@pensar/apex 2.3.0 → 2.4.0

package/build/{cli-zk1ch6qf.js → cli-xshasbwe.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
+} from "./cli-repbyhkk.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-7tw4xfnw.js";
+} from "./cli-tznv8pf1.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-zx8gk8xv.js";
+} from "./cli-tkc598ey.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -31,7 +31,7 @@ Obtain valid credentials/sessions that other agents can use for authenticated te
 # Operating Mode
 
 - Fully autonomous — no human intervention
-- If you encounter barriers (CAPTCHA, MFA), report failure with details
+- If you encounter barriers (CAPTCHA, or MFA with no TOTP seed available), report failure with details
 - Call \`complete_authentication\` when done (success or failure)
 
 # Available Tools
@@ -125,6 +125,22 @@ These are the ONLY way downstream agents receive the session credentials.
 
 **Then**, call the \`response\` tool with your final summary to end the run. This is required — complete_authentication persists the data, response terminates the agent.
 
+# MFA / TOTP Codes
+
+If the login asks for a 6-digit authenticator code, check whether a TOTP seed was provided for this
+account — it appears as an extra secret field on the credential and as a matching environment variable
+(look for a name containing TOTP, MFA, OTP, or 2FA). If one exists, do NOT report an MFA barrier —
+compute the code yourself:
+
+\`\`\`
+python3 -c "import base64,hmac,hashlib,struct,time,os;s=os.environ['<ENV_VAR>'].replace(' ','').upper();k=base64.b32decode(s+'='*(-len(s)%8));d=hmac.new(k,struct.pack('>Q',int(time.time())//30),hashlib.sha1).digest();o=d[-1]&15;print('%06d'%((struct.unpack('>I',d[o:o+4])[0]&0x7fffffff)%1000000))"
+\`\`\`
+
+Read the seed from the environment variable — never paste a seed literal into a command. Codes rotate
+every 30 seconds, so run this immediately before filling the field. If the code is rejected, re-run and
+retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
+or two fresh codes are both rejected.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -136,7 +152,8 @@ If authentication fails, try these mechanical fixes (they are login mechanics, n
 
 If credentials were provided to you, they are already verified and SHARED — do not modify them or their
 account settings. When such provided credentials are genuinely rejected — wrong password, account locked, a
-forced password change is required, MFA is required, or the email is not confirmed — do NOT try to recover by resetting or changing
+forced password change is required, MFA is required and no TOTP seed was provided, or the email is not
+confirmed — do NOT try to recover by resetting or changing
 the password, modifying MFA/2FA settings, or running any account-recovery flow. Fail fast: call
 \`complete_authentication\` with success=false and a summary naming the reason. Do NOT register a new account
 or self-sign-up to get around a rejected provided credential — that is a different account than the one
@@ -194,7 +211,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
     const cm = session.credentialManager;
     super({
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context),
+      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
       model,
       session,
       target,
@@ -272,7 +289,7 @@ function loadAuthResult(authDataPath) {
     };
   }
 }
-function buildAuthPrompt(target, authHints, credentialManager, context) {
+function buildAuthPrompt(target, authHints, credentialManager, context, envVarNames) {
   const parts = [`TARGET: ${target}
 `];
   if (context) {
@@ -290,6 +307,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context) {
     parts.push(`No credentials provided. Probe the target to discover auth requirements.
 `);
   }
+  if (envVarNames?.length) {
+    parts.push("ENVIRONMENT VARIABLES:");
+    parts.push(`These are pre-loaded in your shell and available in every execute_command call. Reference them (e.g. $${envVarNames[0]}) — their values are hidden from you and redacted from command output, so never try to print one.`);
+    parts.push(envVarNames.map((n) => `- ${n}`).join(`
+`));
+    parts.push("");
+  }
   if (authHints) {
     parts.push("AUTH HINTS:");
     if (authHints.authScheme)
@@ -316,8 +340,9 @@ The credentials above were provided to you and have already been verified — th
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
 resetting a second factor) for this account. If they do not authenticate (rejected, locked out, forced
-password change required, MFA required, email not confirmed), call complete_authentication with
-success=false and a clear summary of why — do not attempt to recover, reset, or rotate them. Do NOT
+password change required, email not confirmed, or an MFA prompt with no TOTP seed available), call
+complete_authentication with success=false and a clear summary of why — do not attempt to recover, reset,
+or rotate them. When a TOTP seed IS available, generate the code and continue; that is not a barrier. Do NOT
 register a new account or self-sign-up to work around a failed login: that is not the credential under test
 and only pollutes results — fail fast with success=false instead.`);
   } else {

package/build/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 // @bun
-import"./cli-q24twygk.js";
+import"./cli-dm0fc0bm.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -14,20 +14,20 @@ import {
   init_toolset,
   init_utils,
   logger
-} from "./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
+} from "./cli-tkc598ey.js";
+import"./cli-0n4r54hq.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
 import {
   init_package,
   package_default
-} from "./cli-barsn8br.js";
+} from "./cli-vnynf0js.js";
 import {
   __require,
   __toESM
-} from "./cli-8rxa073f.js";
+} from "./cli-bc05qbss.js";
 // package.json
 var package_default2 = {
   author: "Pensar",
@@ -144,7 +144,7 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.3.0"
+  version: "2.4.0"
 };
 
 // src/core/ai/index.ts
@@ -299,13 +299,18 @@ class AgentEventBus {
         });
         break;
       case "reasoning-start":
-        this.emit("reasoning-start", { subagentId });
+        this.emit("reasoning-start", { subagentId, sessionId, messageId });
         break;
       case "reasoning-delta":
-        this.emit("reasoning-delta", { text: chunk.text, subagentId });
+        this.emit("reasoning-delta", {
+          text: chunk.text,
+          subagentId,
+          sessionId,
+          messageId
+        });
         break;
       case "reasoning-end":
-        this.emit("reasoning-end", { subagentId });
+        this.emit("reasoning-end", { subagentId, sessionId, messageId });
         break;
       case "tool-input-start":
         this.emit("tool-call-start", {
@@ -587,7 +592,7 @@ function attachCliAgentStreamListeners(bus) {
 async function createInstrumentedBus(session) {
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-krd8bnex.js");
+  const { attachWandbToEventBus } = await import("./upload-7wdyyqmr.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -601,10 +606,10 @@ async function resolveCliHeaders() {
   if (headerArgs.length === 0 && !headersFromArg && !noGlobal) {
     return;
   }
-  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-7djk9jyf.js");
+  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-rtccymzn.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-32hn8rrw.js");
+    const { config: appConfig } = await import("./index-y5w6n3tb.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -638,8 +643,8 @@ async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
-  const { getDefaultModelForConfig } = await import("./utils-skmqhyfg.js");
+  const { config: appConfig } = await import("./index-y5w6n3tb.js");
+  const { getDefaultModelForConfig } = await import("./utils-7fwdkqk6.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -648,6 +653,7 @@ async function resolveCliModel() {
 ` + `  ANTHROPIC_API_KEY  \u2014 Anthropic direct
 ` + `  OPENAI_API_KEY     \u2014 OpenAI
 ` + `  OPENROUTER_API_KEY \u2014 OpenRouter
+` + `  CONCENTRATE_API_KEY \u2014 Concentrate
 ` + `
 Or run 'pensar login' to connect to Pensar Console.`);
     process.exit(1);
@@ -725,11 +731,11 @@ Global options:
 `);
 }
 async function runPentest() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runPentestAgent } = await import("./blackboxPentest-tgc2t3y6.js");
-  const { sessions: sessions2 } = await import("./index-e8c8zcrf.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runPentestAgent } = await import("./blackboxPentest-44333zss.js");
+  const { sessions: sessions2 } = await import("./index-sf16jm0m.js");
+  const { config: appConfig } = await import("./index-y5w6n3tb.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -803,11 +809,11 @@ Report:    ${reportPath}` : ""}`);
   process.exit(0);
 }
 async function runTargetedPentest() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-me4jnr3z.js");
-  const { sessions: sessions2 } = await import("./index-e8c8zcrf.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-s1ptvq8e.js");
+  const { sessions: sessions2 } = await import("./index-sf16jm0m.js");
+  const { config: appConfig } = await import("./index-y5w6n3tb.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -857,10 +863,10 @@ POCs:      ${pocsPath}`);
   process.exit(0);
 }
 async function runThreatModel() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runThreatModelWorkflow } = await import("./threatModel-k4f3zgqd.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-xsm6fwk5.js");
+  const { config: appConfig } = await import("./index-y5w6n3tb.js");
   const path2 = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
@@ -894,16 +900,16 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { config } = await import("./main-3d7dfdvs.js").then((m)=>__toESM(m.default,1));
+  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
   config();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-8ky7gccp.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-e8c8zcrf.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-468j74f3.js");
-  const { config: appConfig } = await import("./index-32hn8rrw.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-b9e2xm6v.js");
+  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-sf16jm0m.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-hqjdg6fg.js");
+  const { config: appConfig } = await import("./index-y5w6n3tb.js");
   const { createInterface } = await import("readline");
   const { readFileSync: readFileSync2, existsSync } = await import("fs");
   const path2 = await import("path");
-  const { stepCountIs } = await import("./index-gq9h8j5j.js");
+  const { stepCountIs } = await import("./index-mtq7kmxz.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -1013,35 +1019,35 @@ if (hasFlag("-p") || command === "--prompt") {
   await runTargetedPentest();
 } else if (command === "login" || command === "auth") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-c1z670rx.js");
+  await import("./auth-z3h9859n.js");
 } else if (command === "uninstall") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-jt1bca2p.js");
+  await import("./uninstall-tvsh81v8.js");
 } else if (command === "apps") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./apps-43pqbz7r.js");
+  await import("./apps-17wvz1d7.js");
 } else if (command === "pentests") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-62d6zw6p.js");
+  await import("./pentests-6ks3szc4.js");
 } else if (command === "targets") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./targets-e5k1mrky.js");
+  await import("./targets-sxygyj87.js");
 } else if (command === "issues") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-kh4wg8c5.js");
+  await import("./issues-xx5bs4md.js");
 } else if (command === "fixes") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-86yebsj0.js");
+  await import("./fixes-b89s5haw.js");
 } else if (command === "logs") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-bj28xmbf.js");
+  await import("./logs-qtxe51w2.js");
 } else if (command === "config") {
   process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./config-jzqjz606.js");
+  await import("./config-f1mj4nhd.js");
 } else if (command === "threat-model") {
   await runThreatModel();
 } else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-q3qws68e.js");
+  const { runDoctor } = await import("./doctor-ekneewa3.js");
   await runDoctor();
 } else if (args.length === 0) {
   if (process.env.PENSAR_NO_TUI === "1") {
@@ -1049,7 +1055,7 @@ if (hasFlag("-p") || command === "--prompt") {
     console.error("All other commands work with Node \u2014 run 'pensar --help'.");
     process.exit(1);
   }
-  await import("./index-97vx1a24.js");
+  await import("./index-6d22pyxt.js");
 } else {
   console.error(`Error: Unknown command '${command}'`);
   console.error();

package/build/{config-jzqjz606.js → config-f1mj4nhd.js}

@@ -7,14 +7,14 @@ import {
   formatParseError,
   parseHeaderLine,
   parseHeadersFromFile
-} from "./cli-q24twygk.js";
+} from "./cli-dm0fc0bm.js";
 import {
   config,
   init_config
-} from "./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
+import"./cli-vnynf0js.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/config.ts
 init_config();

package/build/{doctor-q3qws68e.js → doctor-ekneewa3.js}

@@ -1,14 +1,14 @@
 import {
   toolExists
-} from "./cli-7tw4xfnw.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-tznv8pf1.js";
+import"./cli-tkc598ey.js";
+import"./cli-0n4r54hq.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
+import"./cli-vnynf0js.js";
+import"./cli-bc05qbss.js";
 
 // src/core/doctor.ts
 import { execSync, spawnSync } from "node:child_process";
@@ -50,6 +50,7 @@ function checkApiKeys() {
     { provider: "OpenAI", env: "OPENAI_API_KEY" },
     { provider: "Google", env: "GOOGLE_GENERATIVE_AI_API_KEY" },
     { provider: "OpenRouter", env: "OPENROUTER_API_KEY" },
+    { provider: "Concentrate", env: "CONCENTRATE_API_KEY" },
     { provider: "AWS Bedrock", env: "BEDROCK_API_KEY" },
     { provider: "AWS IAM", env: "AWS_ACCESS_KEY_ID" },
     { provider: "vLLM (local)", env: "LOCAL_MODEL_URL" }

package/build/{fastStrike-ebz1ph9a.js → fastStrike-8zka43xs.js}

@@ -4,29 +4,29 @@ import {
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-72b18z0n.js";
+} from "./cli-b1adytsy.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
+import"./cli-qqt4gj1w.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent
-} from "./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+} from "./cli-repbyhkk.js";
+import"./cli-tznv8pf1.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
+import"./cli-tkc598ey.js";
+import"./cli-0n4r54hq.js";
 import {
   exports_external,
   init_zod
-} from "./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
+import"./cli-vnynf0js.js";
+import"./cli-bc05qbss.js";
 
 // src/core/workflows/fastStrike.ts
 init_zod();
@@ -42,14 +42,15 @@ Run this loop, tightly:
 
 1. OBSERVE — Read every response for signal before you act. Note the stack, headers, cookies, tokens, form fields, error messages, redirects, disabled controls, ID patterns. State what you just learned in one line before the next move.
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
-3. ACT — Test that one hypothesis with the minimum number of commands. Every tool call should exist to confirm or kill a specific hypothesis.
+3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Multi-step objectives are yours to finish end to end — foothold, then privesc, then the goal.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. When the objective is met (or every credible lead is exhausted), call the response tool with your result.
+5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
+6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
+- Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
 - Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
 async function runFastStrike(input) {
@@ -121,7 +122,25 @@ ${combined}` : combined;
     enableThinking,
     openAIReasoningEffort
   });
-  const strikeResult = await agent.consume();
+  eventBus?.emit("subagent-spawn", {
+    subagentId: "fast-strike",
+    name: "Fast Strike",
+    input: { target }
+  });
+  let strikeResult;
+  try {
+    strikeResult = await agent.consume();
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "completed"
+    });
+  } catch (e) {
+    eventBus?.emit("subagent-complete", {
+      subagentId: "fast-strike",
+      status: "failed"
+    });
+    throw e;
+  }
   if (abortSignal?.aborted) {
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
@@ -152,5 +171,6 @@ ${combined}` : combined;
   };
 }
 export {
+  FAST_STRIKE_SYSTEM_PROMPT,
   runFastStrike
 };

package/build/{fixes-86yebsj0.js → fixes-b89s5haw.js}

@@ -2,28 +2,28 @@
 import {
   getFix,
   listFixes
-} from "./cli-f71s6kcw.js";
-import"./cli-zm8tfpv7.js";
-import"./cli-bv2807tj.js";
-import"./cli-72b18z0n.js";
-import"./cli-50906d27.js";
-import"./cli-zk1ch6qf.js";
-import"./cli-j0n189ee.js";
-import"./cli-baqhqbe5.js";
+} from "./cli-vq52kp7j.js";
+import"./cli-5k33webc.js";
+import"./cli-gq40s5b3.js";
+import"./cli-b1adytsy.js";
+import"./cli-mavved45.js";
+import"./cli-xshasbwe.js";
+import"./cli-32z0017y.js";
+import"./cli-k8kc47pq.js";
 import"./cli-9fsre5pt.js";
-import"./cli-jyp2c6th.js";
-import"./cli-n2m2yy5b.js";
-import"./cli-7tw4xfnw.js";
+import"./cli-qqt4gj1w.js";
+import"./cli-repbyhkk.js";
+import"./cli-tznv8pf1.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-zx8gk8xv.js";
-import"./cli-vckbhnyk.js";
-import"./cli-3k1x5rn3.js";
-import"./cli-gpnb45ck.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+import"./cli-tkc598ey.js";
+import"./cli-0n4r54hq.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
+import"./cli-vnynf0js.js";
+import"./cli-bc05qbss.js";
 
 // src/cli/fixes.ts
 function showHelp() {

package/build/{index-8db1d2q3.js → index-4ad3sdwk.js}

@@ -14,26 +14,26 @@ import {
   signGatewayRequest,
   startDeviceFlow,
   validateGateway
-} from "./cli-vckbhnyk.js";
-import"./cli-f7hanqbw.js";
-import"./cli-eveg9djy.js";
-import"./cli-barsn8br.js";
-import"./cli-8rxa073f.js";
+} from "./cli-0n4r54hq.js";
+import"./cli-72cvcqhg.js";
+import"./cli-9rhzhgx2.js";
+import"./cli-vnynf0js.js";
+import"./cli-bc05qbss.js";
 init_auth();
 
 export {
-  validateGateway,
-  startDeviceFlow,
-  signGatewayRequest,
-  selectWorkspace,
-  pollWorkspaceSelection,
-  pollWorkOSToken,
-  pollLegacyToken,
-  pollForWorkspaceCreation,
-  isTokenExpired,
-  isConnected,
-  fetchWorkspaces,
-  ensureValidToken,
+  createWorkspaceSelection,
   disconnect,
-  createWorkspaceSelection
+  ensureValidToken,
+  fetchWorkspaces,
+  isConnected,
+  isTokenExpired,
+  pollForWorkspaceCreation,
+  pollLegacyToken,
+  pollWorkOSToken,
+  pollWorkspaceSelection,
+  selectWorkspace,
+  signGatewayRequest,
+  startDeviceFlow,
+  validateGateway
 };