@pensar/apex 2.3.0 → 2.4.0-canary.2d23c2f0

package/build/{cli-bnkgdywr.js → cli-yrw6ck02.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-bpycpvf6.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-bv2807tj.js → cli-zhtfn5gp.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-qdz55t3y.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-vz1abzfe.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-zx8gk8xv.js";
+} from "./cli-bpycpvf6.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 // @bun
-import"./cli-q24twygk.js";
+import"./cli-dm0fc0bm.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -14,20 +14,20 @@ import {
   init_toolset,
   init_utils,
   logger
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
+} from "./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
 import {
   init_package,
   package_default
-} from "./cli-barsn8br.js";
+} from "./cli-s0ay7r6x.js";
 import {
   __require,
   __toESM
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 // package.json
 var package_default2 = {
   author: "Pensar",
@@ -144,7 +144,7 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.3.0"
+  version: "2.4.0-canary.2d23c2f0"
 };
 
 // src/core/ai/index.ts
@@ -299,13 +299,18 @@ class AgentEventBus {
         });
         break;
       case "reasoning-start":
-        this.emit("reasoning-start", { subagentId });
+        this.emit("reasoning-start", { subagentId, sessionId, messageId });
         break;
       case "reasoning-delta":
-        this.emit("reasoning-delta", { text: chunk.text, subagentId });
+        this.emit("reasoning-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId
+        });
         break;
       case "reasoning-end":
-        this.emit("reasoning-end", { subagentId });
+        this.emit("reasoning-end", { subagentId, sessionId, messageId });
         break;
       case "tool-input-start":
         this.emit("tool-call-start", {
@@ -587,7 +592,7 @@ function attachCliAgentStreamListeners(bus) {
 async function createInstrumentedBus(session) {
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-krd8bnex.js");
+  const { attachWandbToEventBus } = await import("./upload-9qp56ncf.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -601,10 +606,10 @@ async function resolveCliHeaders() {
   if (headerArgs.length === 0 && !headersFromArg && !noGlobal) {
     return;
   }
-  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
+  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-rtccymzn.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-32hn8rrw.js");
+    const { config: appConfig } = await import("./index-twcv8135.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -638,8 +643,8 @@ async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
-  const { getDefaultModelForConfig } = await import("./utils-skmqhyfg.js");
+  const { config: appConfig } = await import("./index-twcv8135.js");
+  const { getDefaultModelForConfig } = await import("./utils-rf818gpr.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -648,6 +653,7 @@ async function resolveCliModel() {
 ` + `  ANTHROPIC_API_KEY  \u2014 Anthropic direct
 ` + `  OPENAI_API_KEY     \u2014 OpenAI
 ` + `  OPENROUTER_API_KEY \u2014 OpenRouter
+` + `  CONCENTRATE_API_KEY \u2014 Concentrate
 ` + `
 Or run 'pensar login' to connect to Pensar Console.`);
     process.exit(1);
@@ -725,11 +731,11 @@ Global options:
 `);
 }
 async function runPentest() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runPentestAgent } = await import("./blackboxPentest-tgc2t3y6.js");
-  const { sessions: sessions2 } = await import("./index-e8c8zcrf.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runPentestAgent } = await import("./blackboxPentest-t2sc2mcg.js");
+  const { sessions: sessions2 } = await import("./index-dq0hvce1.js");
+  const { config: appConfig } = await import("./index-twcv8135.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -803,11 +809,11 @@ Report:    ${reportPath}` : ""}`);
   process.exit(0);
 }
 async function runTargetedPentest() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-me4jnr3z.js");
-  const { sessions: sessions2 } = await import("./index-e8c8zcrf.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-vz0ecgm9.js");
+  const { sessions: sessions2 } = await import("./index-dq0hvce1.js");
+  const { config: appConfig } = await import("./index-twcv8135.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -857,10 +863,10 @@ POCs:      ${pocsPath}`);
   process.exit(0);
 }
 async function runThreatModel() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runThreatModelWorkflow } = await import("./threatModel-k4f3zgqd.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-d4afwhnh.js");
+  const { config: appConfig } = await import("./index-twcv8135.js");
   const path2 = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
@@ -894,16 +900,16 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-8ky7gccp.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-e8c8zcrf.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-468j74f3.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-4bm0eavz.js");
+  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-dq0hvce1.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-xk4ht3gn.js");
+  const { config: appConfig } = await import("./index-twcv8135.js");
   const { createInterface } = await import("readline");
   const { readFileSync: readFileSync2, existsSync } = await import("fs");
   const path2 = await import("path");
-  const { stepCountIs } = await import("./index-gq9h8j5j.js");
+  const { stepCountIs } = await import("./index-mtq7kmxz.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -1013,35 +1019,35 @@ if (hasFlag("-p") || command === "--prompt") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-c1z670rx.js");
+  await import("./auth-7afqr3wp.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-jt1bca2p.js");
+  await import("./uninstall-1gqdgxg3.js");
 } else if (command === "apps") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./apps-43pqbz7r.js");
+  await import("./apps-j2pxtjaq.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-62d6zw6p.js");
+  await import("./pentests-gtxzs2fz.js");
 } else if (command === "targets") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./targets-e5k1mrky.js");
+  await import("./targets-me1ajgee.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-kh4wg8c5.js");
+  await import("./issues-ce9j1an1.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-86yebsj0.js");
+  await import("./fixes-mpm6r7cp.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-bj28xmbf.js");
+  await import("./logs-xv0vs83s.js");
 } else if (command === "config") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./config-jzqjz606.js");
+  await import("./config-5v7ddr7b.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-q3qws68e.js");
+  const { runDoctor } = await import("./doctor-jvwt8yq5.js");
   await runDoctor();
 } else if (args.length === 0) {
   if (process.env.PENSAR_NO_TUI === "1") {
@@ -1049,7 +1055,7 @@ if (hasFlag("-p") || command === "--prompt") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-97vx1a24.js");
+  await import("./index-gfw12srr.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{config-jzqjz606.js → config-5v7ddr7b.js}

@@ -7,14 +7,14 @@ import {
   formatParseError,
   parseHeaderLine,
   parseHeadersFromFile
-} from "./cli-q24twygk.js";
+} from "./cli-dm0fc0bm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/config.ts
 init_config();

package/build/{doctor-q3qws68e.js → doctor-jvwt8yq5.js}

@@ -1,14 +1,14 @@
 import {
   toolExists
-} from "./cli-7tw4xfnw.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-vz1abzfe.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/core/doctor.ts
 import { execSync, spawnSync } from "node:child_process";
@@ -50,6 +50,7 @@ function checkApiKeys() {
     { provider: "OpenAI", env: "OPENAI_API_KEY" },
     { provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
     { provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
+    { provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
     { provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
     { provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
     { provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }

package/build/{fastStrike-ebz1ph9a.js → fastStrike-k28f6nf3.js}

@@ -4,29 +4,29 @@ import {
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
+} from "./cli-kppxpy1r.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
+import"./cli-vpxp10qe.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/core/workflows/fastStrike.ts
 init_zod();
@@ -42,14 +42,15 @@ Run this loop, tightly:
 
 1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
-3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
+3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
+5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
+6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
+- Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
 - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
 async function runFastStrike(input) {
@@ -121,7 +122,25 @@ ${combined}` : combined;
     enableThinking,
     openAIReasoningEffort
   });
-  const strikeResult = await agent.consume();
+  eventBus?.emit("subagent-spawn", {
+    subagentId: "fast-strike",
+    name: "Fast Strike",
+    input: { target }
+  });
+  let strikeResult;
+  try {
+    strikeResult = await agent.consume();
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "completed"
+    });
+  } catch (e) {
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "failed"
+    });
+    throw e;
+  }
   if (abortSignal?.aborted) {
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
@@ -152,5 +171,6 @@ ${combined}` : combined;
   };
 }
 export {
+  FAST_STRIKE_SYSTEM_PROMPT,
   runFastStrike
 };

package/build/{fixes-86yebsj0.js → fixes-mpm6r7cp.js}

@@ -2,28 +2,28 @@
 import {
   getFix,
   listFixes
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+} from "./cli-xnmdwvse.js";
+import"./cli-nrtyzpy4.js";
+import"./cli-zhtfn5gp.js";
+import"./cli-kppxpy1r.js";
+import"./cli-jgy1gn5z.js";
+import"./cli-d5n76mez.js";
+import"./cli-tczmn0bc.js";
+import"./cli-gvwg1z9q.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-vpxp10qe.js";
+import"./cli-qdz55t3y.js";
+import"./cli-vz1abzfe.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/fixes.ts
 function showHelp() {

package/build/{index-8db1d2q3.js → index-5phv2wfj.js}

@@ -14,26 +14,26 @@ import {
   signGatewayRequest,
   startDeviceFlow,
   validateGateway
-} from "./cli-vckbhnyk.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-2vmbzyqh.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
+import"./cli-s0ay7r6x.js";
+import"./cli-bc05qbss.js";
 init_auth();
 
 export {
-  validateGateway,
-  startDeviceFlow,
-  signGatewayRequest,
-  selectWorkspace,
-  pollWorkspaceSelection,
-  pollWorkOSToken,
-  pollLegacyToken,
-  pollForWorkspaceCreation,
-  isTokenExpired,
-  isConnected,
-  fetchWorkspaces,
-  ensureValidToken,
+  createWorkspaceSelection,
   disconnect,
-  createWorkspaceSelection
+  ensureValidToken,
+  fetchWorkspaces,
+  isConnected,
+  isTokenExpired,
+  pollForWorkspaceCreation,
+  pollLegacyToken,
+  pollWorkOSToken,
+  pollWorkspaceSelection,
+  selectWorkspace,
+  signGatewayRequest,
+  startDeviceFlow,
+  validateGateway
 };

package/build/{index-h2hj2hj9.js → index-cbwn03kz.js}

@@ -10,11 +10,11 @@ import {
   init_esm_min,
   init_fetch_blob,
   init_from
-} from "./cli-wszshs5e.js";
+} from "./cli-k71t434r.js";
 import {
   __esm,
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // node_modules/data-uri-to-buffer/dist/index.js
 function dataUriToBuffer(uri) {
@@ -176,7 +176,7 @@ class Body {
       }
       return formData;
     }
-    const { toFormData } = await import("./multipart-parser-6zd16497.js");
+    const { toFormData } = await import("./multipart-parser-g2xxkezz.js");
     return toFormData(this.body, ct);
   }
   async blob() {
@@ -1240,18 +1240,18 @@ var init_src = __esm(() => {
 init_src();
 
 export {
-  isRedirect,
-  fileFromSync,
-  fileFrom,
-  fetch as default,
-  blobFromSync,
-  blobFrom,
-  Response,
-  Request,
-  Headers,
-  FormData,
-  file_default as File,
-  FetchError,
+  AbortError,
   fetch_blob_default as Blob,
-  AbortError
+  FetchError,
+  file_default as File,
+  FormData,
+  Headers,
+  Request,
+  Response,
+  blobFrom,
+  blobFromSync,
+  fetch as default,
+  fileFrom,
+  fileFromSync,
+  isRedirect
 };

package/build/{index-e8c8zcrf.js → index-dq0hvce1.js}

@@ -17,22 +17,22 @@ import {
   update,
   write,
   writeRaw
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+} from "./cli-bpycpvf6.js";
+import"./cli-2vmbzyqh.js";
 import {
   init_zod,
   zod_default
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
+} from "./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-bv9bjvpt.js";
+import"./cli-21kv9cmn.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-barsn8br.js";
+} from "./cli-s0ay7r6x.js";
 import {
   __require
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 
 // src/core/session/index.ts
 init_zod();
@@ -178,6 +178,7 @@ var SessionConfigObject = zod_default.object({
   authenticationInstructions: zod_default.string().optional(),
   requestsPerSecond: zod_default.number().optional(),
   allowDestructiveActions: zod_default.boolean().optional(),
+  allowRateLimitTesting: zod_default.boolean().optional(),
   operatorSettings: OperatorSettingsObject.optional(),
   toolsetState: ToolsetStateSchema.optional(),
   enumerateSubdomains: zod_default.boolean().optional(),
@@ -313,7 +314,7 @@ async function create(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-ag14v3sg.js");
+    const { config: appConfig } = await import("./index-s2xwp702.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }
@@ -452,18 +453,22 @@ function hasOperatorState(session) {
   const statePath = path.join(session.rootPath, "messages.json");
   return existsSync(statePath);
 }
-var MAX_RESUME_MESSAGES = 200;
-function getResumeMessages(messages, limit = MAX_RESUME_MESSAGES) {
+var RESUME_MESSAGE_WINDOW = 200;
+function getResumeMessages(messages, limit = RESUME_MESSAGE_WINDOW) {
   if (messages.length <= limit)
     return messages;
-  let cutIndex = messages.length - limit;
+  const roughCutIndex = messages.length - limit;
+  let cutIndex = roughCutIndex;
   while (cutIndex < messages.length) {
     if (messages[cutIndex].role === "user")
       break;
     cutIndex++;
   }
   if (cutIndex >= messages.length) {
-    cutIndex = messages.length - limit;
+    cutIndex = roughCutIndex;
+    while (cutIndex > 0 && messages[cutIndex].role !== "user") {
+      cutIndex--;
+    }
   }
   return messages.slice(cutIndex);
 }
@@ -557,18 +562,18 @@ var sessions = {
   updateSessionHeaders
 };
 export {
-  updateSessionHeaders,
-  updateOperatorSettings,
-  sessions,
-  normalizeMessages,
-  migrateLegacySessionData,
-  loadOperatorState,
-  list,
-  hasOperatorState,
-  getSessionRoot,
-  getResumeMessages,
-  get,
-  create,
+  EXFIL_OUTCOME_GUIDANCE,
   SessionInfoObject,
-  EXFIL_OUTCOME_GUIDANCE
+  create,
+  get,
+  getResumeMessages,
+  getSessionRoot,
+  hasOperatorState,
+  list,
+  loadOperatorState,
+  migrateLegacySessionData,
+  normalizeMessages,
+  sessions,
+  updateOperatorSettings,
+  updateSessionHeaders
 };