@pensar/apex 2.4.0 → 2.5.0-canary.2512a649

package/build/cli-0nrxvm0t.js

@@ -0,0 +1,12 @@
+// src/core/agents/specialized/mobileOtpPrompt.ts
+var MOBILE_OTP_PROMPT_GUIDANCE = `## Mobile OTP credentials
+
+Read each credential's \`Authentication method\` before starting:
+- \`sms-passwordless\`: \`phoneNumber\` is the login identifier, not MFA after a password. Reserve immediately before filling that field, then request the code.
+- \`sms-mfa\`: fill username and password first. If submitting the password triggers the SMS code, reserve immediately before submitting. If it reveals a separate send-code action, reserve immediately before that action. Fill a destination phone field only if the target asks, using \`credentialId\` + \`credentialField="phoneNumber"\`.
+
+Never ask for, write, log, or pass a public phone number. Reserve with \`sms_list_messages\` and \`reserve=true\`; the Console chooses the shared number. A 429 means that number is busy: do not wait or poll inside the tool. Make at most two separate reservation attempts (with an \`execute_command\` sleep between them), then report the authentication block.
+
+At the action that sends the code, record \`Date.now()\` as \`sinceMs\`. Run \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with \`sinceMs\` and \`claim=true\`. If no message arrives, make one delayed list retry; otherwise report the result rather than waiting indefinitely. Fill the claimed OTP and continue. Do not report \`phone_verification\` as a barrier for either Mobile OTP flow. TOTP via an environment variable is unchanged.`;
+
+export { MOBILE_OTP_PROMPT_GUIDANCE };

package/build/{cli-gq40s5b3.js → cli-13bx8fdg.js}

@@ -1,14 +1,17 @@
+import {
+  MOBILE_OTP_PROMPT_GUIDANCE
+} from "./cli-0nrxvm0t.js";
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-nt8jrt7c.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-q8zkbvsn.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-0drqd790.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -377,49 +380,22 @@ function loadAttackSurfaceResults(resultsPath) {
 class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
   constructor(opts) {
     const {
-      model,
-      session,
-      authConfig,
+      target: targetOpt,
+      cwd,
+      surfaceIntegrationEnabled: _surfaceIntegrationEnabled,
       onStepFinish,
-      onCacheMetrics,
-      abortSignal,
-      attackSurfaceRegistry,
-      eventBus,
-      subagentId,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort
+      ...base
     } = opts;
-    const target = opts.target ?? opts.cwd;
-    const resultsPath = join(session.rootPath, "attack-surface-results.json");
-    const assetsPath = join(session.rootPath, "assets");
+    const target = targetOpt ?? cwd;
+    const { session } = base;
     const subagentFolder = join(session.rootPath, "subagents", "attack-surface-agent");
     if (!existsSync(subagentFolder)) {
       mkdirSync(subagentFolder, { recursive: true });
     }
     super({
-      system: detectOSAndEnhancePrompt(SYSTEM),
-      prompt: buildPrompt(target, session),
-      model,
-      session,
+      ...base,
       target,
-      authConfig,
-      onStepFinish: (e) => {
-        onStepFinish?.(e);
-        const messages = e.response.messages;
-        if (messages !== undefined) {
-          writeFileSync(join(subagentFolder, "attack-surface-agent.log"), JSON.stringify(messages, null, 2));
-        }
-      },
-      onCacheMetrics,
-      abortSignal,
-      attackSurfaceRegistry,
-      eventBus,
-      subagentId,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort,
-      messages: opts.messages,
+      system: detectOSAndEnhancePrompt(SYSTEM),
       activeTools: [
         "execute_command",
         "document_app",
@@ -438,6 +414,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -445,8 +422,9 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         hasToolCall("create_attack_surface_report"),
         stepCountIs(1e4)
       ],
-      toolChoice: "auto",
       resolveResult: () => {
+        const resultsPath = join(session.rootPath, "attack-surface-results.json");
+        const assetsPath = join(session.rootPath, "assets");
         let results = null;
         let targets = [];
         if (existsSync(resultsPath)) {
@@ -456,11 +434,19 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
           } catch {}
         }
         return { results, targets, resultsPath, assetsPath };
+      },
+      prompt: buildBlackboxPrompt(target, session),
+      onStepFinish: (e) => {
+        onStepFinish?.(e);
+        const messages = e.response.messages;
+        if (messages !== undefined) {
+          writeFileSync(join(subagentFolder, "attack-surface-agent.log"), JSON.stringify(messages, null, 2));
+        }
       }
     });
   }
 }
-function buildPrompt(target, session) {
+function buildBlackboxPrompt(target, session) {
   const scopeConstraints = session.config?.scopeConstraints;
   const authenticationInstructions = session.config?.authenticationInstructions;
   const enumerateSubdomains = session.config?.enumerateSubdomains ?? false;
@@ -483,6 +469,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
+${MOBILE_OTP_PROMPT_GUIDANCE}
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.
@@ -527,4 +514,4 @@ ${operatorGuidanceBlock}
 ${startDirective}`;
 }
 
-export { BlackboxAttackSurfaceAgent };
+export { BlackboxAttackSurfaceAgent, buildBlackboxPrompt };

package/build/cli-53rm0rrz.js

@@ -0,0 +1,15 @@
+import {
+  __commonJS,
+  __require
+} from "./cli-bc05qbss.js";
+
+// node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js
+var require_execAsync = __commonJS(function(exports) {
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.execAsync = undefined;
+  var child_process = __require("child_process");
+  var util = __require("util");
+  exports.execAsync = util.promisify(child_process.exec);
+});
+
+export { require_execAsync };

package/build/{cli-b1adytsy.js → cli-5s6jqck2.js}

@@ -1,15 +1,14 @@
 import {
-  EvidenceFileEntrySchema
-} from "./cli-qqt4gj1w.js";
-import {
+  AttackPathSchema,
   CweEntrySchema,
+  EvidenceFileEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-repbyhkk.js";
+} from "./cli-nt8jrt7c.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/report/schemas.ts
 init_zod();
@@ -27,7 +26,8 @@ var PentestReportFindingSchema = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 var PentestReportSchema = exports_external.object({
   version: exports_external.string().regex(/^1\.\d+$/),
@@ -86,7 +86,8 @@ function buildPentestReport(findings, context) {
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
       rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
     }))
   };
 }
@@ -141,6 +142,12 @@ function renderFinding(finding, metadata) {
     "",
     finding.impact,
     "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
     "## Evidence",
     "",
     "```",
@@ -187,6 +194,20 @@ function renderFinding(finding, metadata) {
   return lines.join(`
 `);
 }
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
 
 // src/core/report/index.ts
 var REPORT_FILENAME_MD = "pentest-report.md";

package/build/{cli-2cbwdk78.js → cli-5xh2zw52.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-0drqd790.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();