@pensar/apex 2.4.0 → 2.5.0-canary.2512a649

package/build/{cli-9rhzhgx2.js → cli-dkxwnmrz.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-vnynf0js.js";
+} from "./cli-h1xcrswb.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-0n4r54hq.js → cli-ewxfjn4c.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-72cvcqhg.js";
+} from "./cli-8k8wam9m.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-k8kc47pq.js → cli-fa5wxr8x.js}

@@ -2,16 +2,16 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-nt8jrt7c.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-tkc598ey.js";
+} from "./cli-0drqd790.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();
@@ -392,50 +392,25 @@ var WhiteboxAttackSurfaceResultSchema = exports_external.object({
 });
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
+var WHITEBOX_FALLBACK_RESULT = {
+  repoType: "unknown",
+  packageManager: "unknown",
+  apps: [],
+  summary: {
+    totalApps: 0,
+    totalPages: 0,
+    totalApiEndpoints: 0,
+    totalPentestObjectives: 0
+  }
+};
+
 class WhiteboxAttackSurfaceAgent extends OffensiveSecurityAgent {
   constructor(opts) {
-    const {
-      model,
-      codebasePath,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      attackSurfaceRegistry,
-      domains,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort
-    } = opts;
+    const { codebasePath, domains, ...base } = opts;
     let capturedResult = null;
-    const submitResultsTool = tool({
-      description: `Submit the final whitebox attack surface analysis results.
-
-Call this ONCE at the end with your complete structured findings.
-This ends the agent run — make sure all data is included.`,
-      inputSchema: WhiteboxAttackSurfaceResultSchema,
-      execute: async (results) => {
-        capturedResult = results;
-        return { success: true, message: "Results submitted." };
-      }
-    });
     super({
+      ...base,
       system: WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT,
-      prompt: buildPrompt(codebasePath, domains, session.config?.prompt),
-      model,
-      session,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      subagentName: opts.subagentName,
-      attackSurfaceRegistry,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort,
       activeTools: [
         "read_file",
         "list_files",
@@ -445,26 +420,23 @@ This ends the agent run — make sure all data is included.`,
         "spawn_coding_agent",
         "submit_results"
       ],
-      extraTools: {
-        submit_results: submitResultsTool
-      },
       stopWhen: hasToolCall("submit_results"),
-      resolveResult: () => {
-        if (capturedResult) {
-          return capturedResult;
-        }
-        return {
-          repoType: "unknown",
-          packageManager: "unknown",
-          apps: [],
-          summary: {
-            totalApps: 0,
-            totalPages: 0,
-            totalApiEndpoints: 0,
-            totalPentestObjectives: 0
+      extraTools: {
+        ...base.extraTools,
+        submit_results: tool({
+          description: `Submit the final whitebox attack surface analysis results.
+
+Call this ONCE at the end with your complete structured findings.
+This ends the agent run — make sure all data is included.`,
+          inputSchema: WhiteboxAttackSurfaceResultSchema,
+          execute: async (results) => {
+            capturedResult = results;
+            return { success: true, message: "Results submitted." };
           }
-        };
-      }
+        })
+      },
+      resolveResult: () => capturedResult ?? WHITEBOX_FALLBACK_RESULT,
+      prompt: buildPrompt(codebasePath, domains, base.session.config?.prompt)
     });
   }
 }

package/build/{cli-xshasbwe.js → cli-g9xm89jx.js}

@@ -1,9 +1,12 @@
+import {
+  MOBILE_OTP_PROMPT_GUIDANCE
+} from "./cli-0nrxvm0t.js";
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-nt8jrt7c.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-q8zkbvsn.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +14,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-0drqd790.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -141,6 +144,11 @@ every 30 seconds, so run this immediately before filling the field. If the code
 retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
 or two fresh codes are both rejected.
 
+${MOBILE_OTP_PROMPT_GUIDANCE}
+
+TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
+app code.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -191,42 +199,12 @@ var log = scopedLogger(() => createLogger("authentication-agent"));
 
 class AuthenticationAgent extends OffensiveSecurityAgent {
   constructor(opts) {
-    const {
-      model,
-      target,
-      session,
-      authHints,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      context,
-      environmentVariables,
-      secretValues,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort
-    } = opts;
+    const { target, authHints, context, ...base } = opts;
+    const { session } = base;
     const cm = session.credentialManager;
     super({
+      ...base,
       system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
-      model,
-      session,
-      target,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      subagentName: opts.subagentName,
-      environmentVariables,
-      secretValues,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort,
-      toolChoice: "auto",
       activeTools: [
         "execute_command",
         "complete_authentication",
@@ -243,14 +221,14 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
       stopWhen: hasToolCall("complete_authentication"),
-      resolveResult: () => {
-        const authDataPath = join(session.rootPath, "auth", "auth-data.json");
-        return loadAuthResult(authDataPath);
-      }
+      resolveResult: () => loadAuthResult(join(session.rootPath, "auth", "auth-data.json")),
+      target,
+      prompt: buildAuthPrompt(target, authHints, cm, context, base.environmentVariables ? Object.keys(base.environmentVariables) : undefined)
     });
   }
 }
@@ -328,6 +306,10 @@ function buildAuthPrompt(target, authHints, credentialManager, context, envVarNa
     parts.push("");
   }
   if (credBlock) {
+    const hasMobileOtp = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasMobileOtp ? `
+${MOBILE_OTP_PROMPT_GUIDANCE}
+` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -335,7 +317,7 @@ You have credentials available via credential IDs — authenticate immediately.
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
-
+${smsInstructions}
 The credentials above were provided to you and have already been verified — they are SHARED across runs, so
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or
@@ -361,7 +343,4 @@ async function runAuthenticationAgent(input) {
   return result;
 }
 
-// src/core/api/authentication.ts
-var runAuthenticationAgent2 = runAuthenticationAgent;
-
-export { runAuthenticationAgent2 as runAuthenticationAgent };
+export { AuthenticationAgent, runAuthenticationAgent };

package/build/{cli-vnynf0js.js → cli-h1xcrswb.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-bc05qbss.js";
 
 // package.json
-var package_default;
+var version = "2.5.0-canary.2512a649", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",
@@ -23,6 +23,10 @@ var init_package = __esm(() => {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "@openrouter/ai-sdk-provider": "^2.9.1",
       "@opentelemetry/api": "^1.9.1",
+      "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+      "@opentelemetry/otlp-exporter-base": "^0.221.0",
+      "@opentelemetry/otlp-transformer": "^0.221.0",
+      "@opentelemetry/resources": "^2.10.0",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.3.0",
@@ -46,6 +50,8 @@ var init_package = __esm(() => {
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
+      "@opentelemetry/context-async-hooks": "^2.10.0",
+      "@opentelemetry/sdk-trace-base": "^2.10.0",
       "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
@@ -92,7 +98,7 @@ var init_package = __esm(() => {
       url: "https://github.com/pensarai/apex.git"
     },
     scripts: {
-      build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
+      build: "rm -rf build && bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
       "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
       "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
       "build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
@@ -120,7 +126,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.4.0"
+    version
   };
 });
 
@@ -195,4 +201,4 @@ var init_installation = __esm(() => {
   init_package();
 });
 
-export { init_package, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
+export { init_package, version, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };