@pensar/apex 2.3.0 → 2.4.0-canary.09a8744f

package/build/{agent-9xna7jhw.js → agent-4gcavfr4.js}

@@ -1,24 +1,25 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-hc4w41as.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-cdk877bx.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+} from "./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
 init_dist();
@@ -68,7 +69,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
-- Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
+- Missing rate limiting / anti-automation: a modest burst (~20 requests) with no observed throttling, delays, or 429s is sufficient to demonstrate the gap. For endpoints with real-world side effects (sending email/SMS/push, creating tickets/notifications, contact/support/feedback forms, payments), as few as 2–3 attempts plus the observed response is sufficient — do NOT require volume-testing that would spam real recipients. Evidence must state exact request count, timing/distribution, and observed statuses.
 
 ### Common Low-Signal Patterns
 Reject these unless the submitted evidence demonstrates concrete harm:

package/build/agent-7x7b5hz1.js

@@ -0,0 +1,30 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+} from "./cli-nw9ytp7z.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
+import"./cli-c8131c4q.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+};

package/build/agent-zx1cw89c.js

@@ -0,0 +1,20 @@
+import {
+  CodeAgent
+} from "./cli-j5p6jwm8.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
+import"./cli-c8131c4q.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/{apps-43pqbz7r.js → apps-xqecgcbn.js}

@@ -1,39 +1,47 @@
 #!/usr/bin/env bun
 import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
+import"./cli-ex9r1x7c.js";
+import"./cli-9pbk8m32.js";
+import"./cli-n36kxpcz.js";
+import"./cli-7gcsfnw6.js";
+import"./cli-n4cmzq79.js";
+import"./cli-nw9ytp7z.js";
+import"./cli-8nj7pnew.js";
+import"./cli-4a1c4tkn.js";
+import"./cli-j5p6jwm8.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import {
+  ENDPOINT_TRANSPORTS,
   createApp,
+  createDomain,
   createEndpoint,
   deleteApp,
   deleteEndpoint,
   getApp,
   getEndpoint,
   listApps,
+  listDomains,
   listEndpoints,
   searchApps,
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
-import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/apps.ts
 var APPLICATION_TYPES = [
@@ -88,6 +96,14 @@ function parseEndpointType(value) {
   }
   return value;
 }
+function parseTransport(value) {
+  if (value === undefined)
+    return;
+  if (!ENDPOINT_TRANSPORTS.includes(value)) {
+    throw new Error(`Invalid --transport "${value}". Must be one of: ${ENDPOINT_TRANSPORTS.join(", ")}`);
+  }
+  return value;
+}
 function parseInteger(flag, value) {
   if (value === undefined)
     return;
@@ -117,6 +133,8 @@ Usage:
   pensar apps create [options]                             Create an app
   pensar apps update <appId> [options]                     Update an app
   pensar apps delete <appId>                               Delete an app
+  pensar apps domains                                      List workspace domains
+  pensar apps domain-create <domain>                       Create/resolve a domain
   pensar apps endpoints <appId> [filters]                  List endpoints
   pensar apps endpoint <endpointId>                        Show endpoint details
   pensar apps endpoint-create <appId> [options]            Create an endpoint
@@ -130,9 +148,13 @@ App fields (create requires --name and --description):
   --description <text>         Application description
   --type <type>                One of: ${APPLICATION_TYPES.join(", ")}
   --framework <text>           Framework / runtime hint
-  --domain <id>                Linked domain UUID
+  --domain <id>                Linked domain UUID (see "apps domains")
   --disallowed-actions <text>  Free-form disallowed actions notes
 
+Domains:
+  API-created domains are canonicalized and created idempotently by Console.
+  They stay unverified and do not start reconnaissance.
+
 List pagination (for "apps" and "endpoints <appId>"):
   --limit <n>                  Page size (default 100, max 200)
   --offset <n>                 Page offset (default 0)
@@ -158,6 +180,8 @@ Endpoint fields (create requires --endpoint and --description):
   --endpoint <text>            Endpoint path / URL / route
   --description <text>         Endpoint description
   --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
+  --transport <transport>      One of: ${ENDPOINT_TRANSPORTS.join(", ")}
+                               (defaults to http when omitted)
   --location <text>            Source file (whitebox)
   --start-line <n>             Start line number
   --end-line <n>               End line number
@@ -235,6 +259,7 @@ function parseEndpointCreateOptions(argv) {
   if (description === undefined)
     throw new Error("--description is required");
   const type = parseEndpointType(getFlag("--type", argv));
+  const transport = parseTransport(getFlag("--transport", argv));
   const location = getFlag("--location", argv);
   const startLineNumber = parseInteger("--start-line", getFlag("--start-line", argv));
   const endLineNumber = parseInteger("--end-line", getFlag("--end-line", argv));
@@ -246,6 +271,7 @@ function parseEndpointCreateOptions(argv) {
     endpoint,
     description,
     ...type !== undefined ? { type } : {},
+    ...transport !== undefined ? { transport } : {},
     ...location !== undefined ? { location } : {},
     ...startLineNumber !== undefined ? { startLineNumber } : {},
     ...endLineNumber !== undefined ? { endLineNumber } : {},
@@ -269,6 +295,9 @@ function parseEndpointUpdateOptions(argv) {
   const type = parseEndpointType(getFlag("--type", argv));
   if (type !== undefined)
     update.type = type;
+  const transport = parseTransport(getFlag("--transport", argv));
+  if (transport !== undefined)
+    update.transport = transport;
   const location = getFlag("--location", argv);
   if (location !== undefined)
     update.location = location;
@@ -305,7 +334,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps get <appId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const app = await getApp(appId);
       console.log(JSON.stringify(app, null, 2));
@@ -318,7 +347,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps update <appId> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseAppUpdateOptions(args);
       const result = await updateApp(appId, opts);
@@ -328,16 +357,28 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps delete <appId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await deleteApp(appId);
       console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "domains") {
+      const result = await listDomains();
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "domain-create") {
+      const url = args[1];
+      if (!url) {
+        console.error("Error: domain is required");
+        console.error("Usage: pensar apps domain-create <domain>");
+        return markCommandFailed();
+      }
+      const result = await createDomain({ url });
+      console.log(JSON.stringify(result, null, 2));
     } else if (sub === "endpoints") {
       const appId = args[1];
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps endpoints <appId> [filters]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const type = parseEndpointType(getFlag("--type", args));
       const minRiskScore = parseNumber("--min-risk", getFlag("--min-risk", args));
@@ -356,7 +397,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint <endpointId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await getEndpoint(endpointId);
       console.log(JSON.stringify(result, null, 2));
@@ -365,7 +406,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps endpoint-create <appId> --endpoint E --description D");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseEndpointCreateOptions(args);
       const result = await createEndpoint(appId, opts);
@@ -375,7 +416,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint-update <endpointId> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseEndpointUpdateOptions(args);
       const result = await updateEndpoint(endpointId, opts);
@@ -385,7 +426,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint-delete <endpointId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await deleteEndpoint(endpointId);
       console.log(JSON.stringify(result, null, 2));
@@ -394,7 +435,7 @@ async function main() {
       if (!query || query.startsWith("--")) {
         console.error("Error: search query is required");
         console.error("Usage: pensar apps search <query> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const type = parseAppType(getFlag("--type", args));
       const limit = parseInteger("--limit", getFlag("--limit", args));
@@ -410,7 +451,7 @@ async function main() {
       if (!query || query.startsWith("--")) {
         console.error("Error: search query is required");
         console.error("Usage: pensar apps search-endpoints <query> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const applicationId = getFlag("--app", args);
       const type = parseEndpointType(getFlag("--type", args));
@@ -438,12 +479,12 @@ async function main() {
     } else {
       console.error(`Error: Unknown subcommand "${sub}"`);
       showHelp();
-      process.exit(1);
+      return markCommandFailed();
     }
   } catch (err) {
     console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
 }
-main();
+await main();

package/build/{auth-c1z670rx.js → auth-62z3kedh.js}

@@ -1,22 +1,27 @@
 #!/usr/bin/env bun
-import"./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
+import"./cli-ex9r1x7c.js";
+import"./cli-9pbk8m32.js";
+import"./cli-n36kxpcz.js";
+import"./cli-7gcsfnw6.js";
+import"./cli-n4cmzq79.js";
+import"./cli-nw9ytp7z.js";
+import"./cli-8nj7pnew.js";
+import"./cli-4a1c4tkn.js";
+import"./cli-j5p6jwm8.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
+import"./cli-51503njj.js";
 import {
   createWorkspaceSelection,
   disconnect,
+  ensureValidToken,
   fetchWorkspaces,
   getPensarApiUrl,
   getPensarConsoleUrl,
@@ -28,18 +33,19 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
+} from "./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
+} from "./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/cli/auth.ts
 import * as readline from "node:readline";
@@ -85,7 +91,13 @@ Waiting for workspace selection...`);
 }
 async function login() {
   const appConfig = await config.get();
-  if (isConnected(appConfig)) {
+  const hasStoredCredentials = isConnected(appConfig);
+  const validToken = hasStoredCredentials ? await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  }) : null;
+  if (validToken) {
     console.log("Already connected to Pensar Console.");
     if (appConfig.workspaceSlug) {
       console.log(`  Workspace: ${appConfig.workspaceSlug}`);
@@ -95,6 +107,8 @@ Reconnect? (y/N): `);
     if (answer.toLowerCase() !== "y") {
       return;
     }
+  } else if (hasStoredCredentials) {
+    console.log("Your saved Pensar Console session has expired. Reconnecting.");
   }
   console.log(`
 Pensar Console — Managed Inference
@@ -228,6 +242,15 @@ async function status() {
     console.log("Not connected to Pensar Console.\n\nRun `pensar login` to connect.");
     return;
   }
+  const validToken = await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  });
+  if (!validToken) {
+    console.log("Your Pensar Console session has expired.\n\nRun `pensar login` to reconnect.");
+    return;
+  }
   if (!appConfig.accessToken && appConfig.pensarAPIKey && !appConfig.workspaceSlug) {
     try {
       const apiUrl = getPensarApiUrl();
@@ -282,12 +305,12 @@ async function main() {
     } else {
       console.error(`Unknown auth subcommand: ${subcommand}`);
       console.error("Run 'pensar login --help' for usage information");
-      process.exit(1);
+      return markCommandFailed();
     }
   } catch (err) {
     console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
 }
-main();
+await main();

package/build/authentication-phbasmkj.js

@@ -0,0 +1,20 @@
+import {
+  runAuthenticationAgent
+} from "./cli-4a1c4tkn.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
+import"./cli-c8131c4q.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-3s34dabp.js

@@ -0,0 +1,20 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-n4cmzq79.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
+import"./cli-c8131c4q.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/blackboxPentest-mg2p9s1m.js

@@ -0,0 +1,70 @@
+import {
+  EMPTY_SESSION_TOKEN_USAGE,
+  accumulateSessionTokens
+} from "./cli-9pbk8m32.js";
+import {
+  readExecutionMetrics,
+  runPentestWorkflow,
+  writeExecutionMetrics
+} from "./cli-n36kxpcz.js";
+import"./cli-7gcsfnw6.js";
+import"./cli-n4cmzq79.js";
+import"./cli-nw9ytp7z.js";
+import"./cli-8nj7pnew.js";
+import"./cli-j5p6jwm8.js";
+import"./cli-9fsre5pt.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
+import"./cli-fw5r7pfj.js";
+import"./cli-c8131c4q.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+
+// src/core/api/blackboxPentest.ts
+async function runPentestAgent(input) {
+  const persisted = readExecutionMetrics(input.session.rootPath)?.tokenUsage;
+  let tokenUsage = persisted ?? EMPTY_SESSION_TOKEN_USAGE;
+  const onStepFinish = async (event) => {
+    tokenUsage = accumulateSessionTokens(tokenUsage, event.usage ?? {});
+    await input.onStepFinish?.(event);
+  };
+  const onCacheMetrics = (metrics) => {
+    tokenUsage = accumulateSessionTokens(tokenUsage, {
+      cacheReadTokens: metrics.cacheReadInputTokens,
+      cacheWriteTokens: metrics.cacheCreationInputTokens
+    });
+    input.onCacheMetrics?.(metrics);
+  };
+  let result;
+  try {
+    result = await runPentestWorkflow({
+      ...input,
+      onStepFinish,
+      onCacheMetrics
+    });
+  } finally {
+    writeExecutionMetrics({
+      sessionRootPath: input.session.rootPath,
+      tokenUsage
+    });
+  }
+  const { findings, findingsPath, pocsPath, reportPath } = result;
+  console.log(`
+Found ${findings.length} vulnerabilities`);
+  console.log(`Findings: ${findingsPath}`);
+  console.log(`POCs: ${pocsPath}`);
+  if (reportPath)
+    console.log(`Report: ${reportPath}`);
+  return { findings, findingsPath, pocsPath, reportPath };
+}
+export {
+  runPentestAgent
+};