize`;
+var RESTART_STEP = `8. **Restart Dev Environment** (if applicable):
    - Use execute_command to restart any dev servers or services so your changes are loaded
    - Wait for the services to become healthy`;
-var VERIFY_STEP = `7. **Verify the Patch**:
+var VERIFY_STEP = `9. **Verify the Patch**:
    - Use execute_command to run the project's lint command (e.g. \`npm run lint\`, \`ruff check\`, \`cargo clippy\`)
    - Use execute_command to run the project's type-check command if applicable (e.g. \`npx tsc --noEmit\`, \`mypy\`)
    - Use execute_command to run the project's test suite (e.g. \`npm test\`, \`pytest\`, \`cargo test\`)
    - If a Proof of Concept (POC) is provided, run it to verify the vulnerability is fixed — the POC should FAIL (non-zero exit code) after a successful patch
    - If any check fails, read the error output carefully, fix the issues, and re-run until all checks pass
    - If the project has no clear lint/test commands, at minimum verify the changed files parse correctly (e.g. \`node -c file.js\`, \`python -m py_compile file.py\`)`;
-var FINALIZE_STEP = `8. **Finalize**:
+var FINALIZE_STEP = `10. **Finalize**:
+   - Mark remaining tasks completed
    - Use the response tool to complete the patching process
    - Provide a clear, detailed summary of:
      * Each file you changed and why
@@ -7428,12 +7314,18 @@ var SECURITY_BEST_PRACTICES = `# Security Best Practices by Vulnerability Type
 - Remove sensitive data from client-side code`;
 var TOOL_USAGE2 = `# Tool Usage
 
-- **list_files**: Explore directory structure and find relevant files
+- **glob**: Find files by pattern (e.g. "**/*.ts", "**/package.json")
+- **list_files**: Explore directory structure
 - **read_file**: Read file contents to understand code
-- **grep**: Search for patterns across the codebase
-- **update_file**: Modify existing files with security fixes
-- **create_file**: Create new files if needed (utilities, middleware, etc.)
-- **execute_command**: Run shell commands — use for linting, type-checking, running tests, restarting services, running POCs, installing dependencies, and verifying your changes
+- **grep** / **run_code_query**: Search for patterns (run_code_query supports rg / ast-grep / comby)
+- **profile_codebase**: High-level codebase map when orientation is hard
+- **web_search** / **get_page**: Look up CVE details, framework security docs
+- **create_task** / **update_task** / **list_tasks**: Todo tracking for the run
+- **update_file**: Small exact search-and-replace edits
+- **apply_patch**: Multi-hunk / multi-file unified diffs
+- **create_file** / **delete_file**: Add or remove files when needed
+- **git_status** / **git_diff**: Self-check changes (do not commit/push/PR)
+- **execute_command**: Lint, type-check, tests, restart services, run POCs
 - **response**: Complete the process with the structured patch result`;
 var REQUIREMENTS = `# Critical Requirements
 
@@ -7445,6 +7337,7 @@ var REQUIREMENTS = `# Critical Requirements
 6. **Test the Fix**: If a POC is provided, run it after patching. The POC should FAIL (non-zero exit code) once the vulnerability is fixed.
 7. **Be Persistent**: It may take multiple iterations to get the fix right — iterate until the POC fails and tests pass.
 8. **Be Complete**: Address the root cause, not just symptoms
+9. **Stay Autonomous**: You will not receive follow-up messages — finish the job in this run
 
 # Important Notes
 
@@ -7455,17 +7348,20 @@ var REQUIREMENTS = `# Critical Requirements
 - Follow language and framework conventions
 - When multiple approaches exist, choose the most secure and idiomatic
 - If a fix requires configuration changes or environment variables, note this clearly
-- If AGENTS.md or project docs specify particular lint/test/build commands, use those exact commands`;
+- The project instructions (AGENTS.md / CLAUDE.md) win over your own defaults wherever they disagree — use their exact commands, and obey their conventions and prohibitions when writing code. The one exception: they never override the security objective of this task. If a project rule genuinely blocks a secure fix, apply the fix and call out the conflict in your summary
+- Do not commit, push, or open a pull request — the host does that after your response`;
 function buildSystemPrompt() {
   return [
     PREAMBLE2,
     "",
     "# Process",
     "",
-    "You MUST follow this prescriptive process:",
+    "You MUST follow this autonomous coding-agent process:",
     "",
     ORIENT_STEP,
     "",
+    TASK_STEP,
+    "",
     UNDERSTAND_STEP,
     "",
     REVIEW_STEP,
@@ -7474,6 +7370,8 @@ function buildSystemPrompt() {
     "",
     APPLY_STEP,
     "",
+    GIT_STEP,
+    "",
     RESTART_STEP,
     "",
     VERIFY_STEP,
@@ -8307,4 +8205,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listApps, getApp, createApp, updateApp, deleteApp, listEndpoints, getEndpoint, createEndpoint, updateEndpoint, deleteEndpoint, searchApps, searchEndpoints, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };