@pensar/apex 2.3.0 → 2.4.0-canary.0d951436

package/build/{cli-eveg9djy.js → cli-8qcrjget.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-barsn8br.js";
+} from "./cli-x2ss1hx3.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/config/config.ts
 import fs from "node:fs/promises";
@@ -45,6 +45,7 @@ function applyEnvFallbacks(parsedConfig) {
     anthropicAPIKey: parsedConfig.anthropicAPIKey ?? process.env.ANTHROPIC_API_KEY,
     googleAPIKey: parsedConfig.googleAPIKey ?? process.env.GOOGLE_GENERATIVE_AI_API_KEY,
     openRouterAPIKey: parsedConfig.openRouterAPIKey ?? process.env.OPENROUTER_API_KEY,
+    concentrateAPIKey: parsedConfig.concentrateAPIKey ?? process.env.CONCENTRATE_API_KEY,
     inceptionAPIKey: parsedConfig.inceptionAPIKey ?? process.env.INCEPTION_API_KEY,
     bedrockAPIKey: parsedConfig.bedrockAPIKey ?? process.env.BEDROCK_API_KEY,
     pensarAPIKey: parsedConfig.pensarAPIKey ?? process.env.PENSAR_API_KEY,

package/build/{cli-bnkgdywr.js → cli-91s2kda0.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-wy0avc95.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-zm8tfpv7.js → cli-aqknajfz.js}

@@ -1,20 +1,20 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-bv2807tj.js";
+} from "./cli-nanb1srp.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
+} from "./cli-qa226xfj.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-50906d27.js";
+} from "./cli-4zwpvajr.js";
 import {
   CodeAgent
-} from "./cli-j0n189ee.js";
+} from "./cli-gj651k8k.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -22,7 +22,7 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-baqhqbe5.js";
+} from "./cli-x0981jez.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-n2m2yy5b.js";
+} from "./cli-77fm0t26.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,10 +45,10 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-wy0avc95.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -7692,6 +7692,12 @@ async function runPentestSwarm(input) {
     });
     if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
       try {
+        eventBus?.emit("subagent-spawn", {
+          subagentId: `${subagentId}-plan`,
+          name: `${subagentName} (plan)`,
+          input: { target: target.target, objectives: target.objectives },
+          parentSubagentId: subagentId
+        });
         const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
@@ -7717,7 +7723,17 @@ async function runPentestSwarm(input) {
           display
         });
         await planAgent.consume();
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "completed",
+          parentSubagentId: subagentId
+        });
       } catch (planErr) {
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "failed",
+          parentSubagentId: subagentId
+        });
         log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
       }
     }
@@ -7786,7 +7802,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-ebz1ph9a.js");
+    const { runFastStrike } = await import("./fastStrike-hremncmc.js");
     return runFastStrike(input);
   }
   const {

package/build/{cli-8rxa073f.js → cli-bc05qbss.js}

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;

package/build/{cli-f7hanqbw.js → cli-czj2n2c0.js}

@@ -3,10 +3,10 @@ import {
   init,
   init_config,
   update
-} from "./cli-eveg9djy.js";
+} from "./cli-8qcrjget.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/config/index.ts
 var config;

package/build/{cli-q24twygk.js → cli-dm0fc0bm.js}

@@ -1,6 +1,6 @@
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/http/parse.ts
 var NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;

package/build/{cli-zk1ch6qf.js → cli-dy295be8.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-77fm0t26.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-tx0y7xq7.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-wy0avc95.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -31,7 +31,7 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Operating Mode
 
 - Fully autonomous — no human intervention
-- If you encounter barriers (CAPTCHA, MFA), report failure with details
+- If you encounter barriers (CAPTCHA, or MFA with no TOTP seed available), report failure with details
 - Call \`complete_authentication\` when done (success or failure)
 
 # Available Tools
@@ -125,6 +125,22 @@ These are the ONLY way downstream agents receive the session credentials.
 
 **Then**, call the \`response\` tool with your final summary to end the run. This is required — complete_authentication persists the data, response terminates the agent.
 
+# MFA / TOTP Codes
+
+If the login asks for a 6-digit authenticator code, check whether a TOTP seed was provided for this
+account — it appears as an extra secret field on the credential and as a matching environment variable
+(look for a name containing TOTP, MFA, OTP, or 2FA). If one exists, do NOT report an MFA barrier —
+compute the code yourself:
+
+\`\`\`
+python3 -c "import base64,hmac,hashlib,struct,time,os;s=os.environ['<ENV_VAR>'].replace(' ','').upper();k=base64.b32decode(s+'='*(-len(s)%8));d=hmac.new(k,struct.pack('>Q',int(time.time())//30),hashlib.sha1).digest();o=d[-1]&15;print('%06d'%((struct.unpack('>I',d[o:o+4])[0]&0x7fffffff)%1000000))"
+\`\`\`
+
+Read the seed from the environment variable — never paste a seed literal into a command. Codes rotate
+every 30 seconds, so run this immediately before filling the field. If the code is rejected, re-run and
+retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
+or two fresh codes are both rejected.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -136,7 +152,8 @@ If authentication fails, try these mechanical fixes (they are login mechanics, n
 
 If credentials were provided to you, they are already verified and SHARED — do not modify them or their
 account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
-forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+forced password change is required, MFA is required and no TOTP seed was provided, or the email is not
+confirmed — do NOT try to recover by resetting or changing
 the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
 \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
 or self-sign-up to get around a rejected provided credential — that is a different account than the one
@@ -194,7 +211,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
     const cm = session.credentialManager;
     super({
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context),
+      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
       model,
       session,
       target,
@@ -272,7 +289,7 @@ function loadAuthResult(authDataPath) {
     };
   }
 }
-function buildAuthPrompt(target, authHints, credentialManager, context) {
+function buildAuthPrompt(target, authHints, credentialManager, context, envVarNames) {
   const parts = [`TARGET: ${target}
 `];
   if (context) {
@@ -290,6 +307,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push(`No credentials provided. Probe the target to discover auth requirements.
 `);
   }
+  if (envVarNames?.length) {
+    parts.push("ENVIRONMENT VARIABLES:");
+    parts.push(`These are pre-loaded in your shell and available in every execute_command call. Reference them (e.g. $${envVarNames[0]}) — their values are hidden from you and redacted from command output, so never try to print one.`);
+    parts.push(envVarNames.map((n) => `- ${n}`).join(`
+`));
+    parts.push("");
+  }
   if (authHints) {
     parts.push("AUTH HINTS:");
     if (authHints.authScheme)
@@ -316,8 +340,9 @@ The credentials above were provided to you and have already been verified — th
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
 resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
-password change required, MFA required, email not confirmed), call complete_authentication with
-success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+password change required, email not confirmed, or an MFA prompt with no TOTP seed available), call
+complete_authentication with success=false and a clear summary of why — do not attempt to recover, reset,
+or rotate them. When a TOTP seed IS available, generate the code and continue; that is not a barrier. Do NOT
 register a new account or self-sign-up to work around a failed login: that is not the credential under test
 and only pollutes results — fail fast with success=false instead.`);
   } else {

package/build/{cli-yz80qkzn.js → cli-ee3axgts.js}

@@ -1,6 +1,6 @@
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/providers/types.ts
 var AVAILABLE_PROVIDERS;
@@ -30,6 +30,12 @@ var init_types = __esm(() => {
       description: "Access multiple AI models through one API",
       requiresAPIKey: true
     },
+    {
+      id: "concentrate",
+      name: "Concentrate",
+      description: "Access multiple AI models through one API",
+      requiresAPIKey: true
+    },
     {
       id: "inception",
       name: "Inception",