@pensar/apex 2.4.0 → 2.5.0-canary.41357c27

package/build/{cli-5k33webc.js → cli-mtavwpav.js}

@@ -1,28 +1,28 @@
+import {
+  AppsDiscoveryResultSchema,
+  DiscoverySummarySchema,
+  EndpointSchema,
+  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
+  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
+} from "./cli-ygesx0vf.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-gq40s5b3.js";
+} from "./cli-pd9j03q2.js";
+import {
+  TargetedPentestAgent,
+  buildPentestSystemPrompt
+} from "./cli-1e69fd35.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-b1adytsy.js";
-import {
-  TargetedPentestAgent,
-  buildPentestSystemPrompt
-} from "./cli-mavved45.js";
+} from "./cli-yzhjh7x1.js";
 import {
   CodeAgent
-} from "./cli-32z0017y.js";
-import {
-  AppsDiscoveryResultSchema,
-  DiscoverySummarySchema,
-  EndpointSchema,
-  WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
-  WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-k8kc47pq.js";
+} from "./cli-q2sq1qkn.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,7 +45,7 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -126,9 +126,23 @@ function normalizeTokenUsage(value) {
   return {
     inputTokens,
     outputTokens,
+    cacheReadTokens: toNonNegativeInteger(value?.cacheReadTokens),
+    cacheWriteTokens: toNonNegativeInteger(value?.cacheWriteTokens),
     totalTokens: explicitTotal > 0 ? explicitTotal : derivedTotal
   };
 }
+function normalizeContextUsage(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  const v = value;
+  if (typeof v.modelId !== "string" || v.modelId.length === 0)
+    return;
+  return {
+    modelId: v.modelId,
+    usedTokens: toNonNegativeInteger(v.usedTokens),
+    contextLimit: toNonNegativeInteger(v.contextLimit)
+  };
+}
 function metricsPath(sessionRootPath) {
   return join(sessionRootPath, EXECUTION_METRICS_FILENAME);
 }
@@ -143,6 +157,7 @@ function readExecutionMetrics(sessionRootPath) {
     const parsed = JSON.parse(readFileSync(path, "utf-8"));
     return {
       tokenUsage: normalizeTokenUsage(parsed.tokenUsage),
+      contextUsage: normalizeContextUsage(parsed.contextUsage),
       runtime: typeof parsed.runtime === "string" ? parsed.runtime : undefined,
       elapsedSeconds: toNonNegativeInteger(parsed.elapsedSeconds) || undefined,
       updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : new Date().toISOString()
@@ -167,10 +182,13 @@ function writeExecutionMetrics(input) {
   const nextTokenUsage = input.tokenUsage ? normalizeTokenUsage(input.tokenUsage) : existing?.tokenUsage ?? {
     inputTokens: 0,
     outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0,
     totalTokens: 0
   };
   const next = {
     tokenUsage: nextTokenUsage,
+    contextUsage: input.contextUsage ?? existing?.contextUsage,
     runtime: input.runtime ?? existing?.runtime,
     elapsedSeconds: input.elapsedSeconds ?? existing?.elapsedSeconds,
     updatedAt: new Date().toISOString()
@@ -7639,16 +7657,6 @@ When finished, call \`response\` with a summary of how many entry points you doc
 // src/core/workflows/pentest.ts
 var log5 = scopedLogger(() => createLogger("pentest-swarm"));
 var DEFAULT_CONCURRENCY2 = 10;
-function addUsageTotals(totals, usage) {
-  if (!usage)
-    return;
-  const inputTokens = usage.inputTokens ?? 0;
-  const outputTokens = usage.outputTokens ?? 0;
-  const totalTokens = usage.totalTokens ?? inputTokens + outputTokens;
-  totals.inputTokens += inputTokens;
-  totals.outputTokens += outputTokens;
-  totals.totalTokens += totalTokens;
-}
 async function runPentestSwarm(input) {
   const {
     targets,
@@ -7661,6 +7669,7 @@ async function runPentestSwarm(input) {
     onError,
     concurrency = DEFAULT_CONCURRENCY2,
     onStepFinish,
+    onCacheMetrics,
     enableThinking,
     thinkingEffort,
     openAIReasoningEffort,
@@ -7717,6 +7726,8 @@ async function runPentestSwarm(input) {
           tasksDir: executionTasksDir,
           planSubagentId: subagentId,
           eventBus,
+          onStepFinish,
+          onCacheMetrics,
           enableThinking,
           thinkingEffort,
           openAIReasoningEffort,
@@ -7750,6 +7761,8 @@ async function runPentestSwarm(input) {
         abortSignal,
         findingsRegistry,
         onStepFinish: handleStepFinish,
+        onCacheMetrics,
+        forwardUsageCallbacksToSpawnedAgents: true,
         messages: previousMessages.length > 0 ? previousMessages : undefined,
         eventBus,
         subagentId,
@@ -7802,7 +7815,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-8zka43xs.js");
+    const { runFastStrike } = await import("./fastStrike-wp2tvcnq.js");
     return runFastStrike(input);
   }
   const {
@@ -7839,17 +7852,6 @@ async function runPentestWorkflow(input) {
 ${combined}` : combined;
   }
   const startedAt = Date.now();
-  const tokenUsageTotals = {
-    inputTokens: 0,
-    outputTokens: 0,
-    totalTokens: 0
-  };
-  const wrappedOnStepFinish = (event) => {
-    addUsageTotals(tokenUsageTotals, event.usage);
-    if (onStepFinish) {
-      onStepFinish(event);
-    }
-  };
   try {
     const mode = cwd ? "whitebox" : "blackbox";
     let swarmTargets;
@@ -7886,7 +7888,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort,
           surfaceIntegrationEnabled
@@ -7899,7 +7901,7 @@ ${combined}` : combined;
           authConfig,
           abortSignal,
           eventBus,
-          onStepFinish: wrappedOnStepFinish,
+          onStepFinish,
           onCacheMetrics,
           openAIReasoningEffort
         });
@@ -7952,7 +7954,8 @@ ${combined}` : combined;
         abortSignal,
         findingsRegistry,
         eventBus,
-        onStepFinish: wrappedOnStepFinish,
+        onStepFinish,
+        onCacheMetrics,
         enableThinking,
         thinkingEffort,
         openAIReasoningEffort
@@ -8000,7 +8003,6 @@ ${combined}` : combined;
     const runtime = formatDurationHmsFromMs(Date.now() - startedAt);
     writeExecutionMetrics({
       sessionRootPath: session.rootPath,
-      tokenUsage: tokenUsageTotals,
       runtime
     });
   }

package/build/{cli-0n4r54hq.js → cli-naapss75.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-72cvcqhg.js";
+} from "./cli-x4e10v99.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-gq40s5b3.js → cli-pd9j03q2.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-9y49bzhd.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -438,6 +438,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -483,6 +484,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
+When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Immediately before filling it, call sms_list_messages with reserve=true; never pass that tool a phone number. If it returns 429, retry the reservation later as a separate attempt without waiting in the tool. Then fill credentialField="phoneNumber", click send-code, sleep with execute_command, and call sms_list_messages with sinceMs from that click and claim=true. If the list is empty, make one delayed list retry; if it stays empty, stop and report. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.

package/build/{cli-qqt4gj1w.js → cli-pepts4ha.js}

@@ -1,11 +1,12 @@
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/offSecAgent/types.ts
 init_zod();
@@ -47,7 +48,8 @@ var ApexFindingObject = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 
 export { EvidenceFileEntrySchema, ApexFindingObject };

package/build/{cli-32z0017y.js → cli-q2sq1qkn.js}

@@ -1,10 +1,10 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();

package/build/{cli-72cvcqhg.js → cli-x4e10v99.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-9rhzhgx2.js";
+} from "./cli-epqtwyeb.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-2cbwdk78.js → cli-xan180ab.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();

package/build/{cli-vq52kp7j.js → cli-xp52xsqm.js}

@@ -5,20 +5,20 @@ import {
   SKILL_TOOL_NAMES,
   apiRequest,
   buildBaseSystemPrompt
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 import {
   init_constants
-} from "./cli-0n4r54hq.js";
+} from "./cli-naapss75.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 import {
   __commonJS,
   __require
@@ -6966,6 +6966,12 @@ var require_public_api = __commonJS(function(exports) {
 });
 
 // src/core/api/issues.ts
+var CLOSED_DISPOSITIONS = [
+  "resolved",
+  "wont-fix",
+  "out-of-scope",
+  "risk-accepted"
+];
 async function listScans() {
   return apiRequest("GET", "/pentests");
 }
@@ -6998,6 +7004,18 @@ async function getIssue(issueId) {
 async function updateIssue(issueId, data) {
   return apiRequest("PATCH", `/issues/${issueId}`, data);
 }
+async function listIssueComments(issueId, options) {
+  const params = new URLSearchParams;
+  if (options?.page)
+    params.set("page", String(options.page));
+  if (options?.pageSize)
+    params.set("pageSize", String(options.pageSize));
+  const qs = params.toString();
+  return apiRequest("GET", `/issues/${issueId}/comments${qs ? `?${qs}` : ""}`);
+}
+async function createIssueComment(issueId, body) {
+  return apiRequest("POST", `/issues/${issueId}/comments`, { body });
+}
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
@@ -8205,4 +8223,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { CLOSED_DISPOSITIONS, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, listIssueComments, createIssueComment, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };

package/build/{cli-k8kc47pq.js → cli-ygesx0vf.js}

@@ -2,16 +2,16 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();

package/build/{cli-b1adytsy.js → cli-yzhjh7x1.js}

@@ -1,15 +1,16 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-qqt4gj1w.js";
+} from "./cli-pepts4ha.js";
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/report/schemas.ts
 init_zod();
@@ -27,7 +28,8 @@ var PentestReportFindingSchema = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 var PentestReportSchema = exports_external.object({
   version: exports_external.string().regex(/^1\.\d+$/),
@@ -86,7 +88,8 @@ function buildPentestReport(findings, context) {
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
       rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
     }))
   };
 }
@@ -141,6 +144,12 @@ function renderFinding(finding, metadata) {
     "",
     finding.impact,
     "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
     "## Evidence",
     "",
     "```",
@@ -187,6 +196,20 @@ function renderFinding(finding, metadata) {
   return lines.join(`
 `);
 }
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
 
 // src/core/report/index.ts
 var REPORT_FILENAME_MD = "pentest-report.md";