@pensar/apex 2.3.0 → 2.4.0-canary.09a8744f

package/build/{cli-zm8tfpv7.js → cli-n36kxpcz.js}

@@ -1,28 +1,28 @@
+import {
+  AppsDiscoveryResultSchema,
+  DiscoverySummarySchema,
+  EndpointSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
+} from "./cli-7gcsfnw6.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-bv2807tj.js";
+} from "./cli-n4cmzq79.js";
+import {
+  TargetedPentestAgent,
+  buildPentestSystemPrompt
+} from "./cli-nw9ytp7z.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-50906d27.js";
+} from "./cli-8nj7pnew.js";
 import {
   CodeAgent
-} from "./cli-j0n189ee.js";
-import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-baqhqbe5.js";
+} from "./cli-j5p6jwm8.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-n2m2yy5b.js";
+} from "./cli-hc4w41as.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,10 +45,10 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-51503njj.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -126,9 +126,23 @@ function normalizeTokenUsage(value) {
   return {
     inputTokens,
     outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
     totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
   };
 }
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
 function metricsPath(sessionRootPath) {
   return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
 }
@@ -143,6 +157,7 @@ function readExecutionMetrics(sessionRootPath) {
     const parsed = JSON.parse(readFileSync(path, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
       elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
@@ -167,10 +182,13 @@ function writeExecutionMetrics(input) {
   const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
     inputTokens: 0,
     outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
     totalTokens: 0
   };
   const next = {
     tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
     runtime: input.runtime ?? existing?.runtime,
     elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
     updatedAt: new Date().toISOString()
@@ -7639,16 +7657,6 @@ When finished, call \`response\` with a summary of how many entry points you doc
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
 async function runPentestSwarm(input) {
   const {
     targets,
@@ -7661,6 +7669,7 @@ async function runPentestSwarm(input) {
     onError,
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
@@ -7692,6 +7701,12 @@ async function runPentestSwarm(input) {
     });
     if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
       try {
+        eventBus?.emit("subagent-spawn", {
+          subagentId: `${subagentId}-plan`,
+          name: `${subagentName} (plan)`,
+          input: { target: target.target, objectives: target.objectives },
+          parentSubagentId: subagentId
+        });
         const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
@@ -7711,13 +7726,25 @@ async function runPentestSwarm(input) {
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
+          onStepFinish,
+          onCacheMetrics,
           enableThinking,
           thinkingEffort,
           openAIReasoningEffort,
           display
         });
         await planAgent.consume();
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "completed",
+          parentSubagentId: subagentId
+        });
       } catch (planErr) {
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "failed",
+          parentSubagentId: subagentId
+        });
         log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
       }
     }
@@ -7734,6 +7761,8 @@ async function runPentestSwarm(input) {
         abortSignal,
         findingsRegistry,
         onStepFinish: handleStepFinish,
+        onCacheMetrics,
+        forwardUsageCallbacksToSpawnedAgents: true,
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
@@ -7786,7 +7815,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-ebz1ph9a.js");
+    const { runFastStrike } = await import("./fastStrike-zxsk2q40.js");
     return runFastStrike(input);
   }
   const {
@@ -7823,17 +7852,6 @@ async function runPentestWorkflow(input) {
 ${combined}` : combined;
   }
   const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
   try {
     const mode = cwd ? "whitebox" : "blackbox";
     let swarmTargets;
@@ -7870,7 +7888,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
           surfaceIntegrationEnabled
@@ -7883,7 +7901,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort
         });
@@ -7936,7 +7954,8 @@ ${combined}` : combined;
         abortSignal,
         findingsRegistry,
         eventBus,
-        onStepFinish: wrappedOnStepFinish,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort
@@ -7984,7 +8003,6 @@ ${combined}` : combined;
     const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
     writeExecutionMetrics({
       sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
       runtime
     });
   }

package/build/{cli-bv2807tj.js → cli-n4cmzq79.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-hc4w41as.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-cdk877bx.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-zx8gk8xv.js";
+} from "./cli-51503njj.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -438,6 +438,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -483,6 +484,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
+When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.

package/build/{cli-jyp2c6th.js → cli-nvqny4ej.js}

@@ -1,11 +1,12 @@
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-n2m2yy5b.js";
+} from "./cli-hc4w41as.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/offSecAgent/types.ts
 init_zod();
@@ -47,7 +48,8 @@ var ApexFindingObject = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 
 export { EvidenceFileEntrySchema, ApexFindingObject };