@pensar/apex 2.3.0-canary.3f6d2a2b → 2.3.0-canary.52dcca8a

package/build/agent-fm5w5z1k.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-d87eqxwz.js";
+import"./cli-9fsre5pt.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
+import"./cli-c8131c4q.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
+import"./cli-8rxa073f.js";
+export {
+  CodeAgent
+};

package/build/{agent-rktf0v3c.js → agent-hwcyr0hm.js}

@@ -3,22 +3,24 @@ import {
   TargetedPentestAgent,
   buildPentestActiveTools,
   buildPentestPrompt,
-  buildPentestSystemPrompt
-} from "./cli-s8z1mkv5.js";
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+} from "./cli-mxxqfthd.js";
 import"./cli-9fsre5pt.js";
-import"./cli-3r7xgtqj.js";
-import"./cli-mb680jb3.js";
-import"./cli-06fq5zym.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
 import"./cli-c8131c4q.js";
-import"./cli-2q3kvbwv.js";
-import"./cli-dth5et2y.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0qybv29g.js";
-import"./cli-khyery65.js";
-import"./cli-3e0jb8k6.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
 import"./cli-8rxa073f.js";
 export {
+  resolvePentestAgentRole,
   buildPentestSystemPrompt,
   buildPentestPrompt,
   buildPentestActiveTools,

package/build/{agent-2h0w8eta.js → agent-vnqwcr7d.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-mb680jb3.js";
+} from "./cli-7qfq9p90.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-06fq5zym.js";
+} from "./cli-6s9px6xx.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-2q3kvbwv.js";
-import"./cli-dth5et2y.js";
+} from "./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
 import {
   exports_external,
   init_zod
 } from "./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0qybv29g.js";
-import"./cli-khyery65.js";
-import"./cli-3e0jb8k6.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
 import"./cli-8rxa073f.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -68,7 +68,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
-- Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
+- Missing rate limiting / anti-automation: a modest burst (~20 requests) with no observed throttling, delays, or 429s is sufficient to demonstrate the gap. For endpoints with real-world side effects (sending email/SMS/push, creating tickets/notifications, contact/support/feedback forms, payments), as few as 2–3 attempts plus the observed response is sufficient — do NOT require volume-testing that would spam real recipients. Evidence must state exact request count, timing/distribution, and observed statuses.
 
 ### Common Low-Signal Patterns
 Reject these unless the submitted evidence demonstrates concrete harm:

package/build/{apps-rehs72t3.js → apps-67zrw8pd.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env bun
-import"./cli-2m8y1rkp.js";
-import"./cli-abm5bgap.js";
-import"./cli-5asc7364.js";
-import"./cli-xkv494x1.js";
-import"./cli-s8z1mkv5.js";
-import"./cli-41h8gh1v.js";
-import"./cli-7d3h16fw.js";
-import"./cli-qs2mveb2.js";
+import"./cli-kpw8xg85.js";
+import"./cli-kvzs0hjm.js";
+import"./cli-5p2j3vnp.js";
+import"./cli-ztfjw0dz.js";
+import"./cli-mxxqfthd.js";
+import"./cli-cf3qakdp.js";
+import"./cli-d87eqxwz.js";
+import"./cli-tfycemzh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-3r7xgtqj.js";
+import"./cli-0r3ht7s5.js";
 import {
   createApp,
   createEndpoint,
@@ -22,17 +22,17 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-mb680jb3.js";
-import"./cli-06fq5zym.js";
+} from "./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-2q3kvbwv.js";
-import"./cli-dth5et2y.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0qybv29g.js";
-import"./cli-khyery65.js";
-import"./cli-3e0jb8k6.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
 import"./cli-8rxa073f.js";
 
 // src/cli/apps.ts

package/build/{auth-h5bjv1dp.js → auth-yk98rvbx.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-2m8y1rkp.js";
-import"./cli-abm5bgap.js";
-import"./cli-5asc7364.js";
-import"./cli-xkv494x1.js";
-import"./cli-s8z1mkv5.js";
-import"./cli-41h8gh1v.js";
-import"./cli-7d3h16fw.js";
-import"./cli-qs2mveb2.js";
+import"./cli-kpw8xg85.js";
+import"./cli-kvzs0hjm.js";
+import"./cli-5p2j3vnp.js";
+import"./cli-ztfjw0dz.js";
+import"./cli-mxxqfthd.js";
+import"./cli-cf3qakdp.js";
+import"./cli-d87eqxwz.js";
+import"./cli-tfycemzh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-3r7xgtqj.js";
-import"./cli-mb680jb3.js";
-import"./cli-06fq5zym.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-2q3kvbwv.js";
+import"./cli-y7w5jqsx.js";
 import {
   createWorkspaceSelection,
   disconnect,
@@ -29,15 +29,15 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-dth5et2y.js";
+} from "./cli-drwk0mqr.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
 import {
   config,
   init_config
-} from "./cli-0qybv29g.js";
-import"./cli-khyery65.js";
-import"./cli-3e0jb8k6.js";
+} from "./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
 import {
   __require
 } from "./cli-8rxa073f.js";

package/build/authentication-wk9g667h.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-cf3qakdp.js";
+import"./cli-9fsre5pt.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
+import"./cli-c8131c4q.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
+import"./cli-8rxa073f.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-k84zmpsq.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-5p2j3vnp.js";
+import"./cli-9fsre5pt.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
+import"./cli-c8131c4q.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
+import"./cli-3k1x5rn3.js";
+import"./cli-gpnb45ck.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
+import"./cli-8rxa073f.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-gszetqnq.js → blackboxPentest-rh4s1w46.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-abm5bgap.js";
-import"./cli-5asc7364.js";
-import"./cli-xkv494x1.js";
-import"./cli-s8z1mkv5.js";
-import"./cli-7d3h16fw.js";
-import"./cli-qs2mveb2.js";
+} from "./cli-kvzs0hjm.js";
+import"./cli-5p2j3vnp.js";
+import"./cli-ztfjw0dz.js";
+import"./cli-mxxqfthd.js";
+import"./cli-d87eqxwz.js";
+import"./cli-tfycemzh.js";
 import"./cli-9fsre5pt.js";
-import"./cli-3r7xgtqj.js";
-import"./cli-mb680jb3.js";
-import"./cli-06fq5zym.js";
+import"./cli-0r3ht7s5.js";
+import"./cli-7qfq9p90.js";
+import"./cli-6s9px6xx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-2q3kvbwv.js";
-import"./cli-dth5et2y.js";
+import"./cli-y7w5jqsx.js";
+import"./cli-drwk0mqr.js";
 import"./cli-3k1x5rn3.js";
 import"./cli-gpnb45ck.js";
-import"./cli-0qybv29g.js";
-import"./cli-khyery65.js";
-import"./cli-3e0jb8k6.js";
+import"./cli-8tmnaynq.js";
+import"./cli-pz7zedqf.js";
+import"./cli-pzg7xn73.js";
 import"./cli-8rxa073f.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-3r7xgtqj.js → cli-0r3ht7s5.js}

@@ -1,7 +1,7 @@
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-mb680jb3.js";
+} from "./cli-7qfq9p90.js";
 import {
   exports_external,
   init_zod

package/build/{cli-5asc7364.js → cli-5p2j3vnp.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-mb680jb3.js";
+} from "./cli-7qfq9p90.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-06fq5zym.js";
+} from "./cli-6s9px6xx.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-2q3kvbwv.js";
+} from "./cli-y7w5jqsx.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/{cli-06fq5zym.js → cli-6s9px6xx.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-2q3kvbwv.js";
+} from "./cli-y7w5jqsx.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";