@pensar/apex 2.4.0 → 2.5.0-canary.c20fe7ed

package/build/{cli-gq40s5b3.js → cli-whyqn949.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-6grv9k35.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-tznv8pf1.js";
+} from "./cli-1q3vervd.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-bxhaqp8w.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -438,6 +438,7 @@ class BlackboxAttackSurfaceAgent extends OffensiveSecurityAgent {
         "email_search_messages",
         "email_get_message",
         "send_email",
+        "sms_list_messages",
         "web_search",
         "get_page"
       ],
@@ -483,6 +484,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
+When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.

package/build/{cli-72cvcqhg.js → cli-y9mjgfsd.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-9rhzhgx2.js";
+} from "./cli-jq2yh557.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-k8kc47pq.js → cli-ygm0ygzg.js}

@@ -2,16 +2,16 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-repbyhkk.js";
+} from "./cli-6grv9k35.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-tkc598ey.js";
+} from "./cli-bxhaqp8w.js";
 import {
   exports_external,
   init_zod,
   tool
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 
 // src/core/agents/specialized/whiteboxAttackSurface/agent.ts
 init_dist();

package/build/{cli-vq52kp7j.js → cli-zgda61x2.js}

@@ -5,20 +5,20 @@ import {
   SKILL_TOOL_NAMES,
   apiRequest,
   buildBaseSystemPrompt
-} from "./cli-repbyhkk.js";
+} from "./cli-6grv9k35.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-tkc598ey.js";
+} from "./cli-bxhaqp8w.js";
 import {
   init_constants
-} from "./cli-0n4r54hq.js";
+} from "./cli-3b3teb1m.js";
 import {
   exports_external,
   init_zod
-} from "./cli-swpbx60z.js";
+} from "./cli-avmhkjtv.js";
 import {
   __commonJS,
   __require
@@ -6966,6 +6966,12 @@ var require_public_api = __commonJS(function(exports) {
 });
 
 // src/core/api/issues.ts
+var CLOSED_DISPOSITIONS = [
+  "resolved",
+  "wont-fix",
+  "out-of-scope",
+  "risk-accepted"
+];
 async function listScans() {
   return apiRequest("GET", "/pentests");
 }
@@ -6998,6 +7004,18 @@ async function getIssue(issueId) {
 async function updateIssue(issueId, data) {
   return apiRequest("PATCH", `/issues/${issueId}`, data);
 }
+async function listIssueComments(issueId, options) {
+  const params = new URLSearchParams;
+  if (options?.page)
+    params.set("page", String(options.page));
+  if (options?.pageSize)
+    params.set("pageSize", String(options.pageSize));
+  const qs = params.toString();
+  return apiRequest("GET", `/issues/${issueId}/comments${qs ? `?${qs}` : ""}`);
+}
+async function createIssueComment(issueId, body) {
+  return apiRequest("POST", `/issues/${issueId}/comments`, { body });
+}
 async function retestIssue(issueId) {
   return apiRequest("POST", `/issues/${issueId}/retest`);
 }
@@ -8205,4 +8223,4 @@ Working directory: ${input.codebasePath}`;
   });
   return { session, outputPath: input.outputPath };
 }
-export { listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };
+export { CLOSED_DISPOSITIONS, listScans, getScan, listPentestTargets, dispatchPentest, listIssues, getIssue, updateIssue, listIssueComments, createIssueComment, retestIssue, linkPullRequest, listIssuePullRequests, listFixes, getFix, listAgentLogs, searchAgentLogs, listTargetLogs, searchTargetLogs, runOffensiveSecurityAgent, buildPentestPrompt, buildThreatModelPrompt, createSkillsRegistry, runThreatModelWorkflow };