@pensar/apex 2.2.0 → 2.3.0-canary.3f6d2a2b

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/build/{agent-yayy5x2a.js → agent-2h0w8eta.js} +7 -7
  2. package/build/agent-95qsypnq.js +19 -0
  3. package/build/{agent-q5hwjdtb.js → agent-rktf0v3c.js} +9 -9
  4. package/build/{apps-0es69e2s.js → apps-rehs72t3.js} +17 -17
  5. package/build/{auth-q73k9bh9.js → auth-h5bjv1dp.js} +51 -40
  6. package/build/authentication-zqkagnvm.js +19 -0
  7. package/build/blackboxAgent-b799jbpa.js +19 -0
  8. package/build/{blackboxPentest-h28nykk5.js → blackboxPentest-gszetqnq.js} +14 -14
  9. package/build/{cli-s43t5ay0.js → cli-06fq5zym.js} +1 -1
  10. package/build/{cli-51dkmt5p.js → cli-0qybv29g.js} +1 -1
  11. package/build/{cli-1cf5vy5m.js → cli-2m8y1rkp.js} +60 -162
  12. package/build/{cli-6kx46ck0.js → cli-2q3kvbwv.js} +228 -39
  13. package/build/{cli-1f636vzd.js → cli-3e0jb8k6.js} +1 -1
  14. package/build/{cli-ptzy9ak5.js → cli-3r7xgtqj.js} +1 -1
  15. package/build/{cli-xpn9tsw0.js → cli-41h8gh1v.js} +34 -9
  16. package/build/{cli-1re2kv5v.js → cli-5asc7364.js} +3 -3
  17. package/build/{cli-knqx15w6.js → cli-7d3h16fw.js} +2 -2
  18. package/build/{cli-tz9yg4ew.js → cli-abm5bgap.js} +24 -8
  19. package/build/{cli-4tc6888c.js → cli-dth5et2y.js} +51 -2
  20. package/build/{cli-7n43wz82.js → cli-khyery65.js} +5 -2
  21. package/build/{cli-xbdn034b.js → cli-mb680jb3.js} +4517 -120
  22. package/build/{cli-vgg6h2ax.js → cli-pvf8tyr2.js} +1 -1
  23. package/build/{cli-7e5ad5js.js → cli-qs2mveb2.js} +2 -2
  24. package/build/{cli-n114n8mk.js → cli-s8z1mkv5.js} +2 -2
  25. package/build/{cli-2jn8104w.js → cli-xkv494x1.js} +2 -2
  26. package/build/{cli-yz80qkzn.js → cli-ycj65kyw.js} +6 -0
  27. package/build/cli.js +42 -36
  28. package/build/{config-xcf7rc6x.js → config-hawgse8e.js} +3 -3
  29. package/build/{doctor-98zperf9.js → doctor-t305mq12.js} +7 -6
  30. package/build/{fastStrike-9tm6bedh.js → fastStrike-mk0gxtkm.js} +34 -14
  31. package/build/{fixes-1dry8j61.js → fixes-gxn4cmte.js} +16 -16
  32. package/build/{index-4hqbyzf5.js → index-98bpwjq9.js} +16 -8
  33. package/build/{index-pxwwcefn.js → index-a2qb45hc.js} +9 -9
  34. package/build/{index-f6ttv7np.js → index-cpbhz85w.js} +9 -5
  35. package/build/{index-6dbym5jy.js → index-fa4xk0fq.js} +29 -12
  36. package/build/{index-31rwrakh.js → index-qqp08dtj.js} +2 -2
  37. package/build/{index-0j880wqc.js → index-ra8jmwb2.js} +1154 -909
  38. package/build/{index-34h2nb6x.js → index-yggyem63.js} +3 -3
  39. package/build/{issues-wjakj8yy.js → issues-mtbp80dr.js} +44 -16
  40. package/build/{logs-ewyzcspy.js → logs-0wpqqb3z.js} +16 -16
  41. package/build/{offesecAgent-7m9smy0t.js → offesecAgent-d5ceedmg.js} +8 -8
  42. package/build/pentest-2znknvqd.js +29 -0
  43. package/build/{pentests-1hcqjyk2.js → pentests-gnwwdmac.js} +16 -16
  44. package/build/{targetedPentest-3x13kqvc.js → targetedPentest-ap7p8j6q.js} +9 -9
  45. package/build/{targets-nqz8w37e.js → targets-be3c736k.js} +16 -16
  46. package/build/threatModel-bypv7mjx.js +27 -0
  47. package/build/{uninstall-p1q5pkx2.js → uninstall-71xttcr0.js} +1 -1
  48. package/build/{upload-x7etpfp4.js → upload-c7e0bdcn.js} +6 -6
  49. package/build/{utils-kw6yh5yn.js → utils-ef23ac3j.js} +11 -7
  50. package/package.json +1 -1
  51. package/build/agent-3cdfwxcd.js +0 -19
  52. package/build/authentication-tqx2brcv.js +0 -19
  53. package/build/blackboxAgent-d0smgqt7.js +0 -19
  54. package/build/pentest-1cb5t0dt.js +0 -29
  55. package/build/threatModel-7f02av7y.js +0 -27
@@ -3,7 +3,7 @@ import {
3
3
  init_lazyLogger,
4
4
  init_structured,
5
5
  scopedLogger
6
- } from "./cli-6kx46ck0.js";
6
+ } from "./cli-2q3kvbwv.js";
7
7
 
8
8
  // src/core/integrations/wandb/client.ts
9
9
  init_structured();
@@ -2,11 +2,11 @@ import {
2
2
  EndpointTransportEnum,
3
3
  GrpcEndpointMetadataSchema,
4
4
  OffensiveSecurityAgent
5
- } from "./cli-xbdn034b.js";
5
+ } from "./cli-mb680jb3.js";
6
6
  import {
7
7
  hasToolCall,
8
8
  init_dist
9
- } from "./cli-6kx46ck0.js";
9
+ } from "./cli-2q3kvbwv.js";
10
10
  import {
11
11
  exports_external,
12
12
  init_zod,
@@ -5,7 +5,7 @@ import {
5
5
  createReportErrorTool,
6
6
  isMemoryEnabled,
7
7
  readPlan
8
- } from "./cli-xbdn034b.js";
8
+ } from "./cli-mb680jb3.js";
9
9
  import {
10
10
  createLogger,
11
11
  hasToolCall,
@@ -13,7 +13,7 @@ import {
13
13
  init_lazyLogger,
14
14
  init_structured,
15
15
  scopedLogger
16
- } from "./cli-6kx46ck0.js";
16
+ } from "./cli-2q3kvbwv.js";
17
17
  import {
18
18
  exports_external,
19
19
  init_zod
@@ -1,11 +1,11 @@
1
1
  import {
2
2
  EvidenceFileEntrySchema
3
- } from "./cli-ptzy9ak5.js";
3
+ } from "./cli-3r7xgtqj.js";
4
4
  import {
5
5
  CweEntrySchema,
6
6
  ValidatedCweEntrySchema,
7
7
  hasCanonicalName
8
- } from "./cli-xbdn034b.js";
8
+ } from "./cli-mb680jb3.js";
9
9
  import {
10
10
  exports_external,
11
11
  init_zod
@@ -30,6 +30,12 @@ var init_types = __esm(() => {
30
30
  description: "Access multiple AI models through one API",
31
31
  requiresAPIKey: true
32
32
  },
33
+ {
34
+ id: "concentrate",
35
+ name: "Concentrate",
36
+ description: "Access multiple AI models through one API",
37
+ requiresAPIKey: true
38
+ },
33
39
  {
34
40
  id: "inception",
35
41
  name: "Inception",
package/build/cli.js CHANGED
@@ -14,16 +14,16 @@ import {
14
14
  init_toolset,
15
15
  init_utils,
16
16
  logger
17
- } from "./cli-6kx46ck0.js";
18
- import"./cli-4tc6888c.js";
17
+ } from "./cli-2q3kvbwv.js";
18
+ import"./cli-dth5et2y.js";
19
19
  import"./cli-3k1x5rn3.js";
20
20
  import"./cli-gpnb45ck.js";
21
- import"./cli-51dkmt5p.js";
22
- import"./cli-7n43wz82.js";
21
+ import"./cli-0qybv29g.js";
22
+ import"./cli-khyery65.js";
23
23
  import {
24
24
  init_package,
25
25
  package_default
26
- } from "./cli-1f636vzd.js";
26
+ } from "./cli-3e0jb8k6.js";
27
27
  import {
28
28
  __require,
29
29
  __toESM
@@ -144,7 +144,7 @@ var package_default2 = {
144
144
  tsc: "tsc --noEmit"
145
145
  },
146
146
  type: "module",
147
- version: "2.2.0"
147
+ version: "2.3.0-canary.3f6d2a2b"
148
148
  };
149
149
 
150
150
  // src/core/ai/index.ts
@@ -299,13 +299,18 @@ class AgentEventBus {
299
299
  });
300
300
  break;
301
301
  case "reasoning-start":
302
- this.emit("reasoning-start", { subagentId });
302
+ this.emit("reasoning-start", { subagentId, sessionId, messageId });
303
303
  break;
304
304
  case "reasoning-delta":
305
- this.emit("reasoning-delta", { text: chunk.text, subagentId });
305
+ this.emit("reasoning-delta", {
306
+ text: chunk.text,
307
+ subagentId,
308
+ sessionId,
309
+ messageId
310
+ });
306
311
  break;
307
312
  case "reasoning-end":
308
- this.emit("reasoning-end", { subagentId });
313
+ this.emit("reasoning-end", { subagentId, sessionId, messageId });
309
314
  break;
310
315
  case "tool-input-start":
311
316
  this.emit("tool-call-start", {
@@ -587,7 +592,7 @@ function attachCliAgentStreamListeners(bus) {
587
592
  async function createInstrumentedBus(session) {
588
593
  const bus = new AgentEventBus;
589
594
  attachCliAgentStreamListeners(bus);
590
- const { attachWandbToEventBus } = await import("./upload-x7etpfp4.js");
595
+ const { attachWandbToEventBus } = await import("./upload-c7e0bdcn.js");
591
596
  const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
592
597
  console.warn("[wandb] Tracing disabled:", e.message);
593
598
  return null;
@@ -604,7 +609,7 @@ async function resolveCliHeaders() {
604
609
  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
605
610
  const merged = {};
606
611
  if (!noGlobal) {
607
- const { config: appConfig } = await import("./index-31rwrakh.js");
612
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
608
613
  const cfg = await appConfig.get();
609
614
  if (cfg.defaultHeaders) {
610
615
  Object.assign(merged, cfg.defaultHeaders);
@@ -638,8 +643,8 @@ async function resolveCliModel() {
638
643
  const explicit = getArg("--model");
639
644
  if (explicit)
640
645
  return explicit;
641
- const { config: appConfig } = await import("./index-31rwrakh.js");
642
- const { getDefaultModelForConfig } = await import("./utils-kw6yh5yn.js");
646
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
647
+ const { getDefaultModelForConfig } = await import("./utils-ef23ac3j.js");
643
648
  const pensarConfig = await appConfig.get();
644
649
  const defaultModel = getDefaultModelForConfig(pensarConfig);
645
650
  if (!defaultModel) {
@@ -648,6 +653,7 @@ async function resolveCliModel() {
648
653
  ` + ` ANTHROPIC_API_KEY \u2014 Anthropic direct
649
654
  ` + ` OPENAI_API_KEY \u2014 OpenAI
650
655
  ` + ` OPENROUTER_API_KEY \u2014 OpenRouter
656
+ ` + ` CONCENTRATE_API_KEY \u2014 Concentrate
651
657
  ` + `
652
658
  Or run 'pensar login' to connect to Pensar Console.`);
653
659
  process.exit(1);
@@ -727,9 +733,9 @@ Global options:
727
733
  async function runPentest() {
728
734
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
729
735
  config();
730
- const { runPentestAgent } = await import("./blackboxPentest-h28nykk5.js");
731
- const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
732
- const { config: appConfig } = await import("./index-31rwrakh.js");
736
+ const { runPentestAgent } = await import("./blackboxPentest-gszetqnq.js");
737
+ const { sessions: sessions2 } = await import("./index-fa4xk0fq.js");
738
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
733
739
  const target = getArgRequired("--target");
734
740
  const cwd = getArg("--cwd");
735
741
  const mode = getArg("--mode");
@@ -805,9 +811,9 @@ Report: ${reportPath}` : ""}`);
805
811
  async function runTargetedPentest() {
806
812
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
807
813
  config();
808
- const { runTargetedPentestAgent } = await import("./targetedPentest-3x13kqvc.js");
809
- const { sessions: sessions2 } = await import("./index-6dbym5jy.js");
810
- const { config: appConfig } = await import("./index-31rwrakh.js");
814
+ const { runTargetedPentestAgent } = await import("./targetedPentest-ap7p8j6q.js");
815
+ const { sessions: sessions2 } = await import("./index-fa4xk0fq.js");
816
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
811
817
  const target = getArgRequired("--target");
812
818
  const objectives = getAllArgs("--objective");
813
819
  const pensarConfig = await appConfig.get();
@@ -859,8 +865,8 @@ POCs: ${pocsPath}`);
859
865
  async function runThreatModel() {
860
866
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
861
867
  config();
862
- const { runThreatModelWorkflow } = await import("./threatModel-7f02av7y.js");
863
- const { config: appConfig } = await import("./index-31rwrakh.js");
868
+ const { runThreatModelWorkflow } = await import("./threatModel-bypv7mjx.js");
869
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
864
870
  const path2 = await import("path");
865
871
  const pensarConfig = await appConfig.get();
866
872
  const model = await resolveCliModel();
@@ -896,10 +902,10 @@ Threat model written to: ${resolvedPath}`);
896
902
  async function runOperator() {
897
903
  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
898
904
  config();
899
- const { runOffensiveSecurityAgent } = await import("./offesecAgent-7m9smy0t.js");
900
- const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-6dbym5jy.js");
901
- const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-4hqbyzf5.js");
902
- const { config: appConfig } = await import("./index-31rwrakh.js");
905
+ const { runOffensiveSecurityAgent } = await import("./offesecAgent-d5ceedmg.js");
906
+ const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-fa4xk0fq.js");
907
+ const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-98bpwjq9.js");
908
+ const { config: appConfig } = await import("./index-qqp08dtj.js");
903
909
  const { createInterface } = await import("readline");
904
910
  const { readFileSync: readFileSync2, existsSync } = await import("fs");
905
911
  const path2 = await import("path");
@@ -1013,35 +1019,35 @@ if (hasFlag("-p") || command === "--prompt") {
1013
1019
  await runTargetedPentest();
1014
1020
  } else if (command === "login" || command === "auth") {
1015
1021
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1016
- await import("./auth-q73k9bh9.js");
1022
+ await import("./auth-h5bjv1dp.js");
1017
1023
  } else if (command === "uninstall") {
1018
1024
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1019
- await import("./uninstall-p1q5pkx2.js");
1025
+ await import("./uninstall-71xttcr0.js");
1020
1026
  } else if (command === "apps") {
1021
1027
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1022
- await import("./apps-0es69e2s.js");
1028
+ await import("./apps-rehs72t3.js");
1023
1029
  } else if (command === "pentests") {
1024
1030
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1025
- await import("./pentests-1hcqjyk2.js");
1031
+ await import("./pentests-gnwwdmac.js");
1026
1032
  } else if (command === "targets") {
1027
1033
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1028
- await import("./targets-nqz8w37e.js");
1034
+ await import("./targets-be3c736k.js");
1029
1035
  } else if (command === "issues") {
1030
1036
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1031
- await import("./issues-wjakj8yy.js");
1037
+ await import("./issues-mtbp80dr.js");
1032
1038
  } else if (command === "fixes") {
1033
1039
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1034
- await import("./fixes-1dry8j61.js");
1040
+ await import("./fixes-gxn4cmte.js");
1035
1041
  } else if (command === "logs") {
1036
1042
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1037
- await import("./logs-ewyzcspy.js");
1043
+ await import("./logs-0wpqqb3z.js");
1038
1044
  } else if (command === "config") {
1039
1045
  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
1040
- await import("./config-xcf7rc6x.js");
1046
+ await import("./config-hawgse8e.js");
1041
1047
  } else if (command === "threat-model") {
1042
1048
  await runThreatModel();
1043
1049
  } else if (command === "doctor") {
1044
- const { runDoctor } = await import("./doctor-98zperf9.js");
1050
+ const { runDoctor } = await import("./doctor-t305mq12.js");
1045
1051
  await runDoctor();
1046
1052
  } else if (args.length === 0) {
1047
1053
  if (process.env.PENSAR_NO_TUI === "1") {
@@ -1049,7 +1055,7 @@ if (hasFlag("-p") || command === "--prompt") {
1049
1055
  console.error("All other commands work with Node \u2014 run 'pensar --help'.");
1050
1056
  process.exit(1);
1051
1057
  }
1052
- await import("./index-0j880wqc.js");
1058
+ await import("./index-ra8jmwb2.js");
1053
1059
  } else {
1054
1060
  console.error(`Error: Unknown command '${command}'`);
1055
1061
  console.error();
@@ -11,9 +11,9 @@ import {
11
11
  import {
12
12
  config,
13
13
  init_config
14
- } from "./cli-51dkmt5p.js";
15
- import"./cli-7n43wz82.js";
16
- import"./cli-1f636vzd.js";
14
+ } from "./cli-0qybv29g.js";
15
+ import"./cli-khyery65.js";
16
+ import"./cli-3e0jb8k6.js";
17
17
  import"./cli-8rxa073f.js";
18
18
 
19
19
  // src/cli/config.ts
@@ -1,13 +1,13 @@
1
1
  import {
2
2
  toolExists
3
- } from "./cli-s43t5ay0.js";
4
- import"./cli-6kx46ck0.js";
5
- import"./cli-4tc6888c.js";
3
+ } from "./cli-06fq5zym.js";
4
+ import"./cli-2q3kvbwv.js";
5
+ import"./cli-dth5et2y.js";
6
6
  import"./cli-3k1x5rn3.js";
7
7
  import"./cli-gpnb45ck.js";
8
- import"./cli-51dkmt5p.js";
9
- import"./cli-7n43wz82.js";
10
- import"./cli-1f636vzd.js";
8
+ import"./cli-0qybv29g.js";
9
+ import"./cli-khyery65.js";
10
+ import"./cli-3e0jb8k6.js";
11
11
  import"./cli-8rxa073f.js";
12
12
 
13
13
  // src/core/doctor.ts
@@ -50,6 +50,7 @@ function checkApiKeys() {
50
50
  { provider: "OpenAI", env: "OPENAI_API_KEY" },
51
51
  { provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
52
52
  { provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
53
+ { provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
53
54
  { provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
54
55
  { provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
55
56
  { provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }
@@ -4,28 +4,28 @@ import {
4
4
  buildPentestReport,
5
5
  renderJson,
6
6
  renderMarkdown
7
- } from "./cli-2jn8104w.js";
7
+ } from "./cli-xkv494x1.js";
8
8
  import"./cli-9fsre5pt.js";
9
- import"./cli-ptzy9ak5.js";
9
+ import"./cli-3r7xgtqj.js";
10
10
  import {
11
11
  FindingsRegistry,
12
12
  OffensiveSecurityAgent
13
- } from "./cli-xbdn034b.js";
14
- import"./cli-s43t5ay0.js";
13
+ } from "./cli-mb680jb3.js";
14
+ import"./cli-06fq5zym.js";
15
15
  import {
16
16
  createThreatModelPrompt
17
17
  } from "./cli-fw5r7pfj.js";
18
18
  import"./cli-c8131c4q.js";
19
- import"./cli-6kx46ck0.js";
20
- import"./cli-4tc6888c.js";
19
+ import"./cli-2q3kvbwv.js";
20
+ import"./cli-dth5et2y.js";
21
21
  import {
22
22
  exports_external,
23
23
  init_zod
24
24
  } from "./cli-3k1x5rn3.js";
25
25
  import"./cli-gpnb45ck.js";
26
- import"./cli-51dkmt5p.js";
27
- import"./cli-7n43wz82.js";
28
- import"./cli-1f636vzd.js";
26
+ import"./cli-0qybv29g.js";
27
+ import"./cli-khyery65.js";
28
+ import"./cli-3e0jb8k6.js";
29
29
  import"./cli-8rxa073f.js";
30
30
 
31
31
  // src/core/workflows/fastStrike.ts
@@ -42,14 +42,15 @@ Run this loop, tightly:
42
42
 
43
43
  1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
44
44
  2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
45
- 3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
45
+ 3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
46
46
  4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
47
- 5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end foothold, then privesc, then the goal.
48
- 6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
47
+ 5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
48
+ 6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
49
49
 
50
50
  Rules:
51
51
  - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
52
52
  - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
53
+ - Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
53
54
  - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
54
55
  - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
55
56
  async function runFastStrike(input) {
@@ -121,7 +122,25 @@ ${combined}` : combined;
121
122
  enableThinking,
122
123
  openAIReasoningEffort
123
124
  });
124
- const strikeResult = await agent.consume();
125
+ eventBus?.emit("subagent-spawn", {
126
+ subagentId: "fast-strike",
127
+ name: "Fast Strike",
128
+ input: { target }
129
+ });
130
+ let strikeResult;
131
+ try {
132
+ strikeResult = await agent.consume();
133
+ eventBus?.emit("subagent-complete", {
134
+ subagentId: "fast-strike",
135
+ status: "completed"
136
+ });
137
+ } catch (e) {
138
+ eventBus?.emit("subagent-complete", {
139
+ subagentId: "fast-strike",
140
+ status: "failed"
141
+ });
142
+ throw e;
143
+ }
125
144
  if (abortSignal?.aborted) {
126
145
  throw new DOMException("Pentest aborted by user", "AbortError");
127
146
  }
@@ -152,5 +171,6 @@ ${combined}` : combined;
152
171
  };
153
172
  }
154
173
  export {
155
- runFastStrike
174
+ runFastStrike,
175
+ FAST_STRIKE_SYSTEM_PROMPT
156
176
  };
@@ -2,27 +2,27 @@
2
2
  import {
3
3
  getFix,
4
4
  listFixes
5
- } from "./cli-1cf5vy5m.js";
6
- import"./cli-tz9yg4ew.js";
7
- import"./cli-1re2kv5v.js";
8
- import"./cli-2jn8104w.js";
9
- import"./cli-n114n8mk.js";
10
- import"./cli-xpn9tsw0.js";
11
- import"./cli-knqx15w6.js";
12
- import"./cli-7e5ad5js.js";
5
+ } from "./cli-2m8y1rkp.js";
6
+ import"./cli-abm5bgap.js";
7
+ import"./cli-5asc7364.js";
8
+ import"./cli-xkv494x1.js";
9
+ import"./cli-s8z1mkv5.js";
10
+ import"./cli-41h8gh1v.js";
11
+ import"./cli-7d3h16fw.js";
12
+ import"./cli-qs2mveb2.js";
13
13
  import"./cli-9fsre5pt.js";
14
- import"./cli-ptzy9ak5.js";
15
- import"./cli-xbdn034b.js";
16
- import"./cli-s43t5ay0.js";
14
+ import"./cli-3r7xgtqj.js";
15
+ import"./cli-mb680jb3.js";
16
+ import"./cli-06fq5zym.js";
17
17
  import"./cli-fw5r7pfj.js";
18
18
  import"./cli-c8131c4q.js";
19
- import"./cli-6kx46ck0.js";
20
- import"./cli-4tc6888c.js";
19
+ import"./cli-2q3kvbwv.js";
20
+ import"./cli-dth5et2y.js";
21
21
  import"./cli-3k1x5rn3.js";
22
22
  import"./cli-gpnb45ck.js";
23
- import"./cli-51dkmt5p.js";
24
- import"./cli-7n43wz82.js";
25
- import"./cli-1f636vzd.js";
23
+ import"./cli-0qybv29g.js";
24
+ import"./cli-khyery65.js";
25
+ import"./cli-3e0jb8k6.js";
26
26
  import"./cli-8rxa073f.js";
27
27
 
28
28
  // src/cli/fixes.ts
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  ApexFindingObject
3
- } from "./cli-ptzy9ak5.js";
3
+ } from "./cli-3r7xgtqj.js";
4
4
  import {
5
5
  ALL_TOOL_NAMES,
6
6
  ASK_USER_QUESTIONS_TOOL_NAME,
@@ -42,6 +42,8 @@ import {
42
42
  createResponseTool,
43
43
  createSandboxBrowserTools,
44
44
  createTask,
45
+ createWorkspaceApp,
46
+ createWorkspaceEndpoint,
45
47
  delegateAuth,
46
48
  detectAuthScheme,
47
49
  documentApp,
@@ -65,6 +67,8 @@ import {
65
67
  listFiles,
66
68
  listMemories,
67
69
  listTasksTool,
70
+ listWorkspaceApps,
71
+ listWorkspaceEndpoints,
68
72
  parseStorageStateResult,
69
73
  probeAuthEndpoints,
70
74
  provideComparisonResults,
@@ -87,16 +91,16 @@ import {
87
91
  validateDiscovery,
88
92
  webSearch,
89
93
  writePlan
90
- } from "./cli-xbdn034b.js";
91
- import"./cli-s43t5ay0.js";
94
+ } from "./cli-mb680jb3.js";
95
+ import"./cli-06fq5zym.js";
92
96
  import"./cli-c8131c4q.js";
93
- import"./cli-6kx46ck0.js";
94
- import"./cli-4tc6888c.js";
97
+ import"./cli-2q3kvbwv.js";
98
+ import"./cli-dth5et2y.js";
95
99
  import"./cli-3k1x5rn3.js";
96
100
  import"./cli-gpnb45ck.js";
97
- import"./cli-51dkmt5p.js";
98
- import"./cli-7n43wz82.js";
99
- import"./cli-1f636vzd.js";
101
+ import"./cli-0qybv29g.js";
102
+ import"./cli-khyery65.js";
103
+ import"./cli-3e0jb8k6.js";
100
104
  import"./cli-8rxa073f.js";
101
105
  export {
102
106
  writePlan,
@@ -121,6 +125,8 @@ export {
121
125
  provideComparisonResults,
122
126
  probeAuthEndpoints,
123
127
  parseStorageStateResult,
128
+ listWorkspaceEndpoints,
129
+ listWorkspaceApps,
124
130
  listTasksTool,
125
131
  listMemories,
126
132
  listFiles,
@@ -144,6 +150,8 @@ export {
144
150
  documentApp,
145
151
  detectAuthScheme,
146
152
  delegateAuth,
153
+ createWorkspaceEndpoint,
154
+ createWorkspaceApp,
147
155
  createTask,
148
156
  createSandboxBrowserTools,
149
157
  createResponseTool,
@@ -7,19 +7,19 @@ import {
7
7
  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
8
8
  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
9
9
  WhiteboxAttackSurfaceAgent
10
- } from "./cli-7e5ad5js.js";
10
+ } from "./cli-qs2mveb2.js";
11
11
  import"./cli-9fsre5pt.js";
12
- import"./cli-ptzy9ak5.js";
13
- import"./cli-xbdn034b.js";
14
- import"./cli-s43t5ay0.js";
12
+ import"./cli-3r7xgtqj.js";
13
+ import"./cli-mb680jb3.js";
14
+ import"./cli-06fq5zym.js";
15
15
  import"./cli-c8131c4q.js";
16
- import"./cli-6kx46ck0.js";
17
- import"./cli-4tc6888c.js";
16
+ import"./cli-2q3kvbwv.js";
17
+ import"./cli-dth5et2y.js";
18
18
  import"./cli-3k1x5rn3.js";
19
19
  import"./cli-gpnb45ck.js";
20
- import"./cli-51dkmt5p.js";
21
- import"./cli-7n43wz82.js";
22
- import"./cli-1f636vzd.js";
20
+ import"./cli-0qybv29g.js";
21
+ import"./cli-khyery65.js";
22
+ import"./cli-3e0jb8k6.js";
23
23
  import"./cli-8rxa073f.js";
24
24
  export {
25
25
  WhiteboxAttackSurfaceAgent,
@@ -1,4 +1,5 @@
1
1
  import {
2
+ createWorkspaceSelection,
2
3
  disconnect,
3
4
  ensureValidToken,
4
5
  fetchWorkspaces,
@@ -8,14 +9,15 @@ import {
8
9
  pollForWorkspaceCreation,
9
10
  pollLegacyToken,
10
11
  pollWorkOSToken,
12
+ pollWorkspaceSelection,
11
13
  selectWorkspace,
12
14
  signGatewayRequest,
13
15
  startDeviceFlow,
14
16
  validateGateway
15
- } from "./cli-4tc6888c.js";
16
- import"./cli-51dkmt5p.js";
17
- import"./cli-7n43wz82.js";
18
- import"./cli-1f636vzd.js";
17
+ } from "./cli-dth5et2y.js";
18
+ import"./cli-0qybv29g.js";
19
+ import"./cli-khyery65.js";
20
+ import"./cli-3e0jb8k6.js";
19
21
  import"./cli-8rxa073f.js";
20
22
  init_auth();
21
23
 
@@ -24,6 +26,7 @@ export {
24
26
  startDeviceFlow,
25
27
  signGatewayRequest,
26
28
  selectWorkspace,
29
+ pollWorkspaceSelection,
27
30
  pollWorkOSToken,
28
31
  pollLegacyToken,
29
32
  pollForWorkspaceCreation,
@@ -31,5 +34,6 @@ export {
31
34
  isConnected,
32
35
  fetchWorkspaces,
33
36
  ensureValidToken,
34
- disconnect
37
+ disconnect,
38
+ createWorkspaceSelection
35
39
  };