@pensar/apex 2.4.0 → 2.5.0-canary.aa559068

package/build/{cli-xshasbwe.js → cli-r3w58pmq.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-kya26m6f.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-8mws7sa5.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-tkc598ey.js";
+} from "./cli-qwv4jsj2.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -141,6 +141,23 @@ every 30 seconds, so run this immediately before filling the field. If the code
 retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
 or two fresh codes are both rejected.
 
+# SMS passwordless (phone as login)
+
+If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
+after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
+
+1. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
+2. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
+3. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with that \`credentialId\` and \`sinceMs\`.
+   If the list is empty, sleep and list again a few times. If it stays empty or returns an error, stop
+   and report what you observed — do not hang in a wait loop. Set \`claim=true\` once a message is present
+   so other runs cannot reuse the OTP.
+4. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
+5. Continue the login and call \`complete_authentication\`.
+
+TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
+app code.
+
 # Error Recovery
 
 If authentication fails, try these mechanical fixes (they are login mechanics, not credential changes):
@@ -243,6 +260,7 @@ class AuthenticationAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -328,6 +346,14 @@ function buildAuthPrompt(target, authHints, credentialManager, context, envVarNa
     parts.push("");
   }
   if (credBlock) {
+    const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasSmsPasswordless ? `
+If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
+identifier — not MFA-after-password. browser_fill credentialField="phoneNumber", click send-code, then
+execute_command \`sleep 5\` and call sms_list_messages with sinceMs = Date.now() at that click (claim=true
+once a message is present). If the list is empty, sleep and list again; if it stays empty, fail with what
+you observed — do not hang waiting. Then browser_fill the OTP. Do NOT report phone_verification as a
+barrier for this flow. TOTP-via-env for authenticator MFA is unchanged.` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -335,7 +361,7 @@ You have credentials available via credential IDs — authenticate immediately.
    pass credentialId + credentialField (e.g. credentialField="password") instead of the raw value —
    the secret is resolved securely at execution time. NEVER type a password directly.
 3. Call complete_authentication with exported cookies/headers to persist credentials and end the run
-
+${smsInstructions}
 The credentials above were provided to you and have already been verified — they are SHARED across runs, so
 do not modify them or their account settings. NEVER change the password, complete a password reset /
 forced-password-change / account-recovery flow, or modify MFA/2FA settings (enrolling, disabling, or

package/build/{cli-vnynf0js.js → cli-w51z9qjr.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-bc05qbss.js";
 
 // package.json
-var package_default;
+var version = "2.5.0-canary.aa559068", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",
@@ -23,6 +23,10 @@ var init_package = __esm(() => {
       "@modelcontextprotocol/sdk": "^1.29.0",
       "@openrouter/ai-sdk-provider": "^2.9.1",
       "@opentelemetry/api": "^1.9.1",
+      "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+      "@opentelemetry/otlp-exporter-base": "^0.221.0",
+      "@opentelemetry/otlp-transformer": "^0.221.0",
+      "@opentelemetry/resources": "^2.10.0",
       "@opentui/core": "^0.1.107",
       "@opentui/react": "^0.1.107",
       "@pensar/surface": "0.3.0",
@@ -46,6 +50,8 @@ var init_package = __esm(() => {
     description: "AI-powered penetration testing CLI tool with terminal UI",
     devDependencies: {
       "@biomejs/biome": "2.4.14",
+      "@opentelemetry/context-async-hooks": "^2.10.0",
+      "@opentelemetry/sdk-trace-base": "^2.10.0",
       "@types/bun": "^1.3.14",
       "@types/mailparser": "^3.4.6",
       "@types/mime-types": "^3.0.1",
@@ -92,7 +98,7 @@ var init_package = __esm(() => {
       url: "https://github.com/pensarai/apex.git"
     },
     scripts: {
-      build: "bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
+      build: "rm -rf build && bun build src/cli.ts --outdir build --target node --format esm --splitting --external @opentui/core --external @opentui/react --external @opentui/react/* --external react --external react/jsx-runtime --external react/jsx-dev-runtime --external react-reconciler --external weave --external electron --external chromium-bidi --external camoufox-js",
       "build:binaries": "bun run generate:ascii && mkdir -p dist && bun run build:binary:macos-arm64 && bun run build:binary:macos-x64 && bun run build:binary:linux-x64 && bun run build:binary:linux-arm64",
       "build:binary": "bun run generate:ascii && bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --outfile pensar",
       "build:binary:linux-arm64": "bun build src/cli.ts --compile --external electron --external chromium-bidi --external camoufox-js --target=bun-linux-arm64 --outfile dist/pensar-linux-arm64",
@@ -120,7 +126,7 @@ var init_package = __esm(() => {
       tsc: "tsc --noEmit"
     },
     type: "module",
-    version: "2.4.0"
+    version
   };
 });
 
@@ -195,4 +201,4 @@ var init_installation = __esm(() => {
   init_package();
 });
 
-export { init_package, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };
+export { init_package, version, package_default, getCurrentVersion, detectInstallMethod, checkForUpdate, init_installation };

package/build/{cli-b1adytsy.js → cli-whp0f8gp.js}

@@ -1,15 +1,16 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-qqt4gj1w.js";
+} from "./cli-g0whajsq.js";
 import {
+  AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-repbyhkk.js";
+} from "./cli-kya26m6f.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/report/schemas.ts
 init_zod();
@@ -27,7 +28,8 @@ var PentestReportFindingSchema = exports_external.object({
   rootCauseGroup: exports_external.string().optional(),
   relatedFindings: exports_external.array(exports_external.string()).optional(),
   rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional()
+  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+  attackPath: AttackPathSchema.optional()
 });
 var PentestReportSchema = exports_external.object({
   version: exports_external.string().regex(/^1\.\d+$/),
@@ -86,7 +88,8 @@ function buildPentestReport(findings, context) {
       rootCauseGroup: f.rootCauseGroup,
       relatedFindings: f.relatedFindings,
       rootCauseLead: f.rootCauseLead,
-      evidenceFiles: f.evidenceFiles
+      evidenceFiles: f.evidenceFiles,
+      attackPath: f.attackPath
     }))
   };
 }
@@ -141,6 +144,12 @@ function renderFinding(finding, metadata) {
     "",
     finding.impact,
     "",
+    ...finding.attackPath?.length ? [
+      "## Attack Path",
+      "",
+      ...finding.attackPath.map(renderAttackPathHop),
+      ""
+    ] : [],
     "## Evidence",
     "",
     "```",
@@ -187,6 +196,20 @@ function renderFinding(finding, metadata) {
   return lines.join(`
 `);
 }
+function renderAttackPathHop(hop, index) {
+  const parts = [];
+  if (hop.applicationName)
+    parts.push(`**${hop.applicationName}**`);
+  if (hop.applicationId)
+    parts.push(`(\`${hop.applicationId}\`)`);
+  if (hop.host)
+    parts.push(`host \`${hop.host}\``);
+  if (hop.relationshipType)
+    parts.push(`via ${hop.relationshipType}`);
+  if (hop.notes)
+    parts.push(`— ${hop.notes}`);
+  return `${index + 1}. ${parts.join(" ") || "Unspecified system member"}`;
+}
 
 // src/core/report/index.ts
 var REPORT_FILENAME_MD = "pentest-report.md";