@pensar/apex 2.4.0 → 2.5.0-canary.0af37eb0

package/build/cli.js

@@ -1,33 +1,369 @@
 #!/usr/bin/env bun
 // @bun
-import"./cli-dm0fc0bm.js";
+import"./cli-wpmm960k.js";
 import {
-  createThreatModelPrompt
-} from "./cli-fw5r7pfj.js";
-import"./cli-c8131c4q.js";
-import {
-  buildAuthConfig,
-  init_ai1 as init_ai,
+  endAllActiveRootSpans,
+  init_active_root_spans,
+  init_model_history,
   init_models,
+  buildAuthConfig,
+  init_utils,
   init_session,
+  createLogger,
+  logger,
   init_structured,
-  init_toolset,
-  init_utils,
-  logger
-} from "./cli-tkc598ey.js";
-import"./cli-0n4r54hq.js";
-import"./cli-swpbx60z.js";
-import"./cli-j54qa6tm.js";
-import"./cli-72cvcqhg.js";
-import"./cli-9rhzhgx2.js";
+  init_ai2
+} from "./cli-q8pr0zqg.js";
+import {
+  require_src,
+  require_src2,
+  require_src3,
+  require_src4,
+  require_index_node_http,
+  require_src5,
+  require_index_shim,
+  ActiveSpanProcessor
+} from "./cli-4ptm7wgt.js";
+import {
+  createThreatModelPrompt
+} from "./cli-q126f6ef.js";
+import"./cli-qktcyj48.js";
 import {
   init_package,
-  package_default
-} from "./cli-vnynf0js.js";
+  version,
+  package_default,
+  init_installation
+} from "./cli-k8hgxz61.js";
+import {
+  require_src6
+} from "./cli-bb02pjt0.js";
 import {
-  __require,
-  __toESM
-} from "./cli-bc05qbss.js";
+  __toESM,
+  __commonJS,
+  __require
+} from "./cli-h6y3bt60.js";
+
+// node_modules/dotenv/lib/main.js
+var require_main = __commonJS(function(exports, module) {
+  var fs = __require("fs");
+  var path = __require("path");
+  var os = __require("os");
+  var crypto = __require("crypto");
+  var TIPS = [
+    "◈ encrypted .env [www.dotenvx.com]",
+    "◈ secrets for agents [www.dotenvx.com]",
+    "⌁ auth for agents [www.vestauth.com]",
+    "⌘ custom filepath { path: '/custom/path/.env' }",
+    "⌘ enable debugging { debug: true }",
+    "⌘ override existing { override: true }",
+    "⌘ suppress logs { quiet: true }",
+    "⌘ multiple files { path: ['.env.local', '.env'] }"
+  ];
+  function _getRandomTip() {
+    return TIPS[Math.floor(Math.random() * TIPS.length)];
+  }
+  function parseBoolean(value) {
+    if (typeof value === "string") {
+      return !["false", "0", "no", "off", ""].includes(value.toLowerCase());
+    }
+    return Boolean(value);
+  }
+  function supportsAnsi() {
+    return process.stdout.isTTY;
+  }
+  function dim(text) {
+    return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;
+  }
+  var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|[^"])*"|\s*`(?:\\`|[^`])*`|[^#\r\n]+)?\s*(?:#.*)?(?:$|$)/mg;
+  function parse(src) {
+    const obj = {};
+    let lines = src.toString();
+    lines = lines.replace(/\r\n?/mg, `
+`);
+    let match;
+    while ((match = LINE.exec(lines)) != null) {
+      const key = match[1];
+      let value = match[2] || "";
+      value = value.trim();
+      const maybeQuote = value[0];
+      value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");
+      if (maybeQuote === '"') {
+        value = value.replace(/\\n/g, `
+`);
+        value = value.replace(/\\r/g, "\r");
+      }
+      obj[key] = value;
+    }
+    return obj;
+  }
+  function _parseVault(options) {
+    options = options || {};
+    const vaultPath = _vaultPath(options);
+    options.path = vaultPath;
+    const result = DotenvModule.configDotenv(options);
+    if (!result.parsed) {
+      const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
+      err.code = "MISSING_DATA";
+      throw err;
+    }
+    const keys = _dotenvKey(options).split(",");
+    const length = keys.length;
+    let decrypted;
+    for (let i = 0;i < length; i++) {
+      try {
+        const key = keys[i].trim();
+        const attrs = _instructions(result, key);
+        decrypted = DotenvModule.decrypt(attrs.ciphertext, attrs.key);
+        break;
+      } catch (error) {
+        if (i + 1 >= length) {
+          throw error;
+        }
+      }
+    }
+    return DotenvModule.parse(decrypted);
+  }
+  function _warn(message) {
+    console.error(`⚠ ${message}`);
+  }
+  function _debug(message) {
+    console.log(`┆ ${message}`);
+  }
+  function _log(message) {
+    console.log(`◇ ${message}`);
+  }
+  function _dotenvKey(options) {
+    if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
+      return options.DOTENV_KEY;
+    }
+    if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) {
+      return process.env.DOTENV_KEY;
+    }
+    return "";
+  }
+  function _instructions(result, dotenvKey) {
+    let uri;
+    try {
+      uri = new URL(dotenvKey);
+    } catch (error) {
+      if (error.code === "ERR_INVALID_URL") {
+        const err = new Error("INVALID_DOTENV_KEY: Wrong format. Must be in valid uri format like dotenv://:key_1234@dotenvx.com/vault/.env.vault?environment=development");
+        err.code = "INVALID_DOTENV_KEY";
+        throw err;
+      }
+      throw error;
+    }
+    const key = uri.password;
+    if (!key) {
+      const err = new Error("INVALID_DOTENV_KEY: Missing key part");
+      err.code = "INVALID_DOTENV_KEY";
+      throw err;
+    }
+    const environment = uri.searchParams.get("environment");
+    if (!environment) {
+      const err = new Error("INVALID_DOTENV_KEY: Missing environment part");
+      err.code = "INVALID_DOTENV_KEY";
+      throw err;
+    }
+    const environmentKey = `DOTENV_VAULT_${environment.toUpperCase()}`;
+    const ciphertext = result.parsed[environmentKey];
+    if (!ciphertext) {
+      const err = new Error(`NOT_FOUND_DOTENV_ENVIRONMENT: Cannot locate environment ${environmentKey} in your .env.vault file.`);
+      err.code = "NOT_FOUND_DOTENV_ENVIRONMENT";
+      throw err;
+    }
+    return { ciphertext, key };
+  }
+  function _vaultPath(options) {
+    let possibleVaultPath = null;
+    if (options && options.path && options.path.length > 0) {
+      if (Array.isArray(options.path)) {
+        for (const filepath of options.path) {
+          if (fs.existsSync(filepath)) {
+            possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
+          }
+        }
+      } else {
+        possibleVaultPath = options.path.endsWith(".vault") ? options.path : `${options.path}.vault`;
+      }
+    } else {
+      possibleVaultPath = path.resolve(process.cwd(), ".env.vault");
+    }
+    if (fs.existsSync(possibleVaultPath)) {
+      return possibleVaultPath;
+    }
+    return null;
+  }
+  function _resolveHome(envPath) {
+    return envPath[0] === "~" ? path.join(os.homedir(), envPath.slice(1)) : envPath;
+  }
+  function _configVault(options) {
+    const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
+    const quiet = parseBoolean(process.env.DOTENV_CONFIG_QUIET || options && options.quiet);
+    if (debug || !quiet) {
+      _log("loading env from encrypted .env.vault");
+    }
+    const parsed = DotenvModule._parseVault(options);
+    let processEnv = process.env;
+    if (options && options.processEnv != null) {
+      processEnv = options.processEnv;
+    }
+    DotenvModule.populate(processEnv, parsed, options);
+    return { parsed };
+  }
+  function configDotenv(options) {
+    const dotenvPath = path.resolve(process.cwd(), ".env");
+    let encoding = "utf8";
+    let processEnv = process.env;
+    if (options && options.processEnv != null) {
+      processEnv = options.processEnv;
+    }
+    let debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || options && options.debug);
+    let quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || options && options.quiet);
+    if (options && options.encoding) {
+      encoding = options.encoding;
+    } else {
+      if (debug) {
+        _debug("no encoding is specified (UTF-8 is used by default)");
+      }
+    }
+    let optionPaths = [dotenvPath];
+    if (options && options.path) {
+      if (!Array.isArray(options.path)) {
+        optionPaths = [_resolveHome(options.path)];
+      } else {
+        optionPaths = [];
+        for (const filepath of options.path) {
+          optionPaths.push(_resolveHome(filepath));
+        }
+      }
+    }
+    let lastError;
+    const parsedAll = {};
+    for (const path of optionPaths) {
+      try {
+        const parsed = DotenvModule.parse(fs.readFileSync(path, { encoding }));
+        DotenvModule.populate(parsedAll, parsed, options);
+      } catch (e) {
+        if (debug) {
+          _debug(`failed to load ${path} ${e.message}`);
+        }
+        lastError = e;
+      }
+    }
+    const populated = DotenvModule.populate(processEnv, parsedAll, options);
+    debug = parseBoolean(processEnv.DOTENV_CONFIG_DEBUG || debug);
+    quiet = parseBoolean(processEnv.DOTENV_CONFIG_QUIET || quiet);
+    if (debug || !quiet) {
+      const keysCount = Object.keys(populated).length;
+      const shortPaths = [];
+      for (const filePath of optionPaths) {
+        try {
+          const relative2 = path.relative(process.cwd(), filePath);
+          shortPaths.push(relative2);
+        } catch (e) {
+          if (debug) {
+            _debug(`failed to load ${filePath} ${e.message}`);
+          }
+          lastError = e;
+        }
+      }
+      _log(`injected env (${keysCount}) from ${shortPaths.join(",")} ${dim(`// tip: ${_getRandomTip()}`)}`);
+    }
+    if (lastError) {
+      return { parsed: parsedAll, error: lastError };
+    } else {
+      return { parsed: parsedAll };
+    }
+  }
+  function config(options) {
+    if (_dotenvKey(options).length === 0) {
+      return DotenvModule.configDotenv(options);
+    }
+    const vaultPath = _vaultPath(options);
+    if (!vaultPath) {
+      _warn(`you set DOTENV_KEY but you are missing a .env.vault file at ${vaultPath}`);
+      return DotenvModule.configDotenv(options);
+    }
+    return DotenvModule._configVault(options);
+  }
+  function decrypt(encrypted, keyStr) {
+    const key = Buffer.from(keyStr.slice(-64), "hex");
+    let ciphertext = Buffer.from(encrypted, "base64");
+    const nonce = ciphertext.subarray(0, 12);
+    const authTag = ciphertext.subarray(-16);
+    ciphertext = ciphertext.subarray(12, -16);
+    try {
+      const aesgcm = crypto.createDecipheriv("aes-256-gcm", key, nonce);
+      aesgcm.setAuthTag(authTag);
+      return `${aesgcm.update(ciphertext)}${aesgcm.final()}`;
+    } catch (error) {
+      const isRange = error instanceof RangeError;
+      const invalidKeyLength = error.message === "Invalid key length";
+      const decryptionFailed = error.message === "Unsupported state or unable to authenticate data";
+      if (isRange || invalidKeyLength) {
+        const err = new Error("INVALID_DOTENV_KEY: It must be 64 characters long (or more)");
+        err.code = "INVALID_DOTENV_KEY";
+        throw err;
+      } else if (decryptionFailed) {
+        const err = new Error("DECRYPTION_FAILED: Please check your DOTENV_KEY");
+        err.code = "DECRYPTION_FAILED";
+        throw err;
+      } else {
+        throw error;
+      }
+    }
+  }
+  function populate(processEnv, parsed, options = {}) {
+    const debug = Boolean(options && options.debug);
+    const override = Boolean(options && options.override);
+    const populated = {};
+    if (typeof parsed !== "object") {
+      const err = new Error("OBJECT_REQUIRED: Please check the processEnv argument being passed to populate");
+      err.code = "OBJECT_REQUIRED";
+      throw err;
+    }
+    for (const key of Object.keys(parsed)) {
+      if (Object.prototype.hasOwnProperty.call(processEnv, key)) {
+        if (override === true) {
+          processEnv[key] = parsed[key];
+          populated[key] = parsed[key];
+        }
+        if (debug) {
+          if (override === true) {
+            _debug(`"${key}" is already defined and WAS overwritten`);
+          } else {
+            _debug(`"${key}" is already defined and was NOT overwritten`);
+          }
+        }
+      } else {
+        processEnv[key] = parsed[key];
+        populated[key] = parsed[key];
+      }
+    }
+    return populated;
+  }
+  var DotenvModule = {
+    configDotenv,
+    _configVault,
+    _parseVault,
+    config,
+    decrypt,
+    parse,
+    populate
+  };
+  module.exports.configDotenv = DotenvModule.configDotenv;
+  module.exports._configVault = DotenvModule._configVault;
+  module.exports._parseVault = DotenvModule._parseVault;
+  module.exports.config = DotenvModule.config;
+  module.exports.decrypt = DotenvModule.decrypt;
+  module.exports.parse = DotenvModule.parse;
+  module.exports.populate = DotenvModule.populate;
+  module.exports = DotenvModule;
+});
+
+// src/cli.ts
+var import_dotenv = __toESM(require_main(), 1);
 // package.json
 var package_default2 = {
   author: "Pensar",
@@ -47,6 +383,10 @@ var package_default2 = {
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@openrouter/ai-sdk-provider": "^2.9.1",
     "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+    "@opentelemetry/otlp-exporter-base": "^0.221.0",
+    "@opentelemetry/otlp-transformer": "^0.221.0",
+    "@opentelemetry/resources": "^2.10.0",
     "@opentui/core": "^0.1.107",
     "@opentui/react": "^0.1.107",
     "@pensar/surface": "0.3.0",
@@ -70,6 +410,8 @@ var package_default2 = {
   description: "AI-powered penetration testing CLI tool with terminal UI",
   devDependencies: {
     "@biomejs/biome": "2.4.14",
+    "@opentelemetry/context-async-hooks": "^2.10.0",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@types/bun": "^1.3.14",
     "@types/mailparser": "^3.4.6",
     "@types/mime-types": "^3.0.1",
@@ -116,7 +458,7 @@ var package_default2 = {
     url: "https://github.com/pensarai/apex.git"
   },
   scripts: {
-    build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
+    build: "rm -rf build && bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
     "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
     "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
     "build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
@@ -144,14 +486,29 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.4.0"
+  version: "2.5.0-canary.0af37eb0"
 };
 
 // src/core/ai/index.ts
-init_ai();
+init_ai2();
+init_model_history();
 init_models();
 init_utils();
 
+// src/core/api/clientIdentity.ts
+init_installation();
+var currentCommand;
+function setCurrentCommand(command) {
+  currentCommand = normalizeCommand(command);
+}
+var COMMAND_SHAPE = /^[a-z][a-z0-9-]{0,31}$/;
+function normalizeCommand(command) {
+  if (!command)
+    return;
+  const trimmed = command.trim().toLowerCase();
+  return COMMAND_SHAPE.test(trimmed) ? trimmed : undefined;
+}
+
 // src/core/cli/logLevelArgs.ts
 var VALID_LOG_LEVELS = new Set([
   "DEBUG",
@@ -266,12 +623,12 @@ class AgentEventBus {
         const p = payload;
         const isLifecycle = forwardKey === "subagent-spawn" || forwardKey === "subagent-complete";
         if (isLifecycle) {
-          const next2 = { ...p };
+          const next = { ...p };
           if (!p.parentSubagentId)
-            next2.parentSubagentId = childSessionId;
+            next.parentSubagentId = childSessionId;
           if (!p.parentSessionId)
-            next2.parentSessionId = childSessionId;
-          parent.emit(forwardKey, next2);
+            next.parentSessionId = childSessionId;
+          parent.emit(forwardKey, next);
           return;
         }
         const next = { ...p };
@@ -371,7 +728,7 @@ class AgentEventBus {
 // src/core/installation/index.ts
 init_package();
 import { spawnSync } from "node:child_process";
-function getCurrentVersion() {
+function getCurrentVersion2() {
   return package_default.version;
 }
 function isNewerVersion(current, latest) {
@@ -436,7 +793,7 @@ function getUpgradeCommandString(method) {
   return `${cmd} ${args.join(" ")}`;
 }
 function runUpgrade(method, options) {
-  const currentVersion = getCurrentVersion();
+  const currentVersion = getCurrentVersion2();
   const { cmd, args } = getUpgradeCommand(method);
   const interactive = options?.interactive ?? false;
   const result = spawnSync(cmd, args, {
@@ -461,7 +818,7 @@ function runUpgrade(method, options) {
   };
 }
 async function upgrade(options) {
-  const currentVersion = getCurrentVersion();
+  const currentVersion = getCurrentVersion2();
   let latestVersion;
   try {
     latestVersion = await getLatestVersion();
@@ -508,10 +865,203 @@ import os from "node:os";
 import path from "node:path";
 var ERROR_LOG_PATH = path.join(os.homedir(), ".pensar", "error.log");
 
+// src/core/observability/runtime.ts
+init_package();
+init_structured();
+init_active_root_spans();
+var import_api = __toESM(require_src6(), 1);
+var import_context_async_hooks = __toESM(require_src(), 1);
+var import_exporter_trace_otlp_http = __toESM(require_src5(), 1);
+var import_otlp_exporter_base = __toESM(require_src2(), 1);
+var import_node_http = __toESM(require_index_node_http(), 1);
+var import_otlp_transformer = __toESM(require_src4(), 1);
+var import_resources = __toESM(require_src3(), 1);
+var import_sdk_trace_base = __toESM(require_index_shim(), 1);
+import { randomUUID } from "node:crypto";
+var DEFAULT_SHUTDOWN_TIMEOUT_MS = 5000;
+function withTimeout(promise, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (result) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = setTimeout(() => settle("timed-out"), timeoutMs);
+    promise.then(() => settle("completed"), () => settle("completed"));
+  });
+}
+var log = createLogger("observability");
+var NOOP_RUNTIME = {
+  async forceFlush() {},
+  async shutdown() {
+    return "completed";
+  }
+};
+function isOtelSdkDisabled(env) {
+  return env.OTEL_SDK_DISABLED === "true";
+}
+function resolveTracesEndpoint(env) {
+  const specific = env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT?.trim();
+  if (specific)
+    return specific;
+  const generic = env.OTEL_EXPORTER_OTLP_ENDPOINT?.trim();
+  if (!generic)
+    return null;
+  return `${generic.endsWith("/") ? generic : `${generic}/`}v1/traces`;
+}
+function resolveTracesProtocol(env) {
+  const raw = (env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL ?? env.OTEL_EXPORTER_OTLP_PROTOCOL ?? "").trim();
+  return raw === "http/protobuf" ? "http/protobuf" : "http/json";
+}
+function parseResourceAttributes(env) {
+  const raw = env.OTEL_RESOURCE_ATTRIBUTES;
+  if (!raw)
+    return {};
+  const attrs = {};
+  for (const pair of raw.split(",")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0)
+      continue;
+    const key = pair.slice(0, eq).trim();
+    const value = pair.slice(eq + 1).trim();
+    if (key && value)
+      attrs[key] = value;
+  }
+  return attrs;
+}
+function buildResource(env) {
+  const resourceAttributes = parseResourceAttributes(env);
+  return import_resources.resourceFromAttributes({
+    "service.version": version,
+    "service.instance.id": randomUUID(),
+    ...resourceAttributes,
+    "service.name": env.OTEL_SERVICE_NAME?.trim() || resourceAttributes["service.name"] || "apex"
+  });
+}
+function createTraceExporter(protocol) {
+  if (protocol === "http/json") {
+    return new import_exporter_trace_otlp_http.OTLPTraceExporter;
+  }
+  return new import_otlp_exporter_base.OTLPExporterBase(import_node_http.createOtlpHttpExportDelegate(import_node_http.convertLegacyHttpOptions({}, "TRACES", "v1/traces", {
+    "Content-Type": "application/x-protobuf"
+  }), import_otlp_transformer.ProtobufTraceSerializer, "otlp_http_span_exporter", import_otlp_transformer.TraceExporterMetricsHelper, undefined));
+}
+var activeRuntime = null;
+function startObservabilityRuntime(env = process.env, opts) {
+  if (activeRuntime)
+    return activeRuntime;
+  if (isOtelSdkDisabled(env))
+    return NOOP_RUNTIME;
+  if (!resolveTracesEndpoint(env))
+    return NOOP_RUNTIME;
+  const shutdownTimeoutMs = opts?.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
+  const exporter = createTraceExporter(resolveTracesProtocol(env));
+  const activeSpans = new ActiveSpanProcessor;
+  const provider = new import_sdk_trace_base.BasicTracerProvider({
+    resource: buildResource(env),
+    spanProcessors: [
+      activeSpans,
+      ...opts?.spanProcessors ?? [new import_sdk_trace_base.BatchSpanProcessor(exporter)]
+    ]
+  });
+  const contextManager = new import_context_async_hooks.AsyncLocalStorageContextManager;
+  contextManager.enable();
+  const ownsTracerGlobal = import_api.trace.setGlobalTracerProvider(provider);
+  if (!ownsTracerGlobal) {
+    log.warn("OTel tracer provider already registered by the host — Apex stays embedded and will not register its own");
+    contextManager.disable();
+    provider.shutdown().catch((error) => log.warn("Orphaned provider shutdown failed", { error: String(error) }));
+    return NOOP_RUNTIME;
+  }
+  const ownsContextGlobal = import_api.context.setGlobalContextManager(contextManager);
+  if (!ownsContextGlobal) {
+    log.warn("OTel context manager already registered by the host — Apex reuses it and will not disable it");
+  }
+  let shutdownPromise = null;
+  const runtime = {
+    async forceFlush() {
+      await provider.forceFlush();
+    },
+    shutdown() {
+      if (!shutdownPromise) {
+        const shutdownWork = async () => {
+          activeSpans.endAll();
+          endAllActiveRootSpans();
+          try {
+            await provider.forceFlush();
+          } finally {
+            activeSpans.endAll();
+            await provider.shutdown().catch((error) => {
+              log.warn("OTLP export/shutdown failed", { error: String(error) });
+            });
+          }
+        };
+        shutdownPromise = withTimeout(shutdownWork(), shutdownTimeoutMs).then((result) => {
+          contextManager.disable();
+          if (ownsContextGlobal) {
+            import_api.context.disable();
+          }
+          import_api.trace.disable();
+          return result;
+        }).finally(() => {
+          activeRuntime = null;
+        });
+      }
+      return shutdownPromise;
+    }
+  };
+  activeRuntime = runtime;
+  return runtime;
+}
+function installObservabilityExitHandlers(runtime, opts) {
+  let exitPromise = null;
+  let exitCode = 0;
+  let fatalSeen = false;
+  const reportError = (error, source) => {
+    try {
+      opts?.onError?.(error, source);
+    } catch {}
+  };
+  const exitWith = (code, error, source) => {
+    let pendingReport = null;
+    if (error !== undefined && !fatalSeen) {
+      fatalSeen = true;
+      exitCode = 1;
+      const fatalSource = source ?? "uncaughtException";
+      pendingReport = () => reportError(error, fatalSource);
+    } else if (!fatalSeen && exitCode === 0) {
+      exitCode = code;
+    }
+    if (exitPromise) {
+      pendingReport?.();
+      return exitPromise;
+    }
+    try {
+      opts?.cleanup?.(code);
+    } catch (cleanupError) {
+      if (!fatalSeen) {
+        fatalSeen = true;
+        exitCode = 1;
+        pendingReport = () => reportError(cleanupError, "uncaughtException");
+      }
+    }
+    pendingReport?.();
+    exitPromise = runtime.shutdown().catch(() => {}).then(() => process.exit(exitCode));
+    return exitPromise;
+  };
+  process.on("SIGINT", () => void exitWith(130));
+  process.on("SIGTERM", () => void exitWith(143));
+  process.on("uncaughtException", (error) => void exitWith(1, error, "uncaughtException"));
+  process.on("unhandledRejection", (reason) => void exitWith(1, reason, "unhandledRejection"));
+  return exitWith;
+}
+
 // src/tui/utils/command-flags.ts
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
-init_toolset();
 function combinePromptParts(threatModel, prompt) {
   const parts = [];
   if (threatModel)
@@ -537,7 +1087,8 @@ function resolveThreatModelPrompt(value) {
 
 // src/cli.ts
 var args = process.argv.slice(2);
-var version = package_default2.version;
+var version2 = package_default2.version;
+import_dotenv.config();
 var OBFUSCATE_FLAGS = new Set(["--obfuscate", "--redact", "-O"]);
 var obfuscateRequested = args.some((a) => OBFUSCATE_FLAGS.has(a));
 if (obfuscateRequested) {
@@ -592,7 +1143,7 @@ function attachCliAgentStreamListeners(bus) {
 async function createInstrumentedBus(session) {
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-7wdyyqmr.js");
+  const { attachWandbToEventBus } = await import("./upload-twg8pvy7.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -606,10 +1157,10 @@ async function resolveCliHeaders() {
   if (headerArgs.length === 0 && !headersFromArg && !noGlobal) {
     return;
   }
-  const { parseHeaderLine: parseHeaderLine2, parseHeadersFromFile, formatParseError: formatParseError2 } = await import("./parse-rtccymzn.js");
+  const { parseHeaderLine, parseHeadersFromFile, formatParseError } = await import("./parse-cqecqrc5.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-y5w6n3tb.js");
+    const { config: appConfig } = await import("./index-rjmmakbh.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -620,7 +1171,7 @@ async function resolveCliHeaders() {
     if (!parsed.ok) {
       for (const err of parsed.error) {
         console.error(`--headers-from error:
-${formatParseError2(err)}`);
+${formatParseError(err)}`);
       }
       process.exit(1);
     }
@@ -629,10 +1180,10 @@ ${formatParseError2(err)}`);
     }
   }
   for (const arg of headerArgs) {
-    const parsed = parseHeaderLine2(arg);
+    const parsed = parseHeaderLine(arg);
     if (!parsed.ok) {
       console.error(`--header "${arg}" rejected:
-${formatParseError2(parsed.error)}`);
+${formatParseError(parsed.error)}`);
       process.exit(1);
     }
     merged[parsed.value.name] = parsed.value.value;
@@ -643,8 +1194,8 @@ async function resolveCliModel() {
   const explicit = getArg("--model");
   if (explicit)
     return explicit;
-  const { config: appConfig } = await import("./index-y5w6n3tb.js");
-  const { getDefaultModelForConfig } = await import("./utils-7fwdkqk6.js");
+  const { config: appConfig } = await import("./index-rjmmakbh.js");
+  const { getDefaultModelForConfig } = await import("./utils-cnv9jj0h.js");
   const pensarConfig = await appConfig.get();
   const defaultModel = getDefaultModelForConfig(pensarConfig);
   if (!defaultModel) {
@@ -731,11 +1282,9 @@ Global options:
 `);
 }
 async function runPentest() {
-  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
-  config();
-  const { runPentestAgent } = await import("./blackboxPentest-44333zss.js");
-  const { sessions: sessions2 } = await import("./index-sf16jm0m.js");
-  const { config: appConfig } = await import("./index-y5w6n3tb.js");
+  const { runPentestAgent } = await import("./blackboxPentest-bf7b9m36.js");
+  const { sessions } = await import("./index-3dpcjj6e.js");
+  const { config: appConfig } = await import("./index-rjmmakbh.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -770,7 +1319,7 @@ Task-driven: enabled` : ""}${fastStrike ? `
 Fast strike: enabled` : ""}${headers ? `
 Headers: ${Object.keys(headers).length} configured` : ""}
 `);
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
     targets: [target],
     config: {
@@ -806,14 +1355,11 @@ Report:    ${reportPath}` : ""}`);
   } finally {
     await wandbCleanup();
   }
-  process.exit(0);
 }
 async function runTargetedPentest() {
-  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
-  config();
-  const { runTargetedPentestAgent } = await import("./targetedPentest-s1ptvq8e.js");
-  const { sessions: sessions2 } = await import("./index-sf16jm0m.js");
-  const { config: appConfig } = await import("./index-y5w6n3tb.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-34zhke7a.js");
+  const { sessions } = await import("./index-3dpcjj6e.js");
+  const { config: appConfig } = await import("./index-rjmmakbh.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const pensarConfig = await appConfig.get();
@@ -834,7 +1380,7 @@ Objectives:
 ${objectivesList}
 `);
   const headers = await resolveCliHeaders();
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: "Targeted Pentest",
     targets: [target],
     ...headers !== undefined ? { config: { headers } } : {}
@@ -860,18 +1406,15 @@ POCs:      ${pocsPath}`);
   } finally {
     await wandbCleanup();
   }
-  process.exit(0);
 }
 async function runThreatModel() {
-  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
-  config();
-  const { runThreatModelWorkflow } = await import("./threatModel-xsm6fwk5.js");
-  const { config: appConfig } = await import("./index-y5w6n3tb.js");
-  const path2 = await import("path");
+  const { runThreatModelWorkflow } = await import("./threatModel-r96hed1d.js");
+  const { config: appConfig } = await import("./index-rjmmakbh.js");
+  const path = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
   const outputArg = getArg("--output") ?? getArg("-o") ?? "threat-model.md";
-  const resolvedPath = path2.isAbsolute(outputArg) ? outputArg : path2.resolve(process.cwd(), outputArg);
+  const resolvedPath = path.isAbsolute(outputArg) ? outputArg : path.resolve(process.cwd(), outputArg);
   const sep = "=".repeat(60);
   console.log(`${sep}
 THREAT MODEL GENERATION
@@ -900,16 +1443,14 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { config } = await import("./main-mmjp338j.js").then((m)=>__toESM(m.default,1));
-  config();
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-b9e2xm6v.js");
-  const { sessions: sessions2, normalizeMessages, getResumeMessages } = await import("./index-sf16jm0m.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-hqjdg6fg.js");
-  const { config: appConfig } = await import("./index-y5w6n3tb.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-jwnbnsqm.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-3dpcjj6e.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-k1mb1edx.js");
+  const { config: appConfig } = await import("./index-rjmmakbh.js");
   const { createInterface } = await import("readline");
-  const { readFileSync: readFileSync2, existsSync } = await import("fs");
-  const path2 = await import("path");
-  const { stepCountIs } = await import("./index-mtq7kmxz.js");
+  const { readFileSync, existsSync } = await import("fs");
+  const path = await import("path");
+  const { stepCountIs } = await import("./index-a1bg29j1.js");
   const promptRaw = getArg("-p") ?? getArg("--prompt");
   if (!promptRaw) {
     console.error("Error: -p <prompt> is required");
@@ -930,7 +1471,7 @@ Target:  ${target}` : ""}
 ${sep}
 `);
   const headers = await resolveCliHeaders();
-  const session = await sessions2.create({
+  const session = await sessions.create({
     name: "Operator Session",
     targets: target ? [target] : [],
     config: {
@@ -951,13 +1492,13 @@ ${sep}
     input: process.stdin,
     output: process.stdout
   });
-  const askFollowUp = () => new Promise((resolve2) => {
+  const askFollowUp = () => new Promise((resolve) => {
     process.stdout.write(`
 ${sep}
 `);
     rl.question("follow-up (empty to exit): ", (answer) => {
       const trimmed = answer.trim();
-      resolve2(trimmed || null);
+      resolve(trimmed || null);
     });
   });
   try {
@@ -974,9 +1515,9 @@ ${sep}
         session,
         messages
       });
-      const messagesPath = path2.join(session.rootPath, "messages.json");
+      const messagesPath = path.join(session.rootPath, "messages.json");
       if (existsSync(messagesPath)) {
-        const raw = JSON.parse(readFileSync2(messagesPath, "utf-8"));
+        const raw = JSON.parse(readFileSync(messagesPath, "utf-8"));
         const allMessages = Array.isArray(raw) ? raw : [];
         messages = normalizeMessages(getResumeMessages(allMessages));
       }
@@ -997,68 +1538,91 @@ ${sep}
 Session: ${session.rootPath}`);
 }
 async function runUpgrade2() {
-  const currentVersion = getCurrentVersion();
+  const currentVersion = getCurrentVersion2();
   console.log(`Current version: v${currentVersion}
 Checking for updates...`);
   const result = await upgrade({ interactive: true });
   console.log(`
 ${result.message}`);
-  process.exit(result.success ? 0 : 1);
+  process.exitCode = result.success ? 0 : 1;
 }
-if (hasFlag("-p") || command === "--prompt") {
-  await runOperator();
-} else if (command === "version" || command === "--version" || command === "-v") {
-  console.log(`v${version}`);
-} else if (command === "help" || command === "--help" || command === "-h") {
-  showHelp();
-} else if (command === "upgrade" || command === "update") {
-  await runUpgrade2();
-} else if (command === "pentest") {
-  await runPentest();
-} else if (command === "targeted-pentest") {
-  await runTargetedPentest();
-} else if (command === "login" || command === "auth") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./auth-z3h9859n.js");
-} else if (command === "uninstall") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./uninstall-tvsh81v8.js");
-} else if (command === "apps") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./apps-17wvz1d7.js");
-} else if (command === "pentests") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./pentests-6ks3szc4.js");
-} else if (command === "targets") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./targets-sxygyj87.js");
-} else if (command === "issues") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./issues-xx5bs4md.js");
-} else if (command === "fixes") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./fixes-b89s5haw.js");
-} else if (command === "logs") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./logs-qtxe51w2.js");
-} else if (command === "config") {
-  process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-  await import("./config-f1mj4nhd.js");
-} else if (command === "threat-model") {
-  await runThreatModel();
-} else if (command === "doctor") {
-  const { runDoctor } = await import("./doctor-ekneewa3.js");
-  await runDoctor();
-} else if (args.length === 0) {
-  if (process.env.PENSAR_NO_TUI === "1") {
-    console.error("TUI mode requires Bun. Install Bun (https://bun.sh) or use a standalone binary release for interactive mode.");
-    console.error("All other commands work with Node \u2014 run 'pensar --help'.");
-    process.exit(1);
+var observabilityRuntime = startObservabilityRuntime();
+var exitAfterObservabilityShutdown = args.length !== 0 ? installObservabilityExitHandlers(observabilityRuntime, {
+  onError: (error) => {
+    console.error("Uncaught exception:", error);
+  }
+}) : null;
+setCurrentCommand(command);
+try {
+  if (hasFlag("-p") || command === "--prompt") {
+    await runOperator();
+  } else if (command === "version" || command === "--version" || command === "-v") {
+    console.log(`v${version2}`);
+  } else if (command === "help" || command === "--help" || command === "-h") {
+    showHelp();
+  } else if (command === "upgrade" || command === "update") {
+    await runUpgrade2();
+  } else if (command === "pentest") {
+    await runPentest();
+  } else if (command === "targeted-pentest") {
+    await runTargetedPentest();
+  } else if (command === "login" || command === "auth") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./auth-wf1r533f.js");
+  } else if (command === "uninstall") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./uninstall-qdzsynrt.js");
+  } else if (command === "apps") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./apps-qf8jww9t.js");
+  } else if (command === "pentests") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./pentests-6pp1j1w5.js");
+  } else if (command === "targets") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./targets-yvh0d0fr.js");
+  } else if (command === "issues") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./issues-vgfdw93j.js");
+  } else if (command === "fixes") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./fixes-6kxes4g7.js");
+  } else if (command === "logs") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./logs-czxxx0n0.js");
+  } else if (command === "config") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./config-g93k0986.js");
+  } else if (command === "threat-model") {
+    await runThreatModel();
+  } else if (command === "doctor") {
+    const { runDoctor } = await import("./doctor-4fcx7g0h.js");
+    await runDoctor();
+  } else if (args.length === 0) {
+    if (process.env.PENSAR_NO_TUI === "1") {
+      console.error("TUI mode requires Bun. Install Bun (https://bun.sh) or use a standalone binary release for interactive mode.");
+      console.error("All other commands work with Node \u2014 run 'pensar --help'.");
+      await observabilityRuntime.shutdown().catch(() => {});
+      process.exitCode = 1;
+    } else {
+      await import("./index-r8554acn.js");
+    }
+  } else {
+    console.error(`Error: Unknown command '${command}'`);
+    console.error();
+    console.error("Run 'pensar --help' for usage information");
+    process.exitCode = 1;
+  }
+} catch (error) {
+  if (exitAfterObservabilityShutdown !== null) {
+    await exitAfterObservabilityShutdown(1, error, "uncaughtException");
+  }
+  throw error;
+} finally {
+  if (exitAfterObservabilityShutdown !== null) {
+    const shutdownResult = await observabilityRuntime.shutdown().catch(() => "completed");
+    if (shutdownResult === "timed-out" || command === "pentest" || command === "targeted-pentest") {
+      await exitAfterObservabilityShutdown(typeof process.exitCode === "number" ? process.exitCode : 0);
+    }
   }
-  await import("./index-6d22pyxt.js");
-} else {
-  console.error(`Error: Unknown command '${command}'`);
-  console.error();
-  console.error("Run 'pensar --help' for usage information");
-  process.exit(1);
 }