@pensar/apex 2.4.0 → 2.5.0-canary.0af37eb0

package/build/{cli-j54qa6tm.js → cli-qktcyj48.js}

@@ -1,7 +1,7 @@
 import {
   __commonJS,
   __require
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // node_modules/@vercel/oidc/dist/token-error.js
 var require_token_error = __commonJS(function(exports, module) {

package/build/cli-retw3rw5.js

@@ -0,0 +1,12 @@
+// src/core/agents/specialized/mobileOtpPrompt.ts
+var MOBILE_OTP_PROMPT_GUIDANCE = `## Mobile OTP credentials
+
+Read each credential's \`Authentication method\` before starting:
+- \`sms-passwordless\`: \`phoneNumber\` is the login identifier, not MFA after a password. Reserve immediately before filling that field, then request the code.
+- \`sms-mfa\`: fill username and password first. If submitting the password triggers the SMS code, reserve immediately before submitting. If it reveals a separate send-code action, reserve immediately before that action. Fill a destination phone field only if the target asks, using \`credentialId\` + \`credentialField="phoneNumber"\`.
+
+Never ask for, write, log, or pass a public phone number. Reserve with \`sms_list_messages\` and \`reserve=true\`; the Console chooses the shared number. A 429 means that number is busy: do not wait or poll inside the tool. Make at most two separate reservation attempts (with an \`execute_command\` sleep between them), then report the authentication block.
+
+At the action that sends the code, record \`Date.now()\` as \`sinceMs\`. Run \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with \`sinceMs\` and \`claim=true\`. If no message arrives, make one delayed list retry; otherwise report the result rather than waiting indefinitely. Fill the claimed OTP and continue. Do not report \`phone_verification\` as a barrier for either Mobile OTP flow. TOTP via an environment variable is unchanged.`;
+
+export { MOBILE_OTP_PROMPT_GUIDANCE };

package/build/{cli-b1adytsy.js → cli-s2y86fd5.js}

@@ -1,53 +1,60 @@
 import {
-  EvidenceFileEntrySchema
-} from "./cli-qqt4gj1w.js";
-import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
-  hasCanonicalName
-} from "./cli-repbyhkk.js";
+  hasCanonicalName,
+  EvidenceFileEntrySchema
+} from "./cli-y212s0r8.js";
 import {
-  exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-q8pr0zqg.js";
+import {
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  _enum
+} from "./cli-tjm77pmx.js";
 
 // src/core/report/schemas.ts
 init_zod();
-var PentestReportFindingSchema = exports_external.object({
-  title: exports_external.string(),
-  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
-  description: exports_external.string(),
-  impact: exports_external.string(),
-  evidence: exports_external.string(),
-  endpoint: exports_external.string(),
-  pocPath: exports_external.string(),
-  remediation: exports_external.string(),
-  references: exports_external.string().optional(),
-  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
-  rootCauseGroup: exports_external.string().optional(),
-  relatedFindings: exports_external.array(exports_external.string()).optional(),
-  rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+var PentestReportFindingSchema = object({
+  title: string(),
+  severity: _enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: string(),
+  impact: string(),
+  evidence: string(),
+  endpoint: string(),
+  pocPath: string(),
+  remediation: string(),
+  references: string().optional(),
+  cwes: array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: string().optional(),
+  relatedFindings: array(string()).optional(),
+  rootCauseLead: boolean().optional(),
+  evidenceFiles: array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
-var PentestReportSchema = exports_external.object({
-  version: exports_external.string().regex(/^1\.\d+$/),
-  metadata: exports_external.object({
-    target: exports_external.string(),
-    model: exports_external.string(),
-    timestamp: exports_external.string(),
-    sessionId: exports_external.string(),
-    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
+var PentestReportSchema = object({
+  version: string().regex(/^1\.\d+$/),
+  metadata: object({
+    target: string(),
+    model: string(),
+    timestamp: string(),
+    sessionId: string(),
+    mode: _enum(["blackbox", "whitebox", "targeted"])
   }),
-  summary: exports_external.object({
-    totalFindings: exports_external.number(),
-    bySeverity: exports_external.object({
-      CRITICAL: exports_external.number(),
-      HIGH: exports_external.number(),
-      MEDIUM: exports_external.number(),
-      LOW: exports_external.number()
+  summary: object({
+    totalFindings: number(),
+    bySeverity: object({
+      CRITICAL: number(),
+      HIGH: number(),
+      MEDIUM: number(),
+      LOW: number()
     })
   }),
-  findings: exports_external.array(PentestReportFindingSchema)
+  findings: array(PentestReportFindingSchema)
 });
 var REPORT_VERSION = "1.0";
 
@@ -86,7 +93,8 @@ function buildPentestReport(findings, context) {
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
       rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
     }))
   };
 }
@@ -141,6 +149,12 @@ function renderFinding(finding, metadata) {
     "",
     finding.impact,
     "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
     "## Evidence",
     "",
     "```",
@@ -187,6 +201,20 @@ function renderFinding(finding, metadata) {
   return lines.join(`
 `);
 }
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
 
 // src/core/report/index.ts
 var REPORT_FILENAME_MD = "pentest-report.md";