@pensar/apex 2.2.0 → 2.3.0-canary.3f6d2a2b

package/build/{cli-6kx46ck0.js → cli-2q3kvbwv.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-4tc6888c.js";
+} from "./cli-dth5et2y.js";
 import {
   AISDKError,
   APICallError,
@@ -87,11 +87,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-51dkmt5p.js";
+} from "./cli-0qybv29g.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-1f636vzd.js";
+} from "./cli-3e0jb8k6.js";
 import {
   __callDispose,
   __commonJS,
@@ -8382,6 +8382,121 @@ var init_bedrock = __esm(() => {
   ];
 });
 
+// src/core/ai/models/concentrate.ts
+var CONCENTRATE_MODELS;
+var init_concentrate = __esm(() => {
+  CONCENTRATE_MODELS = [
+    {
+      id: "concentrate:claude-opus-4-6",
+      name: "Claude Opus 4.6",
+      provider: "concentrate",
+      contextLength: 200000
+    },
+    {
+      id: "concentrate:claude-sonnet-4-6",
+      name: "Claude Sonnet 4.6",
+      provider: "concentrate",
+      contextLength: 200000
+    },
+    {
+      id: "concentrate:claude-sonnet-4-5",
+      name: "Claude Sonnet 4.5",
+      provider: "concentrate",
+      contextLength: 200000
+    },
+    {
+      id: "concentrate:claude-haiku-4-5",
+      name: "Claude Haiku 4.5",
+      provider: "concentrate",
+      contextLength: 200000
+    },
+    {
+      id: "concentrate:gpt-5.6-sol",
+      name: "GPT 5.6 Sol",
+      provider: "concentrate",
+      contextLength: 1050000
+    },
+    {
+      id: "concentrate:gpt-5.6-terra",
+      name: "GPT 5.6 Terra",
+      provider: "concentrate",
+      contextLength: 1050000
+    },
+    {
+      id: "concentrate:gpt-5.6-luna",
+      name: "GPT 5.6 Luna",
+      provider: "concentrate",
+      contextLength: 1050000
+    },
+    {
+      id: "concentrate:gpt-5.5",
+      name: "GPT 5.5",
+      provider: "concentrate",
+      contextLength: 1050000
+    },
+    {
+      id: "concentrate:gpt-5.4",
+      name: "GPT 5.4",
+      provider: "concentrate",
+      contextLength: 1050000
+    },
+    {
+      id: "concentrate:gpt-5.3-codex",
+      name: "GPT 5.3 Codex",
+      provider: "concentrate",
+      contextLength: 400000
+    },
+    {
+      id: "concentrate:gemini-3.6-flash",
+      name: "Gemini 3.6 Flash",
+      provider: "concentrate",
+      contextLength: 1048576
+    },
+    {
+      id: "concentrate:gemini-3.1-pro-preview",
+      name: "Gemini 3.1 Pro Preview",
+      provider: "concentrate",
+      contextLength: 1e6
+    },
+    {
+      id: "concentrate:gemini-2.5-pro",
+      name: "Gemini 2.5 Pro",
+      provider: "concentrate",
+      contextLength: 1e6
+    },
+    {
+      id: "concentrate:deepseek-v3-2",
+      name: "DeepSeek V3.2",
+      provider: "concentrate",
+      contextLength: 163840
+    },
+    {
+      id: "concentrate:mistral-large-3",
+      name: "Mistral Large 3",
+      provider: "concentrate",
+      contextLength: 256000
+    },
+    {
+      id: "concentrate:kimi-k2-thinking",
+      name: "Kimi K2 Thinking",
+      provider: "concentrate",
+      contextLength: 262144
+    },
+    {
+      id: "concentrate:minimax-m2-7",
+      name: "MiniMax M2.7",
+      provider: "concentrate",
+      contextLength: 204800
+    },
+    {
+      id: "concentrate:glm-5",
+      name: "GLM-5",
+      provider: "concentrate",
+      contextLength: 202800
+    }
+  ];
+});
+
 // src/core/ai/models/google.ts
 var GOOGLE_MODELS;
 var init_google = __esm(() => {
@@ -9314,6 +9429,7 @@ var AVAILABLE_MODELS;
 var init_models = __esm(() => {
   init_anthropic();
   init_bedrock();
+  init_concentrate();
   init_google();
   init_inception();
   init_mantle2();
@@ -9327,6 +9443,7 @@ var init_models = __esm(() => {
     ...BEDROCK_MODELS,
     ...MANTLE_MODELS,
     ...OPENROUTER_MODELS,
+    ...CONCENTRATE_MODELS,
     ...PENSAR_MODELS,
     ...INCEPTION_MODELS
   ];
@@ -45218,37 +45335,56 @@ var init_observability = __esm(() => {
 });
 
 // src/core/ai/caching.ts
-function withCachedSystemPrompt(system, messages) {
+function bedrockSupportsCachePoint(modelId) {
+  const base = modelId.replace(/^(?:[a-z]{2,6}\.)?anthropic\./, "");
+  return base.startsWith("claude-") && !BEDROCK_UNCACHEABLE_CLAUDE.test(base);
+}
+function cacheBreakpointFor(model) {
+  const { provider } = getModelInfo(model);
+  switch (provider) {
+    case "anthropic":
+    case "pensar":
+      return ANTHROPIC_CACHE_CONTROL;
+    case "bedrock":
+      return bedrockSupportsCachePoint(model) ? BEDROCK_CACHE_POINT : undefined;
+    default:
+      return;
+  }
+}
+function withCachedSystemPrompt(system, messages, breakpoint) {
   return [
     {
       role: "system",
       content: system,
-      providerOptions: ANTHROPIC_CACHE_CONTROL
+      ...breakpoint ? { providerOptions: breakpoint } : {}
     },
     ...messages
   ];
 }
-function withCachedLastMessage(messages) {
-  if (messages.length === 0)
+function withCachedLastMessage(messages, breakpoint) {
+  if (messages.length === 0 || !breakpoint)
     return messages;
   return messages.map((msg, i) => {
     if (i === messages.length - 1) {
-      return {
-        ...msg,
-        providerOptions: {
-          ...msg.providerOptions,
-          ...ANTHROPIC_CACHE_CONTROL
-        }
-      };
+      const merged = { ...msg.providerOptions };
+      for (const [provider, options] of Object.entries(breakpoint)) {
+        merged[provider] = { ...merged[provider], ...options };
+      }
+      return { ...msg, providerOptions: merged };
     }
     return msg;
   });
 }
-var ANTHROPIC_CACHE_CONTROL;
+var ANTHROPIC_CACHE_CONTROL, BEDROCK_CACHE_POINT, BEDROCK_UNCACHEABLE_CLAUDE;
 var init_caching = __esm(() => {
+  init_models();
   ANTHROPIC_CACHE_CONTROL = {
     anthropic: { cacheControl: { type: "ephemeral" } }
   };
+  BEDROCK_CACHE_POINT = {
+    bedrock: { cachePoint: { type: "default" } }
+  };
+  BEDROCK_UNCACHEABLE_CLAUDE = /^claude-(?:v2|instant|3[-.])/;
 });
 
 // src/core/ai/contextManagement.ts
@@ -45953,7 +46089,7 @@ function streamResponse(opts) {
     }
   };
   const providerModel = getProviderModel(model, authConfig);
-  const useAnthropicCaching = isAnthropicProvider(model);
+  const cacheBreakpoint = cacheBreakpointFor(model);
   const systemWithToolPolicy = applySequentialToolCallPolicy(system, tools, model);
   let fittedMessages = messages;
   let proactiveFitFailed = false;
@@ -45980,11 +46116,11 @@ function streamResponse(opts) {
   }
   let effectiveSystem = systemWithToolPolicy;
   let effectiveMessages = fittedMessages;
-  if (useAnthropicCaching && systemWithToolPolicy) {
+  if (cacheBreakpoint && systemWithToolPolicy) {
     const baseMessages = fittedMessages ?? [
       { role: "user", content: prompt }
     ];
-    effectiveMessages = withCachedSystemPrompt(systemWithToolPolicy, baseMessages);
+    effectiveMessages = withCachedSystemPrompt(systemWithToolPolicy, baseMessages, cacheBreakpoint);
     effectiveSystem = undefined;
   }
   const providerOptions = buildReasoningProviderOptions(model, {
@@ -46014,8 +46150,10 @@ function streamResponse(opts) {
       maxOutputTokens: getMaxOutputTokens(model),
       prepareStep: (opts2) => {
         messagesContainer.current = opts2.messages;
-        if (useAnthropicCaching) {
-          return { messages: withCachedLastMessage(opts2.messages) };
+        if (cacheBreakpoint) {
+          return {
+            messages: withCachedLastMessage(opts2.messages, cacheBreakpoint)
+          };
         }
         return;
       },
@@ -46468,6 +46606,11 @@ function toReference(stored) {
   if (stored.tokens?.customHeaders) {
     ref.customHeaderKeys = Object.keys(stored.tokens.customHeaders);
   }
+  if (stored.additionalFields) {
+    const keys = Object.keys(stored.additionalFields);
+    if (keys.length > 0)
+      ref.additionalFieldKeys = keys;
+  }
   const ctx = stored.metadata?.context;
   if (typeof ctx === "string" && ctx)
     ref.context = ctx;
@@ -46478,7 +46621,7 @@ class CredentialManager {
   store = new Map;
   findDuplicate(candidate) {
     for (const [id, existing] of this.store) {
-      if (existing.username === candidate.username && existing.password === candidate.password && existing.apiKey === candidate.apiKey && existing.loginUrl === candidate.loginUrl && existing.tokens?.bearerToken === candidate.tokens?.bearerToken && existing.tokens?.cookies === candidate.tokens?.cookies && existing.tokens?.sessionToken === candidate.tokens?.sessionToken && JSON.stringify(existing.tokens?.customHeaders) === JSON.stringify(candidate.tokens?.customHeaders)) {
+      if (existing.username === candidate.username && existing.password === candidate.password && existing.apiKey === candidate.apiKey && existing.loginUrl === candidate.loginUrl && existing.tokens?.bearerToken === candidate.tokens?.bearerToken && existing.tokens?.cookies === candidate.tokens?.cookies && existing.tokens?.sessionToken === candidate.tokens?.sessionToken && JSON.stringify(existing.tokens?.customHeaders) === JSON.stringify(candidate.tokens?.customHeaders) && JSON.stringify(existing.additionalFields) === JSON.stringify(candidate.additionalFields)) {
         return id;
       }
     }
@@ -46576,6 +46719,9 @@ class CredentialManager {
       if (ref.customHeaderKeys?.length) {
         parts.push(`  Header keys: ${ref.customHeaderKeys.join(", ")}`);
       }
+      if (ref.additionalFieldKeys?.length) {
+        parts.push(`  Additional secret fields: ${ref.additionalFieldKeys.join(", ")}`);
+      }
       if (ref.context)
         parts.push(`  Context: ${ref.context}`);
       return parts.join(`
@@ -46584,6 +46730,9 @@ class CredentialManager {
     return `<available_credentials>
 The following credentials are available. To use a credential, pass its ID to the appropriate tool.
 Do NOT ask the user for passwords or secrets — they are resolved automatically from the credential ID.
+"Additional secret fields" are operator-supplied named secrets: pass the name as "credentialField"
+to browser_fill, or read the matching environment variable in execute_command. Their values are
+never shown to you and are redacted from command output.
 
 ${lines.join(`
 
@@ -47127,7 +47276,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-34h2nb6x.js");
+    const { config: appConfig } = await import("./index-yggyem63.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }
@@ -47238,17 +47387,21 @@ function hasOperatorState(session) {
   const statePath = path2.join(session.rootPath, "messages.json");
   return existsSync(statePath);
 }
-function getResumeMessages(messages, limit = MAX_RESUME_MESSAGES) {
+function getResumeMessages(messages, limit = RESUME_MESSAGE_WINDOW) {
   if (messages.length <= limit)
     return messages;
-  let cutIndex = messages.length - limit;
+  const roughCutIndex = messages.length - limit;
+  let cutIndex = roughCutIndex;
   while (cutIndex < messages.length) {
     if (messages[cutIndex].role === "user")
       break;
     cutIndex++;
   }
   if (cutIndex >= messages.length) {
-    cutIndex = messages.length - limit;
+    cutIndex = roughCutIndex;
+    while (cutIndex > 0 && messages[cutIndex].role !== "user") {
+      cutIndex--;
+    }
   }
   return messages.slice(cutIndex);
 }
@@ -47303,7 +47456,8 @@ async function updateOperatorSettings(sessionId, settings) {
       session.config.operatorSettings = {
         initialMode: "manual",
         requireApproval: true,
-        enableSuggestions: true
+        enableSuggestions: true,
+        strikeMode: false
       };
     }
     if (settings.initialMode !== undefined) {
@@ -47315,6 +47469,9 @@ async function updateOperatorSettings(sessionId, settings) {
     if (settings.enableSuggestions !== undefined) {
       session.config.operatorSettings.enableSuggestions = settings.enableSuggestions;
     }
+    if (settings.strikeMode !== undefined) {
+      session.config.operatorSettings.strikeMode = settings.strikeMode;
+    }
   });
 }
 async function updateSessionHeaders(sessionId, headers) {
@@ -47344,7 +47501,7 @@ var DEFAULT_OUTCOME_GUIDANCE, EXFIL_OUTCOME_GUIDANCE, DEFAULT_HEADER_RECORD, Aut
   } catch (e) {
     console.error(e);
   }
-}, RemoveMsgInput, MAX_RESUME_MESSAGES = 200, sessions;
+}, RemoveMsgInput, RESUME_MESSAGE_WINDOW = 200, sessions;
 var init_session = __esm(() => {
   init_zod();
   init_name();
@@ -47387,7 +47544,8 @@ var init_session = __esm(() => {
   OperatorSettingsObject = zod_default.object({
     initialMode: zod_default.enum(["plan", "manual", "auto"]).default("manual"),
     requireApproval: zod_default.boolean().default(true),
-    enableSuggestions: zod_default.boolean().default(true)
+    enableSuggestions: zod_default.boolean().default(true),
+    strikeMode: zod_default.boolean().optional()
   });
   EmailInboxConfigObject = zod_default.discriminatedUnion("provider", [
     zod_default.object({
@@ -47422,6 +47580,14 @@ var init_session = __esm(() => {
       username: zod_default.string(),
       password: zod_default.string(),
       tls: zod_default.boolean()
+    }),
+    zod_default.object({
+      provider: zod_default.literal("http"),
+      id: zod_default.string(),
+      name: zod_default.string(),
+      emailAddress: zod_default.string(),
+      endpoint: zod_default.string(),
+      token: zod_default.string()
     })
   ]);
   EmailIntegrationConfigObject = zod_default.object({
@@ -47842,6 +48008,24 @@ function hasCacheControl(part) {
   const opts = part.providerOptions;
   return !!opts?.anthropic?.cacheControl;
 }
+function applyCacheControl(message) {
+  if (typeof message.content === "string") {
+    if (message.content === "")
+      return;
+    message.content = [
+      {
+        type: "text",
+        text: message.content,
+        cache_control: EPHEMERAL_CACHE_CONTROL
+      }
+    ];
+    return;
+  }
+  const last = message.content[message.content.length - 1];
+  if (!last || last.type === "thinking")
+    return;
+  last.cache_control = EPHEMERAL_CACHE_CONTROL;
+}
 function convertToAnthropicFormat(modelId, options) {
   const messages = [];
   let systemPrompt;
@@ -47852,7 +48036,6 @@ function convertToAnthropicFormat(modelId, options) {
         systemPrompt = part.content;
         systemHasCacheControl = hasCacheControl(part);
       } else if (part.role === "user") {
-        const partHasCache = hasCacheControl(part);
         const text2 = part.content.map((c) => {
           if (c.type === "text")
             return c.text;
@@ -47860,16 +48043,7 @@ function convertToAnthropicFormat(modelId, options) {
             return "[file]";
           return "";
         }).join("");
-        if (partHasCache) {
-          messages.push({
-            role: "user",
-            content: [
-              { type: "text", text: text2, cache_control: EPHEMERAL_CACHE_CONTROL }
-            ]
-          });
-        } else {
-          messages.push({ role: "user", content: text2 });
-        }
+        messages.push({ role: "user", content: text2 });
       } else if (part.role === "assistant") {
         const assistantContent = part.content;
         const hasStructuredParts = assistantContent.some((c) => c.type === "tool-call" || c.type === "reasoning");
@@ -47922,6 +48096,10 @@ function convertToAnthropicFormat(modelId, options) {
         });
         messages.push({ role: "user", content: toolResults });
       }
+      const pushed = messages[messages.length - 1];
+      if (part.role !== "system" && pushed && hasCacheControl(part)) {
+        applyCacheControl(pushed);
+      }
     }
   }
   if (options.responseFormat?.type === "json") {
@@ -48821,6 +48999,7 @@ function buildAuthConfig(cfg) {
     openAiAPIKey: cfg.openAiAPIKey ?? undefined,
     googleAPIKey: cfg.googleAPIKey ?? undefined,
     openRouterAPIKey: cfg.openRouterAPIKey ?? undefined,
+    concentrateAPIKey: cfg.concentrateAPIKey ?? undefined,
     inceptionAPIKey: cfg.inceptionAPIKey ?? undefined,
     pensarAPIKey: cfg.pensarAPIKey ?? undefined,
     accessToken: cfg.accessToken ?? undefined,
@@ -48838,6 +49017,7 @@ function getProviderModel(model, authConfig) {
   const anthropicAPIKey = authConfig?.anthropicAPIKey || process.env.ANTHROPIC_API_KEY;
   const googleAPIKey = authConfig?.googleAPIKey || process.env.GOOGLE_GENERATIVE_AI_API_KEY;
   const openRouterAPIKey = authConfig?.openRouterAPIKey || process.env.OPENROUTER_API_KEY;
+  const concentrateAPIKey = authConfig?.concentrateAPIKey || process.env.CONCENTRATE_API_KEY;
   const bedrockApiKey = authConfig?.bedrock?.apiKey || process.env.BEDROCK_API_KEY;
   const bedrockAccessKeyId = authConfig?.bedrock?.accessKeyId || process.env.AWS_ACCESS_KEY_ID;
   const bedrockSecretAccessKey = authConfig?.bedrock?.secretAccessKey || process.env.AWS_SECRET_ACCESS_KEY;
@@ -48861,6 +49041,15 @@ function getProviderModel(model, authConfig) {
       providerModel = openrouter2(model);
       break;
     }
+    case "concentrate": {
+      const concentrate = createOpenAICompatible({
+        name: "concentrate",
+        apiKey: concentrateAPIKey,
+        baseURL: "https://api.concentrate.ai/v1"
+      });
+      providerModel = concentrate(model.replace(/^concentrate:/, ""));
+      break;
+    }
     case "inception": {
       const inception = createOpenAICompatible({
         name: "inception",

package/build/{cli-1f636vzd.js → cli-3e0jb8k6.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.2.0"
+    version: "2.3.0-canary.3f6d2a2b"
   };
 });
 

package/build/{cli-ptzy9ak5.js → cli-3r7xgtqj.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-xbdn034b.js";
+} from "./cli-mb680jb3.js";
 import {
   exports_external,
   init_zod

package/build/{cli-xpn9tsw0.js → cli-41h8gh1v.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-xbdn034b.js";
+} from "./cli-mb680jb3.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-s43t5ay0.js";
+} from "./cli-06fq5zym.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-6kx46ck0.js";
+} from "./cli-2q3kvbwv.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -31,7 +31,7 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Operating Mode
 
 - Fully autonomous — no human intervention
-- If you encounter barriers (CAPTCHA, MFA), report failure with details
+- If you encounter barriers (CAPTCHA, or MFA with no TOTP seed available), report failure with details
 - Call \`complete_authentication\` when done (success or failure)
 
 # Available Tools
@@ -125,6 +125,22 @@ These are the ONLY way downstream agents receive the session credentials.
 
 **Then**, call the \`response\` tool with your final summary to end the run. This is required — complete_authentication persists the data, response terminates the agent.
 
+# MFA / TOTP Codes
+
+If the login asks for a 6-digit authenticator code, check whether a TOTP seed was provided for this
+account — it appears as an extra secret field on the credential and as a matching environment variable
+(look for a name containing TOTP, MFA, OTP, or 2FA). If one exists, do NOT report an MFA barrier —
+compute the code yourself:
+
+\`\`\`
+python3 -c "import base64,hmac,hashlib,struct,time,os;s=os.environ['<ENV_VAR>'].replace(' ','').upper();k=base64.b32decode(s+'='*(-len(s)%8));d=hmac.new(k,struct.pack('>Q',int(time.time())//30),hashlib.sha1).digest();o=d[-1]&15;print('%06d'%((struct.unpack('>I',d[o:o+4])[0]&0x7fffffff)%1000000))"
+\`\`\`
+
+Read the seed from the environment variable — never paste a seed literal into a command. Codes rotate
+every 30 seconds, so run this immediately before filling the field. If the code is rejected, re-run and
+retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
+or two fresh codes are both rejected.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -136,7 +152,8 @@ If authentication fails, try these mechanical fixes (they are login mechanics, n
 
 If credentials were provided to you, they are already verified and SHARED — do not modify them or their
 account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
-forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+forced password change is required, MFA is required and no TOTP seed was provided, or the email is not
+confirmed — do NOT try to recover by resetting or changing
 the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
 \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
 or self-sign-up to get around a rejected provided credential — that is a different account than the one
@@ -194,7 +211,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
     const cm = session.credentialManager;
     super({
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context),
+      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
       model,
       session,
       target,
@@ -272,7 +289,7 @@ function loadAuthResult(authDataPath) {
     };
   }
 }
-function buildAuthPrompt(target, authHints, credentialManager, context) {
+function buildAuthPrompt(target, authHints, credentialManager, context, envVarNames) {
   const parts = [`TARGET: ${target}
 `];
   if (context) {
@@ -290,6 +307,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push(`No credentials provided. Probe the target to discover auth requirements.
 `);
   }
+  if (envVarNames?.length) {
+    parts.push("ENVIRONMENT VARIABLES:");
+    parts.push(`These are pre-loaded in your shell and available in every execute_command call. Reference them (e.g. $${envVarNames[0]}) — their values are hidden from you and redacted from command output, so never try to print one.`);
+    parts.push(envVarNames.map((n) => `- ${n}`).join(`
+`));
+    parts.push("");
+  }
   if (authHints) {
     parts.push("AUTH HINTS:");
     if (authHints.authScheme)
@@ -316,8 +340,9 @@ The credentials above were provided to you and have already been verified — th
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
 resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
-password change required, MFA required, email not confirmed), call complete_authentication with
-success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+password change required, email not confirmed, or an MFA prompt with no TOTP seed available), call
+complete_authentication with success=false and a clear summary of why — do not attempt to recover, reset,
+or rotate them. When a TOTP seed IS available, generate the code and continue; that is not a barrier. Do NOT
 register a new account or self-sign-up to work around a failed login: that is not the credential under test
 and only pollutes results — fail fast with success=false instead.`);
   } else {

package/build/{cli-1re2kv5v.js → cli-5asc7364.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-xbdn034b.js";
+} from "./cli-mb680jb3.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-s43t5ay0.js";
+} from "./cli-06fq5zym.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-6kx46ck0.js";
+} from "./cli-2q3kvbwv.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/{cli-knqx15w6.js → cli-7d3h16fw.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-xbdn034b.js";
+} from "./cli-mb680jb3.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-6kx46ck0.js";
+} from "./cli-2q3kvbwv.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();