@pensar/apex 2.4.0 → 2.5.0-canary.22f2eb52

package/build/{cli-k71t434r.js → cli-ec2hwkv3.js}

@@ -1,9 +1,9 @@
 import {
+  __toESM,
   __commonJS,
   __esm,
-  __require,
-  __toESM
-} from "./cli-bc05qbss.js";
+  __require
+} from "./cli-h6y3bt60.js";
 
 // node_modules/fetch-blob/node_modules/web-streams-polyfill/dist/ponyfill.es2018.js
 var require_ponyfill_es2018 = __commonJS(function(exports, module) {
@@ -23,7 +23,7 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
           value: name,
           configurable: true
         });
-      } catch (_a2) {}
+      } catch (_a) {}
     }
     const originalPromise = Promise;
     const originalPromiseThen = Promise.prototype.then;
@@ -519,7 +519,7 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       }
       try {
         return x._asyncIteratorImpl instanceof ReadableStreamAsyncIteratorImpl;
-      } catch (_a2) {
+      } catch (_a) {
         return false;
       }
     }
@@ -1344,9 +1344,9 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       return mode;
     }
     function convertByobReadOptions(options, context) {
-      var _a2;
+      var _a;
       assertDictionary(options, context);
-      const min = (_a2 = options === null || options === undefined ? undefined : options.min) !== null && _a2 !== undefined ? _a2 : 1;
+      const min = (_a = options === null || options === undefined ? undefined : options.min) !== null && _a !== undefined ? _a : 1;
       return {
         min: convertUnsignedLongLongWithEnforceRange(min, `${context} has member 'min' that`)
       };
@@ -1588,7 +1588,7 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       }
       try {
         return typeof value.aborted === "boolean";
-      } catch (_a2) {
+      } catch (_a) {
         return false;
       }
     }
@@ -1705,12 +1705,12 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       return true;
     }
     function WritableStreamAbort(stream, reason) {
-      var _a2;
+      var _a;
       if (stream._state === "closed" || stream._state === "errored") {
         return promiseResolvedWith(undefined);
       }
       stream._writableStreamController._abortReason = reason;
-      (_a2 = stream._writableStreamController._abortController) === null || _a2 === undefined || _a2.abort(reason);
+      (_a = stream._writableStreamController._abortController) === null || _a === undefined || _a.abort(reason);
       const state = stream._state;
       if (state === "closed" || state === "errored") {
         return promiseResolvedWith(undefined);
@@ -2422,7 +2422,7 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       try {
         new ctor;
         return true;
-      } catch (_a2) {
+      } catch (_a) {
         return false;
       }
     }
@@ -2431,7 +2431,7 @@ var require_ponyfill_es2018 = __commonJS(function(exports, module) {
       return isDOMExceptionConstructor(ctor) ? ctor : undefined;
     }
     function createPolyfill() {
-      const ctor = function DOMException2(message, name) {
+      const ctor = function DOMException(message, name) {
         this.message = message || "";
         this.name = name || "Error";
         if (Error.captureStackTrace) {
@@ -4139,7 +4139,7 @@ async function* toIterator(parts, clone = true) {
     }
   }
 }
-var import_streams, POOL_SIZE = 65536, _Blob, Blob2, fetch_blob_default;
+var import_streams, POOL_SIZE = 65536, _Blob, Blob, fetch_blob_default;
 var init_fetch_blob = __esm(() => {
   import_streams = __toESM(require_streams(), 1);
   /*! fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
@@ -4228,20 +4228,20 @@ var init_fetch_blob = __esm(() => {
         if (added >= span) {
           break;
         }
-        const size2 = ArrayBuffer.isView(part) ? part.byteLength : part.size;
-        if (relativeStart && size2 <= relativeStart) {
-          relativeStart -= size2;
-          relativeEnd -= size2;
+        const size = ArrayBuffer.isView(part) ? part.byteLength : part.size;
+        if (relativeStart && size <= relativeStart) {
+          relativeStart -= size;
+          relativeEnd -= size;
         } else {
           let chunk;
           if (ArrayBuffer.isView(part)) {
-            chunk = part.subarray(relativeStart, Math.min(size2, relativeEnd));
+            chunk = part.subarray(relativeStart, Math.min(size, relativeEnd));
             added += chunk.byteLength;
           } else {
-            chunk = part.slice(relativeStart, Math.min(size2, relativeEnd));
+            chunk = part.slice(relativeStart, Math.min(size, relativeEnd));
             added += chunk.size;
           }
-          relativeEnd -= size2;
+          relativeEnd -= size;
           blobParts.push(chunk);
           relativeStart = 0;
         }
@@ -4263,12 +4263,12 @@ var init_fetch_blob = __esm(() => {
     type: { enumerable: true },
     slice: { enumerable: true }
   });
-  Blob2 = _Blob;
-  fetch_blob_default = Blob2;
+  Blob = _Blob;
+  fetch_blob_default = Blob;
 });
 
 // node_modules/fetch-blob/file.js
-var _File, File2, file_default;
+var _File, File, file_default;
 var init_file = __esm(() => {
   init_fetch_blob();
   _File = class File extends fetch_blob_default {
@@ -4300,8 +4300,8 @@ var init_file = __esm(() => {
       return !!object && object instanceof fetch_blob_default && /^(File)$/.test(object[Symbol.toStringTag]);
     }
   };
-  File2 = _File;
-  file_default = File2;
+  File = _File;
+  file_default = File;
 });
 
 // node_modules/formdata-polyfill/esm.min.js
@@ -4320,12 +4320,12 @@ Content-Type: ${v.type || "application/octet-stream"}\r
   c.push(`--${b}--`);
   return new B(c, { type: "multipart/form-data; boundary=" + b });
 }
-var t, i, h, r, m, f = (a, b, c) => (a += "", /^(Blob|File)$/.test(b && b[t]) ? [(c = c !== undefined ? c + "" : b[t] == "File" ? b.name : "blob", a), b.name !== c || b[t] == "blob" ? new file_default([b], c, b) : b] : [a, b + ""]), e = (c, f2) => (f2 ? c : c.replace(/\r?\n|\r/g, `\r
-`)).replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22"), x = (n, a, e2) => {
-  if (a.length < e2) {
-    throw new TypeError(`Failed to execute '${n}' on 'FormData': ${e2} arguments required, but only ${a.length} present.`);
+var t, i, h, r, m, f = (a, b, c) => (a += "", /^(Blob|File)$/.test(b && b[t]) ? [(c = c !== undefined ? c + "" : b[t] == "File" ? b.name : "blob", a), b.name !== c || b[t] == "blob" ? new file_default([b], c, b) : b] : [a, b + ""]), e = (c, f) => (f ? c : c.replace(/\r?\n|\r/g, `\r
+`)).replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22"), x = (n, a, e) => {
+  if (a.length < e) {
+    throw new TypeError(`Failed to execute '${n}' on 'FormData': ${e} arguments required, but only ${a.length} present.`);
   }
-}, FormData;
+}, FormData2;
 var init_esm_min = __esm(() => {
   init_fetch_blob();
   init_file();
@@ -4333,7 +4333,7 @@ var init_esm_min = __esm(() => {
   ({ toStringTag: t, iterator: i, hasInstance: h } = Symbol);
   r = Math.random;
   m = "append,set,get,getAll,delete,keys,values,entries,forEach,constructor".split(",");
-  FormData = class FormData2 {
+  FormData2 = class FormData {
     #d = [];
     constructor(...a) {
       if (a.length)
@@ -4346,7 +4346,7 @@ var init_esm_min = __esm(() => {
       return this.entries();
     }
     static [h](o) {
-      return o && typeof o === "object" && o[t] === "FormData" && !m.some((m2) => typeof o[m2] != "function");
+      return o && typeof o === "object" && o[t] === "FormData" && !m.some((m) => typeof o[m] != "function");
     }
     append(...a) {
       x("append", arguments, 2);
@@ -4422,54 +4422,12 @@ var require_node_domexception = __commonJS(function(exports, module) {
 
 // node_modules/fetch-blob/from.js
 import { statSync, createReadStream, promises as fs } from "node:fs";
-import { basename } from "node:path";
-var import_node_domexception, stat, blobFromSync = (path, type) => fromBlob(statSync(path), path, type), blobFrom = (path, type) => stat(path).then((stat2) => fromBlob(stat2, path, type)), fileFrom = (path, type) => stat(path).then((stat2) => fromFile(stat2, path, type)), fileFromSync = (path, type) => fromFile(statSync(path), path, type), fromBlob = (stat2, path, type = "") => new fetch_blob_default([new BlobDataItem({
-  path,
-  size: stat2.size,
-  lastModified: stat2.mtimeMs,
-  start: 0
-})], { type }), fromFile = (stat2, path, type = "") => new file_default([new BlobDataItem({
-  path,
-  size: stat2.size,
-  lastModified: stat2.mtimeMs,
-  start: 0
-})], basename(path), { type, lastModified: stat2.mtimeMs }), BlobDataItem;
+var import_node_domexception, stat;
 var init_from = __esm(() => {
   init_file();
   init_fetch_blob();
   import_node_domexception = __toESM(require_node_domexception(), 1);
   ({ stat } = fs);
-  BlobDataItem = class BlobDataItem {
-    #path;
-    #start;
-    constructor(options) {
-      this.#path = options.path;
-      this.#start = options.start;
-      this.size = options.size;
-      this.lastModified = options.lastModified;
-    }
-    slice(start, end) {
-      return new BlobDataItem({
-        path: this.#path,
-        lastModified: this.lastModified,
-        size: end - start,
-        start: this.#start + start
-      });
-    }
-    async* stream() {
-      const { mtimeMs } = await stat(this.#path);
-      if (mtimeMs > this.lastModified) {
-        throw new import_node_domexception.default("The requested file could not be read, typically due to permission problems that have occurred after a reference to a file was acquired.", "NotReadableError");
-      }
-      yield* createReadStream(this.#path, {
-        start: this.#start,
-        end: this.#start + this.size - 1
-      });
-    }
-    get [Symbol.toStringTag]() {
-      return "Blob";
-    }
-  };
 });
 
-export { fetch_blob_default, init_fetch_blob, file_default, FormData, formDataToBlob, init_esm_min, blobFromSync, blobFrom, fileFrom, fileFromSync, init_from };
+export { fetch_blob_default, init_fetch_blob, file_default, FormData2, formDataToBlob, init_esm_min, init_from };

package/build/{cli-vnynf0js.js → cli-f5rw841m.js}

@@ -1,9 +1,9 @@
 import {
   __esm
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // package.json
-var package_default;
+var version = "2.5.0-canary.22f2eb52", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",
@@ -23,6 +23,10 @@ var init_package = __esm(() => {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "@openrouter/ai-sdk-provider": "^2.9.1",
       "@opentelemetry/api": "^1.9.1",
+      "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+      "@opentelemetry/otlp-exporter-base": "^0.221.0",
+      "@opentelemetry/otlp-transformer": "^0.221.0",
+      "@opentelemetry/resources": "^2.10.0",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.3.0",
@@ -46,6 +50,8 @@ var init_package = __esm(() => {
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
+      "@opentelemetry/context-async-hooks": "^2.10.0",
+      "@opentelemetry/sdk-trace-base": "^2.10.0",
       "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
@@ -92,7 +98,7 @@ var init_package = __esm(() => {
       url: "https://github.com/pensarai/apex.git"
     },
     scripts: {
-      build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
+      build: "rm -rf build && bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
       "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
       "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
       "build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
@@ -120,7 +126,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.4.0"
+    version
   };
 });
 
@@ -195,4 +201,4 @@ var init_installation = __esm(() => {
   init_package();
 });
 
-export { init_package, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
+export { init_package, version, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };

package/build/{cli-k8kc47pq.js → cli-gamfs2yq.js}

@@ -2,16 +2,22 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-qkb3v2nw.js";
 import {
-  hasToolCall,
+  init_zod,
+  stepCountIs2,
   init_dist
-} from "./cli-tkc598ey.js";
+} from "./cli-j1916nvj.js";
 import {
-  exports_external,
-  init_zod,
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  union,
+  _enum,
   tool
-} from "./cli-swpbx60z.js";
+} from "./cli-tjm77pmx.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();
@@ -44,7 +50,7 @@ var NO_MANIFEST_HARD_RULES = `**You MUST NOT, under any circumstances:**
 These patterns silently truncate at output-token limits and routes get dropped. The only correct workflow is: discover a route → call \`document_endpoint\` for it → discover the next route → call \`document_endpoint\` for it → ... until every route is documented. Repetition is expected and required.`;
 var SUBMODULE_IGNORE_STEP = `**Ignore submodules** — check for a \`.gitmodules\` file or run \`git submodule status\`. Any directories that are git submodules are external dependencies and must be **completely excluded** from your analysis.`;
 var DOCUMENT_IMMEDIATELY_RULE = `**Document each item the instant you discover it** — every output tool call must be made directly, one item per call, immediately after you identify it. Never collect items into a manifest, JSON file, or batch script. If you find yourself thinking "let me list all of these and then document them," stop — that pattern silently drops items when output tokens run out.`;
-var WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT = `You are an expert source-code analyst with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
+var WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2 = `You are an expert source-code analyst with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
 
 Your focus is on identifying **deployed applications and services** — APIs, web apps, microservices — that listen on a port and serve traffic, as well as **owned cloud resources** (S3 buckets, cloud storage, CDN origins, etc.) that are part of the attack surface. Ignore libraries, shared packages, SDKs, CLI tools, build scripts, and test suites unless they are part of a deployable service.
 
@@ -119,7 +125,7 @@ When you have called \`document_endpoint\` for every endpoint in your input list
 3. **Document immediately.** Call \`document_endpoint\` directly per endpoint, the moment you have enough context. Do not collect entries in a buffer to "process later."
 4. **Stay scoped.** Your job is documentation, not discovery. Do not call \`list_files\` or \`grep\` to look for additional routes — the list is final.
 `;
-var WHITEBOX_DISCOVERY_SYSTEM_PROMPT = `You are an expert source-code analyst with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
+var WHITEBOX_DISCOVERY_SYSTEM_PROMPT2 = `You are an expert source-code analyst with direct filesystem access. You will be given a specific objective — focus exclusively on completing it.
 
 Your focus is on **deployed applications and services** — APIs, web apps, microservices — that listen on a port and serve traffic, as well as **owned cloud resources** (S3 buckets, cloud storage, CDN origins, etc.) that are part of the attack surface. Ignore libraries, shared packages, SDKs, CLI tools, build scripts, and test suites unless they are part of a deployable service.
 
@@ -311,34 +317,36 @@ Then:
 
 // src/core/agents/specialized/whiteboxAttackSurface/types.ts
 init_zod();
-var RiskScoreBreakdownSchema = exports_external.object({
-  exposure: exports_external.number().min(0).max(3).describe("Exposure Level (0-3): 3=Public no auth, 2=Standard user login, 1=Privileged/admin access, 0=Private/internal-only"),
-  dataSensitivity: exports_external.number().min(0).max(3).describe("Data Sensitivity (0-3): 3=PII/PHI/financial/passwords/tokens, 2=Business operations/configs, 1=Low-value user data, 0=No meaningful data"),
-  functionCriticality: exports_external.number().min(0).max(2).describe("Function Criticality (0-2): 2=Auth flows/payments/state-changing mutations, 1=Core product functionality, 0=Non-critical content"),
-  securityIndicators: exports_external.number().min(0).max(2).describe("Security Indicators (0-2): 2=Critical vuln patterns (SQLi, command injection, hardcoded secrets), 1=Moderate concerns (missing validation, weak error handling), 0=No obvious issues")
+var RiskScoreBreakdownSchema = object({
+  exposure: number().min(0).max(3).describe("Exposure Level (0-3): 3=Public no auth, 2=Standard user login, 1=Privileged/admin access, 0=Private/internal-only"),
+  dataSensitivity: number().min(0).max(3).describe("Data Sensitivity (0-3): 3=PII/PHI/financial/passwords/tokens, 2=Business operations/configs, 1=Low-value user data, 0=No meaningful data"),
+  functionCriticality: number().min(0).max(2).describe("Function Criticality (0-2): 2=Auth flows/payments/state-changing mutations, 1=Core product functionality, 0=Non-critical content"),
+  securityIndicators: number().min(0).max(2).describe("Security Indicators (0-2): 2=Critical vuln patterns (SQLi, command injection, hardcoded secrets), 1=Moderate concerns (missing validation, weak error handling), 0=No obvious issues")
 });
-var RiskScoreSchema = exports_external.object({
-  score: exports_external.number().min(0).max(10).describe("Total risk score (0-10)"),
-  explanation: exports_external.string().describe("Justification for the risk score"),
+var RiskScoreSchema = object({
+  score: number().min(0).max(10).describe("Total risk score (0-10)"),
+  explanation: string().describe("Justification for the risk score"),
   breakdown: RiskScoreBreakdownSchema
 });
-var EndpointSchema = exports_external.object({
-  method: exports_external.string().describe("HTTP method (GET, POST, PUT, DELETE, etc.) or 'PAGE' for web pages"),
-  path: exports_external.string().describe("Route path (e.g. /api/users/:id, /dashboard)"),
-  handler: exports_external.string().optional().describe("Handler function or component name, if identifiable"),
-  file: exports_external.string().describe("File where this endpoint is defined"),
-  line: exports_external.number().optional().describe("Line number in the file"),
-  authRequired: exports_external.boolean().optional().describe("Whether this endpoint appears to require authentication"),
-  description: exports_external.string().optional().describe("Brief description of what this endpoint does"),
-  pentestObjectives: exports_external.array(exports_external.string()).default([]).describe("Pentest objectives for this endpoint, derived from the threat model when available " + "(e.g. 'Test for IDOR by enumerating user IDs', 'Test for SQL injection in search parameter')"),
+var MethodSchema = union([string(), array(string())]).transform((m) => Array.isArray(m) ? m.join(", ") : m);
+var StringListSchema = union([string(), array(string())]).transform((v) => Array.isArray(v) ? v : [v]);
+var EndpointSchema2 = object({
+  method: MethodSchema.describe("HTTP method (GET, POST, PUT, DELETE, etc.) or 'PAGE' for web pages"),
+  path: string().describe("Route path (e.g. /api/users/:id, /dashboard)"),
+  handler: string().optional().describe("Handler function or component name, if identifiable"),
+  file: string().describe("File where this endpoint is defined"),
+  line: number().optional().describe("Line number in the file"),
+  authRequired: boolean().optional().describe("Whether this endpoint appears to require authentication"),
+  description: string().optional().describe("Brief description of what this endpoint does"),
+  pentestObjectives: StringListSchema.default([]).describe("Pentest objectives for this endpoint, derived from the threat model when available " + "(e.g. 'Test for IDOR by enumerating user IDs', 'Test for SQL injection in search parameter')"),
   riskScore: RiskScoreSchema.optional().describe("AI-calculated risk score for prioritizing pentest efforts"),
-  threatModel: exports_external.string().optional().describe("Endpoint-specific threat model describing attack vectors, data sensitivity, and testing priorities"),
+  threatModel: string().optional().describe("Endpoint-specific threat model describing attack vectors, data sensitivity, and testing priorities"),
   transport: EndpointTransportEnum.optional().describe("Wire transport; 'grpc'/'grpc_web'/'connect' for gRPC methods, else http"),
   grpc: GrpcEndpointMetadataSchema.optional().describe("gRPC service/method/streaming metadata when transport is a gRPC variant")
 });
-var AppSchema = exports_external.object({
-  name: exports_external.string().describe("Application or service name"),
-  type: exports_external.enum([
+var AppSchema = object({
+  name: string().describe("Application or service name"),
+  type: _enum([
     "web_application",
     "api",
     "full_stack",
@@ -348,18 +356,18 @@ var AppSchema = exports_external.object({
     "cloud_resource",
     "storage"
   ]).default("web_application").describe("Type of application (web_application, api, full_stack, database, cloud_resource, storage, etc.)"),
-  framework: exports_external.string().describe("Framework in use (e.g. Express, Next.js, Django, FastAPI, Rails)"),
-  description: exports_external.string().describe("Brief description of what this app does"),
-  location: exports_external.string().describe("Path to the app root relative to the repository root"),
-  pages: exports_external.array(EndpointSchema).describe("Web pages / views defined in this app"),
-  apiEndpoints: exports_external.array(EndpointSchema).describe("API endpoints defined in this app")
+  framework: string().describe("Framework in use (e.g. Express, Next.js, Django, FastAPI, Rails)"),
+  description: string().describe("Brief description of what this app does"),
+  location: string().describe("Path to the app root relative to the repository root"),
+  pages: array(EndpointSchema2).describe("Web pages / views defined in this app"),
+  apiEndpoints: array(EndpointSchema2).describe("API endpoints defined in this app")
 });
-var AppInfoSchema = exports_external.object({
-  name: exports_external.string().describe("Application or service name"),
-  framework: exports_external.string().describe("Framework or cloud service (e.g. Express, Next.js, Django, FastAPI, Rails, AWS S3, CloudFront)"),
-  description: exports_external.string().describe("Brief description of what this app does"),
-  location: exports_external.string().describe("Path to the app root relative to the repository root, or resource identifier for cloud resources"),
-  type: exports_external.enum([
+var AppInfoSchema = object({
+  name: string().describe("Application or service name"),
+  framework: string().describe("Framework or cloud service (e.g. Express, Next.js, Django, FastAPI, Rails, AWS S3, CloudFront)"),
+  description: string().describe("Brief description of what this app does"),
+  location: string().describe("Path to the app root relative to the repository root, or resource identifier for cloud resources"),
+  type: _enum([
     "web_application",
     "api",
     "full_stack",
@@ -370,72 +378,63 @@ var AppInfoSchema = exports_external.object({
     "storage"
   ]).default("web_application").describe("Application type — web_application for frontend apps, api for backend services, " + "full_stack for frameworks like Next.js/Remix that serve both, " + "database for databases, cloud_resource for owned cloud infra, storage for S3/GCS/blob storage")
 });
-var AppsDiscoveryResultSchema = exports_external.object({
-  repoType: exports_external.string().describe("e.g. monorepo, single-app, multi-package"),
-  packageManager: exports_external.string().describe("e.g. npm, yarn, pnpm, pip, cargo, go modules"),
-  apps: exports_external.array(AppInfoSchema).describe("All applications/services discovered in the repository")
+var AppsDiscoveryResultSchema2 = object({
+  repoType: string().describe("e.g. monorepo, single-app, multi-package"),
+  packageManager: string().describe("e.g. npm, yarn, pnpm, pip, cargo, go modules"),
+  apps: array(AppInfoSchema).describe("All applications/services discovered in the repository")
 });
-var DiscoverySummarySchema = exports_external.object({
-  endpointsDocumented: exports_external.number().describe("Number of endpoints documented via document_endpoint"),
-  summary: exports_external.string().describe("Brief summary of what was found")
+var DiscoverySummarySchema2 = object({
+  endpointsDocumented: number().describe("Number of endpoints documented via document_endpoint"),
+  summary: string().describe("Brief summary of what was found")
 });
-var WhiteboxAttackSurfaceResultSchema = exports_external.object({
-  repoType: exports_external.string().describe("Repository structure type (e.g. 'monorepo', 'single-app', 'multi-package')"),
-  packageManager: exports_external.string().describe("Package manager detected (e.g. npm, yarn, pnpm, pip, cargo, go modules)"),
-  apps: exports_external.array(AppSchema).describe("All applications discovered in the repository"),
-  summary: exports_external.object({
-    totalApps: exports_external.number(),
-    totalPages: exports_external.number(),
-    totalApiEndpoints: exports_external.number(),
-    totalPentestObjectives: exports_external.number()
+var WhiteboxAttackSurfaceResultSchema = object({
+  repoType: string().describe("Repository structure type (e.g. 'monorepo', 'single-app', 'multi-package')"),
+  packageManager: string().describe("Package manager detected (e.g. npm, yarn, pnpm, pip, cargo, go modules)"),
+  apps: array(AppSchema).describe("All applications discovered in the repository"),
+  summary: object({
+    totalApps: number(),
+    totalPages: number(),
+    totalApiEndpoints: number(),
+    totalPentestObjectives: number()
   })
 });
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
-class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
+var SUBMIT_RESULTS_TOOL_NAME = "submit_results";
+var WHITEBOX_MAX_STEPS = 1e4;
+var WHITEBOX_FALLBACK_RESULT = {
+  repoType: "unknown",
+  packageManager: "unknown",
+  apps: [],
+  summary: {
+    totalApps: 0,
+    totalPages: 0,
+    totalApiEndpoints: 0,
+    totalPentestObjectives: 0
+  }
+};
+
+class WhiteboxSubmitValidationError extends Error {
+  constructor() {
+    super("Whitebox attack surface recon called submit_results but no attempt passed " + "schema validation — refusing to silently return an empty attack surface. " + "The run should be retried.");
+    this.name = "WhiteboxSubmitValidationError";
+  }
+}
+function finalizeWhiteboxResult(capturedResult, submitAttempted) {
+  if (capturedResult !== null)
+    return capturedResult;
+  if (submitAttempted)
+    throw new WhiteboxSubmitValidationError;
+  return WHITEBOX_FALLBACK_RESULT;
+}
+
+class WhiteboxAttackSurfaceAgent2 extends OffensiveSecurityAgent {
   constructor(opts) {
-    const {
-      model,
-      codebasePath,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      attackSurfaceRegistry,
-      domains,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort
-    } = opts;
+    const { codebasePath, domains, ...base } = opts;
     let capturedResult = null;
-    const submitResultsTool = tool({
-      description: `Submit the final whitebox attack surface analysis results.
-
-Call this ONCE at the end with your complete structured findings.
-This ends the agent run — make sure all data is included.`,
-      inputSchema: WhiteboxAttackSurfaceResultSchema,
-      execute: async (results) => {
-        capturedResult = results;
-        return { success: true, message: "Results submitted." };
-      }
-    });
     super({
+      ...base,
       system: WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT,
-      prompt: buildPrompt(codebasePath, domains, session.config?.prompt),
-      model,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      subagentName: opts.subagentName,
-      attackSurfaceRegistry,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort,
       activeTools: [
         "read_file",
         "list_files",
@@ -445,26 +444,30 @@ This ends the agent run — make sure all data is included.`,
         "spawn_coding_agent",
         "submit_results"
       ],
+      stopWhen: [
+        () => capturedResult !== null,
+        stepCountIs2(WHITEBOX_MAX_STEPS)
+      ],
       extraTools: {
-        submit_results: submitResultsTool
-      },
-      stopWhen: hasToolCall("submit_results"),
-      resolveResult: () => {
-        if (capturedResult) {
-          return capturedResult;
-        }
-        return {
-          repoType: "unknown",
-          packageManager: "unknown",
-          apps: [],
-          summary: {
-            totalApps: 0,
-            totalPages: 0,
-            totalApiEndpoints: 0,
-            totalPentestObjectives: 0
+        ...base.extraTools,
+        [SUBMIT_RESULTS_TOOL_NAME]: tool({
+          description: `Submit the final whitebox attack surface analysis results.
+
+Call this ONCE at the end with your complete structured findings.
+This ends the agent run — make sure all data is included.`,
+          inputSchema: WhiteboxAttackSurfaceResultSchema,
+          execute: async (results) => {
+            capturedResult = results;
+            return { success: true, message: "Results submitted." };
           }
-        };
-      }
+        })
+      },
+      resolveResult: async (streamResult) => {
+        const steps = await streamResult.steps;
+        const submitAttempted = steps.some((step) => step.toolCalls.some((call) => call.toolName === SUBMIT_RESULTS_TOOL_NAME));
+        return finalizeWhiteboxResult(capturedResult, submitAttempted);
+      },
+      prompt: buildPrompt(codebasePath, domains, base.session.config?.prompt)
     });
   }
 }
@@ -507,4 +510,4 @@ When finished, call \`submit_results\` with the complete structured output. Do N
 
 Begin now.`;
 }
-export { WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT, WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT, WHITEBOX_DISCOVERY_SYSTEM_PROMPT, RiskScoreBreakdownSchema, RiskScoreSchema, EndpointSchema, AppsDiscoveryResultSchema, DiscoverySummarySchema, WhiteboxAttackSurfaceAgent };
+export { WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT2, WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT, WHITEBOX_DISCOVERY_SYSTEM_PROMPT2, EndpointSchema2, AppsDiscoveryResultSchema2, DiscoverySummarySchema2, WhiteboxAttackSurfaceAgent2 };