@pensar/apex 2.4.0 → 2.5.0-canary.2bbb0f6f

package/build/cli-7q3ae3ft.js

@@ -0,0 +1,6 @@
+// src/cli/command-exit.ts
+function markCommandFailed() {
+  process.exitCode = 1;
+}
+
+export { markCommandFailed };

package/build/{cli-5k33webc.js → cli-7sqb16dd.js}

@@ -1,28 +1,28 @@
+import {
+  AppsDiscoveryResultSchema,
+  DiscoverySummarySchema,
+  EndpointSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
+} from "./cli-fw7sp0fp.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-gq40s5b3.js";
+} from "./cli-14j00zfh.js";
+import {
+  TargetedPentestAgent,
+  buildPentestSystemPrompt
+} from "./cli-3ew5fs3f.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-b1adytsy.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-mavved45.js";
+} from "./cli-yge44bmk.js";
 import {
   CodeAgent
-} from "./cli-32z0017y.js";
-import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-k8kc47pq.js";
+} from "./cli-g3cb8pj5.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-repbyhkk.js";
+} from "./cli-4vwnsyep.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,7 +45,7 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-f47dgye3.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -126,9 +126,23 @@ function normalizeTokenUsage(value) {
   return {
     inputTokens,
     outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
     totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
   };
 }
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
 function metricsPath(sessionRootPath) {
   return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
 }
@@ -143,6 +157,7 @@ function readExecutionMetrics(sessionRootPath) {
     const parsed = JSON.parse(readFileSync(path, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
       elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
@@ -167,10 +182,13 @@ function writeExecutionMetrics(input) {
   const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
     inputTokens: 0,
     outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
     totalTokens: 0
   };
   const next = {
     tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
     runtime: input.runtime ?? existing?.runtime,
     elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
     updatedAt: new Date().toISOString()
@@ -7639,16 +7657,6 @@ When finished, call \`response\` with a summary of how many entry points you doc
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
 async function runPentestSwarm(input) {
   const {
     targets,
@@ -7661,6 +7669,7 @@ async function runPentestSwarm(input) {
     onError,
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
@@ -7717,6 +7726,8 @@ async function runPentestSwarm(input) {
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
+          onStepFinish,
+          onCacheMetrics,
           enableThinking,
           thinkingEffort,
           openAIReasoningEffort,
@@ -7750,6 +7761,8 @@ async function runPentestSwarm(input) {
         abortSignal,
         findingsRegistry,
         onStepFinish: handleStepFinish,
+        onCacheMetrics,
+        forwardUsageCallbacksToSpawnedAgents: true,
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
@@ -7802,7 +7815,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-8zka43xs.js");
+    const { runFastStrike } = await import("./fastStrike-f441e9nr.js");
     return runFastStrike(input);
   }
   const {
@@ -7839,17 +7852,6 @@ async function runPentestWorkflow(input) {
 ${combined}` : combined;
   }
   const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
   try {
     const mode = cwd ? "whitebox" : "blackbox";
     let swarmTargets;
@@ -7886,7 +7888,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
           surfaceIntegrationEnabled
@@ -7899,7 +7901,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort
         });
@@ -7952,7 +7954,8 @@ ${combined}` : combined;
         abortSignal,
         findingsRegistry,
         eventBus,
-        onStepFinish: wrappedOnStepFinish,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort
@@ -8000,7 +8003,6 @@ ${combined}` : combined;
     const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
     writeExecutionMetrics({
       sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
       runtime
     });
   }

package/build/{cli-9rhzhgx2.js → cli-8pk8znhw.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-vnynf0js.js";
+} from "./cli-3bmqdcfh.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/cli-9pbk8m32.js

@@ -0,0 +1,32 @@
+// src/core/session/usage.ts
+var EMPTY_SESSION_TOKEN_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function accumulateSessionTokens(current, step) {
+  const inputTokens = step.inputTokens ?? 0;
+  const outputTokens = step.outputTokens ?? 0;
+  const cacheReadTokens = step.cacheReadTokens ?? 0;
+  const cacheWriteTokens = step.cacheWriteTokens ?? 0;
+  if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
+    return current;
+  }
+  return {
+    inputTokens: current.inputTokens + inputTokens,
+    outputTokens: current.outputTokens + outputTokens,
+    cacheReadTokens: current.cacheReadTokens + cacheReadTokens,
+    cacheWriteTokens: current.cacheWriteTokens + cacheWriteTokens
+  };
+}
+function contextPercentage(context) {
+  if (!context)
+    return null;
+  if (context.contextLimit <= 0)
+    return null;
+  const raw = context.usedTokens / context.contextLimit * 100;
+  return Math.min(100, Math.max(0, raw));
+}
+
+export { EMPTY_SESSION_TOKEN_USAGE, accumulateSessionTokens, contextPercentage };

package/build/{cli-72cvcqhg.js → cli-9ya3yktn.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-9rhzhgx2.js";
+} from "./cli-8pk8znhw.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-vq52kp7j.js → cli-a8n64cef.js}

@@ -5,20 +5,20 @@ import {
   SKILL_TOOL_NAMES,
   apiRequest,
   buildBaseSystemPrompt
-} from "./cli-repbyhkk.js";
+} from "./cli-4vwnsyep.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-f47dgye3.js";
 import {
   init_constants
-} from "./cli-0n4r54hq.js";
+} from "./cli-08fcc6d8.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 import {
   __commonJS,
   __require
@@ -6966,6 +6966,12 @@ var require_public_api = __commonJS(function(exports) {
 });
 
 // src/core/api/issues.ts
+var CLOSED_DISPOSITIONS = [
+  "resolved",
+  "wont-fix",
+  "out-of-scope",
+  "risk-accepted"
+];
 async function listScans() {
   return apiRequest("GET", "/pentests");
 }
@@ -6998,6 +7004,18 @@ async function getIssue(issueId) {
 async function updateIssue(issueId, data) {
   return apiRequest("PATCH", `/issues/${issueId}`, data);
 }
+async function listIssueComments(issueId, options) {
+  const params = new URLSearchParams;
+  if (options?.page)
+    params.set("page", String(options.page));
+  if (options?.pageSize)
+    params.set("pageSize", String(options.pageSize));
+  const qs = params.toString();
+  return apiRequest("GET", `/issues/${issueId}/comments${qs ? `?${qs}` : ""}`);
+}
+async function createIssueComment(issueId, body) {
+  return apiRequest("POST", `/issues/${issueId}/comments`, { body });
+}
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
@@ -8205,4 +8223,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { CLOSED_DISPOSITIONS, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, listIssueComments, createIssueComment, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };

package/build/{cli-qqt4gj1w.js → cli-a9vq54sx.js}

@@ -1,11 +1,12 @@
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-repbyhkk.js";
+} from "./cli-4vwnsyep.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/offSecAgent/types.ts
 init_zod();
@@ -47,7 +48,8 @@ var ApexFindingObject = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 
 export { EvidenceFileEntrySchema, ApexFindingObject };