@pensar/apex 2.4.0-canary.fbb66e97 → 2.5.0-canary.2bbb0f6f

package/build/agent-20hb6mg7.js

@@ -0,0 +1,20 @@
+import {
+  CodeAgent
+} from "./cli-g3cb8pj5.js";
+import"./cli-9fsre5pt.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
+import"./cli-c8131c4q.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/{agent-4ts7armt.js → agent-71sn1cjn.js}

@@ -1,23 +1,24 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-9w6kmefp.js";
+} from "./cli-4vwnsyep.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-3ezbs9mw.js";
+} from "./cli-gbch9xmy.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-7n5666p8.js";
-import"./cli-vphjaj1e.js";
+} from "./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-mkgfykpq.js";
-import"./cli-x96bafe8.js";
-import"./cli-s5ky796g.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts

package/build/{agent-shhafg9p.js → agent-xnrz4bhp.js}

@@ -5,19 +5,20 @@ import {
   buildPentestPrompt,
   buildPentestSystemPrompt,
   resolvePentestAgentRole
-} from "./cli-n2dv2jxn.js";
+} from "./cli-3ew5fs3f.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ba9a23ap.js";
-import"./cli-9w6kmefp.js";
-import"./cli-3ezbs9mw.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
 import"./cli-c8131c4q.js";
-import"./cli-7n5666p8.js";
-import"./cli-vphjaj1e.js";
-import"./cli-swpbx60z.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-mkgfykpq.js";
-import"./cli-x96bafe8.js";
-import"./cli-s5ky796g.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 export {
   PentestResponseSchema,

package/build/{apps-yfm59wch.js → apps-ghf7kp1s.js}

@@ -1,14 +1,18 @@
 #!/usr/bin/env bun
-import"./cli-sms0a70d.js";
-import"./cli-n8c6cdwe.js";
-import"./cli-wdnf5jvs.js";
-import"./cli-tdm8vj3v.js";
-import"./cli-n2dv2jxn.js";
-import"./cli-s7bkeg8d.js";
-import"./cli-a4vxda8s.js";
-import"./cli-q2pshbky.js";
+import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
+import"./cli-a8n64cef.js";
+import"./cli-9pbk8m32.js";
+import"./cli-7sqb16dd.js";
+import"./cli-fw7sp0fp.js";
+import"./cli-14j00zfh.js";
+import"./cli-3ew5fs3f.js";
+import"./cli-yge44bmk.js";
+import"./cli-4mgj070h.js";
+import"./cli-g3cb8pj5.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ba9a23ap.js";
+import"./cli-a9vq54sx.js";
 import {
   ENDPOINT_TRANSPORTS,
   createApp,
@@ -25,17 +29,18 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-9w6kmefp.js";
-import"./cli-3ezbs9mw.js";
+} from "./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-7n5666p8.js";
-import"./cli-vphjaj1e.js";
-import"./cli-swpbx60z.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-mkgfykpq.js";
-import"./cli-x96bafe8.js";
-import"./cli-s5ky796g.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 
 // src/cli/apps.ts
@@ -329,7 +334,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps get <appId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const app = await getApp(appId);
       console.log(JSON.stringify(app, null, 2));
@@ -342,7 +347,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps update <appId> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseAppUpdateOptions(args);
       const result = await updateApp(appId, opts);
@@ -352,7 +357,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps delete <appId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await deleteApp(appId);
       console.log(JSON.stringify(result, null, 2));
@@ -364,7 +369,7 @@ async function main() {
       if (!url) {
         console.error("Error: domain is required");
         console.error("Usage: pensar apps domain-create <domain>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await createDomain({ url });
       console.log(JSON.stringify(result, null, 2));
@@ -373,7 +378,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps endpoints <appId> [filters]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const type = parseEndpointType(getFlag("--type", args));
       const minRiskScore = parseNumber("--min-risk", getFlag("--min-risk", args));
@@ -392,7 +397,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint <endpointId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await getEndpoint(endpointId);
       console.log(JSON.stringify(result, null, 2));
@@ -401,7 +406,7 @@ async function main() {
       if (!appId) {
         console.error("Error: app ID is required");
         console.error("Usage: pensar apps endpoint-create <appId> --endpoint E --description D");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseEndpointCreateOptions(args);
       const result = await createEndpoint(appId, opts);
@@ -411,7 +416,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint-update <endpointId> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const opts = parseEndpointUpdateOptions(args);
       const result = await updateEndpoint(endpointId, opts);
@@ -421,7 +426,7 @@ async function main() {
       if (!endpointId) {
         console.error("Error: endpoint ID is required");
         console.error("Usage: pensar apps endpoint-delete <endpointId>");
-        process.exit(1);
+        return markCommandFailed();
       }
       const result = await deleteEndpoint(endpointId);
       console.log(JSON.stringify(result, null, 2));
@@ -430,7 +435,7 @@ async function main() {
       if (!query || query.startsWith("--")) {
         console.error("Error: search query is required");
         console.error("Usage: pensar apps search <query> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const type = parseAppType(getFlag("--type", args));
       const limit = parseInteger("--limit", getFlag("--limit", args));
@@ -446,7 +451,7 @@ async function main() {
       if (!query || query.startsWith("--")) {
         console.error("Error: search query is required");
         console.error("Usage: pensar apps search-endpoints <query> [options]");
-        process.exit(1);
+        return markCommandFailed();
       }
       const applicationId = getFlag("--app", args);
       const type = parseEndpointType(getFlag("--type", args));
@@ -474,12 +479,12 @@ async function main() {
     } else {
       console.error(`Error: Unknown subcommand "${sub}"`);
       showHelp();
-      process.exit(1);
+      return markCommandFailed();
     }
   } catch (err) {
     console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
 }
-main();
+await main();

package/build/{auth-1dct9tqf.js → auth-p1nrv7re.js}

@@ -1,19 +1,23 @@
 #!/usr/bin/env bun
-import"./cli-sms0a70d.js";
-import"./cli-n8c6cdwe.js";
-import"./cli-wdnf5jvs.js";
-import"./cli-tdm8vj3v.js";
-import"./cli-n2dv2jxn.js";
-import"./cli-s7bkeg8d.js";
-import"./cli-a4vxda8s.js";
-import"./cli-q2pshbky.js";
+import {
+  markCommandFailed
+} from "./cli-7q3ae3ft.js";
+import"./cli-a8n64cef.js";
+import"./cli-9pbk8m32.js";
+import"./cli-7sqb16dd.js";
+import"./cli-fw7sp0fp.js";
+import"./cli-14j00zfh.js";
+import"./cli-3ew5fs3f.js";
+import"./cli-yge44bmk.js";
+import"./cli-4mgj070h.js";
+import"./cli-g3cb8pj5.js";
 import"./cli-9fsre5pt.js";
-import"./cli-ba9a23ap.js";
-import"./cli-9w6kmefp.js";
-import"./cli-3ezbs9mw.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-7n5666p8.js";
+import"./cli-f47dgye3.js";
 import {
   createWorkspaceSelection,
   disconnect,
@@ -29,15 +33,16 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-vphjaj1e.js";
-import"./cli-swpbx60z.js";
+} from "./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-mkgfykpq.js";
-import"./cli-x96bafe8.js";
-import"./cli-s5ky796g.js";
+} from "./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -300,12 +305,12 @@ async function main() {
     } else {
       console.error(`Unknown auth subcommand: ${subcommand}`);
       console.error("Run 'pensar login --help' for usage information");
-      process.exit(1);
+      return markCommandFailed();
     }
   } catch (err) {
     console.error(`
 Error: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
+    return markCommandFailed();
   }
 }
-main();
+await main();

package/build/authentication-m1vj2f0s.js

@@ -0,0 +1,20 @@
+import {
+  runAuthenticationAgent
+} from "./cli-4mgj070h.js";
+import"./cli-9fsre5pt.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
+import"./cli-c8131c4q.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-hjfzgk93.js

@@ -0,0 +1,20 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-14j00zfh.js";
+import"./cli-9fsre5pt.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
+import"./cli-c8131c4q.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/blackboxPentest-9snp9gvp.js

@@ -0,0 +1,70 @@
+import {
+  EMPTY_SESSION_TOKEN_USAGE,
+  accumulateSessionTokens
+} from "./cli-9pbk8m32.js";
+import {
+  readExecutionMetrics,
+  runPentestWorkflow,
+  writeExecutionMetrics
+} from "./cli-7sqb16dd.js";
+import"./cli-fw7sp0fp.js";
+import"./cli-14j00zfh.js";
+import"./cli-3ew5fs3f.js";
+import"./cli-yge44bmk.js";
+import"./cli-g3cb8pj5.js";
+import"./cli-9fsre5pt.js";
+import"./cli-a9vq54sx.js";
+import"./cli-4vwnsyep.js";
+import"./cli-gbch9xmy.js";
+import"./cli-fw5r7pfj.js";
+import"./cli-c8131c4q.js";
+import"./cli-f47dgye3.js";
+import"./cli-08fcc6d8.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-9ya3yktn.js";
+import"./cli-8pk8znhw.js";
+import"./cli-3bmqdcfh.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+
+// src/core/api/blackboxPentest.ts
+async function runPentestAgent(input) {
+  const persisted = readExecutionMetrics(input.session.rootPath)?.tokenUsage;
+  let tokenUsage = persisted ?? EMPTY_SESSION_TOKEN_USAGE;
+  const onStepFinish = async (event) => {
+    tokenUsage = accumulateSessionTokens(tokenUsage, event.usage ?? {});
+    await input.onStepFinish?.(event);
+  };
+  const onCacheMetrics = (metrics) => {
+    tokenUsage = accumulateSessionTokens(tokenUsage, {
+      cacheReadTokens: metrics.cacheReadInputTokens,
+      cacheWriteTokens: metrics.cacheCreationInputTokens
+    });
+    input.onCacheMetrics?.(metrics);
+  };
+  let result;
+  try {
+    result = await runPentestWorkflow({
+      ...input,
+      onStepFinish,
+      onCacheMetrics
+    });
+  } finally {
+    writeExecutionMetrics({
+      sessionRootPath: input.session.rootPath,
+      tokenUsage
+    });
+  }
+  const { findings, findingsPath, pocsPath, reportPath } = result;
+  console.log(`
+Found ${findings.length} vulnerabilities`);
+  console.log(`Findings: ${findingsPath}`);
+  console.log(`POCs: ${pocsPath}`);
+  if (reportPath)
+    console.log(`Report: ${reportPath}`);
+  return { findings, findingsPath, pocsPath, reportPath };
+}
+export {
+  runPentestAgent
+};

package/build/{cli-vphjaj1e.js → cli-08fcc6d8.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-mkgfykpq.js";
+} from "./cli-9ya3yktn.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-wdnf5jvs.js → cli-14j00zfh.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-9w6kmefp.js";
+} from "./cli-4vwnsyep.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-3ezbs9mw.js";
+} from "./cli-gbch9xmy.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-7n5666p8.js";
+} from "./cli-f47dgye3.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -438,6 +438,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -483,6 +484,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
+When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.

package/build/{cli-s5ky796g.js → cli-3bmqdcfh.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-bc05qbss.js";
 
 // package.json
-var package_default;
+var version = "2.5.0-canary.2bbb0f6f", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",
@@ -23,6 +23,10 @@ var init_package = __esm(() => {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "@openrouter/ai-sdk-provider": "^2.9.1",
       "@opentelemetry/api": "^1.9.1",
+      "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+      "@opentelemetry/otlp-exporter-base": "^0.221.0",
+      "@opentelemetry/otlp-transformer": "^0.221.0",
+      "@opentelemetry/resources": "^2.10.0",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.3.0",
@@ -46,6 +50,8 @@ var init_package = __esm(() => {
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
+      "@opentelemetry/context-async-hooks": "^2.10.0",
+      "@opentelemetry/sdk-trace-base": "^2.10.0",
       "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
@@ -120,7 +126,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.4.0-canary.fbb66e97"
+    version
   };
 });
 
@@ -195,4 +201,4 @@ var init_installation = __esm(() => {
   init_package();
 });
 
-export { init_package, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
+export { init_package, version, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };