@pensar/apex 2.4.0 → 2.5.0-canary.22f2eb52

package/build/index-cbajq2xy.js

@@ -0,0 +1,17 @@
+import {
+  init,
+  get,
+  update2,
+  init_config2
+} from "./cli-v8ph8hy2.js";
+
+// src/core/config/index.ts
+init_config2();
+var config = {
+  get,
+  init,
+  update: update2
+};
+export {
+  config
+};

package/build/index-cn4p95gh.js

@@ -0,0 +1,100 @@
+import"./cli-wfb4gde1.js";
+import {
+  scopedLogger,
+  init_lazyLogger,
+  createLogger,
+  init_structured
+} from "./cli-j1916nvj.js";
+import"./cli-qktcyj48.js";
+
+// src/core/agents/specialized/findingJudge/index.ts
+init_structured();
+init_lazyLogger();
+var log = scopedLogger(() => createLogger("FindingJudge"));
+async function judgeFinding(input, ctx) {
+  try {
+    const { FindingJudgeAgent } = await import("./agent-ywewzc2h.js");
+    const agent = new FindingJudgeAgent({
+      finding: input,
+      model: ctx.model,
+      session: ctx.session,
+      authConfig: ctx.authConfig,
+      abortSignal: ctx.abortSignal,
+      eventBus: ctx.eventBus,
+      subagentId: ctx.subagentId,
+      subagentName: ctx.subagentName,
+      sandbox: ctx.sandbox,
+      target: input.target ?? ctx.target ?? ctx.session.targets[0],
+      enableThinking: ctx.enableThinking,
+      thinkingEffort: ctx.thinkingEffort,
+      openAIReasoningEffort: ctx.openAIReasoningEffort,
+      languageModelMiddleware: ctx.languageModelMiddleware,
+      usageRecorder: ctx.usageRecorder,
+      streamIdFactory: ctx.streamIdFactory
+    });
+    const result = await agent.consume();
+    if (!result) {
+      throw new Error("Finding judge agent finished without a response.");
+    }
+    return normalizeJudgeResult(result);
+  } catch (err) {
+    const fallback = createJudgeFailureResult(err, ctx.model);
+    log.warn("Agentic validation failed", {
+      model: fallback.error?.model,
+      type: fallback.error?.type,
+      message: fallback.error?.message
+    });
+    return fallback;
+  }
+}
+function normalizeJudgeResult(result) {
+  return {
+    valid: result.valid,
+    findingType: result.findingType,
+    confidence: result.confidence,
+    reasoning: result.reasoning,
+    concerns: result.concerns,
+    verificationSteps: result.verificationSteps,
+    toolEvidence: result.toolEvidence,
+    reproducedPoc: result.reproducedPoc,
+    webResearchUsed: result.webResearchUsed,
+    limitations: result.limitations
+  };
+}
+function createJudgeFailureResult(err, model) {
+  const errObj = typeof err === "object" && err !== null ? err : {};
+  const message = err instanceof Error ? err.message : String(err);
+  const type = err instanceof Error ? err.constructor.name : typeof err;
+  const stack = err instanceof Error ? err.stack : undefined;
+  const statusCode = errObj.status ?? errObj.statusCode ?? errObj.code;
+  const statusStr = statusCode != null ? ` [status=${statusCode}]` : "";
+  const isAbort = err instanceof Error && (err.name === "AbortError" || err.constructor.name === "DOMException");
+  const confidence = isAbort ? 0.3 : 0.4;
+  const diagnostic = `${type}${statusStr}: ${message.substring(0, 200)}`;
+  return {
+    valid: false,
+    findingType: "informational",
+    confidence,
+    reasoning: `Agentic finding judge could not complete (${diagnostic}). Rejecting the finding as unverified so unavailable judge infrastructure does not preserve false positives as vulnerabilities.`,
+    concerns: [
+      "Agentic judge infrastructure failed before producing a completed verification judgment.",
+      "The submitted PoC may have executed successfully, but the judge did not independently verify that it proves a material vulnerability."
+    ],
+    verificationSteps: [],
+    toolEvidence: [],
+    reproducedPoc: false,
+    webResearchUsed: false,
+    limitations: [
+      "No independent judge verification was completed due to infrastructure failure."
+    ],
+    error: {
+      message: `${message}${statusStr}`,
+      type,
+      model: String(model ?? "undefined"),
+      stack: stack?.substring(0, 500)
+    }
+  };
+}
+export {
+  judgeFinding
+};

package/build/index-kas88svr.js

@@ -0,0 +1,36 @@
+import {
+  isConnected2,
+  disconnect2,
+  startDeviceFlow2,
+  pollWorkOSToken2,
+  pollLegacyToken2,
+  isTokenExpired2,
+  ensureValidToken2,
+  validateGateway2,
+  signGatewayRequest2,
+  fetchWorkspaces2,
+  pollForWorkspaceCreation2,
+  selectWorkspace2,
+  createWorkspaceSelection2,
+  pollWorkspaceSelection2,
+  init_auth
+} from "./cli-j1916nvj.js";
+import"./cli-wfb4gde1.js";
+init_auth();
+
+export {
+  createWorkspaceSelection2 as createWorkspaceSelection,
+  disconnect2 as disconnect,
+  ensureValidToken2 as ensureValidToken,
+  fetchWorkspaces2 as fetchWorkspaces,
+  isConnected2 as isConnected,
+  isTokenExpired2 as isTokenExpired,
+  pollForWorkspaceCreation2 as pollForWorkspaceCreation,
+  pollLegacyToken2 as pollLegacyToken,
+  pollWorkOSToken2 as pollWorkOSToken,
+  pollWorkspaceSelection2 as pollWorkspaceSelection,
+  selectWorkspace2 as selectWorkspace,
+  signGatewayRequest2 as signGatewayRequest,
+  startDeviceFlow2 as startDeviceFlow,
+  validateGateway2 as validateGateway
+};

package/build/index-mr20g8k4.js

@@ -0,0 +1,22 @@
+import {
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT2,
+  EndpointSchema2,
+  AppsDiscoveryResultSchema2,
+  DiscoverySummarySchema2,
+  WhiteboxAttackSurfaceAgent2
+} from "./cli-gamfs2yq.js";
+import"./cli-qba2x69h.js";
+import"./cli-qkb3v2nw.js";
+import"./cli-n4h7ygp5.js";
+import"./cli-j1916nvj.js";
+import"./cli-qktcyj48.js";
+import"./cli-wfb4gde1.js";
+export {
+  AppsDiscoveryResultSchema2 as AppsDiscoveryResultSchema,
+  DiscoverySummarySchema2 as DiscoverySummarySchema,
+  EndpointSchema2 as EndpointSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2 as WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT2 as WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WhiteboxAttackSurfaceAgent2 as WhiteboxAttackSurfaceAgent
+};

package/build/{index-psqjpw5m.js → index-nweqptgs.js}

@@ -1,7 +1,7 @@
 import {
   __commonJS,
   __require
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // node_modules/ms/index.js
 var require_ms = __commonJS(function(exports, module) {
@@ -566,8 +566,8 @@ var require_node = __commonJS(function(exports, module) {
     return "colors" in exports.inspectOpts ? Boolean(exports.inspectOpts.colors) : tty.isatty(process.stderr.fd);
   }
   function formatArgs(args) {
-    const { namespace: name, useColors: useColors2 } = this;
-    if (useColors2) {
+    const { namespace: name, useColors } = this;
+    if (useColors) {
       const c = this.color;
       const colorCode = "\x1B[3" + (c < 8 ? c : "8;5;" + c);
       const prefix = `  ${colorCode};1m${name} \x1B[0m`;
@@ -690,12 +690,12 @@ var require_helpers = __commonJS(function(exports) {
   exports.json = json;
   function req(url, opts = {}) {
     const href = typeof url === "string" ? url : url.href;
-    const req2 = (href.startsWith("https:") ? https : http).request(url, opts);
+    const req = (href.startsWith("https:") ? https : http).request(url, opts);
     const promise = new Promise((resolve, reject) => {
-      req2.once("response", resolve).once("error", reject).end();
+      req.once("response", resolve).once("error", reject).end();
     });
-    req2.then = promise.then.bind(promise);
-    return req2;
+    req.then = promise.then.bind(promise);
+    return req;
   }
   exports.req = req;
 });

package/build/{index-sf16jm0m.js → index-rx5jn1nz.js}

@@ -1,38 +1,42 @@
+import"./cli-wfb4gde1.js";
 import {
-  CredentialManager,
-  RateLimiter,
-  ToolsetStateSchema,
-  createDir,
+  init_zod,
+  schema,
   descending,
+  init_id,
   generateRandomName,
   generateSessionName,
-  init_credentials,
-  init_id,
   init_name,
+  CredentialManager,
+  init_credentials,
+  RateLimiter,
   init_rateLimiter,
-  init_storage,
-  init_toolset,
+  write,
+  createDir,
+  writeRaw,
   read,
-  schema,
   update,
-  write,
-  writeRaw
-} from "./cli-tkc598ey.js";
-import"./cli-0n4r54hq.js";
+  init_storage,
+  ToolsetStateSchema,
+  init_toolset
+} from "./cli-j1916nvj.js";
 import {
-  init_zod,
-  zod_default
-} from "./cli-swpbx60z.js";
-import"./cli-j54qa6tm.js";
-import"./cli-72cvcqhg.js";
-import"./cli-9rhzhgx2.js";
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  union,
+  discriminatedUnion,
+  record,
+  _enum,
+  literal
+} from "./cli-tjm77pmx.js";
+import"./cli-qktcyj48.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-vnynf0js.js";
-import {
-  __require
-} from "./cli-bc05qbss.js";
+} from "./cli-f5rw841m.js";
 
 // src/core/session/index.ts
 init_zod();
@@ -51,90 +55,90 @@ var EXFIL_OUTCOME_GUIDANCE = "Exfiltrate data to extract the flag value. " + "Cr
 var DEFAULT_HEADER_RECORD = {
   "User-Agent": "pensar-apex"
 };
-var AuthCredentialsObject = zod_default.object({
-  username: zod_default.string().optional(),
-  password: zod_default.string().optional(),
-  loginUrl: zod_default.string().optional(),
-  additionalFields: zod_default.record(zod_default.string(), zod_default.string()).optional(),
-  apiKey: zod_default.string().optional(),
-  role: zod_default.string().optional(),
-  context: zod_default.string().optional(),
-  tokens: zod_default.object({
-    bearerToken: zod_default.string().optional(),
-    cookies: zod_default.string().optional(),
-    sessionToken: zod_default.string().optional(),
-    customHeaders: zod_default.record(zod_default.string(), zod_default.string()).optional()
+var AuthCredentialsObject = object({
+  username: string().optional(),
+  password: string().optional(),
+  loginUrl: string().optional(),
+  additionalFields: record(string(), string()).optional(),
+  apiKey: string().optional(),
+  role: string().optional(),
+  context: string().optional(),
+  tokens: object({
+    bearerToken: string().optional(),
+    cookies: string().optional(),
+    sessionToken: string().optional(),
+    customHeaders: record(string(), string()).optional()
   }).optional()
 });
-var ScopeConstraintsObject = zod_default.object({
-  allowedHosts: zod_default.string().array().optional(),
-  allowedPorts: zod_default.number().array().optional(),
-  strictScope: zod_default.boolean().optional()
+var ScopeConstraintsObject = object({
+  allowedHosts: string().array().optional(),
+  allowedPorts: number().array().optional(),
+  strictScope: boolean().optional()
 });
-var SessionHeadersRecord = zod_default.record(zod_default.string(), zod_default.string());
-var OffensiveHeadersConfigObject = zod_default.object({
-  mode: zod_default.enum(["none", "default", "custom"]).optional(),
+var SessionHeadersRecord = record(string(), string());
+var OffensiveHeadersConfigObject = object({
+  mode: _enum(["none", "default", "custom"]).optional(),
   headers: SessionHeadersRecord.optional()
 });
-var OperatorSettingsObject = zod_default.object({
-  initialMode: zod_default.enum(["plan", "manual", "auto"]).default("manual"),
-  requireApproval: zod_default.boolean().default(true),
-  enableSuggestions: zod_default.boolean().default(true),
-  strikeMode: zod_default.boolean().optional()
+var OperatorSettingsObject = object({
+  initialMode: _enum(["plan", "manual", "auto"]).default("manual"),
+  requireApproval: boolean().default(true),
+  enableSuggestions: boolean().default(true),
+  strikeMode: boolean().optional()
 });
-var EmailInboxConfigObject = zod_default.discriminatedUnion("provider", [
-  zod_default.object({
-    provider: zod_default.literal("gmail"),
-    id: zod_default.string(),
-    name: zod_default.string(),
-    emailAddress: zod_default.string(),
-    accessToken: zod_default.string(),
-    refreshToken: zod_default.string(),
-    clientId: zod_default.string().optional(),
-    clientSecret: zod_default.string().optional(),
-    tokenExpiry: zod_default.number().optional()
+var EmailInboxConfigObject = discriminatedUnion("provider", [
+  object({
+    provider: literal("gmail"),
+    id: string(),
+    name: string(),
+    emailAddress: string(),
+    accessToken: string(),
+    refreshToken: string(),
+    clientId: string().optional(),
+    clientSecret: string().optional(),
+    tokenExpiry: number().optional()
   }),
-  zod_default.object({
-    provider: zod_default.literal("outlook"),
-    id: zod_default.string(),
-    name: zod_default.string(),
-    emailAddress: zod_default.string(),
-    accessToken: zod_default.string(),
-    refreshToken: zod_default.string(),
-    clientId: zod_default.string().optional(),
-    clientSecret: zod_default.string().optional(),
-    tokenExpiry: zod_default.number().optional()
+  object({
+    provider: literal("outlook"),
+    id: string(),
+    name: string(),
+    emailAddress: string(),
+    accessToken: string(),
+    refreshToken: string(),
+    clientId: string().optional(),
+    clientSecret: string().optional(),
+    tokenExpiry: number().optional()
   }),
-  zod_default.object({
-    provider: zod_default.literal("imap"),
-    id: zod_default.string(),
-    name: zod_default.string(),
-    emailAddress: zod_default.string(),
-    imapHost: zod_default.string(),
-    imapPort: zod_default.number(),
-    username: zod_default.string(),
-    password: zod_default.string(),
-    tls: zod_default.boolean()
+  object({
+    provider: literal("imap"),
+    id: string(),
+    name: string(),
+    emailAddress: string(),
+    imapHost: string(),
+    imapPort: number(),
+    username: string(),
+    password: string(),
+    tls: boolean()
   }),
-  zod_default.object({
-    provider: zod_default.literal("http"),
-    id: zod_default.string(),
-    name: zod_default.string(),
-    emailAddress: zod_default.string(),
-    endpoint: zod_default.string(),
-    token: zod_default.string()
+  object({
+    provider: literal("http"),
+    id: string(),
+    name: string(),
+    emailAddress: string(),
+    endpoint: string(),
+    token: string()
   })
 ]);
-var EmailIntegrationConfigObject = zod_default.object({
-  inboxes: zod_default.array(EmailInboxConfigObject)
+var EmailIntegrationConfigObject = object({
+  inboxes: array(EmailInboxConfigObject)
 });
-var SmtpConfigObject = zod_default.object({
-  host: zod_default.string(),
-  port: zod_default.number(),
-  username: zod_default.string(),
-  password: zod_default.string(),
-  tls: zod_default.boolean().default(true),
-  fromAddress: zod_default.string().optional()
+var SmtpConfigObject = object({
+  host: string(),
+  port: number(),
+  username: string(),
+  password: string(),
+  tls: boolean().default(true),
+  fromAddress: string().optional()
 });
 function resolveSmtpConfig(explicit) {
   if (explicit)
@@ -167,30 +171,31 @@ function resolveSmtpConfig(explicit) {
   }
   return;
 }
-var SessionConfigObject = zod_default.object({
+var SessionConfigObject = object({
   headers: SessionHeadersRecord.optional(),
   offensiveHeaders: OffensiveHeadersConfigObject.optional(),
-  sessionType: zod_default.enum(["web-app"]).optional(),
-  mode: zod_default.enum(["auto", "driver", "operator"]).optional(),
-  outcomeGuidance: zod_default.string().optional(),
+  sessionType: _enum(["web-app"]).optional(),
+  mode: _enum(["auto", "driver", "operator"]).optional(),
+  outcomeGuidance: string().optional(),
   scopeConstraints: ScopeConstraintsObject.optional(),
-  authCredentials: zod_default.union([AuthCredentialsObject, zod_default.array(AuthCredentialsObject)]).optional(),
-  authenticationInstructions: zod_default.string().optional(),
-  requestsPerSecond: zod_default.number().optional(),
-  allowDestructiveActions: zod_default.boolean().optional(),
-  allowRateLimitTesting: zod_default.boolean().optional(),
+  authCredentials: union([AuthCredentialsObject, array(AuthCredentialsObject)]).optional(),
+  authenticationInstructions: string().optional(),
+  requestsPerSecond: number().optional(),
+  allowDestructiveActions: boolean().optional(),
+  allowRateLimitTesting: boolean().optional(),
   operatorSettings: OperatorSettingsObject.optional(),
   toolsetState: ToolsetStateSchema.optional(),
-  enumerateSubdomains: zod_default.boolean().optional(),
-  codebasePath: zod_default.string().optional(),
+  enumerateSubdomains: boolean().optional(),
+  codebasePath: string().optional(),
   emailIntegration: EmailIntegrationConfigObject.optional(),
   smtpConfig: SmtpConfigObject.optional(),
-  exfilMode: zod_default.boolean().optional(),
-  agentCwd: zod_default.string().optional(),
-  prompt: zod_default.string().optional(),
-  taskDriven: zod_default.boolean().optional(),
-  requirePlan: zod_default.boolean().optional(),
-  promptInjectionLibrarySource: zod_default.string().optional()
+  exfilMode: boolean().optional(),
+  agentCwd: string().optional(),
+  prompt: string().optional(),
+  taskDriven: boolean().optional(),
+  requirePlan: boolean().optional(),
+  disableSubagents: boolean().optional(),
+  promptInjectionLibrarySource: string().optional()
 });
 function getPensarDir() {
   return path.join(os.homedir(), ".pensar");
@@ -242,8 +247,8 @@ function normalizeDeprecatedHeaders(config) {
   if (!config)
     return config;
   if (config.offensiveHeaders == null) {
-    const { offensiveHeaders: _drop, ...rest2 } = config;
-    return rest2;
+    const { offensiveHeaders: _drop, ...rest } = config;
+    return rest;
   }
   const { offensiveHeaders, ...rest } = config;
   const restWithHeaders = rest;
@@ -273,21 +278,21 @@ function migrateLegacySessionData(input) {
     return input;
   return { ...root, config: normalizeDeprecatedHeaders(cfg) };
 }
-var SessionInfoObject = zod_default.object({
+var SessionInfoObject = object({
   id: schema("session"),
-  name: zod_default.string().optional(),
-  version: zod_default.string(),
-  targets: zod_default.array(zod_default.string()),
+  name: string().optional(),
+  version: string(),
+  targets: array(string()),
   config: SessionConfigObject.optional(),
-  time: zod_default.object({
-    created: zod_default.number(),
-    updated: zod_default.number()
+  time: object({
+    created: number(),
+    updated: number()
   }),
-  rootPath: zod_default.string(),
-  logsPath: zod_default.string(),
-  findingsPath: zod_default.string(),
-  scratchpadPath: zod_default.string(),
-  pocsPath: zod_default.string()
+  rootPath: string(),
+  logsPath: string(),
+  findingsPath: string(),
+  scratchpadPath: string(),
+  pocsPath: string()
 });
 async function create(input) {
   const name = input.name ?? generateRandomName();
@@ -314,7 +319,7 @@ async function create(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-ghwf5z3v.js");
+    const { config: appConfig } = await import("./index-3mzr07h0.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }
@@ -350,7 +355,8 @@ async function create(input) {
       targets: input.targets,
       userMessage: input.userMessage,
       model: input.model,
-      authConfig: input.authConfig
+      authConfig: input.authConfig,
+      sessionId: result.id
     }).then((aiName) => {
       if (aiName) {
         result.name = aiName;
@@ -382,27 +388,7 @@ async function update2(id, editor) {
   });
   return result;
 }
-async function* list() {
-  const sessionsDir = getSessionsDir();
-  let entries;
-  try {
-    entries = await import("node:fs/promises").then((fsp) => fsp.readdir(sessionsDir, { withFileTypes: true }));
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    if (!entry.isDirectory())
-      continue;
-    try {
-      yield await read([
-        "sessions",
-        entry.name,
-        "session"
-      ]);
-    } catch {}
-  }
-}
-var RemoveInput = zod_default.object({
+var RemoveInput = object({
   sessionId: schema("session")
 });
 var remove2 = async (input) => {
@@ -414,7 +400,7 @@ var remove2 = async (input) => {
     console.error(e);
   }
 };
-var RemoveMsgInput = zod_default.object({
+var RemoveMsgInput = object({
   sessionId: schema("session"),
   messageId: schema("message")
 });
@@ -562,18 +548,7 @@ var sessions = {
   updateSessionHeaders
 };
 export {
-  EXFIL_OUTCOME_GUIDANCE,
-  SessionInfoObject,
-  create,
-  get,
   getResumeMessages,
-  getSessionRoot,
-  hasOperatorState,
-  list,
-  loadOperatorState,
-  migrateLegacySessionData,
   normalizeMessages,
-  sessions,
-  updateOperatorSettings,
-  updateSessionHeaders
+  sessions
 };