@pensar/apex 2.4.0 → 2.5.0-canary.2bbb0f6f
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/agent-20hb6mg7.js +20 -0
- package/build/{agent-5ejt5vpz.js → agent-71sn1cjn.js} +9 -8
- package/build/{agent-nhs1w5w0.js → agent-xnrz4bhp.js} +11 -10
- package/build/{apps-17wvz1d7.js → apps-ghf7kp1s.js} +72 -31
- package/build/{auth-z3h9859n.js → auth-p1nrv7re.js} +25 -20
- package/build/authentication-m1vj2f0s.js +20 -0
- package/build/blackboxAgent-hjfzgk93.js +20 -0
- package/build/blackboxPentest-9snp9gvp.js +70 -0
- package/build/{cli-0n4r54hq.js → cli-08fcc6d8.js} +1 -1
- package/build/{cli-gq40s5b3.js → cli-14j00zfh.js} +5 -3
- package/build/{cli-vnynf0js.js → cli-3bmqdcfh.js} +10 -4
- package/build/{cli-mavved45.js → cli-3ew5fs3f.js} +46 -25
- package/build/{cli-xshasbwe.js → cli-4mgj070h.js} +30 -4
- package/build/{cli-repbyhkk.js → cli-4vwnsyep.js} +1141 -525
- package/build/cli-53rm0rrz.js +15 -0
- package/build/cli-68260ckj.js +12136 -0
- package/build/cli-7q3ae3ft.js +6 -0
- package/build/{cli-5k33webc.js → cli-7sqb16dd.js} +45 -43
- package/build/{cli-9rhzhgx2.js → cli-8pk8znhw.js} +1 -1
- package/build/cli-9pbk8m32.js +32 -0
- package/build/{cli-72cvcqhg.js → cli-9ya3yktn.js} +1 -1
- package/build/{cli-vq52kp7j.js → cli-a8n64cef.js} +23 -5
- package/build/{cli-qqt4gj1w.js → cli-a9vq54sx.js} +5 -3
- package/build/{cli-swpbx60z.js → cli-avmhkjtv.js} +1 -1481
- package/build/{cli-tkc598ey.js → cli-f47dgye3.js} +411 -280
- package/build/{cli-k8kc47pq.js → cli-fw7sp0fp.js} +3 -3
- package/build/{cli-32z0017y.js → cli-g3cb8pj5.js} +2 -2
- package/build/{cli-tznv8pf1.js → cli-gbch9xmy.js} +1 -1
- package/build/cli-knd276ed.js +1485 -0
- package/build/{cli-2cbwdk78.js → cli-t7rhyqx5.js} +1 -1
- package/build/{cli-b1adytsy.js → cli-yge44bmk.js} +28 -5
- package/build/cli.js +641 -95
- package/build/{config-f1mj4nhd.js → config-cqw98n5y.js} +18 -15
- package/build/{doctor-ekneewa3.js → doctor-vzh1wmfa.js} +8 -7
- package/build/{fastStrike-8zka43xs.js → fastStrike-f441e9nr.js} +13 -10
- package/build/{fixes-b89s5haw.js → fixes-xxz52cf2.js} +25 -20
- package/build/getMachineId-bsd-xj3bn2fv.js +36 -0
- package/build/getMachineId-darwin-07jzjcx6.js +36 -0
- package/build/getMachineId-linux-ahngynxd.js +29 -0
- package/build/getMachineId-unsupported-vy43b44z.js +19 -0
- package/build/getMachineId-win-8x66cynz.js +38 -0
- package/build/{index-ghwf5z3v.js → index-23jj0234.js} +3 -3
- package/build/{index-6d22pyxt.js → index-3gavwzay.js} +1756 -1213
- package/build/{index-4ad3sdwk.js → index-4v5jc2td.js} +4 -4
- package/build/{index-mtq7kmxz.js → index-5wh7gq37.js} +4 -2
- package/build/{index-sf16jm0m.js → index-e7kq5rrd.js} +9 -7
- package/build/{index-rbzhk712.js → index-fxx38nc9.js} +11 -10
- package/build/{index-hqjdg6fg.js → index-j3dc7dks.js} +17 -9
- package/build/{index-y5w6n3tb.js → index-yc1dnj3n.js} +2 -2
- package/build/{issues-xx5bs4md.js → issues-zdag9ayw.js} +82 -26
- package/build/{logs-qtxe51w2.js → logs-f492cjgt.js} +25 -20
- package/build/{offesecAgent-b9e2xm6v.js → offesecAgent-pr0cmrqb.js} +10 -9
- package/build/pentest-1g3fzah5.js +30 -0
- package/build/{pentests-6ks3szc4.js → pentests-vstpzh9j.js} +26 -21
- package/build/{targetedPentest-s1ptvq8e.js → targetedPentest-wj3ae355.js} +11 -10
- package/build/{targets-sxygyj87.js → targets-806zxf1n.js} +27 -22
- package/build/threatModel-dc4jbhkf.js +29 -0
- package/build/{uninstall-tvsh81v8.js → uninstall-58ak2e2v.js} +6 -3
- package/build/{upload-7wdyyqmr.js → upload-kkktzh83.js} +8 -7
- package/build/{utils-7fwdkqk6.js → utils-1sawtwbj.js} +7 -6
- package/package.json +8 -2
- package/build/agent-mvpgvgks.js +0 -19
- package/build/authentication-3s97cpk4.js +0 -19
- package/build/blackboxAgent-gw0a1ca4.js +0 -19
- package/build/blackboxPentest-44333zss.js +0 -37
- package/build/main-mmjp338j.js +0 -324
- package/build/pentest-xtc1sjdw.js +0 -29
- package/build/threatModel-xsm6fwk5.js +0 -27
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import {
|
|
2
|
+
CodeAgent
|
|
3
|
+
} from "./cli-g3cb8pj5.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-a9vq54sx.js";
|
|
6
|
+
import"./cli-4vwnsyep.js";
|
|
7
|
+
import"./cli-gbch9xmy.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-f47dgye3.js";
|
|
10
|
+
import"./cli-08fcc6d8.js";
|
|
11
|
+
import"./cli-avmhkjtv.js";
|
|
12
|
+
import"./cli-j54qa6tm.js";
|
|
13
|
+
import"./cli-9ya3yktn.js";
|
|
14
|
+
import"./cli-8pk8znhw.js";
|
|
15
|
+
import"./cli-3bmqdcfh.js";
|
|
16
|
+
import"./cli-knd276ed.js";
|
|
17
|
+
import"./cli-bc05qbss.js";
|
|
18
|
+
export {
|
|
19
|
+
CodeAgent
|
|
20
|
+
};
|
|
@@ -1,23 +1,24 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-4vwnsyep.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-gbch9xmy.js";
|
|
7
7
|
import"./cli-c8131c4q.js";
|
|
8
8
|
import {
|
|
9
9
|
init_dist,
|
|
10
10
|
stepCountIs
|
|
11
|
-
} from "./cli-
|
|
12
|
-
import"./cli-
|
|
11
|
+
} from "./cli-f47dgye3.js";
|
|
12
|
+
import"./cli-08fcc6d8.js";
|
|
13
13
|
import {
|
|
14
14
|
exports_external,
|
|
15
15
|
init_zod
|
|
16
|
-
} from "./cli-
|
|
16
|
+
} from "./cli-avmhkjtv.js";
|
|
17
17
|
import"./cli-j54qa6tm.js";
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
18
|
+
import"./cli-9ya3yktn.js";
|
|
19
|
+
import"./cli-8pk8znhw.js";
|
|
20
|
+
import"./cli-3bmqdcfh.js";
|
|
21
|
+
import"./cli-knd276ed.js";
|
|
21
22
|
import"./cli-bc05qbss.js";
|
|
22
23
|
|
|
23
24
|
// src/core/agents/specialized/findingJudge/agent.ts
|
|
@@ -5,19 +5,20 @@ import {
|
|
|
5
5
|
buildPentestPrompt,
|
|
6
6
|
buildPentestSystemPrompt,
|
|
7
7
|
resolvePentestAgentRole
|
|
8
|
-
} from "./cli-
|
|
8
|
+
} from "./cli-3ew5fs3f.js";
|
|
9
9
|
import"./cli-9fsre5pt.js";
|
|
10
|
-
import"./cli-
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
10
|
+
import"./cli-a9vq54sx.js";
|
|
11
|
+
import"./cli-4vwnsyep.js";
|
|
12
|
+
import"./cli-gbch9xmy.js";
|
|
13
13
|
import"./cli-c8131c4q.js";
|
|
14
|
-
import"./cli-
|
|
15
|
-
import"./cli-
|
|
16
|
-
import"./cli-
|
|
14
|
+
import"./cli-f47dgye3.js";
|
|
15
|
+
import"./cli-08fcc6d8.js";
|
|
16
|
+
import"./cli-avmhkjtv.js";
|
|
17
17
|
import"./cli-j54qa6tm.js";
|
|
18
|
-
import"./cli-
|
|
19
|
-
import"./cli-
|
|
20
|
-
import"./cli-
|
|
18
|
+
import"./cli-9ya3yktn.js";
|
|
19
|
+
import"./cli-8pk8znhw.js";
|
|
20
|
+
import"./cli-3bmqdcfh.js";
|
|
21
|
+
import"./cli-knd276ed.js";
|
|
21
22
|
import"./cli-bc05qbss.js";
|
|
22
23
|
export {
|
|
23
24
|
PentestResponseSchema,
|
|
@@ -1,38 +1,46 @@
|
|
|
1
1
|
#!/usr/bin/env bun
|
|
2
|
-
import
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
2
|
+
import {
|
|
3
|
+
markCommandFailed
|
|
4
|
+
} from "./cli-7q3ae3ft.js";
|
|
5
|
+
import"./cli-a8n64cef.js";
|
|
6
|
+
import"./cli-9pbk8m32.js";
|
|
7
|
+
import"./cli-7sqb16dd.js";
|
|
8
|
+
import"./cli-fw7sp0fp.js";
|
|
9
|
+
import"./cli-14j00zfh.js";
|
|
10
|
+
import"./cli-3ew5fs3f.js";
|
|
11
|
+
import"./cli-yge44bmk.js";
|
|
12
|
+
import"./cli-4mgj070h.js";
|
|
13
|
+
import"./cli-g3cb8pj5.js";
|
|
10
14
|
import"./cli-9fsre5pt.js";
|
|
11
|
-
import"./cli-
|
|
15
|
+
import"./cli-a9vq54sx.js";
|
|
12
16
|
import {
|
|
17
|
+
ENDPOINT_TRANSPORTS,
|
|
13
18
|
createApp,
|
|
19
|
+
createDomain,
|
|
14
20
|
createEndpoint,
|
|
15
21
|
deleteApp,
|
|
16
22
|
deleteEndpoint,
|
|
17
23
|
getApp,
|
|
18
24
|
getEndpoint,
|
|
19
25
|
listApps,
|
|
26
|
+
listDomains,
|
|
20
27
|
listEndpoints,
|
|
21
28
|
searchApps,
|
|
22
29
|
searchEndpoints,
|
|
23
30
|
updateApp,
|
|
24
31
|
updateEndpoint
|
|
25
|
-
} from "./cli-
|
|
26
|
-
import"./cli-
|
|
32
|
+
} from "./cli-4vwnsyep.js";
|
|
33
|
+
import"./cli-gbch9xmy.js";
|
|
27
34
|
import"./cli-fw5r7pfj.js";
|
|
28
35
|
import"./cli-c8131c4q.js";
|
|
29
|
-
import"./cli-
|
|
30
|
-
import"./cli-
|
|
31
|
-
import"./cli-
|
|
36
|
+
import"./cli-f47dgye3.js";
|
|
37
|
+
import"./cli-08fcc6d8.js";
|
|
38
|
+
import"./cli-avmhkjtv.js";
|
|
32
39
|
import"./cli-j54qa6tm.js";
|
|
33
|
-
import"./cli-
|
|
34
|
-
import"./cli-
|
|
35
|
-
import"./cli-
|
|
40
|
+
import"./cli-9ya3yktn.js";
|
|
41
|
+
import"./cli-8pk8znhw.js";
|
|
42
|
+
import"./cli-3bmqdcfh.js";
|
|
43
|
+
import"./cli-knd276ed.js";
|
|
36
44
|
import"./cli-bc05qbss.js";
|
|
37
45
|
|
|
38
46
|
// src/cli/apps.ts
|
|
@@ -88,6 +96,14 @@ function parseEndpointType(value) {
|
|
|
88
96
|
}
|
|
89
97
|
return value;
|
|
90
98
|
}
|
|
99
|
+
function parseTransport(value) {
|
|
100
|
+
if (value === undefined)
|
|
101
|
+
return;
|
|
102
|
+
if (!ENDPOINT_TRANSPORTS.includes(value)) {
|
|
103
|
+
throw new Error(`Invalid --transport "${value}". Must be one of: ${ENDPOINT_TRANSPORTS.join(", ")}`);
|
|
104
|
+
}
|
|
105
|
+
return value;
|
|
106
|
+
}
|
|
91
107
|
function parseInteger(flag, value) {
|
|
92
108
|
if (value === undefined)
|
|
93
109
|
return;
|
|
@@ -117,6 +133,8 @@ Usage:
|
|
|
117
133
|
pensar apps create [options] Create an app
|
|
118
134
|
pensar apps update <appId> [options] Update an app
|
|
119
135
|
pensar apps delete <appId> Delete an app
|
|
136
|
+
pensar apps domains List workspace domains
|
|
137
|
+
pensar apps domain-create <domain> Create/resolve a domain
|
|
120
138
|
pensar apps endpoints <appId> [filters] List endpoints
|
|
121
139
|
pensar apps endpoint <endpointId> Show endpoint details
|
|
122
140
|
pensar apps endpoint-create <appId> [options] Create an endpoint
|
|
@@ -130,9 +148,13 @@ App fields (create requires --name and --description):
|
|
|
130
148
|
--description <text> Application description
|
|
131
149
|
--type <type> One of: ${APPLICATION_TYPES.join(", ")}
|
|
132
150
|
--framework <text> Framework / runtime hint
|
|
133
|
-
--domain <id> Linked domain UUID
|
|
151
|
+
--domain <id> Linked domain UUID (see "apps domains")
|
|
134
152
|
--disallowed-actions <text> Free-form disallowed actions notes
|
|
135
153
|
|
|
154
|
+
Domains:
|
|
155
|
+
API-created domains are canonicalized and created idempotently by Console.
|
|
156
|
+
They stay unverified and do not start reconnaissance.
|
|
157
|
+
|
|
136
158
|
List pagination (for "apps" and "endpoints <appId>"):
|
|
137
159
|
--limit <n> Page size (default 100, max 200)
|
|
138
160
|
--offset <n> Page offset (default 0)
|
|
@@ -158,6 +180,8 @@ Endpoint fields (create requires --endpoint and --description):
|
|
|
158
180
|
--endpoint <text> Endpoint path / URL / route
|
|
159
181
|
--description <text> Endpoint description
|
|
160
182
|
--type <type> One of: ${ENDPOINT_TYPES.join(", ")}
|
|
183
|
+
--transport <transport> One of: ${ENDPOINT_TRANSPORTS.join(", ")}
|
|
184
|
+
(defaults to http when omitted)
|
|
161
185
|
--location <text> Source file (whitebox)
|
|
162
186
|
--start-line <n> Start line number
|
|
163
187
|
--end-line <n> End line number
|
|
@@ -235,6 +259,7 @@ function parseEndpointCreateOptions(argv) {
|
|
|
235
259
|
if (description === undefined)
|
|
236
260
|
throw new Error("--description is required");
|
|
237
261
|
const type = parseEndpointType(getFlag("--type", argv));
|
|
262
|
+
const transport = parseTransport(getFlag("--transport", argv));
|
|
238
263
|
const location = getFlag("--location", argv);
|
|
239
264
|
const startLineNumber = parseInteger("--start-line", getFlag("--start-line", argv));
|
|
240
265
|
const endLineNumber = parseInteger("--end-line", getFlag("--end-line", argv));
|
|
@@ -246,6 +271,7 @@ function parseEndpointCreateOptions(argv) {
|
|
|
246
271
|
endpoint,
|
|
247
272
|
description,
|
|
248
273
|
...type !== undefined ? { type } : {},
|
|
274
|
+
...transport !== undefined ? { transport } : {},
|
|
249
275
|
...location !== undefined ? { location } : {},
|
|
250
276
|
...startLineNumber !== undefined ? { startLineNumber } : {},
|
|
251
277
|
...endLineNumber !== undefined ? { endLineNumber } : {},
|
|
@@ -269,6 +295,9 @@ function parseEndpointUpdateOptions(argv) {
|
|
|
269
295
|
const type = parseEndpointType(getFlag("--type", argv));
|
|
270
296
|
if (type !== undefined)
|
|
271
297
|
update.type = type;
|
|
298
|
+
const transport = parseTransport(getFlag("--transport", argv));
|
|
299
|
+
if (transport !== undefined)
|
|
300
|
+
update.transport = transport;
|
|
272
301
|
const location = getFlag("--location", argv);
|
|
273
302
|
if (location !== undefined)
|
|
274
303
|
update.location = location;
|
|
@@ -305,7 +334,7 @@ async function main() {
|
|
|
305
334
|
if (!appId) {
|
|
306
335
|
console.error("Error: app ID is required");
|
|
307
336
|
console.error("Usage: pensar apps get <appId>");
|
|
308
|
-
|
|
337
|
+
return markCommandFailed();
|
|
309
338
|
}
|
|
310
339
|
const app = await getApp(appId);
|
|
311
340
|
console.log(JSON.stringify(app, null, 2));
|
|
@@ -318,7 +347,7 @@ async function main() {
|
|
|
318
347
|
if (!appId) {
|
|
319
348
|
console.error("Error: app ID is required");
|
|
320
349
|
console.error("Usage: pensar apps update <appId> [options]");
|
|
321
|
-
|
|
350
|
+
return markCommandFailed();
|
|
322
351
|
}
|
|
323
352
|
const opts = parseAppUpdateOptions(args);
|
|
324
353
|
const result = await updateApp(appId, opts);
|
|
@@ -328,16 +357,28 @@ async function main() {
|
|
|
328
357
|
if (!appId) {
|
|
329
358
|
console.error("Error: app ID is required");
|
|
330
359
|
console.error("Usage: pensar apps delete <appId>");
|
|
331
|
-
|
|
360
|
+
return markCommandFailed();
|
|
332
361
|
}
|
|
333
362
|
const result = await deleteApp(appId);
|
|
334
363
|
console.log(JSON.stringify(result, null, 2));
|
|
364
|
+
} else if (sub === "domains") {
|
|
365
|
+
const result = await listDomains();
|
|
366
|
+
console.log(JSON.stringify(result, null, 2));
|
|
367
|
+
} else if (sub === "domain-create") {
|
|
368
|
+
const url = args[1];
|
|
369
|
+
if (!url) {
|
|
370
|
+
console.error("Error: domain is required");
|
|
371
|
+
console.error("Usage: pensar apps domain-create <domain>");
|
|
372
|
+
return markCommandFailed();
|
|
373
|
+
}
|
|
374
|
+
const result = await createDomain({ url });
|
|
375
|
+
console.log(JSON.stringify(result, null, 2));
|
|
335
376
|
} else if (sub === "endpoints") {
|
|
336
377
|
const appId = args[1];
|
|
337
378
|
if (!appId) {
|
|
338
379
|
console.error("Error: app ID is required");
|
|
339
380
|
console.error("Usage: pensar apps endpoints <appId> [filters]");
|
|
340
|
-
|
|
381
|
+
return markCommandFailed();
|
|
341
382
|
}
|
|
342
383
|
const type = parseEndpointType(getFlag("--type", args));
|
|
343
384
|
const minRiskScore = parseNumber("--min-risk", getFlag("--min-risk", args));
|
|
@@ -356,7 +397,7 @@ async function main() {
|
|
|
356
397
|
if (!endpointId) {
|
|
357
398
|
console.error("Error: endpoint ID is required");
|
|
358
399
|
console.error("Usage: pensar apps endpoint <endpointId>");
|
|
359
|
-
|
|
400
|
+
return markCommandFailed();
|
|
360
401
|
}
|
|
361
402
|
const result = await getEndpoint(endpointId);
|
|
362
403
|
console.log(JSON.stringify(result, null, 2));
|
|
@@ -365,7 +406,7 @@ async function main() {
|
|
|
365
406
|
if (!appId) {
|
|
366
407
|
console.error("Error: app ID is required");
|
|
367
408
|
console.error("Usage: pensar apps endpoint-create <appId> --endpoint E --description D");
|
|
368
|
-
|
|
409
|
+
return markCommandFailed();
|
|
369
410
|
}
|
|
370
411
|
const opts = parseEndpointCreateOptions(args);
|
|
371
412
|
const result = await createEndpoint(appId, opts);
|
|
@@ -375,7 +416,7 @@ async function main() {
|
|
|
375
416
|
if (!endpointId) {
|
|
376
417
|
console.error("Error: endpoint ID is required");
|
|
377
418
|
console.error("Usage: pensar apps endpoint-update <endpointId> [options]");
|
|
378
|
-
|
|
419
|
+
return markCommandFailed();
|
|
379
420
|
}
|
|
380
421
|
const opts = parseEndpointUpdateOptions(args);
|
|
381
422
|
const result = await updateEndpoint(endpointId, opts);
|
|
@@ -385,7 +426,7 @@ async function main() {
|
|
|
385
426
|
if (!endpointId) {
|
|
386
427
|
console.error("Error: endpoint ID is required");
|
|
387
428
|
console.error("Usage: pensar apps endpoint-delete <endpointId>");
|
|
388
|
-
|
|
429
|
+
return markCommandFailed();
|
|
389
430
|
}
|
|
390
431
|
const result = await deleteEndpoint(endpointId);
|
|
391
432
|
console.log(JSON.stringify(result, null, 2));
|
|
@@ -394,7 +435,7 @@ async function main() {
|
|
|
394
435
|
if (!query || query.startsWith("--")) {
|
|
395
436
|
console.error("Error: search query is required");
|
|
396
437
|
console.error("Usage: pensar apps search <query> [options]");
|
|
397
|
-
|
|
438
|
+
return markCommandFailed();
|
|
398
439
|
}
|
|
399
440
|
const type = parseAppType(getFlag("--type", args));
|
|
400
441
|
const limit = parseInteger("--limit", getFlag("--limit", args));
|
|
@@ -410,7 +451,7 @@ async function main() {
|
|
|
410
451
|
if (!query || query.startsWith("--")) {
|
|
411
452
|
console.error("Error: search query is required");
|
|
412
453
|
console.error("Usage: pensar apps search-endpoints <query> [options]");
|
|
413
|
-
|
|
454
|
+
return markCommandFailed();
|
|
414
455
|
}
|
|
415
456
|
const applicationId = getFlag("--app", args);
|
|
416
457
|
const type = parseEndpointType(getFlag("--type", args));
|
|
@@ -438,12 +479,12 @@ async function main() {
|
|
|
438
479
|
} else {
|
|
439
480
|
console.error(`Error: Unknown subcommand "${sub}"`);
|
|
440
481
|
showHelp();
|
|
441
|
-
|
|
482
|
+
return markCommandFailed();
|
|
442
483
|
}
|
|
443
484
|
} catch (err) {
|
|
444
485
|
console.error(`
|
|
445
486
|
Error: ${err instanceof Error ? err.message : String(err)}`);
|
|
446
|
-
|
|
487
|
+
return markCommandFailed();
|
|
447
488
|
}
|
|
448
489
|
}
|
|
449
|
-
main();
|
|
490
|
+
await main();
|
|
@@ -1,19 +1,23 @@
|
|
|
1
1
|
#!/usr/bin/env bun
|
|
2
|
-
import
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import"./cli-
|
|
6
|
-
import"./cli-
|
|
7
|
-
import"./cli-
|
|
8
|
-
import"./cli-
|
|
9
|
-
import"./cli-
|
|
2
|
+
import {
|
|
3
|
+
markCommandFailed
|
|
4
|
+
} from "./cli-7q3ae3ft.js";
|
|
5
|
+
import"./cli-a8n64cef.js";
|
|
6
|
+
import"./cli-9pbk8m32.js";
|
|
7
|
+
import"./cli-7sqb16dd.js";
|
|
8
|
+
import"./cli-fw7sp0fp.js";
|
|
9
|
+
import"./cli-14j00zfh.js";
|
|
10
|
+
import"./cli-3ew5fs3f.js";
|
|
11
|
+
import"./cli-yge44bmk.js";
|
|
12
|
+
import"./cli-4mgj070h.js";
|
|
13
|
+
import"./cli-g3cb8pj5.js";
|
|
10
14
|
import"./cli-9fsre5pt.js";
|
|
11
|
-
import"./cli-
|
|
12
|
-
import"./cli-
|
|
13
|
-
import"./cli-
|
|
15
|
+
import"./cli-a9vq54sx.js";
|
|
16
|
+
import"./cli-4vwnsyep.js";
|
|
17
|
+
import"./cli-gbch9xmy.js";
|
|
14
18
|
import"./cli-fw5r7pfj.js";
|
|
15
19
|
import"./cli-c8131c4q.js";
|
|
16
|
-
import"./cli-
|
|
20
|
+
import"./cli-f47dgye3.js";
|
|
17
21
|
import {
|
|
18
22
|
createWorkspaceSelection,
|
|
19
23
|
disconnect,
|
|
@@ -29,15 +33,16 @@ import {
|
|
|
29
33
|
pollWorkspaceSelection,
|
|
30
34
|
selectWorkspace,
|
|
31
35
|
startDeviceFlow
|
|
32
|
-
} from "./cli-
|
|
33
|
-
import"./cli-
|
|
36
|
+
} from "./cli-08fcc6d8.js";
|
|
37
|
+
import"./cli-avmhkjtv.js";
|
|
34
38
|
import"./cli-j54qa6tm.js";
|
|
35
39
|
import {
|
|
36
40
|
config,
|
|
37
41
|
init_config
|
|
38
|
-
} from "./cli-
|
|
39
|
-
import"./cli-
|
|
40
|
-
import"./cli-
|
|
42
|
+
} from "./cli-9ya3yktn.js";
|
|
43
|
+
import"./cli-8pk8znhw.js";
|
|
44
|
+
import"./cli-3bmqdcfh.js";
|
|
45
|
+
import"./cli-knd276ed.js";
|
|
41
46
|
import {
|
|
42
47
|
__require
|
|
43
48
|
} from "./cli-bc05qbss.js";
|
|
@@ -300,12 +305,12 @@ async function main() {
|
|
|
300
305
|
} else {
|
|
301
306
|
console.error(`Unknown auth subcommand: ${subcommand}`);
|
|
302
307
|
console.error("Run 'pensar login --help' for usage information");
|
|
303
|
-
|
|
308
|
+
return markCommandFailed();
|
|
304
309
|
}
|
|
305
310
|
} catch (err) {
|
|
306
311
|
console.error(`
|
|
307
312
|
Error: ${err instanceof Error ? err.message : String(err)}`);
|
|
308
|
-
|
|
313
|
+
return markCommandFailed();
|
|
309
314
|
}
|
|
310
315
|
}
|
|
311
|
-
main();
|
|
316
|
+
await main();
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import {
|
|
2
|
+
runAuthenticationAgent
|
|
3
|
+
} from "./cli-4mgj070h.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-a9vq54sx.js";
|
|
6
|
+
import"./cli-4vwnsyep.js";
|
|
7
|
+
import"./cli-gbch9xmy.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-f47dgye3.js";
|
|
10
|
+
import"./cli-08fcc6d8.js";
|
|
11
|
+
import"./cli-avmhkjtv.js";
|
|
12
|
+
import"./cli-j54qa6tm.js";
|
|
13
|
+
import"./cli-9ya3yktn.js";
|
|
14
|
+
import"./cli-8pk8znhw.js";
|
|
15
|
+
import"./cli-3bmqdcfh.js";
|
|
16
|
+
import"./cli-knd276ed.js";
|
|
17
|
+
import"./cli-bc05qbss.js";
|
|
18
|
+
export {
|
|
19
|
+
runAuthenticationAgent
|
|
20
|
+
};
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
import {
|
|
2
|
+
BlackboxAttackSurfaceAgent
|
|
3
|
+
} from "./cli-14j00zfh.js";
|
|
4
|
+
import"./cli-9fsre5pt.js";
|
|
5
|
+
import"./cli-a9vq54sx.js";
|
|
6
|
+
import"./cli-4vwnsyep.js";
|
|
7
|
+
import"./cli-gbch9xmy.js";
|
|
8
|
+
import"./cli-c8131c4q.js";
|
|
9
|
+
import"./cli-f47dgye3.js";
|
|
10
|
+
import"./cli-08fcc6d8.js";
|
|
11
|
+
import"./cli-avmhkjtv.js";
|
|
12
|
+
import"./cli-j54qa6tm.js";
|
|
13
|
+
import"./cli-9ya3yktn.js";
|
|
14
|
+
import"./cli-8pk8znhw.js";
|
|
15
|
+
import"./cli-3bmqdcfh.js";
|
|
16
|
+
import"./cli-knd276ed.js";
|
|
17
|
+
import"./cli-bc05qbss.js";
|
|
18
|
+
export {
|
|
19
|
+
BlackboxAttackSurfaceAgent
|
|
20
|
+
};
|
|
@@ -0,0 +1,70 @@
|
|
|
1
|
+
import {
|
|
2
|
+
EMPTY_SESSION_TOKEN_USAGE,
|
|
3
|
+
accumulateSessionTokens
|
|
4
|
+
} from "./cli-9pbk8m32.js";
|
|
5
|
+
import {
|
|
6
|
+
readExecutionMetrics,
|
|
7
|
+
runPentestWorkflow,
|
|
8
|
+
writeExecutionMetrics
|
|
9
|
+
} from "./cli-7sqb16dd.js";
|
|
10
|
+
import"./cli-fw7sp0fp.js";
|
|
11
|
+
import"./cli-14j00zfh.js";
|
|
12
|
+
import"./cli-3ew5fs3f.js";
|
|
13
|
+
import"./cli-yge44bmk.js";
|
|
14
|
+
import"./cli-g3cb8pj5.js";
|
|
15
|
+
import"./cli-9fsre5pt.js";
|
|
16
|
+
import"./cli-a9vq54sx.js";
|
|
17
|
+
import"./cli-4vwnsyep.js";
|
|
18
|
+
import"./cli-gbch9xmy.js";
|
|
19
|
+
import"./cli-fw5r7pfj.js";
|
|
20
|
+
import"./cli-c8131c4q.js";
|
|
21
|
+
import"./cli-f47dgye3.js";
|
|
22
|
+
import"./cli-08fcc6d8.js";
|
|
23
|
+
import"./cli-avmhkjtv.js";
|
|
24
|
+
import"./cli-j54qa6tm.js";
|
|
25
|
+
import"./cli-9ya3yktn.js";
|
|
26
|
+
import"./cli-8pk8znhw.js";
|
|
27
|
+
import"./cli-3bmqdcfh.js";
|
|
28
|
+
import"./cli-knd276ed.js";
|
|
29
|
+
import"./cli-bc05qbss.js";
|
|
30
|
+
|
|
31
|
+
// src/core/api/blackboxPentest.ts
|
|
32
|
+
async function runPentestAgent(input) {
|
|
33
|
+
const persisted = readExecutionMetrics(input.session.rootPath)?.tokenUsage;
|
|
34
|
+
let tokenUsage = persisted ?? EMPTY_SESSION_TOKEN_USAGE;
|
|
35
|
+
const onStepFinish = async (event) => {
|
|
36
|
+
tokenUsage = accumulateSessionTokens(tokenUsage, event.usage ?? {});
|
|
37
|
+
await input.onStepFinish?.(event);
|
|
38
|
+
};
|
|
39
|
+
const onCacheMetrics = (metrics) => {
|
|
40
|
+
tokenUsage = accumulateSessionTokens(tokenUsage, {
|
|
41
|
+
cacheReadTokens: metrics.cacheReadInputTokens,
|
|
42
|
+
cacheWriteTokens: metrics.cacheCreationInputTokens
|
|
43
|
+
});
|
|
44
|
+
input.onCacheMetrics?.(metrics);
|
|
45
|
+
};
|
|
46
|
+
let result;
|
|
47
|
+
try {
|
|
48
|
+
result = await runPentestWorkflow({
|
|
49
|
+
...input,
|
|
50
|
+
onStepFinish,
|
|
51
|
+
onCacheMetrics
|
|
52
|
+
});
|
|
53
|
+
} finally {
|
|
54
|
+
writeExecutionMetrics({
|
|
55
|
+
sessionRootPath: input.session.rootPath,
|
|
56
|
+
tokenUsage
|
|
57
|
+
});
|
|
58
|
+
}
|
|
59
|
+
const { findings, findingsPath, pocsPath, reportPath } = result;
|
|
60
|
+
console.log(`
|
|
61
|
+
Found ${findings.length} vulnerabilities`);
|
|
62
|
+
console.log(`Findings: ${findingsPath}`);
|
|
63
|
+
console.log(`POCs: ${pocsPath}`);
|
|
64
|
+
if (reportPath)
|
|
65
|
+
console.log(`Report: ${reportPath}`);
|
|
66
|
+
return { findings, findingsPath, pocsPath, reportPath };
|
|
67
|
+
}
|
|
68
|
+
export {
|
|
69
|
+
runPentestAgent
|
|
70
|
+
};
|
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
import {
|
|
2
2
|
OffensiveSecurityAgent
|
|
3
|
-
} from "./cli-
|
|
3
|
+
} from "./cli-4vwnsyep.js";
|
|
4
4
|
import {
|
|
5
5
|
detectOSAndEnhancePrompt
|
|
6
|
-
} from "./cli-
|
|
6
|
+
} from "./cli-gbch9xmy.js";
|
|
7
7
|
import {
|
|
8
8
|
hasToolCall,
|
|
9
9
|
init_dist,
|
|
10
10
|
stepCountIs
|
|
11
|
-
} from "./cli-
|
|
11
|
+
} from "./cli-f47dgye3.js";
|
|
12
12
|
|
|
13
13
|
// src/core/agents/specialized/attackSurface/blackboxAgent.ts
|
|
14
14
|
init_dist();
|
|
@@ -438,6 +438,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
|
|
|
438
438
|
"email_search_messages",
|
|
439
439
|
"email_get_message",
|
|
440
440
|
"send_email",
|
|
441
|
+
"sms_list_messages",
|
|
441
442
|
"web_search",
|
|
442
443
|
"get_page"
|
|
443
444
|
],
|
|
@@ -483,6 +484,7 @@ ${authenticationInstructions}
|
|
|
483
484
|
Your FIRST tool call must be: browser_navigate to ${loginTarget}
|
|
484
485
|
Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
|
|
485
486
|
For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
|
|
487
|
+
When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
|
|
486
488
|
|
|
487
489
|
Do NOT run curl, nmap, dig, or any other command before completing login.
|
|
488
490
|
Include authentication information with EVERY target that requires it in your final report.
|
|
@@ -3,7 +3,7 @@ import {
|
|
|
3
3
|
} from "./cli-bc05qbss.js";
|
|
4
4
|
|
|
5
5
|
// package.json
|
|
6
|
-
var package_default;
|
|
6
|
+
var version = "2.5.0-canary.2bbb0f6f", package_default;
|
|
7
7
|
var init_package = __esm(() => {
|
|
8
8
|
package_default = {
|
|
9
9
|
author: "Pensar",
|
|
@@ -23,6 +23,10 @@ var init_package = __esm(() => {
|
|
|
23
23
|
"@modelcontextprotocol/sdk": "^1.29.0",
|
|
24
24
|
"@openrouter/ai-sdk-provider": "^2.9.1",
|
|
25
25
|
"@opentelemetry/api": "^1.9.1",
|
|
26
|
+
"@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
|
|
27
|
+
"@opentelemetry/otlp-exporter-base": "^0.221.0",
|
|
28
|
+
"@opentelemetry/otlp-transformer": "^0.221.0",
|
|
29
|
+
"@opentelemetry/resources": "^2.10.0",
|
|
26
30
|
"@opentui/core": "^0.1.107",
|
|
27
31
|
"@opentui/react": "^0.1.107",
|
|
28
32
|
"@pensar/surface": "0.3.0",
|
|
@@ -46,6 +50,8 @@ var init_package = __esm(() => {
|
|
|
46
50
|
description: "AI-powered penetration testing CLI tool with terminal UI",
|
|
47
51
|
devDependencies: {
|
|
48
52
|
"@biomejs/biome": "2.4.14",
|
|
53
|
+
"@opentelemetry/context-async-hooks": "^2.10.0",
|
|
54
|
+
"@opentelemetry/sdk-trace-base": "^2.10.0",
|
|
49
55
|
"@types/bun": "^1.3.14",
|
|
50
56
|
"@types/mailparser": "^3.4.6",
|
|
51
57
|
"@types/mime-types": "^3.0.1",
|
|
@@ -92,7 +98,7 @@ var init_package = __esm(() => {
|
|
|
92
98
|
url: "https://github.com/pensarai/apex.git"
|
|
93
99
|
},
|
|
94
100
|
scripts: {
|
|
95
|
-
build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
|
|
101
|
+
build: "rm -rf build && bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
|
|
96
102
|
"build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
|
|
97
103
|
"build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
|
|
98
104
|
"build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
|
|
@@ -120,7 +126,7 @@ var init_package = __esm(() => {
|
|
|
120
126
|
tsc: "tsc --noEmit"
|
|
121
127
|
},
|
|
122
128
|
type: "module",
|
|
123
|
-
version
|
|
129
|
+
version
|
|
124
130
|
};
|
|
125
131
|
});
|
|
126
132
|
|
|
@@ -195,4 +201,4 @@ var init_installation = __esm(() => {
|
|
|
195
201
|
init_package();
|
|
196
202
|
});
|
|
197
203
|
|
|
198
|
-
export { init_package, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
|
|
204
|
+
export { init_package, version, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
|