@pensar/apex 2.4.0-canary.7d58f42b → 2.4.0-canary.d13eb239

package/build/{agent-2mgkzsjp.js → agent-e46h35ay.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-719fst3v.js";
+} from "./cli-deh0yfrw.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-hxpne4g1.js";
+} from "./cli-rgsym52y.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-mms9gcfg.js";
-import"./cli-x0wdzz6m.js";
+} from "./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
 import {
   exports_external,
   init_zod
 } from "./cli-swpbx60z.js";
 import"./cli-j54qa6tm.js";
-import"./cli-b9322y77.js";
-import"./cli-ztgapbp2.js";
-import"./cli-n4yc9rjz.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
 import"./cli-bc05qbss.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/agent-rjfefj3b.js

@@ -0,0 +1,19 @@
+import {
+  CodeAgent
+} from "./cli-0eeheft8.js";
+import"./cli-9fsre5pt.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
+import"./cli-c8131c4q.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/{agent-wp6zfnk6.js → agent-tm0tmpgc.js}

@@ -5,19 +5,19 @@ import {
   buildPentestPrompt,
   buildPentestSystemPrompt,
   resolvePentestAgentRole
-} from "./cli-p47nvwh9.js";
+} from "./cli-jgk83qr1.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ck7njgve.js";
-import"./cli-719fst3v.js";
-import"./cli-hxpne4g1.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
 import"./cli-c8131c4q.js";
-import"./cli-mms9gcfg.js";
-import"./cli-x0wdzz6m.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
 import"./cli-swpbx60z.js";
 import"./cli-j54qa6tm.js";
-import"./cli-b9322y77.js";
-import"./cli-ztgapbp2.js";
-import"./cli-n4yc9rjz.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
 import"./cli-bc05qbss.js";
 export {
   PentestResponseSchema,

package/build/{apps-g2a56s8h.js → apps-yd4dytnh.js}

@@ -1,14 +1,14 @@
 #!/usr/bin/env bun
-import"./cli-kwen4v4s.js";
-import"./cli-fjr302a9.js";
-import"./cli-1rrjt09r.js";
-import"./cli-yry0gjp8.js";
-import"./cli-p47nvwh9.js";
-import"./cli-kv7v8nqp.js";
-import"./cli-3rzeb1qk.js";
-import"./cli-ck1mwkrr.js";
+import"./cli-vkjgcner.js";
+import"./cli-yy936th4.js";
+import"./cli-0wc6bt29.js";
+import"./cli-1b7ytd6z.js";
+import"./cli-jgk83qr1.js";
+import"./cli-wjw0pmn3.js";
+import"./cli-0eeheft8.js";
+import"./cli-z3ykxkhs.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ck7njgve.js";
+import"./cli-xdrjf347.js";
 import {
   ENDPOINT_TRANSPORTS,
   createApp,
@@ -25,17 +25,17 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-719fst3v.js";
-import"./cli-hxpne4g1.js";
+} from "./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-mms9gcfg.js";
-import"./cli-x0wdzz6m.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
 import"./cli-swpbx60z.js";
 import"./cli-j54qa6tm.js";
-import"./cli-b9322y77.js";
-import"./cli-ztgapbp2.js";
-import"./cli-n4yc9rjz.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
 import"./cli-bc05qbss.js";
 
 // src/cli/apps.ts

package/build/{auth-2j1mypvj.js → auth-90n1pswd.js}

@@ -1,19 +1,19 @@
 #!/usr/bin/env bun
-import"./cli-kwen4v4s.js";
-import"./cli-fjr302a9.js";
-import"./cli-1rrjt09r.js";
-import"./cli-yry0gjp8.js";
-import"./cli-p47nvwh9.js";
-import"./cli-kv7v8nqp.js";
-import"./cli-3rzeb1qk.js";
-import"./cli-ck1mwkrr.js";
+import"./cli-vkjgcner.js";
+import"./cli-yy936th4.js";
+import"./cli-0wc6bt29.js";
+import"./cli-1b7ytd6z.js";
+import"./cli-jgk83qr1.js";
+import"./cli-wjw0pmn3.js";
+import"./cli-0eeheft8.js";
+import"./cli-z3ykxkhs.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ck7njgve.js";
-import"./cli-719fst3v.js";
-import"./cli-hxpne4g1.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-mms9gcfg.js";
+import"./cli-a1xmncfm.js";
 import {
   createWorkspaceSelection,
   disconnect,
@@ -29,15 +29,15 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-x0wdzz6m.js";
+} from "./cli-419b5qgw.js";
 import"./cli-swpbx60z.js";
 import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-b9322y77.js";
-import"./cli-ztgapbp2.js";
-import"./cli-n4yc9rjz.js";
+} from "./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
 import {
   __require
 } from "./cli-bc05qbss.js";

package/build/authentication-19qczcfx.js

@@ -0,0 +1,19 @@
+import {
+  runAuthenticationAgent
+} from "./cli-wjw0pmn3.js";
+import"./cli-9fsre5pt.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
+import"./cli-c8131c4q.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-ja53082h.js

@@ -0,0 +1,19 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-0wc6bt29.js";
+import"./cli-9fsre5pt.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
+import"./cli-c8131c4q.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
+import"./cli-swpbx60z.js";
+import"./cli-j54qa6tm.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-4y38fze4.js → blackboxPentest-qt04n5v0.js}

@@ -1,24 +1,24 @@
 import {
   runPentestWorkflow
-} from "./cli-fjr302a9.js";
-import"./cli-1rrjt09r.js";
-import"./cli-yry0gjp8.js";
-import"./cli-p47nvwh9.js";
-import"./cli-3rzeb1qk.js";
-import"./cli-ck1mwkrr.js";
+} from "./cli-yy936th4.js";
+import"./cli-0wc6bt29.js";
+import"./cli-1b7ytd6z.js";
+import"./cli-jgk83qr1.js";
+import"./cli-0eeheft8.js";
+import"./cli-z3ykxkhs.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ck7njgve.js";
-import"./cli-719fst3v.js";
-import"./cli-hxpne4g1.js";
+import"./cli-xdrjf347.js";
+import"./cli-deh0yfrw.js";
+import"./cli-rgsym52y.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-mms9gcfg.js";
-import"./cli-x0wdzz6m.js";
+import"./cli-a1xmncfm.js";
+import"./cli-419b5qgw.js";
 import"./cli-swpbx60z.js";
 import"./cli-j54qa6tm.js";
-import"./cli-b9322y77.js";
-import"./cli-ztgapbp2.js";
-import"./cli-n4yc9rjz.js";
+import"./cli-4z8jyxcb.js";
+import"./cli-2s00pcp1.js";
+import"./cli-04hkr78f.js";
 import"./cli-bc05qbss.js";
 
 // src/core/api/blackboxPentest.ts

package/build/{cli-n4yc9rjz.js → cli-04hkr78f.js}

@@ -120,7 +120,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.4.0-canary.7d58f42b"
+    version: "2.4.0-canary.d13eb239"
   };
 });
 

package/build/{cli-3rzeb1qk.js → cli-0eeheft8.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-719fst3v.js";
+} from "./cli-deh0yfrw.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-mms9gcfg.js";
+} from "./cli-a1xmncfm.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-1rrjt09r.js → cli-0wc6bt29.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-719fst3v.js";
+} from "./cli-deh0yfrw.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-hxpne4g1.js";
+} from "./cli-rgsym52y.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-mms9gcfg.js";
+} from "./cli-a1xmncfm.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();

package/build/{cli-yry0gjp8.js → cli-1b7ytd6z.js}

@@ -1,11 +1,11 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-ck7njgve.js";
+} from "./cli-xdrjf347.js";
 import {
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-719fst3v.js";
+} from "./cli-deh0yfrw.js";
 import {
   exports_external,
   init_zod

package/build/{cli-ztgapbp2.js → cli-2s00pcp1.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-n4yc9rjz.js";
+} from "./cli-04hkr78f.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-x0wdzz6m.js → cli-419b5qgw.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-b9322y77.js";
+} from "./cli-4z8jyxcb.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-b9322y77.js → cli-4z8jyxcb.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-ztgapbp2.js";
+} from "./cli-2s00pcp1.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-mms9gcfg.js → cli-a1xmncfm.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-x0wdzz6m.js";
+} from "./cli-419b5qgw.js";
 import {
   AISDKError,
   APICallError,
@@ -87,11 +87,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-b9322y77.js";
+} from "./cli-4z8jyxcb.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-n4yc9rjz.js";
+} from "./cli-04hkr78f.js";
 import {
   __callDispose,
   __commonJS,
@@ -45821,6 +45821,9 @@ var init_streamTelemetry = __esm(() => {
 
 // src/core/ai/ai.ts
 import { AsyncLocalStorage } from "node:async_hooks";
+function isRepairFailClosedTool(toolName) {
+  return REPAIR_FAIL_CLOSED_TOOLS.has(toolName);
+}
 function takeStepContext() {
   const store = stepContextStore.getStore();
   if (!store)
@@ -46265,6 +46268,12 @@ function streamResponse(opts) {
           const rawLen = typeof raw === "string" ? raw.length : JSON.stringify(raw).length;
           log.warn(`[response-debug] experimental_repairToolCall FIRED for response ` + `rawInputChars=${rawLen} error=${(error.message || String(error)).slice(0, 200)}`);
         }
+        if (isRepairFailClosedTool(toolCall.toolName)) {
+          if (!silent) {
+            log.warn(`Tool-call repair disabled for security-sensitive tool "${toolCall.toolName}" — failing closed (no argument synthesis).`);
+          }
+          return null;
+        }
         try {
           if (!silent) {
             log.debug(`Repairing tool call: ${toolCall.toolName}`, {
@@ -46447,7 +46456,7 @@ async function generateObjectResponse(opts) {
   }
   throw lastError;
 }
-var log, RESPONSE_DEBUG, RESPONSE_TOOL_NAME = "response", DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, stepContextStore, SEQUENTIAL_TOOL_CALL_INSTRUCTION, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, NON_GATED_TOOLS, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
+var log, RESPONSE_DEBUG, RESPONSE_TOOL_NAME = "response", REPAIR_FAIL_CLOSED_TOOLS, DEFAULT_OPENAI_REASONING_EFFORT = "medium", OPENAI_REASONING_MODEL_IDS, _usageCallback = null, stepContextStore, SEQUENTIAL_TOOL_CALL_INSTRUCTION, MAX_RATE_LIMIT_RETRIES = 20, MAX_IDLE_RESUME_RETRIES = 3, STREAM_IDLE_TIMEOUT_MS, StreamIdleTimeoutError, NON_GATED_TOOLS, MAX_OBJECT_RATE_LIMIT_RETRIES = 8, ContextLengthError, ContextLengthExhaustedError, MAX_RESTART_DEPTH = 3, MAX_TOOL_INPUT_CHARS = 8000, MAX_SCHEMA_CHARS = 6000, MINIMAL_RESTART_PROMPT = "Continue the previous task. Earlier context was discarded due to repeated context-length errors.";
 var init_ai = __esm(() => {
   init_dist4();
   init_structured();
@@ -46460,6 +46469,9 @@ var init_ai = __esm(() => {
   init_utils();
   log = scopedLogger(() => createLogger("ai"));
   RESPONSE_DEBUG = process.env.RESPONSE_DEBUG === "1" || process.env.RESPONSE_DEBUG === "true";
+  REPAIR_FAIL_CLOSED_TOOLS = new Set([
+    "spawn_pentest_agent"
+  ]);
   OPENAI_REASONING_MODEL_IDS = new Set([
     "gpt-5",
     "gpt-5-2025-08-07",
@@ -46505,9 +46517,40 @@ var init_ai = __esm(() => {
   };
 });
 
+// src/core/ai/model-history.ts
+function addRecentModelId(recentModelIds, modelId) {
+  const nextRecentModelIds = [];
+  for (const id of [modelId, ...recentModelIds]) {
+    if (nextRecentModelIds.includes(id))
+      continue;
+    nextRecentModelIds.push(id);
+    if (nextRecentModelIds.length === MAX_RECENT_MODELS)
+      break;
+  }
+  return nextRecentModelIds;
+}
+function getRecentModels(availableModels, recentModelIds) {
+  const modelsById = new Map(availableModels.map((model) => [model.id, model]));
+  const seen = new Set;
+  const recentModels = [];
+  for (const id of recentModelIds) {
+    const model = modelsById.get(id);
+    if (!model || seen.has(id))
+      continue;
+    seen.add(id);
+    recentModels.push(model);
+    if (recentModels.length === MAX_RECENT_MODELS)
+      break;
+  }
+  return recentModels;
+}
+var MAX_RECENT_MODELS = 5;
+var init_model_history = () => {};
+
 // src/core/ai/index.ts
 var init_ai2 = __esm(() => {
   init_ai();
+  init_model_history();
   init_models();
   init_utils();
 });
@@ -47341,7 +47384,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-y45hn0x8.js");
+    const { config: appConfig } = await import("./index-7vdchwsv.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }
@@ -49426,4 +49469,4 @@ var init_utils = __esm(() => {
   STREAMING_FETCH_TIMEOUT_MS = 35 * 60 * 1000;
 });
 
-export { stepCountIs, hasToolCall, init_dist4 as init_dist, AVAILABLE_MODELS, init_models, require_tslib, scopedLogger, init_lazyLogger, buildAuthConfig, init_utils, init_ai2 as init_ai, generateRandomName, generateSessionName, init_name, CredentialManager, init_credentials, schema, descending, newSessionId, newMessageId, newPartId, init_id, RateLimiter, init_rateLimiter, NotFoundError, write2 as write, createDir, writeRaw, read2 as read, update, list, init_storage, ToolsetStateSchema, init_toolset, create2 as create, list2 as list1, normalizeMessages, sessions, init_session, writeErrorLog, routeLogsToErrorFile, init_logger, createLogger, logger, init_structured, getApexTracer, withSubagentSessionBaggage, init_observability, DEFAULT_OPENAI_REASONING_EFFORT, modelSupportsThinking, modelSupportsOpenAIReasoning, getOpenAIReasoningEfforts, streamResponse, generateObjectResponse, init_ai as init_ai1 };
+export { stepCountIs, hasToolCall, init_dist4 as init_dist, addRecentModelId, getRecentModels, init_model_history, AVAILABLE_MODELS, init_models, require_tslib, scopedLogger, init_lazyLogger, buildAuthConfig, init_utils, init_ai2 as init_ai, generateRandomName, generateSessionName, init_name, CredentialManager, init_credentials, schema, descending, newSessionId, newMessageId, newPartId, init_id, RateLimiter, init_rateLimiter, NotFoundError, write2 as write, createDir, writeRaw, read2 as read, update, list, init_storage, ToolsetStateSchema, init_toolset, create2 as create, list2 as list1, getResumeMessages, normalizeMessages, sessions, init_session, writeErrorLog, routeLogsToErrorFile, init_logger, createLogger, logger, init_structured, getApexTracer, withSubagentSessionBaggage, init_observability, DEFAULT_OPENAI_REASONING_EFFORT, modelSupportsThinking, modelSupportsOpenAIReasoning, getOpenAIReasoningEfforts, streamResponse, generateObjectResponse, init_ai as init_ai1 };