@pensar/apex 2.3.0 → 2.4.0-canary.09a8744f

package/build/{cli-zk1ch6qf.js → cli-4a1c4tkn.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-hc4w41as.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-cdk877bx.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-51503njj.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -31,7 +31,7 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Operating Mode
 
 - Fully autonomous — no human intervention
-- If you encounter barriers (CAPTCHA, MFA), report failure with details
+- If you encounter barriers (CAPTCHA, or MFA with no TOTP seed available), report failure with details
 - Call \`complete_authentication\` when done (success or failure)
 
 # Available Tools
@@ -125,6 +125,39 @@ These are the ONLY way downstream agents receive the session credentials.
 
 **Then**, call the \`response\` tool with your final summary to end the run. This is required — complete_authentication persists the data, response terminates the agent.
 
+# MFA / TOTP Codes
+
+If the login asks for a 6-digit authenticator code, check whether a TOTP seed was provided for this
+account — it appears as an extra secret field on the credential and as a matching environment variable
+(look for a name containing TOTP, MFA, OTP, or 2FA). If one exists, do NOT report an MFA barrier —
+compute the code yourself:
+
+\`\`\`
+python3 -c "import base64,hmac,hashlib,struct,time,os;s=os.environ['<ENV_VAR>'].replace(' ','').upper();k=base64.b32decode(s+'='*(-len(s)%8));d=hmac.new(k,struct.pack('>Q',int(time.time())//30),hashlib.sha1).digest();o=d[-1]&15;print('%06d'%((struct.unpack('>I',d[o:o+4])[0]&0x7fffffff)%1000000))"
+\`\`\`
+
+Read the seed from the environment variable — never paste a seed literal into a command. Codes rotate
+every 30 seconds, so run this immediately before filling the field. If the code is rejected, re-run and
+retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
+or two fresh codes are both rejected.
+
+# SMS passwordless (phone as login)
+
+If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
+after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
+
+1. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
+2. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
+3. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with that \`credentialId\` and \`sinceMs\`.
+   If the list is empty, sleep and list again a few times. If it stays empty or returns an error, stop
+   and report what you observed — do not hang in a wait loop. Set \`claim=true\` once a message is present
+   so other runs cannot reuse the OTP.
+4. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
+5. Continue the login and call \`complete_authentication\`.
+
+TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
+app code.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -136,7 +169,8 @@ If authentication fails, try these mechanical fixes (they are login mechanics, n
 
 If credentials were provided to you, they are already verified and SHARED — do not modify them or their
 account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
-forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+forced password change is required, MFA is required and no TOTP seed was provided, or the email is not
+confirmed — do NOT try to recover by resetting or changing
 the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
 \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
 or self-sign-up to get around a rejected provided credential — that is a different account than the one
@@ -194,7 +228,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
     const cm = session.credentialManager;
     super({
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context),
+      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
       model,
       session,
       target,
@@ -226,6 +260,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -272,7 +307,7 @@ function loadAuthResult(authDataPath) {
     };
   }
 }
-function buildAuthPrompt(target, authHints, credentialManager, context) {
+function buildAuthPrompt(target, authHints, credentialManager, context, envVarNames) {
   const parts = [`TARGET: ${target}
 `];
   if (context) {
@@ -290,6 +325,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push(`No credentials provided. Probe the target to discover auth requirements.
 `);
   }
+  if (envVarNames?.length) {
+    parts.push("ENVIRONMENT VARIABLES:");
+    parts.push(`These are pre-loaded in your shell and available in every execute_command call. Reference them (e.g. $${envVarNames[0]}) — their values are hidden from you and redacted from command output, so never try to print one.`);
+    parts.push(envVarNames.map((n) => `- ${n}`).join(`
+`));
+    parts.push("");
+  }
   if (authHints) {
     parts.push("AUTH HINTS:");
     if (authHints.authScheme)
@@ -304,6 +346,14 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push("");
   }
   if (credBlock) {
+    const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasSmsPasswordless ? `
+If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
+identifier — not MFA-after-password. browser_fill credentialField="phoneNumber", click send-code, then
+execute_command \`sleep 5\` and call sms_list_messages with sinceMs = Date.now() at that click (claim=true
+once a message is present). If the list is empty, sleep and list again; if it stays empty, fail with what
+you observed — do not hang waiting. Then browser_fill the OTP. Do NOT report phone_verification as a
+barrier for this flow. TOTP-via-env for authenticator MFA is unchanged.` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -311,13 +361,14 @@ You have credentials available via credential IDs — authenticate immediately.
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
-
+${smsInstructions}
 The credentials above were provided to you and have already been verified — they are SHARED across runs, so
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
 resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
-password change required, MFA required, email not confirmed), call complete_authentication with
-success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+password change required, email not confirmed, or an MFA prompt with no TOTP seed available), call
+complete_authentication with success=false and a clear summary of why — do not attempt to recover, reset,
+or rotate them. When a TOTP seed IS available, generate the code and continue; that is not a barrier. Do NOT
 register a new account or self-sign-up to work around a failed login: that is not the credential under test
 and only pollutes results — fail fast with success=false instead.`);
   } else {