@pensar/apex 2.2.0 → 2.3.0-canary.3f6d2a2b
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/{agent-yayy5x2a.js → agent-2h0w8eta.js} +7 -7
- package/build/agent-95qsypnq.js +19 -0
- package/build/{agent-q5hwjdtb.js → agent-rktf0v3c.js} +9 -9
- package/build/{apps-0es69e2s.js → apps-rehs72t3.js} +17 -17
- package/build/{auth-q73k9bh9.js → auth-h5bjv1dp.js} +51 -40
- package/build/authentication-zqkagnvm.js +19 -0
- package/build/blackboxAgent-b799jbpa.js +19 -0
- package/build/{blackboxPentest-h28nykk5.js → blackboxPentest-gszetqnq.js} +14 -14
- package/build/{cli-s43t5ay0.js → cli-06fq5zym.js} +1 -1
- package/build/{cli-51dkmt5p.js → cli-0qybv29g.js} +1 -1
- package/build/{cli-1cf5vy5m.js → cli-2m8y1rkp.js} +60 -162
- package/build/{cli-6kx46ck0.js → cli-2q3kvbwv.js} +228 -39
- package/build/{cli-1f636vzd.js → cli-3e0jb8k6.js} +1 -1
- package/build/{cli-ptzy9ak5.js → cli-3r7xgtqj.js} +1 -1
- package/build/{cli-xpn9tsw0.js → cli-41h8gh1v.js} +34 -9
- package/build/{cli-1re2kv5v.js → cli-5asc7364.js} +3 -3
- package/build/{cli-knqx15w6.js → cli-7d3h16fw.js} +2 -2
- package/build/{cli-tz9yg4ew.js → cli-abm5bgap.js} +24 -8
- package/build/{cli-4tc6888c.js → cli-dth5et2y.js} +51 -2
- package/build/{cli-7n43wz82.js → cli-khyery65.js} +5 -2
- package/build/{cli-xbdn034b.js → cli-mb680jb3.js} +4517 -120
- package/build/{cli-vgg6h2ax.js → cli-pvf8tyr2.js} +1 -1
- package/build/{cli-7e5ad5js.js → cli-qs2mveb2.js} +2 -2
- package/build/{cli-n114n8mk.js → cli-s8z1mkv5.js} +2 -2
- package/build/{cli-2jn8104w.js → cli-xkv494x1.js} +2 -2
- package/build/{cli-yz80qkzn.js → cli-ycj65kyw.js} +6 -0
- package/build/cli.js +42 -36
- package/build/{config-xcf7rc6x.js → config-hawgse8e.js} +3 -3
- package/build/{doctor-98zperf9.js → doctor-t305mq12.js} +7 -6
- package/build/{fastStrike-9tm6bedh.js → fastStrike-mk0gxtkm.js} +34 -14
- package/build/{fixes-1dry8j61.js → fixes-gxn4cmte.js} +16 -16
- package/build/{index-4hqbyzf5.js → index-98bpwjq9.js} +16 -8
- package/build/{index-pxwwcefn.js → index-a2qb45hc.js} +9 -9
- package/build/{index-f6ttv7np.js → index-cpbhz85w.js} +9 -5
- package/build/{index-6dbym5jy.js → index-fa4xk0fq.js} +29 -12
- package/build/{index-31rwrakh.js → index-qqp08dtj.js} +2 -2
- package/build/{index-0j880wqc.js → index-ra8jmwb2.js} +1154 -909
- package/build/{index-34h2nb6x.js → index-yggyem63.js} +3 -3
- package/build/{issues-wjakj8yy.js → issues-mtbp80dr.js} +44 -16
- package/build/{logs-ewyzcspy.js → logs-0wpqqb3z.js} +16 -16
- package/build/{offesecAgent-7m9smy0t.js → offesecAgent-d5ceedmg.js} +8 -8
- package/build/pentest-2znknvqd.js +29 -0
- package/build/{pentests-1hcqjyk2.js → pentests-gnwwdmac.js} +16 -16
- package/build/{targetedPentest-3x13kqvc.js → targetedPentest-ap7p8j6q.js} +9 -9
- package/build/{targets-nqz8w37e.js → targets-be3c736k.js} +16 -16
- package/build/threatModel-bypv7mjx.js +27 -0
- package/build/{uninstall-p1q5pkx2.js → uninstall-71xttcr0.js} +1 -1
- package/build/{upload-x7etpfp4.js → upload-c7e0bdcn.js} +6 -6
- package/build/{utils-kw6yh5yn.js → utils-ef23ac3j.js} +11 -7
- package/package.json +1 -1
- package/build/agent-3cdfwxcd.js +0 -19
- package/build/authentication-tqx2brcv.js +0 -19
- package/build/blackboxAgent-d0smgqt7.js +0 -19
- package/build/pentest-1cb5t0dt.js +0 -29
- package/build/threatModel-7f02av7y.js +0 -27
|
@@ -2,11 +2,11 @@ import {
|
|
|
2
2
|
EndpointTransportEnum,
|
|
3
3
|
GrpcEndpointMetadataSchema,
|
|
4
4
|
OffensiveSecurityAgent
|
|
5
|
-
} from "./cli-
|
|
5
|
+
} from "./cli-mb680jb3.js";
|
|
6
6
|
import {
|
|
7
7
|
hasToolCall,
|
|
8
8
|
init_dist
|
|
9
|
-
} from "./cli-
|
|
9
|
+
} from "./cli-2q3kvbwv.js";
|
|
10
10
|
import {
|
|
11
11
|
exports_external,
|
|
12
12
|
init_zod,
|
|
@@ -5,7 +5,7 @@ import {
|
|
|
5
5
|
createReportErrorTool,
|
|
6
6
|
isMemoryEnabled,
|
|
7
7
|
readPlan
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-mb680jb3.js";
|
|
9
9
|
import {
|
|
10
10
|
createLogger,
|
|
11
11
|
hasToolCall,
|
|
@@ -13,7 +13,7 @@ import {
|
|
|
13
13
|
init_lazyLogger,
|
|
14
14
|
init_structured,
|
|
15
15
|
scopedLogger
|
|
16
|
-
} from "./cli-
|
|
16
|
+
} from "./cli-2q3kvbwv.js";
|
|
17
17
|
import {
|
|
18
18
|
exports_external,
|
|
19
19
|
init_zod
|
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
import {
|
|
2
2
|
EvidenceFileEntrySchema
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-3r7xgtqj.js";
|
|
4
4
|
import {
|
|
5
5
|
CweEntrySchema,
|
|
6
6
|
ValidatedCweEntrySchema,
|
|
7
7
|
hasCanonicalName
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-mb680jb3.js";
|
|
9
9
|
import {
|
|
10
10
|
exports_external,
|
|
11
11
|
init_zod
|
|
@@ -30,6 +30,12 @@ var init_types = __esm(() => {
|
|
|
30
30
|
description: "Access multiple AI models through one API",
|
|
31
31
|
requiresAPIKey: true
|
|
32
32
|
},
|
|
33
|
+
{
|
|
34
|
+
id: "concentrate",
|
|
35
|
+
name: "Concentrate",
|
|
36
|
+
description: "Access multiple AI models through one API",
|
|
37
|
+
requiresAPIKey: true
|
|
38
|
+
},
|
|
33
39
|
{
|
|
34
40
|
id: "inception",
|
|
35
41
|
name: "Inception",
|
package/build/cli.js
CHANGED
|
@@ -14,16 +14,16 @@ import {
|
|
|
14
14
|
init_toolset,
|
|
15
15
|
init_utils,
|
|
16
16
|
logger
|
|
17
|
-
} from "./cli-
|
|
18
|
-
import"./cli-
|
|
17
|
+
} from "./cli-2q3kvbwv.js";
|
|
18
|
+
import"./cli-dth5et2y.js";
|
|
19
19
|
import"./cli-3k1x5rn3.js";
|
|
20
20
|
import"./cli-gpnb45ck.js";
|
|
21
|
-
import"./cli-
|
|
22
|
-
import"./cli-
|
|
21
|
+
import"./cli-0qybv29g.js";
|
|
22
|
+
import"./cli-khyery65.js";
|
|
23
23
|
import {
|
|
24
24
|
init_package,
|
|
25
25
|
package_default
|
|
26
|
-
} from "./cli-
|
|
26
|
+
} from "./cli-3e0jb8k6.js";
|
|
27
27
|
import {
|
|
28
28
|
__require,
|
|
29
29
|
__toESM
|
|
@@ -144,7 +144,7 @@ var package_default2 = {
|
|
|
144
144
|
tsc: "tsc --noEmit"
|
|
145
145
|
},
|
|
146
146
|
type: "module",
|
|
147
|
-
version: "2.
|
|
147
|
+
version: "2.3.0-canary.3f6d2a2b"
|
|
148
148
|
};
|
|
149
149
|
|
|
150
150
|
// src/core/ai/index.ts
|
|
@@ -299,13 +299,18 @@ class AgentEventBus {
|
|
|
299
299
|
});
|
|
300
300
|
break;
|
|
301
301
|
case "reasoning-start":
|
|
302
|
-
this.emit("reasoning-start", { subagentId });
|
|
302
|
+
this.emit("reasoning-start", { subagentId, sessionId, messageId });
|
|
303
303
|
break;
|
|
304
304
|
case "reasoning-delta":
|
|
305
|
-
this.emit("reasoning-delta", {
|
|
305
|
+
this.emit("reasoning-delta", {
|
|
306
|
+
text: chunk.text,
|
|
307
|
+
subagentId,
|
|
308
|
+
sessionId,
|
|
309
|
+
messageId
|
|
310
|
+
});
|
|
306
311
|
break;
|
|
307
312
|
case "reasoning-end":
|
|
308
|
-
this.emit("reasoning-end", { subagentId });
|
|
313
|
+
this.emit("reasoning-end", { subagentId, sessionId, messageId });
|
|
309
314
|
break;
|
|
310
315
|
case "tool-input-start":
|
|
311
316
|
this.emit("tool-call-start", {
|
|
@@ -587,7 +592,7 @@ function attachCliAgentStreamListeners(bus) {
|
|
|
587
592
|
async function createInstrumentedBus(session) {
|
|
588
593
|
const bus = new AgentEventBus;
|
|
589
594
|
attachCliAgentStreamListeners(bus);
|
|
590
|
-
const { attachWandbToEventBus } = await import("./upload-
|
|
595
|
+
const { attachWandbToEventBus } = await import("./upload-c7e0bdcn.js");
|
|
591
596
|
const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
|
|
592
597
|
console.warn("[wandb] Tracing disabled:", e.message);
|
|
593
598
|
return null;
|
|
@@ -604,7 +609,7 @@ async function resolveCliHeaders() {
|
|
|
604
609
|
const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
|
|
605
610
|
const merged = {};
|
|
606
611
|
if (!noGlobal) {
|
|
607
|
-
const { config: appConfig } = await import("./index-
|
|
612
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
608
613
|
const cfg = await appConfig.get();
|
|
609
614
|
if (cfg.defaultHeaders) {
|
|
610
615
|
Object.assign(merged, cfg.defaultHeaders);
|
|
@@ -638,8 +643,8 @@ async function resolveCliModel() {
|
|
|
638
643
|
const explicit = getArg("--model");
|
|
639
644
|
if (explicit)
|
|
640
645
|
return explicit;
|
|
641
|
-
const { config: appConfig } = await import("./index-
|
|
642
|
-
const { getDefaultModelForConfig } = await import("./utils-
|
|
646
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
647
|
+
const { getDefaultModelForConfig } = await import("./utils-ef23ac3j.js");
|
|
643
648
|
const pensarConfig = await appConfig.get();
|
|
644
649
|
const defaultModel = getDefaultModelForConfig(pensarConfig);
|
|
645
650
|
if (!defaultModel) {
|
|
@@ -648,6 +653,7 @@ async function resolveCliModel() {
|
|
|
648
653
|
` + ` ANTHROPIC_API_KEY \u2014 Anthropic direct
|
|
649
654
|
` + ` OPENAI_API_KEY \u2014 OpenAI
|
|
650
655
|
` + ` OPENROUTER_API_KEY \u2014 OpenRouter
|
|
656
|
+
` + ` CONCENTRATE_API_KEY \u2014 Concentrate
|
|
651
657
|
` + `
|
|
652
658
|
Or run 'pensar login' to connect to Pensar Console.`);
|
|
653
659
|
process.exit(1);
|
|
@@ -727,9 +733,9 @@ Global options:
|
|
|
727
733
|
async function runPentest() {
|
|
728
734
|
const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
|
|
729
735
|
config();
|
|
730
|
-
const { runPentestAgent } = await import("./blackboxPentest-
|
|
731
|
-
const { sessions: sessions2 } = await import("./index-
|
|
732
|
-
const { config: appConfig } = await import("./index-
|
|
736
|
+
const { runPentestAgent } = await import("./blackboxPentest-gszetqnq.js");
|
|
737
|
+
const { sessions: sessions2 } = await import("./index-fa4xk0fq.js");
|
|
738
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
733
739
|
const target = getArgRequired("--target");
|
|
734
740
|
const cwd = getArg("--cwd");
|
|
735
741
|
const mode = getArg("--mode");
|
|
@@ -805,9 +811,9 @@ Report: ${reportPath}` : ""}`);
|
|
|
805
811
|
async function runTargetedPentest() {
|
|
806
812
|
const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
|
|
807
813
|
config();
|
|
808
|
-
const { runTargetedPentestAgent } = await import("./targetedPentest-
|
|
809
|
-
const { sessions: sessions2 } = await import("./index-
|
|
810
|
-
const { config: appConfig } = await import("./index-
|
|
814
|
+
const { runTargetedPentestAgent } = await import("./targetedPentest-ap7p8j6q.js");
|
|
815
|
+
const { sessions: sessions2 } = await import("./index-fa4xk0fq.js");
|
|
816
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
811
817
|
const target = getArgRequired("--target");
|
|
812
818
|
const objectives = getAllArgs("--objective");
|
|
813
819
|
const pensarConfig = await appConfig.get();
|
|
@@ -859,8 +865,8 @@ POCs: ${pocsPath}`);
|
|
|
859
865
|
async function runThreatModel() {
|
|
860
866
|
const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
|
|
861
867
|
config();
|
|
862
|
-
const { runThreatModelWorkflow } = await import("./threatModel-
|
|
863
|
-
const { config: appConfig } = await import("./index-
|
|
868
|
+
const { runThreatModelWorkflow } = await import("./threatModel-bypv7mjx.js");
|
|
869
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
864
870
|
const path2 = await import("path");
|
|
865
871
|
const pensarConfig = await appConfig.get();
|
|
866
872
|
const model = await resolveCliModel();
|
|
@@ -896,10 +902,10 @@ Threat model written to: ${resolvedPath}`);
|
|
|
896
902
|
async function runOperator() {
|
|
897
903
|
const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
|
|
898
904
|
config();
|
|
899
|
-
const { runOffensiveSecurityAgent } = await import("./offesecAgent-
|
|
900
|
-
const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-
|
|
901
|
-
const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-
|
|
902
|
-
const { config: appConfig } = await import("./index-
|
|
905
|
+
const { runOffensiveSecurityAgent } = await import("./offesecAgent-d5ceedmg.js");
|
|
906
|
+
const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-fa4xk0fq.js");
|
|
907
|
+
const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-98bpwjq9.js");
|
|
908
|
+
const { config: appConfig } = await import("./index-qqp08dtj.js");
|
|
903
909
|
const { createInterface } = await import("readline");
|
|
904
910
|
const { readFileSync: readFileSync2, existsSync } = await import("fs");
|
|
905
911
|
const path2 = await import("path");
|
|
@@ -1013,35 +1019,35 @@ if (hasFlag("-p") || command === "--prompt") {
|
|
|
1013
1019
|
await runTargetedPentest();
|
|
1014
1020
|
} else if (command === "login" || command === "auth") {
|
|
1015
1021
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1016
|
-
await import("./auth-
|
|
1022
|
+
await import("./auth-h5bjv1dp.js");
|
|
1017
1023
|
} else if (command === "uninstall") {
|
|
1018
1024
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1019
|
-
await import("./uninstall-
|
|
1025
|
+
await import("./uninstall-71xttcr0.js");
|
|
1020
1026
|
} else if (command === "apps") {
|
|
1021
1027
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1022
|
-
await import("./apps-
|
|
1028
|
+
await import("./apps-rehs72t3.js");
|
|
1023
1029
|
} else if (command === "pentests") {
|
|
1024
1030
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1025
|
-
await import("./pentests-
|
|
1031
|
+
await import("./pentests-gnwwdmac.js");
|
|
1026
1032
|
} else if (command === "targets") {
|
|
1027
1033
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1028
|
-
await import("./targets-
|
|
1034
|
+
await import("./targets-be3c736k.js");
|
|
1029
1035
|
} else if (command === "issues") {
|
|
1030
1036
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1031
|
-
await import("./issues-
|
|
1037
|
+
await import("./issues-mtbp80dr.js");
|
|
1032
1038
|
} else if (command === "fixes") {
|
|
1033
1039
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1034
|
-
await import("./fixes-
|
|
1040
|
+
await import("./fixes-gxn4cmte.js");
|
|
1035
1041
|
} else if (command === "logs") {
|
|
1036
1042
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1037
|
-
await import("./logs-
|
|
1043
|
+
await import("./logs-0wpqqb3z.js");
|
|
1038
1044
|
} else if (command === "config") {
|
|
1039
1045
|
process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
|
|
1040
|
-
await import("./config-
|
|
1046
|
+
await import("./config-hawgse8e.js");
|
|
1041
1047
|
} else if (command === "threat-model") {
|
|
1042
1048
|
await runThreatModel();
|
|
1043
1049
|
} else if (command === "doctor") {
|
|
1044
|
-
const { runDoctor } = await import("./doctor-
|
|
1050
|
+
const { runDoctor } = await import("./doctor-t305mq12.js");
|
|
1045
1051
|
await runDoctor();
|
|
1046
1052
|
} else if (args.length === 0) {
|
|
1047
1053
|
if (process.env.PENSAR_NO_TUI === "1") {
|
|
@@ -1049,7 +1055,7 @@ if (hasFlag("-p") || command === "--prompt") {
|
|
|
1049
1055
|
console.error("All other commands work with Node \u2014 run 'pensar --help'.");
|
|
1050
1056
|
process.exit(1);
|
|
1051
1057
|
}
|
|
1052
|
-
await import("./index-
|
|
1058
|
+
await import("./index-ra8jmwb2.js");
|
|
1053
1059
|
} else {
|
|
1054
1060
|
console.error(`Error: Unknown command '${command}'`);
|
|
1055
1061
|
console.error();
|
|
@@ -11,9 +11,9 @@ import {
|
|
|
11
11
|
import {
|
|
12
12
|
config,
|
|
13
13
|
init_config
|
|
14
|
-
} from "./cli-
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
14
|
+
} from "./cli-0qybv29g.js";
|
|
15
|
+
import"./cli-khyery65.js";
|
|
16
|
+
import"./cli-3e0jb8k6.js";
|
|
17
17
|
import"./cli-8rxa073f.js";
|
|
18
18
|
|
|
19
19
|
// src/cli/config.ts
|
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
import {
|
|
2
2
|
toolExists
|
|
3
|
-
} from "./cli-
|
|
4
|
-
import"./cli-
|
|
5
|
-
import"./cli-
|
|
3
|
+
} from "./cli-06fq5zym.js";
|
|
4
|
+
import"./cli-2q3kvbwv.js";
|
|
5
|
+
import"./cli-dth5et2y.js";
|
|
6
6
|
import"./cli-3k1x5rn3.js";
|
|
7
7
|
import"./cli-gpnb45ck.js";
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
10
|
-
import"./cli-
|
|
8
|
+
import"./cli-0qybv29g.js";
|
|
9
|
+
import"./cli-khyery65.js";
|
|
10
|
+
import"./cli-3e0jb8k6.js";
|
|
11
11
|
import"./cli-8rxa073f.js";
|
|
12
12
|
|
|
13
13
|
// src/core/doctor.ts
|
|
@@ -50,6 +50,7 @@ function checkApiKeys() {
|
|
|
50
50
|
{ provider: "OpenAI", env: "OPENAI_API_KEY" },
|
|
51
51
|
{ provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
|
|
52
52
|
{ provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
|
|
53
|
+
{ provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
|
|
53
54
|
{ provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
|
|
54
55
|
{ provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
|
|
55
56
|
{ provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }
|
|
@@ -4,28 +4,28 @@ import {
|
|
|
4
4
|
buildPentestReport,
|
|
5
5
|
renderJson,
|
|
6
6
|
renderMarkdown
|
|
7
|
-
} from "./cli-
|
|
7
|
+
} from "./cli-xkv494x1.js";
|
|
8
8
|
import"./cli-9fsre5pt.js";
|
|
9
|
-
import"./cli-
|
|
9
|
+
import"./cli-3r7xgtqj.js";
|
|
10
10
|
import {
|
|
11
11
|
FindingsRegistry,
|
|
12
12
|
OffensiveSecurityAgent
|
|
13
|
-
} from "./cli-
|
|
14
|
-
import"./cli-
|
|
13
|
+
} from "./cli-mb680jb3.js";
|
|
14
|
+
import"./cli-06fq5zym.js";
|
|
15
15
|
import {
|
|
16
16
|
createThreatModelPrompt
|
|
17
17
|
} from "./cli-fw5r7pfj.js";
|
|
18
18
|
import"./cli-c8131c4q.js";
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
19
|
+
import"./cli-2q3kvbwv.js";
|
|
20
|
+
import"./cli-dth5et2y.js";
|
|
21
21
|
import {
|
|
22
22
|
exports_external,
|
|
23
23
|
init_zod
|
|
24
24
|
} from "./cli-3k1x5rn3.js";
|
|
25
25
|
import"./cli-gpnb45ck.js";
|
|
26
|
-
import"./cli-
|
|
27
|
-
import"./cli-
|
|
28
|
-
import"./cli-
|
|
26
|
+
import"./cli-0qybv29g.js";
|
|
27
|
+
import"./cli-khyery65.js";
|
|
28
|
+
import"./cli-3e0jb8k6.js";
|
|
29
29
|
import"./cli-8rxa073f.js";
|
|
30
30
|
|
|
31
31
|
// src/core/workflows/fastStrike.ts
|
|
@@ -42,14 +42,15 @@ Run this loop, tightly:
|
|
|
42
42
|
|
|
43
43
|
1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
|
|
44
44
|
2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
|
|
45
|
-
3. ACT — Test that one hypothesis with the
|
|
45
|
+
3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
|
|
46
46
|
4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
|
|
47
|
-
5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more.
|
|
48
|
-
6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go.
|
|
47
|
+
5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
|
|
48
|
+
6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
|
|
49
49
|
|
|
50
50
|
Rules:
|
|
51
51
|
- You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
|
|
52
52
|
- Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
|
|
53
|
+
- Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
|
|
53
54
|
- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
|
|
54
55
|
- Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
|
|
55
56
|
async function runFastStrike(input) {
|
|
@@ -121,7 +122,25 @@ ${combined}` : combined;
|
|
|
121
122
|
enableThinking,
|
|
122
123
|
openAIReasoningEffort
|
|
123
124
|
});
|
|
124
|
-
|
|
125
|
+
eventBus?.emit("subagent-spawn", {
|
|
126
|
+
subagentId: "fast-strike",
|
|
127
|
+
name: "Fast Strike",
|
|
128
|
+
input: { target }
|
|
129
|
+
});
|
|
130
|
+
let strikeResult;
|
|
131
|
+
try {
|
|
132
|
+
strikeResult = await agent.consume();
|
|
133
|
+
eventBus?.emit("subagent-complete", {
|
|
134
|
+
subagentId: "fast-strike",
|
|
135
|
+
status: "completed"
|
|
136
|
+
});
|
|
137
|
+
} catch (e) {
|
|
138
|
+
eventBus?.emit("subagent-complete", {
|
|
139
|
+
subagentId: "fast-strike",
|
|
140
|
+
status: "failed"
|
|
141
|
+
});
|
|
142
|
+
throw e;
|
|
143
|
+
}
|
|
125
144
|
if (abortSignal?.aborted) {
|
|
126
145
|
throw new DOMException("Pentest aborted by user", "AbortError");
|
|
127
146
|
}
|
|
@@ -152,5 +171,6 @@ ${combined}` : combined;
|
|
|
152
171
|
};
|
|
153
172
|
}
|
|
154
173
|
export {
|
|
155
|
-
runFastStrike
|
|
174
|
+
runFastStrike,
|
|
175
|
+
FAST_STRIKE_SYSTEM_PROMPT
|
|
156
176
|
};
|
|
@@ -2,27 +2,27 @@
|
|
|
2
2
|
import {
|
|
3
3
|
getFix,
|
|
4
4
|
listFixes
|
|
5
|
-
} from "./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
10
|
-
import"./cli-
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
5
|
+
} from "./cli-2m8y1rkp.js";
|
|
6
|
+
import"./cli-abm5bgap.js";
|
|
7
|
+
import"./cli-5asc7364.js";
|
|
8
|
+
import"./cli-xkv494x1.js";
|
|
9
|
+
import"./cli-s8z1mkv5.js";
|
|
10
|
+
import"./cli-41h8gh1v.js";
|
|
11
|
+
import"./cli-7d3h16fw.js";
|
|
12
|
+
import"./cli-qs2mveb2.js";
|
|
13
13
|
import"./cli-9fsre5pt.js";
|
|
14
|
-
import"./cli-
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
14
|
+
import"./cli-3r7xgtqj.js";
|
|
15
|
+
import"./cli-mb680jb3.js";
|
|
16
|
+
import"./cli-06fq5zym.js";
|
|
17
17
|
import"./cli-fw5r7pfj.js";
|
|
18
18
|
import"./cli-c8131c4q.js";
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
19
|
+
import"./cli-2q3kvbwv.js";
|
|
20
|
+
import"./cli-dth5et2y.js";
|
|
21
21
|
import"./cli-3k1x5rn3.js";
|
|
22
22
|
import"./cli-gpnb45ck.js";
|
|
23
|
-
import"./cli-
|
|
24
|
-
import"./cli-
|
|
25
|
-
import"./cli-
|
|
23
|
+
import"./cli-0qybv29g.js";
|
|
24
|
+
import"./cli-khyery65.js";
|
|
25
|
+
import"./cli-3e0jb8k6.js";
|
|
26
26
|
import"./cli-8rxa073f.js";
|
|
27
27
|
|
|
28
28
|
// src/cli/fixes.ts
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import {
|
|
2
2
|
ApexFindingObject
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-3r7xgtqj.js";
|
|
4
4
|
import {
|
|
5
5
|
ALL_TOOL_NAMES,
|
|
6
6
|
ASK_USER_QUESTIONS_TOOL_NAME,
|
|
@@ -42,6 +42,8 @@ import {
|
|
|
42
42
|
createResponseTool,
|
|
43
43
|
createSandboxBrowserTools,
|
|
44
44
|
createTask,
|
|
45
|
+
createWorkspaceApp,
|
|
46
|
+
createWorkspaceEndpoint,
|
|
45
47
|
delegateAuth,
|
|
46
48
|
detectAuthScheme,
|
|
47
49
|
documentApp,
|
|
@@ -65,6 +67,8 @@ import {
|
|
|
65
67
|
listFiles,
|
|
66
68
|
listMemories,
|
|
67
69
|
listTasksTool,
|
|
70
|
+
listWorkspaceApps,
|
|
71
|
+
listWorkspaceEndpoints,
|
|
68
72
|
parseStorageStateResult,
|
|
69
73
|
probeAuthEndpoints,
|
|
70
74
|
provideComparisonResults,
|
|
@@ -87,16 +91,16 @@ import {
|
|
|
87
91
|
validateDiscovery,
|
|
88
92
|
webSearch,
|
|
89
93
|
writePlan
|
|
90
|
-
} from "./cli-
|
|
91
|
-
import"./cli-
|
|
94
|
+
} from "./cli-mb680jb3.js";
|
|
95
|
+
import"./cli-06fq5zym.js";
|
|
92
96
|
import"./cli-c8131c4q.js";
|
|
93
|
-
import"./cli-
|
|
94
|
-
import"./cli-
|
|
97
|
+
import"./cli-2q3kvbwv.js";
|
|
98
|
+
import"./cli-dth5et2y.js";
|
|
95
99
|
import"./cli-3k1x5rn3.js";
|
|
96
100
|
import"./cli-gpnb45ck.js";
|
|
97
|
-
import"./cli-
|
|
98
|
-
import"./cli-
|
|
99
|
-
import"./cli-
|
|
101
|
+
import"./cli-0qybv29g.js";
|
|
102
|
+
import"./cli-khyery65.js";
|
|
103
|
+
import"./cli-3e0jb8k6.js";
|
|
100
104
|
import"./cli-8rxa073f.js";
|
|
101
105
|
export {
|
|
102
106
|
writePlan,
|
|
@@ -121,6 +125,8 @@ export {
|
|
|
121
125
|
provideComparisonResults,
|
|
122
126
|
probeAuthEndpoints,
|
|
123
127
|
parseStorageStateResult,
|
|
128
|
+
listWorkspaceEndpoints,
|
|
129
|
+
listWorkspaceApps,
|
|
124
130
|
listTasksTool,
|
|
125
131
|
listMemories,
|
|
126
132
|
listFiles,
|
|
@@ -144,6 +150,8 @@ export {
|
|
|
144
150
|
documentApp,
|
|
145
151
|
detectAuthScheme,
|
|
146
152
|
delegateAuth,
|
|
153
|
+
createWorkspaceEndpoint,
|
|
154
|
+
createWorkspaceApp,
|
|
147
155
|
createTask,
|
|
148
156
|
createSandboxBrowserTools,
|
|
149
157
|
createResponseTool,
|
|
@@ -7,19 +7,19 @@ import {
|
|
|
7
7
|
WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
|
|
8
8
|
WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
|
|
9
9
|
WhiteboxAttackSurfaceAgent
|
|
10
|
-
} from "./cli-
|
|
10
|
+
} from "./cli-qs2mveb2.js";
|
|
11
11
|
import"./cli-9fsre5pt.js";
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
14
|
-
import"./cli-
|
|
12
|
+
import"./cli-3r7xgtqj.js";
|
|
13
|
+
import"./cli-mb680jb3.js";
|
|
14
|
+
import"./cli-06fq5zym.js";
|
|
15
15
|
import"./cli-c8131c4q.js";
|
|
16
|
-
import"./cli-
|
|
17
|
-
import"./cli-
|
|
16
|
+
import"./cli-2q3kvbwv.js";
|
|
17
|
+
import"./cli-dth5et2y.js";
|
|
18
18
|
import"./cli-3k1x5rn3.js";
|
|
19
19
|
import"./cli-gpnb45ck.js";
|
|
20
|
-
import"./cli-
|
|
21
|
-
import"./cli-
|
|
22
|
-
import"./cli-
|
|
20
|
+
import"./cli-0qybv29g.js";
|
|
21
|
+
import"./cli-khyery65.js";
|
|
22
|
+
import"./cli-3e0jb8k6.js";
|
|
23
23
|
import"./cli-8rxa073f.js";
|
|
24
24
|
export {
|
|
25
25
|
WhiteboxAttackSurfaceAgent,
|
|
@@ -1,4 +1,5 @@
|
|
|
1
1
|
import {
|
|
2
|
+
createWorkspaceSelection,
|
|
2
3
|
disconnect,
|
|
3
4
|
ensureValidToken,
|
|
4
5
|
fetchWorkspaces,
|
|
@@ -8,14 +9,15 @@ import {
|
|
|
8
9
|
pollForWorkspaceCreation,
|
|
9
10
|
pollLegacyToken,
|
|
10
11
|
pollWorkOSToken,
|
|
12
|
+
pollWorkspaceSelection,
|
|
11
13
|
selectWorkspace,
|
|
12
14
|
signGatewayRequest,
|
|
13
15
|
startDeviceFlow,
|
|
14
16
|
validateGateway
|
|
15
|
-
} from "./cli-
|
|
16
|
-
import"./cli-
|
|
17
|
-
import"./cli-
|
|
18
|
-
import"./cli-
|
|
17
|
+
} from "./cli-dth5et2y.js";
|
|
18
|
+
import"./cli-0qybv29g.js";
|
|
19
|
+
import"./cli-khyery65.js";
|
|
20
|
+
import"./cli-3e0jb8k6.js";
|
|
19
21
|
import"./cli-8rxa073f.js";
|
|
20
22
|
init_auth();
|
|
21
23
|
|
|
@@ -24,6 +26,7 @@ export {
|
|
|
24
26
|
startDeviceFlow,
|
|
25
27
|
signGatewayRequest,
|
|
26
28
|
selectWorkspace,
|
|
29
|
+
pollWorkspaceSelection,
|
|
27
30
|
pollWorkOSToken,
|
|
28
31
|
pollLegacyToken,
|
|
29
32
|
pollForWorkspaceCreation,
|
|
@@ -31,5 +34,6 @@ export {
|
|
|
31
34
|
isConnected,
|
|
32
35
|
fetchWorkspaces,
|
|
33
36
|
ensureValidToken,
|
|
34
|
-
disconnect
|
|
37
|
+
disconnect,
|
|
38
|
+
createWorkspaceSelection
|
|
35
39
|
};
|