@pensar/apex 2.3.0 → 2.4.0-canary.09a8744f

package/build/{config-jzqjz606.js → config-7f07yemp.js}

@@ -3,18 +3,21 @@ import {
   isSensitiveHeaderName,
   renderHeaderValue
 } from "./cli-e08r86zk.js";
+import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
 import {
   formatParseError,
   parseHeaderLine,
   parseHeadersFromFile
-} from "./cli-q24twygk.js";
+} from "./cli-dm0fc0bm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/config.ts
 init_config();
@@ -68,19 +71,19 @@ async function cmdAdd(args, allowOverwrite) {
   const value = args[0];
   if (!value) {
     console.error('Error: expected "Name: Value" argument');
-    process.exit(1);
+    return markCommandFailed();
   }
   const parsed = parseHeaderLine(value);
   if (!parsed.ok) {
     console.error(`Invalid header:
 ${formatParseError(parsed.error)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
   const headers = await loadDefaults();
   const canonical = Object.keys(headers).find((k) => k.toLowerCase() === parsed.value.name.toLowerCase());
   if (canonical && !allowOverwrite) {
     console.error(`Header "${canonical}" already exists. Use \`pensar config headers set\` to overwrite.`);
-    process.exit(1);
+    return markCommandFailed();
   }
   if (canonical && canonical !== parsed.value.name) {
     delete headers[canonical];
@@ -93,13 +96,13 @@ async function cmdRemove(args) {
   const name = args[0];
   if (!name) {
     console.error("Error: expected <Name> argument");
-    process.exit(1);
+    return markCommandFailed();
   }
   const headers = await loadDefaults();
   const canonical = Object.keys(headers).find((k) => k.toLowerCase() === name.toLowerCase());
   if (!canonical) {
     console.error(`No default header named "${name}".`);
-    process.exit(1);
+    return markCommandFailed();
   }
   delete headers[canonical];
   await saveDefaults(headers);
@@ -109,7 +112,7 @@ async function cmdClear(args) {
   const confirmed = args.includes("--yes") || args.includes("-y");
   if (!confirmed) {
     console.error("Refusing to clear without confirmation. Pass --yes to proceed.");
-    process.exit(1);
+    return markCommandFailed();
   }
   await saveDefaults({});
   console.log("Cleared all default headers.");
@@ -118,7 +121,7 @@ async function cmdImport(args) {
   const file = args[0];
   if (!file) {
     console.error("Error: expected <file> argument");
-    process.exit(1);
+    return markCommandFailed();
   }
   const parsed = await parseHeadersFromFile(file);
   if (!parsed.ok) {
@@ -126,7 +129,7 @@ async function cmdImport(args) {
       console.error(`Import error:
 ${formatParseError(err)}`);
     }
-    process.exit(1);
+    return markCommandFailed();
   }
   const next = {};
   for (const entry of parsed.value) {
@@ -145,7 +148,7 @@ async function main() {
   if (sub !== "headers") {
     console.error(`Unknown 'pensar config' subcommand: ${sub}`);
     console.error("Only 'headers' is supported today.");
-    process.exit(1);
+    return markCommandFailed();
   }
   const op = args[1];
   const rest = args.slice(2);
@@ -178,11 +181,11 @@ async function main() {
     default:
       console.error(`Unknown headers operation: ${op}`);
       showHelp();
-      process.exit(1);
+      return markCommandFailed();
   }
 }
-main().catch((err) => {
+await main().catch((err) => {
   console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-  process.exit(1);
+  return markCommandFailed();
 });

package/build/{doctor-q3qws68e.js → doctor-gwvyn249.js}

@@ -1,14 +1,15 @@
 import {
   toolExists
-} from "./cli-7tw4xfnw.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-cdk877bx.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
 
 // src/core/doctor.ts
 import { execSync, spawnSync } from "node:child_process";
@@ -50,6 +51,7 @@ function checkApiKeys() {
     { provider: "OpenAI", env: "OPENAI_API_KEY" },
     { provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
     { provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
+    { provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
     { provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
     { provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
     { provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }

package/build/{fastStrike-ebz1ph9a.js → fastStrike-zxsk2q40.js}

@@ -4,29 +4,30 @@ import {
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
+} from "./cli-8nj7pnew.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
+import"./cli-nvqny4ej.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
 
 // src/core/workflows/fastStrike.ts
 init_zod();
@@ -42,14 +43,15 @@ Run this loop, tightly:
 
 1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
-3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
+3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
+5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
+6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
+- Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
 - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
 async function runFastStrike(input) {
@@ -62,6 +64,7 @@ async function runFastStrike(input) {
     abortSignal,
     eventBus,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     openAIReasoningEffort,
     prompt,
@@ -118,10 +121,29 @@ ${combined}` : combined;
     abortSignal,
     eventBus,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     openAIReasoningEffort
   });
-  const strikeResult = await agent.consume();
+  eventBus?.emit("subagent-spawn", {
+    subagentId: "fast-strike",
+    name: "Fast Strike",
+    input: { target }
+  });
+  let strikeResult;
+  try {
+    strikeResult = await agent.consume();
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "completed"
+    });
+  } catch (e) {
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "failed"
+    });
+    throw e;
+  }
   if (abortSignal?.aborted) {
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
@@ -152,5 +174,6 @@ ${combined}` : combined;
   };
 }
 export {
+  FAST_STRIKE_SYSTEM_PROMPT,
   runFastStrike
 };

package/build/{fixes-86yebsj0.js → fixes-zqe8v8ye.js}

@@ -1,29 +1,34 @@
 #!/usr/bin/env bun
+import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
 import {
   getFix,
   listFixes
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+} from "./cli-ex9r1x7c.js";
+import"./cli-9pbk8m32.js";
+import"./cli-n36kxpcz.js";
+import"./cli-7gcsfnw6.js";
+import"./cli-n4cmzq79.js";
+import"./cli-nw9ytp7z.js";
+import"./cli-8nj7pnew.js";
+import"./cli-4a1c4tkn.js";
+import"./cli-j5p6jwm8.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-nvqny4ej.js";
+import"./cli-hc4w41as.js";
+import"./cli-cdk877bx.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-51503njj.js";
+import"./cli-b3d97zgc.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9fds4ss0.js";
+import"./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/fixes.ts
 function showHelp() {
@@ -49,7 +54,7 @@ async function main() {
       if (!fixId) {
         console.error("Error: fix ID is required");
         console.error("Usage: pensar fixes get <fixId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const fix = await getFix(fixId);
       console.log(JSON.stringify(fix, null, 2));
@@ -60,7 +65,7 @@ async function main() {
   } catch (err) {
     console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
 }
-main();
+await main();

package/build/getMachineId-bsd-xj3bn2fv.js

@@ -0,0 +1,36 @@
+import {
+  require_execAsync
+} from "./cli-53rm0rrz.js";
+import {
+  require_src
+} from "./cli-knd276ed.js";
+import {
+  __commonJS,
+  __require
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-bsd.js
+var require_getMachineId_bsd = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.getMachineId = undefined;
+  var fs_1 = __require("fs");
+  var execAsync_1 = require_execAsync();
+  var api_1 = require_src();
+  async function getMachineId() {
+    try {
+      const result = await fs_1.promises.readFile("/etc/hostid", { encoding: "utf8" });
+      return result.trim();
+    } catch (e) {
+      api_1.diag.debug(`error reading machine id: ${e}`);
+    }
+    try {
+      const result = await (0, execAsync_1.execAsync)("kenv -q smbios.system.uuid");
+      return result.stdout.trim();
+    } catch (e) {
+      api_1.diag.debug(`error reading machine id: ${e}`);
+    }
+    return;
+  }
+  exports.getMachineId = getMachineId;
+});
+export default require_getMachineId_bsd();

package/build/getMachineId-darwin-07jzjcx6.js

@@ -0,0 +1,36 @@
+import {
+  require_execAsync
+} from "./cli-53rm0rrz.js";
+import {
+  require_src
+} from "./cli-knd276ed.js";
+import {
+  __commonJS
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-darwin.js
+var require_getMachineId_darwin = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.getMachineId = undefined;
+  var execAsync_1 = require_execAsync();
+  var api_1 = require_src();
+  async function getMachineId() {
+    try {
+      const result = await (0, execAsync_1.execAsync)('ioreg -rd1 -c "IOPlatformExpertDevice"');
+      const idLine = result.stdout.split(`
+`).find((line) => line.includes("IOPlatformUUID"));
+      if (!idLine) {
+        return;
+      }
+      const parts = idLine.split('" = "');
+      if (parts.length === 2) {
+        return parts[1].slice(0, -1);
+      }
+    } catch (e) {
+      api_1.diag.debug(`error reading machine id: ${e}`);
+    }
+    return;
+  }
+  exports.getMachineId = getMachineId;
+});
+export default require_getMachineId_darwin();

package/build/getMachineId-linux-ahngynxd.js

@@ -0,0 +1,29 @@
+import {
+  require_src
+} from "./cli-knd276ed.js";
+import {
+  __commonJS,
+  __require
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-linux.js
+var require_getMachineId_linux = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.getMachineId = undefined;
+  var fs_1 = __require("fs");
+  var api_1 = require_src();
+  async function getMachineId() {
+    const paths = ["/etc/machine-id", "/var/lib/dbus/machine-id"];
+    for (const path of paths) {
+      try {
+        const result = await fs_1.promises.readFile(path, { encoding: "utf8" });
+        return result.trim();
+      } catch (e) {
+        api_1.diag.debug(`error reading machine id: ${e}`);
+      }
+    }
+    return;
+  }
+  exports.getMachineId = getMachineId;
+});
+export default require_getMachineId_linux();

package/build/getMachineId-unsupported-vy43b44z.js

@@ -0,0 +1,19 @@
+import {
+  require_src
+} from "./cli-knd276ed.js";
+import {
+  __commonJS
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-unsupported.js
+var require_getMachineId_unsupported = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.getMachineId = undefined;
+  var api_1 = require_src();
+  async function getMachineId() {
+    api_1.diag.debug("could not read machine-id: unsupported platform");
+    return;
+  }
+  exports.getMachineId = getMachineId;
+});
+export default require_getMachineId_unsupported();

package/build/getMachineId-win-8x66cynz.js

@@ -0,0 +1,38 @@
+import {
+  require_execAsync
+} from "./cli-53rm0rrz.js";
+import {
+  require_src
+} from "./cli-knd276ed.js";
+import {
+  __commonJS,
+  __require
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/getMachineId-win.js
+var require_getMachineId_win = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.getMachineId = undefined;
+  var process = __require("process");
+  var execAsync_1 = require_execAsync();
+  var api_1 = require_src();
+  async function getMachineId() {
+    const args = "QUERY HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid";
+    let command = "%windir%\\System32\\REG.exe";
+    if (process.arch === "ia32" && "PROCESSOR_ARCHITEW6432" in process.env) {
+      command = "%windir%\\sysnative\\cmd.exe /c " + command;
+    }
+    try {
+      const result = await (0, execAsync_1.execAsync)(`${command} ${args}`);
+      const parts = result.stdout.split("REG_SZ");
+      if (parts.length === 2) {
+        return parts[1].trim();
+      }
+    } catch (e) {
+      api_1.diag.debug(`error reading machine id: ${e}`);
+    }
+    return;
+  }
+  exports.getMachineId = getMachineId;
+});
+export default require_getMachineId_win();

package/build/{index-32hn8rrw.js → index-4j14ssrg.js}

@@ -3,9 +3,9 @@ import {
   init,
   init_config,
   update
-} from "./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-5tbg4dyb.js";
+import"./cli-e1gmqsyh.js";
+import"./cli-bc05qbss.js";
 
 // src/core/config/index.ts
 init_config();