@pensar/apex 2.3.0 → 2.4.0-canary.2d23c2f0

package/build/agent-4wd7a02r.js

@@ -0,0 +1,29 @@
+import {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+} from "./cli-jgy1gn5z.js";
+import"./cli-9fsre5pt.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
+import"./cli-c8131c4q.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
+export {
+  PentestResponseSchema,
+  TargetedPentestAgent,
+  buildPentestActiveTools,
+  buildPentestPrompt,
+  buildPentestSystemPrompt,
+  resolvePentestAgentRole
+};

package/build/agent-cgmq23jr.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-tczmn0bc.js";
+import"./cli-9fsre5pt.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
+import"./cli-c8131c4q.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/{agent-9xna7jhw.js → agent-gtmbvqh2.js}

@@ -1,24 +1,24 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-qdz55t3y.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-vz1abzfe.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+} from "./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
 init_dist();
@@ -68,7 +68,7 @@ You are the last line of defense against false positives, hallucinated findings,
 - Authorization / access-control boundary bypass (RSC/prefetch/redirect-body leaks, missing per-route checks): the evidence must establish the access-model delta — which identity/role was used, and proof that the returned data is genuinely out of scope for that identity (cross-tenant, another user's, or admin-only data a member should not see). A 200 response, a leaked RSC payload, or a skipped redirect alone does NOT prove sensitive exposure. If the bypass is real but the returned data is non-sensitive or plausibly same-tenant/expected-visible, classify as a valid lower-impact finding and require the claim's impact/severity to match — do NOT accept it as high-confidence sensitive/cross-tenant exposure.
 - Authentication bypass: output should show protected access without valid credentials.
 - Email/HTML injection: ideally verify delivery and rendering. If only server acceptance is shown, confidence must stay below 0.7 and limitations must state rendering was not independently verified.
-- Missing rate limiting / anti-automation: fewer than 50 requests is insufficient. Evidence must state exact request count, timing/distribution, and observed statuses.
+- Missing rate limiting / anti-automation: a modest burst (~20 requests) with no observed throttling, delays, or 429s is sufficient to demonstrate the gap. For endpoints with real-world side effects (sending email/SMS/push, creating tickets/notifications, contact/support/feedback forms, payments), as few as 2–3 attempts plus the observed response is sufficient — do NOT require volume-testing that would spam real recipients. Evidence must state exact request count, timing/distribution, and observed statuses.
 
 ### Common Low-Signal Patterns
 Reject these unless the submitted evidence demonstrates concrete harm:

package/build/{apps-43pqbz7r.js → apps-j2pxtjaq.js}

@@ -1,4 +1,14 @@
 #!/usr/bin/env bun
+import"./cli-xnmdwvse.js";
+import"./cli-nrtyzpy4.js";
+import"./cli-zhtfn5gp.js";
+import"./cli-kppxpy1r.js";
+import"./cli-jgy1gn5z.js";
+import"./cli-d5n76mez.js";
+import"./cli-tczmn0bc.js";
+import"./cli-gvwg1z9q.js";
+import"./cli-9fsre5pt.js";
+import"./cli-vpxp10qe.js";
 import {
   createApp,
   createEndpoint,
@@ -12,28 +22,18 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
-import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/apps.ts
 var APPLICATION_TYPES = [

package/build/{auth-c1z670rx.js → auth-7afqr3wp.js}

@@ -1,22 +1,23 @@
 #!/usr/bin/env bun
-import"./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+import"./cli-xnmdwvse.js";
+import"./cli-nrtyzpy4.js";
+import"./cli-zhtfn5gp.js";
+import"./cli-kppxpy1r.js";
+import"./cli-jgy1gn5z.js";
+import"./cli-d5n76mez.js";
+import"./cli-tczmn0bc.js";
+import"./cli-gvwg1z9q.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
+import"./cli-bpycpvf6.js";
 import {
   createWorkspaceSelection,
   disconnect,
+  ensureValidToken,
   fetchWorkspaces,
   getPensarApiUrl,
   getPensarConsoleUrl,
@@ -28,18 +29,18 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
+} from "./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
+} from "./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/cli/auth.ts
 import * as readline from "node:readline";
@@ -85,7 +86,13 @@ Waiting for workspace selection...`);
 }
 async function login() {
   const appConfig = await config.get();
-  if (isConnected(appConfig)) {
+  const hasStoredCredentials = isConnected(appConfig);
+  const validToken = hasStoredCredentials ? await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  }) : null;
+  if (validToken) {
     console.log("Already connected to Pensar Console.");
     if (appConfig.workspaceSlug) {
       console.log(`  Workspace: ${appConfig.workspaceSlug}`);
@@ -95,6 +102,8 @@ Reconnect? (y/N): `);
     if (answer.toLowerCase() !== "y") {
       return;
     }
+  } else if (hasStoredCredentials) {
+    console.log("Your saved Pensar Console session has expired. Reconnecting.");
   }
   console.log(`
 Pensar Console — Managed Inference
@@ -228,6 +237,15 @@ async function status() {
     console.log("Not connected to Pensar Console.\n\nRun `pensar login` to connect.");
     return;
   }
+  const validToken = await ensureValidToken({
+    accessToken: appConfig.accessToken,
+    refreshToken: appConfig.refreshToken,
+    pensarAPIKey: appConfig.pensarAPIKey
+  });
+  if (!validToken) {
+    console.log("Your Pensar Console session has expired.\n\nRun `pensar login` to reconnect.");
+    return;
+  }
   if (!appConfig.accessToken && appConfig.pensarAPIKey && !appConfig.workspaceSlug) {
     try {
       const apiUrl = getPensarApiUrl();

package/build/authentication-hvsegb1p.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-d5n76mez.js";
+import"./cli-9fsre5pt.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
+import"./cli-c8131c4q.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-47wf7hkx.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-zhtfn5gp.js";
+import"./cli-9fsre5pt.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
+import"./cli-c8131c4q.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-tgc2t3y6.js → blackboxPentest-t2sc2mcg.js}

@@ -1,25 +1,25 @@
 import {
   runPentestWorkflow
-} from "./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+} from "./cli-nrtyzpy4.js";
+import"./cli-zhtfn5gp.js";
+import"./cli-kppxpy1r.js";
+import"./cli-jgy1gn5z.js";
+import"./cli-tczmn0bc.js";
+import"./cli-gvwg1z9q.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/core/api/blackboxPentest.ts
 async function runPentestAgent(input) {

package/build/{cli-eveg9djy.js → cli-21kv9cmn.js}

@@ -1,10 +1,10 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-barsn8br.js";
+} from "./cli-s0ay7r6x.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/config/config.ts
 import fs from "node:fs/promises";
@@ -45,6 +45,7 @@ function applyEnvFallbacks(parsedConfig) {
     anthropicAPIKey: parsedConfig.anthropicAPIKey ?? process.env.ANTHROPIC_API_KEY,
     googleAPIKey: parsedConfig.googleAPIKey ?? process.env.GOOGLE_GENERATIVE_AI_API_KEY,
     openRouterAPIKey: parsedConfig.openRouterAPIKey ?? process.env.OPENROUTER_API_KEY,
+    concentrateAPIKey: parsedConfig.concentrateAPIKey ?? process.env.CONCENTRATE_API_KEY,
     inceptionAPIKey: parsedConfig.inceptionAPIKey ?? process.env.INCEPTION_API_KEY,
     bedrockAPIKey: parsedConfig.bedrockAPIKey ?? process.env.BEDROCK_API_KEY,
     pensarAPIKey: parsedConfig.pensarAPIKey ?? process.env.PENSAR_API_KEY,

package/build/{cli-vckbhnyk.js → cli-2vmbzyqh.js}

@@ -1,10 +1,10 @@
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
+} from "./cli-bv9bjvpt.js";
 import {
   __esm
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/auth/connection.ts
 function isConnected(cfg) {

package/build/{cli-8rxa073f.js → cli-bc05qbss.js}

@@ -20,12 +20,14 @@ var __toESM = (mod, isNodeMode, target) => {
   }
   target = mod != null ? __create(__getProtoOf(mod)) : {};
   const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  for (let key of __getOwnPropNames(mod))
-    if (!__hasOwnProp.call(to, key))
-      __defProp(to, key, {
-        get: __accessProp.bind(mod, key),
-        enumerable: true
-      });
+  if (mod && typeof mod === "object" || typeof mod === "function") {
+    for (let key of __getOwnPropNames(mod))
+      if (!__hasOwnProp.call(to, key))
+        __defProp(to, key, {
+          get: __accessProp.bind(mod, key),
+          enumerable: true
+        });
+  }
   if (canCache)
     cache.set(mod, to);
   return to;