@pensar/apex 2.4.0 → 2.5.0-canary.41357c27

package/build/{cli-xshasbwe.js → cli-7hqdp86d.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-mjd75xw4.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-9y49bzhd.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -141,6 +141,25 @@ every 30 seconds, so run this immediately before filling the field. If the code
 retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
 or two fresh codes are both rejected.
 
+# SMS passwordless (phone as login)
+
+If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
+after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
+
+1. Call \`sms_list_messages\` with \`reserve=true\` immediately before filling the phone field. Never pass
+   a phone number to this tool. If it returns 429, retry this reservation later as a separate attempt; do
+   not wait or poll inside the tool.
+2. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
+3. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
+4. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with \`sinceMs\` and \`claim=true\`.
+   If the list is empty, make one delayed list retry; if it stays empty or returns an error, stop and report
+   what you observed — do not hang in a wait loop.
+5. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
+6. Continue the login and call \`complete_authentication\`.
+
+TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
+app code.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -243,6 +262,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -328,6 +348,16 @@ function buildAuthPrompt(target, authHints, credentialManager, context, envVarNa
     parts.push("");
   }
   if (credBlock) {
+    const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasSmsPasswordless ? `
+If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
+identifier — not MFA-after-password. Immediately before filling the phone field, call sms_list_messages
+with reserve=true; never pass that tool a phone number. If it returns 429, retry the reservation later as
+a separate attempt without waiting in the tool. Then browser_fill credentialField="phoneNumber", click
+send-code, and call sms_list_messages with sinceMs = Date.now() at that click and claim=true after a brief
+execute_command sleep. If the list is empty, make one delayed list retry; if it stays empty, fail with what
+you observed. Then browser_fill the OTP. Do NOT report phone_verification as a barrier for this flow.
+TOTP-via-env for authenticator MFA is unchanged.` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -335,7 +365,7 @@ You have credentials available via credential IDs — authenticate immediately.
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
-
+${smsInstructions}
 The credentials above were provided to you and have already been verified — they are SHARED across runs, so
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or

package/build/cli-7q3ae3ft.js

@@ -0,0 +1,6 @@
+// src/cli/command-exit.ts
+function markCommandFailed() {
+  process.exitCode = 1;
+}
+
+export { markCommandFailed };

package/build/cli-9pbk8m32.js

@@ -0,0 +1,32 @@
+// src/core/session/usage.ts
+var EMPTY_SESSION_TOKEN_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function accumulateSessionTokens(current, step) {
+  const inputTokens = step.inputTokens ?? 0;
+  const outputTokens = step.outputTokens ?? 0;
+  const cacheReadTokens = step.cacheReadTokens ?? 0;
+  const cacheWriteTokens = step.cacheWriteTokens ?? 0;
+  if (inputTokens === 0 && outputTokens === 0 && cacheReadTokens === 0 && cacheWriteTokens === 0) {
+    return current;
+  }
+  return {
+    inputTokens: current.inputTokens + inputTokens,
+    outputTokens: current.outputTokens + outputTokens,
+    cacheReadTokens: current.cacheReadTokens + cacheReadTokens,
+    cacheWriteTokens: current.cacheWriteTokens + cacheWriteTokens
+  };
+}
+function contextPercentage(context) {
+  if (!context)
+    return null;
+  if (context.contextLimit <= 0)
+    return null;
+  const raw = context.usedTokens / context.contextLimit * 100;
+  return Math.min(100, Math.max(0, raw));
+}
+
+export { EMPTY_SESSION_TOKEN_USAGE, accumulateSessionTokens, contextPercentage };

package/build/{cli-tznv8pf1.js → cli-9y49bzhd.js}

@@ -3,7 +3,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-70banr6y.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";