@pensar/apex 2.3.0 → 2.4.0-canary.19561fbe

package/build/agent-7r8ae2n3.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-gt8cqkar.js";
+import"./cli-9fsre5pt.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
+import"./cli-c8131c4q.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/agent-8fwm9a5a.js

@@ -0,0 +1,29 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+} from "./cli-bdnfzsg5.js";
+import"./cli-9fsre5pt.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
+import"./cli-c8131c4q.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
+export {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+};

package/build/{agent-9xna7jhw.js → agent-9xkng6z0.js}

@@ -1,24 +1,24 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-32sskghg.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-av6ny5j7.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+} from "./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
 init_dist();
@@ -68,7 +68,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
-- Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
+- Missing rate limiting / anti-automation: a modest burst (~20 requests) with no observed throttling, delays, or 429s is sufficient to demonstrate the gap. For endpoints with real-world side effects (sending email/SMS/push, creating tickets/notifications, contact/support/feedback forms, payments), as few as 2–3 attempts plus the observed response is sufficient — do NOT require volume-testing that would spam real recipients. Evidence must state exact request count, timing/distribution, and observed statuses.
 
 ### Common Low-Signal Patterns
 Reject these unless the submitted evidence demonstrates concrete harm:

package/build/{apps-43pqbz7r.js → apps-zz0g7btr.js}

@@ -1,39 +1,42 @@
 #!/usr/bin/env bun
+import"./cli-xw30dapx.js";
+import"./cli-15becs7s.js";
+import"./cli-pn8yhmp4.js";
+import"./cli-w8v5w7f3.js";
+import"./cli-bdnfzsg5.js";
+import"./cli-f6b6kdc6.js";
+import"./cli-gt8cqkar.js";
+import"./cli-3tjmnhmz.js";
+import"./cli-9fsre5pt.js";
+import"./cli-kfc5yyre.js";
 import {
+  ENDPOINT_TRANSPORTS,
   createApp,
+  createDomain,
   createEndpoint,
   deleteApp,
   deleteEndpoint,
   getApp,
   getEndpoint,
   listApps,
+  listDomains,
   listEndpoints,
   searchApps,
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
-import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/apps.ts
 var APPLICATION_TYPES = [
@@ -88,6 +91,14 @@ function parseEndpointType(value) {
   }
   return value;
 }
+function parseTransport(value) {
+  if (value === undefined)
+    return;
+  if (!ENDPOINT_TRANSPORTS.includes(value)) {
+    throw new Error(`Invalid --transport "${value}". Must be one of: ${ENDPOINT_TRANSPORTS.join(", ")}`);
+  }
+  return value;
+}
 function parseInteger(flag, value) {
   if (value === undefined)
     return;
@@ -117,6 +128,8 @@ Usage:
   pensar apps create [options]                             Create an app
   pensar apps update <appId> [options]                     Update an app
   pensar apps delete <appId>                               Delete an app
+  pensar apps domains                                      List workspace domains
+  pensar apps domain-create <domain>                       Create/resolve a domain
   pensar apps endpoints <appId> [filters]                  List endpoints
   pensar apps endpoint <endpointId>                        Show endpoint details
   pensar apps endpoint-create <appId> [options]            Create an endpoint
@@ -130,9 +143,13 @@ App fields (create requires --name and --description):
   --description <text>         Application description
   --type <type>                One of: ${APPLICATION_TYPES.join(", ")}
   --framework <text>           Framework / runtime hint
-  --domain <id>                Linked domain UUID
+  --domain <id>                Linked domain UUID (see "apps domains")
   --disallowed-actions <text>  Free-form disallowed actions notes
 
+Domains:
+  API-created domains are canonicalized and created idempotently by Console.
+  They stay unverified and do not start reconnaissance.
+
 List pagination (for "apps" and "endpoints <appId>"):
   --limit <n>                  Page size (default 100, max 200)
   --offset <n>                 Page offset (default 0)
@@ -158,6 +175,8 @@ Endpoint fields (create requires --endpoint and --description):
   --endpoint <text>            Endpoint path / URL / route
   --description <text>         Endpoint description
   --type <type>                One of: ${ENDPOINT_TYPES.join(", ")}
+  --transport <transport>      One of: ${ENDPOINT_TRANSPORTS.join(", ")}
+                               (defaults to http when omitted)
   --location <text>            Source file (whitebox)
   --start-line <n>             Start line number
   --end-line <n>               End line number
@@ -235,6 +254,7 @@ function parseEndpointCreateOptions(argv) {
   if (description === undefined)
     throw new Error("--description is required");
   const type = parseEndpointType(getFlag("--type", argv));
+  const transport = parseTransport(getFlag("--transport", argv));
   const location = getFlag("--location", argv);
   const startLineNumber = parseInteger("--start-line", getFlag("--start-line", argv));
   const endLineNumber = parseInteger("--end-line", getFlag("--end-line", argv));
@@ -246,6 +266,7 @@ function parseEndpointCreateOptions(argv) {
     endpoint,
     description,
     ...type !== undefined ? { type } : {},
+    ...transport !== undefined ? { transport } : {},
     ...location !== undefined ? { location } : {},
     ...startLineNumber !== undefined ? { startLineNumber } : {},
     ...endLineNumber !== undefined ? { endLineNumber } : {},
@@ -269,6 +290,9 @@ function parseEndpointUpdateOptions(argv) {
   const type = parseEndpointType(getFlag("--type", argv));
   if (type !== undefined)
     update.type = type;
+  const transport = parseTransport(getFlag("--transport", argv));
+  if (transport !== undefined)
+    update.transport = transport;
   const location = getFlag("--location", argv);
   if (location !== undefined)
     update.location = location;
@@ -332,6 +356,18 @@ async function main() {
       }
       const result = await deleteApp(appId);
       console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "domains") {
+      const result = await listDomains();
+      console.log(JSON.stringify(result, null, 2));
+    } else if (sub === "domain-create") {
+      const url = args[1];
+      if (!url) {
+        console.error("Error: domain is required");
+        console.error("Usage: pensar apps domain-create <domain>");
+        process.exit(1);
+      }
+      const result = await createDomain({ url });
+      console.log(JSON.stringify(result, null, 2));
     } else if (sub === "endpoints") {
       const appId = args[1];
       if (!appId) {

package/build/{auth-c1z670rx.js → auth-yg4f0h7t.js}

@@ -1,22 +1,23 @@
 #!/usr/bin/env bun
-import"./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+import"./cli-xw30dapx.js";
+import"./cli-15becs7s.js";
+import"./cli-pn8yhmp4.js";
+import"./cli-w8v5w7f3.js";
+import"./cli-bdnfzsg5.js";
+import"./cli-f6b6kdc6.js";
+import"./cli-gt8cqkar.js";
+import"./cli-3tjmnhmz.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
+import"./cli-72mp7fnw.js";
 import {
   createWorkspaceSelection,
   disconnect,
+  ensureValidToken,
   fetchWorkspaces,
   getPensarApiUrl,
   getPensarConsoleUrl,
@@ -28,18 +29,18 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
+} from "./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
+} from "./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/cli/auth.ts
 import * as readline from "node:readline";
@@ -85,7 +86,13 @@ Waiting for workspace selection...`);
 }
 async function login() {
   const appConfig = await config.get();
-  if (isConnected(appConfig)) {
+  const hasStoredCredentials = isConnected(appConfig);
+  const validToken = hasStoredCredentials ? await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  }) : null;
+  if (validToken) {
     console.log("Already connected to Pensar Console.");
     if (appConfig.workspaceSlug) {
       console.log(`  Workspace: ${appConfig.workspaceSlug}`);
@@ -95,6 +102,8 @@ Reconnect? (y/N): `);
     if (answer.toLowerCase() !== "y") {
       return;
     }
+  } else if (hasStoredCredentials) {
+    console.log("Your saved Pensar Console session has expired. Reconnecting.");
   }
   console.log(`
 Pensar Console — Managed Inference
@@ -228,6 +237,15 @@ async function status() {
     console.log("Not connected to Pensar Console.\n\nRun `pensar login` to connect.");
     return;
   }
+  const validToken = await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  });
+  if (!validToken) {
+    console.log("Your Pensar Console session has expired.\n\nRun `pensar login` to reconnect.");
+    return;
+  }
   if (!appConfig.accessToken && appConfig.pensarAPIKey && !appConfig.workspaceSlug) {
     try {
       const apiUrl = getPensarApiUrl();

package/build/authentication-4pw5fgb0.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-f6b6kdc6.js";
+import"./cli-9fsre5pt.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
+import"./cli-c8131c4q.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-86505pbv.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-pn8yhmp4.js";
+import"./cli-9fsre5pt.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
+import"./cli-c8131c4q.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-tgc2t3y6.js → blackboxPentest-wt2tgsv6.js}

@@ -1,25 +1,25 @@
 import {
   runPentestWorkflow
-} from "./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+} from "./cli-15becs7s.js";
+import"./cli-pn8yhmp4.js";
+import"./cli-w8v5w7f3.js";
+import"./cli-bdnfzsg5.js";
+import"./cli-gt8cqkar.js";
+import"./cli-3tjmnhmz.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-kfc5yyre.js";
+import"./cli-32sskghg.js";
+import"./cli-av6ny5j7.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-72mp7fnw.js";
+import"./cli-wdn70vwe.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-701hy1tq.js";
+import"./cli-fejghj51.js";
+import"./cli-zp8z5vrt.js";
+import"./cli-bc05qbss.js";
 
 // src/core/api/blackboxPentest.ts
 async function runPentestAgent(input) {

package/build/{cli-zm8tfpv7.js → cli-15becs7s.js}

@@ -1,20 +1,20 @@
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-bv2807tj.js";
+} from "./cli-pn8yhmp4.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
+} from "./cli-w8v5w7f3.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-50906d27.js";
+} from "./cli-bdnfzsg5.js";
 import {
   CodeAgent
-} from "./cli-j0n189ee.js";
+} from "./cli-gt8cqkar.js";
 import {
   AppsDiscoveryResultSchema,
   DiscoverySummarySchema,
@@ -22,7 +22,7 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-baqhqbe5.js";
+} from "./cli-3tjmnhmz.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-n2m2yy5b.js";
+} from "./cli-32sskghg.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,10 +45,10 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-72mp7fnw.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/workflows/pentest.ts
 init_dist();
@@ -7692,6 +7692,12 @@ async function runPentestSwarm(input) {
     });
     if (session.config?.requirePlan && session.config?.taskDriven && previousMessages.length === 0) {
       try {
+        eventBus?.emit("subagent-spawn", {
+          subagentId: `${subagentId}-plan`,
+          name: `${subagentName} (plan)`,
+          input: { target: target.target, objectives: target.objectives },
+          parentSubagentId: subagentId
+        });
         const executionTasksDir = join18(session.rootPath, "subagents", `${subagentId}-tasks`);
         const planAgent = new OffensiveSecurityAgent({
           system: PLAN_PHASE_SYSTEM_PROMPT,
@@ -7717,7 +7723,17 @@ async function runPentestSwarm(input) {
           display
         });
         await planAgent.consume();
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "completed",
+          parentSubagentId: subagentId
+        });
       } catch (planErr) {
+        eventBus?.emit("subagent-complete", {
+          subagentId: `${subagentId}-plan`,
+          status: "failed",
+          parentSubagentId: subagentId
+        });
         log5.warn(`Plan phase failed for ${subagentId}: ${planErr}`);
       }
     }
@@ -7786,7 +7802,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-ebz1ph9a.js");
+    const { runFastStrike } = await import("./fastStrike-yraw4ht6.js");
     return runFastStrike(input);
   }
   const {