@pensar/apex 2.4.0 → 2.5.0-canary.22f2eb52

package/build/{cli-tznv8pf1.js → cli-n4h7ygp5.js}

@@ -1,9 +1,9 @@
 import {
-  createLogger,
+  scopedLogger,
   init_lazyLogger,
-  init_structured,
-  scopedLogger
-} from "./cli-tkc598ey.js";
+  createLogger,
+  init_structured
+} from "./cli-j1916nvj.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-b1adytsy.js → cli-q45hcq3f.js}

@@ -1,53 +1,60 @@
 import {
-  EvidenceFileEntrySchema
-} from "./cli-qqt4gj1w.js";
-import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
-  hasCanonicalName
-} from "./cli-repbyhkk.js";
+  hasCanonicalName,
+  EvidenceFileEntrySchema
+} from "./cli-qkb3v2nw.js";
 import {
-  exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-j1916nvj.js";
+import {
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  _enum
+} from "./cli-tjm77pmx.js";
 
 // src/core/report/schemas.ts
 init_zod();
-var PentestReportFindingSchema = exports_external.object({
-  title: exports_external.string(),
-  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
-  description: exports_external.string(),
-  impact: exports_external.string(),
-  evidence: exports_external.string(),
-  endpoint: exports_external.string(),
-  pocPath: exports_external.string(),
-  remediation: exports_external.string(),
-  references: exports_external.string().optional(),
-  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
-  rootCauseGroup: exports_external.string().optional(),
-  relatedFindings: exports_external.array(exports_external.string()).optional(),
-  rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+var PentestReportFindingSchema = object({
+  title: string(),
+  severity: _enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: string(),
+  impact: string(),
+  evidence: string(),
+  endpoint: string(),
+  pocPath: string(),
+  remediation: string(),
+  references: string().optional(),
+  cwes: array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: string().optional(),
+  relatedFindings: array(string()).optional(),
+  rootCauseLead: boolean().optional(),
+  evidenceFiles: array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
-var PentestReportSchema = exports_external.object({
-  version: exports_external.string().regex(/^1\.\d+$/),
-  metadata: exports_external.object({
-    target: exports_external.string(),
-    model: exports_external.string(),
-    timestamp: exports_external.string(),
-    sessionId: exports_external.string(),
-    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
+var PentestReportSchema = object({
+  version: string().regex(/^1\.\d+$/),
+  metadata: object({
+    target: string(),
+    model: string(),
+    timestamp: string(),
+    sessionId: string(),
+    mode: _enum(["blackbox", "whitebox", "targeted"])
   }),
-  summary: exports_external.object({
-    totalFindings: exports_external.number(),
-    bySeverity: exports_external.object({
-      CRITICAL: exports_external.number(),
-      HIGH: exports_external.number(),
-      MEDIUM: exports_external.number(),
-      LOW: exports_external.number()
+  summary: object({
+    totalFindings: number(),
+    bySeverity: object({
+      CRITICAL: number(),
+      HIGH: number(),
+      MEDIUM: number(),
+      LOW: number()
     })
   }),
-  findings: exports_external.array(PentestReportFindingSchema)
+  findings: array(PentestReportFindingSchema)
 });
 var REPORT_VERSION = "1.0";
 
@@ -86,7 +93,8 @@ function buildPentestReport(findings, context) {
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
       rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
     }))
   };
 }
@@ -141,6 +149,12 @@ function renderFinding(finding, metadata) {
     "",
     finding.impact,
     "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
     "## Evidence",
     "",
     "```",
@@ -187,6 +201,20 @@ function renderFinding(finding, metadata) {
   return lines.join(`
 `);
 }
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
 
 // src/core/report/index.ts
 var REPORT_FILENAME_MD = "pentest-report.md";