@pensar/apex 2.3.0 → 2.4.0-canary.01e519de

package/build/{cli-7tw4xfnw.js → cli-nyj54g4k.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-er8qc2y9.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-zm8tfpv7.js → cli-r2cvbp82.js}

@@ -1,28 +1,28 @@
+import {
+  AppsDiscoveryResultSchema,
+  DiscoverySummarySchema,
+  EndpointSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
+} from "./cli-0e3qxh7j.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-bv2807tj.js";
+} from "./cli-4aakh7qb.js";
+import {
+  TargetedPentestAgent,
+  buildPentestSystemPrompt
+} from "./cli-jxnwyczj.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-50906d27.js";
+} from "./cli-j18by3n1.js";
 import {
   CodeAgent
-} from "./cli-j0n189ee.js";
-import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-baqhqbe5.js";
+} from "./cli-51g5fkhp.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-n2m2yy5b.js";
+} from "./cli-c5wcg4h3.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,10 +45,10 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-er8qc2y9.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -126,9 +126,23 @@ function normalizeTokenUsage(value) {
   return {
     inputTokens,
     outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
     totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
   };
 }
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
 function metricsPath(sessionRootPath) {
   return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
 }
@@ -143,6 +157,7 @@ function readExecutionMetrics(sessionRootPath) {
     const parsed = JSON.parse(readFileSync(path, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
       elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
@@ -167,10 +182,13 @@ function writeExecutionMetrics(input) {
   const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
     inputTokens: 0,
     outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
     totalTokens: 0
   };
   const next = {
     tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
     runtime: input.runtime ?? existing?.runtime,
     elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
     updatedAt: new Date().toISOString()
@@ -7639,16 +7657,6 @@ When finished, call \`response\` with a summary of how many entry points you doc
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
 async function runPentestSwarm(input) {
   const {
     targets,
@@ -7661,6 +7669,7 @@ async function runPentestSwarm(input) {
     onError,
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
@@ -7692,6 +7701,12 @@ async function runPentestSwarm(input) {
     });
     if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
       try {
+        eventBus?.emit("subagent-spawn", {
+          subagentId: `${subagentId}-plan`,
+          name: `${subagentName} (plan)`,
+          input: { target: target.target, objectives: target.objectives },
+          parentSubagentId: subagentId
+        });
         const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
@@ -7711,13 +7726,25 @@ async function runPentestSwarm(input) {
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
+          onStepFinish,
+          onCacheMetrics,
           enableThinking,
           thinkingEffort,
           openAIReasoningEffort,
           display
         });
         await planAgent.consume();
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "completed",
+          parentSubagentId: subagentId
+        });
       } catch (planErr) {
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "failed",
+          parentSubagentId: subagentId
+        });
         log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
       }
     }
@@ -7734,6 +7761,8 @@ async function runPentestSwarm(input) {
         abortSignal,
         findingsRegistry,
         onStepFinish: handleStepFinish,
+        onCacheMetrics,
+        forwardUsageCallbacksToSpawnedAgents: true,
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
@@ -7786,7 +7815,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-ebz1ph9a.js");
+    const { runFastStrike } = await import("./fastStrike-z2917eqj.js");
     return runFastStrike(input);
   }
   const {
@@ -7823,17 +7852,6 @@ async function runPentestWorkflow(input) {
 ${combined}` : combined;
   }
   const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
   try {
     const mode = cwd ? "whitebox" : "blackbox";
     let swarmTargets;
@@ -7870,7 +7888,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
           surfaceIntegrationEnabled
@@ -7883,7 +7901,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort
         });
@@ -7936,7 +7954,8 @@ ${combined}` : combined;
         abortSignal,
         findingsRegistry,
         eventBus,
-        onStepFinish: wrappedOnStepFinish,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort
@@ -7984,7 +8003,6 @@ ${combined}` : combined;
     const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
     writeExecutionMetrics({
       sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
       runtime
     });
   }

package/build/{cli-f7hanqbw.js → cli-r4z9n4q4.js}

@@ -3,10 +3,10 @@ import {
   init,
   init_config,
   update
-} from "./cli-eveg9djy.js";
+} from "./cli-rnwxtghc.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/config/index.ts
 var config;

package/build/{cli-eveg9djy.js → cli-rnwxtghc.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-barsn8br.js";
+} from "./cli-g106a565.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/config/config.ts
 import fs from "node:fs/promises";
@@ -45,6 +45,7 @@ function applyEnvFallbacks(parsedConfig) {
     anthropicAPIKey: parsedConfig.anthropicAPIKey ?? process.env.ANTHROPIC_API_KEY,
     googleAPIKey: parsedConfig.googleAPIKey ?? process.env.GOOGLE_GENERATIVE_AI_API_KEY,
     openRouterAPIKey: parsedConfig.openRouterAPIKey ?? process.env.OPENROUTER_API_KEY,
+    concentrateAPIKey: parsedConfig.concentrateAPIKey ?? process.env.CONCENTRATE_API_KEY,
     inceptionAPIKey: parsedConfig.inceptionAPIKey ?? process.env.INCEPTION_API_KEY,
     bedrockAPIKey: parsedConfig.bedrockAPIKey ?? process.env.BEDROCK_API_KEY,
     pensarAPIKey: parsedConfig.pensarAPIKey ?? process.env.PENSAR_API_KEY,

package/build/{cli-vckbhnyk.js → cli-tam9trnb.js}

@@ -1,10 +1,10 @@
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
+} from "./cli-r4z9n4q4.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/auth/connection.ts
 function isConnected(cfg) {

package/build/{cli-zk1ch6qf.js → cli-xz5thhya.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-c5wcg4h3.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-nyj54g4k.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-er8qc2y9.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -31,7 +31,7 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Operating Mode
 
 - Fully autonomous — no human intervention
-- If you encounter barriers (CAPTCHA, MFA), report failure with details
+- If you encounter barriers (CAPTCHA, or MFA with no TOTP seed available), report failure with details
 - Call \`complete_authentication\` when done (success or failure)
 
 # Available Tools
@@ -125,6 +125,39 @@ These are the ONLY way downstream agents receive the session credentials.
 
 **Then**, call the \`response\` tool with your final summary to end the run. This is required — complete_authentication persists the data, response terminates the agent.
 
+# MFA / TOTP Codes
+
+If the login asks for a 6-digit authenticator code, check whether a TOTP seed was provided for this
+account — it appears as an extra secret field on the credential and as a matching environment variable
+(look for a name containing TOTP, MFA, OTP, or 2FA). If one exists, do NOT report an MFA barrier —
+compute the code yourself:
+
+\`\`\`
+python3 -c "import base64,hmac,hashlib,struct,time,os;s=os.environ['<ENV_VAR>'].replace(' ','').upper();k=base64.b32decode(s+'='*(-len(s)%8));d=hmac.new(k,struct.pack('>Q',int(time.time())//30),hashlib.sha1).digest();o=d[-1]&15;print('%06d'%((struct.unpack('>I',d[o:o+4])[0]&0x7fffffff)%1000000))"
+\`\`\`
+
+Read the seed from the environment variable — never paste a seed literal into a command. Codes rotate
+every 30 seconds, so run this immediately before filling the field. If the code is rejected, re-run and
+retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
+or two fresh codes are both rejected.
+
+# SMS passwordless (phone as login)
+
+If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
+after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
+
+1. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
+2. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
+3. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with that \`credentialId\` and \`sinceMs\`.
+   If the list is empty, sleep and list again a few times. If it stays empty or returns an error, stop
+   and report what you observed — do not hang in a wait loop. Set \`claim=true\` once a message is present
+   so other runs cannot reuse the OTP.
+4. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
+5. Continue the login and call \`complete_authentication\`.
+
+TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
+app code.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -136,7 +169,8 @@ If authentication fails, try these mechanical fixes (they are login mechanics, n
 
 If credentials were provided to you, they are already verified and SHARED — do not modify them or their
 account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
-forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+forced password change is required, MFA is required and no TOTP seed was provided, or the email is not
+confirmed — do NOT try to recover by resetting or changing
 the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
 \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
 or self-sign-up to get around a rejected provided credential — that is a different account than the one
@@ -194,7 +228,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
     const cm = session.credentialManager;
     super({
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context),
+      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
       model,
       session,
       target,
@@ -226,6 +260,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -272,7 +307,7 @@ function loadAuthResult(authDataPath) {
     };
   }
 }
-function buildAuthPrompt(target, authHints, credentialManager, context) {
+function buildAuthPrompt(target, authHints, credentialManager, context, envVarNames) {
   const parts = [`TARGET: ${target}
 `];
   if (context) {
@@ -290,6 +325,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push(`No credentials provided. Probe the target to discover auth requirements.
 `);
   }
+  if (envVarNames?.length) {
+    parts.push("ENVIRONMENT VARIABLES:");
+    parts.push(`These are pre-loaded in your shell and available in every execute_command call. Reference them (e.g. $${envVarNames[0]}) — their values are hidden from you and redacted from command output, so never try to print one.`);
+    parts.push(envVarNames.map((n) => `- ${n}`).join(`
+`));
+    parts.push("");
+  }
   if (authHints) {
     parts.push("AUTH HINTS:");
     if (authHints.authScheme)
@@ -304,6 +346,14 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push("");
   }
   if (credBlock) {
+    const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasSmsPasswordless ? `
+If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
+identifier — not MFA-after-password. browser_fill credentialField="phoneNumber", click send-code, then
+execute_command \`sleep 5\` and call sms_list_messages with sinceMs = Date.now() at that click (claim=true
+once a message is present). If the list is empty, sleep and list again; if it stays empty, fail with what
+you observed — do not hang waiting. Then browser_fill the OTP. Do NOT report phone_verification as a
+barrier for this flow. TOTP-via-env for authenticator MFA is unchanged.` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -311,13 +361,14 @@ You have credentials available via credential IDs — authenticate immediately.
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
-
+${smsInstructions}
 The credentials above were provided to you and have already been verified — they are SHARED across runs, so
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
 resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
-password change required, MFA required, email not confirmed), call complete_authentication with
-success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+password change required, email not confirmed, or an MFA prompt with no TOTP seed available), call
+complete_authentication with success=false and a clear summary of why — do not attempt to recover, reset,
+or rotate them. When a TOTP seed IS available, generate the code and continue; that is not a barrier. Do NOT
 register a new account or self-sign-up to work around a failed login: that is not the credential under test
 and only pollutes results — fail fast with success=false instead.`);
   } else {

package/build/{cli-jyp2c6th.js → cli-y6tyk0ms.js}

@@ -1,11 +1,12 @@
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-n2m2yy5b.js";
+} from "./cli-c5wcg4h3.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/offSecAgent/types.ts
 init_zod();
@@ -47,7 +48,8 @@ var ApexFindingObject = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 
 export { EvidenceFileEntrySchema, ApexFindingObject };