@pensar/apex 2.5.0-canary.2bbb0f6f → 2.5.0-canary.2fbcf53e

package/build/{agent-71sn1cjn.js → agent-03dzgvvr.js}

@@ -1,25 +1,25 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-4vwnsyep.js";
+} from "./cli-hvj9qass.js";
+import"./cli-6x8frsp1.js";
 import {
-  detectOSAndEnhancePrompt
-} from "./cli-gbch9xmy.js";
-import"./cli-c8131c4q.js";
+  init_zod,
+  stepCountIs2,
+  init_dist
+} from "./cli-6a720rez.js";
 import {
-  init_dist,
-  stepCountIs
-} from "./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
+  detectOSAndEnhancePrompt
+} from "./cli-44aw4n3f.js";
+import"./cli-qba2x69h.js";
 import {
-  exports_external,
-  init_zod
-} from "./cli-avmhkjtv.js";
-import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
-import"./cli-knd276ed.js";
-import"./cli-bc05qbss.js";
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  _enum
+} from "./cli-tjm77pmx.js";
+import"./cli-qktcyj48.js";
 
 // src/core/agents/specialized/findingJudge/agent.ts
 init_dist();
@@ -169,17 +169,17 @@ var FINDING_TYPES = [
   "informational",
   "expected-behavior"
 ];
-var FindingJudgeOutputSchema = exports_external.object({
-  valid: exports_external.boolean().describe("Whether the POC demonstrates a currently exploitable vulnerability that should be persisted"),
-  findingType: exports_external.enum(FINDING_TYPES).describe("Classification: 'vulnerability' for genuine security issues, 'informational' for low-risk observations worth noting, 'expected-behavior' for findings that describe intentional design decisions"),
-  confidence: exports_external.number().min(0).max(1).describe("Confidence in the judgment, a decimal between 0.0 (no confidence) and 1.0 (certain)"),
-  reasoning: exports_external.string().describe("Brief explanation of the key tool observations and analysis that led to this judgment"),
-  concerns: exports_external.array(exports_external.string()).describe("Specific concerns identified. Empty array only when the finding is a valid high-confidence vulnerability."),
-  verificationSteps: exports_external.array(exports_external.string()).describe("Concrete verification actions performed before deciding."),
-  toolEvidence: exports_external.array(exports_external.string()).describe("Specific observations from tool output or provided artifacts."),
-  reproducedPoc: exports_external.boolean().describe("Whether the judge reran or independently reproduced the POC."),
-  webResearchUsed: exports_external.boolean().describe("Whether web_search/get_page materially informed the judgment."),
-  limitations: exports_external.array(exports_external.string()).describe("Remaining verification gaps or environmental limitations.")
+var FindingJudgeOutputSchema = object({
+  valid: boolean().describe("Whether the POC demonstrates a currently exploitable vulnerability that should be persisted"),
+  findingType: _enum(FINDING_TYPES).describe("Classification: 'vulnerability' for genuine security issues, 'informational' for low-risk observations worth noting, 'expected-behavior' for findings that describe intentional design decisions"),
+  confidence: number().min(0).max(1).describe("Confidence in the judgment, a decimal between 0.0 (no confidence) and 1.0 (certain)"),
+  reasoning: string().describe("Brief explanation of the key tool observations and analysis that led to this judgment"),
+  concerns: array(string()).describe("Specific concerns identified. Empty array only when the finding is a valid high-confidence vulnerability."),
+  verificationSteps: array(string()).describe("Concrete verification actions performed before deciding."),
+  toolEvidence: array(string()).describe("Specific observations from tool output or provided artifacts."),
+  reproducedPoc: boolean().describe("Whether the judge reran or independently reproduced the POC."),
+  webResearchUsed: boolean().describe("Whether web_search/get_page materially informed the judgment."),
+  limitations: array(string()).describe("Remaining verification gaps or environmental limitations.")
 });
 
 // src/core/agents/specialized/findingJudge/agent.ts
@@ -196,25 +196,24 @@ var FINDING_JUDGE_ACTIVE_TOOLS = [
 
 class FindingJudgeAgent extends OffensiveSecurityAgent {
   constructor(opts) {
-    const target = opts.finding.target ?? opts.target ?? opts.session.targets[0];
+    const {
+      finding,
+      target: targetOpt,
+      subagentId,
+      subagentName,
+      ...base
+    } = opts;
+    const target = finding.target ?? targetOpt ?? base.session.targets[0];
     super({
+      ...base,
       system: detectOSAndEnhancePrompt(FINDING_JUDGE_SYSTEM_PROMPT),
-      prompt: buildFindingJudgePrompt({ ...opts.finding, target }),
-      model: opts.model,
-      session: opts.session,
-      target,
-      authConfig: opts.authConfig,
-      abortSignal: opts.abortSignal,
-      eventBus: opts.eventBus,
-      sandbox: opts.sandbox,
-      enableThinking: opts.enableThinking,
-      thinkingEffort: opts.thinkingEffort,
-      openAIReasoningEffort: opts.openAIReasoningEffort,
-      subagentId: opts.subagentId ?? "finding-judge",
-      subagentName: opts.subagentName ?? "Finding Judge",
       activeTools: [...FINDING_JUDGE_ACTIVE_TOOLS],
       responseSchema: FindingJudgeOutputSchema,
-      stopWhen: stepCountIs(60)
+      stopWhen: stepCountIs2(60),
+      target,
+      prompt: buildFindingJudgePrompt({ ...finding, target }),
+      subagentId: subagentId ?? "finding-judge",
+      subagentName: subagentName ?? "Finding Judge"
     });
   }
 }

package/build/agent-f409nrpq.js

@@ -0,0 +1,12 @@
+import {
+  CodeAgent2
+} from "./cli-hhmamgyb.js";
+import"./cli-qba2x69h.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-6a720rez.js";
+import"./cli-qktcyj48.js";
+import"./cli-6x8frsp1.js";
+export {
+  CodeAgent2 as CodeAgent
+};

package/build/agent-vwc0mwjt.js

@@ -0,0 +1,14 @@
+import {
+  TargetedPentestAgent2,
+  buildPentestSystemPrompt2
+} from "./cli-as3caggc.js";
+import"./cli-qba2x69h.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-6a720rez.js";
+import"./cli-qktcyj48.js";
+import"./cli-6x8frsp1.js";
+export {
+  TargetedPentestAgent2 as TargetedPentestAgent,
+  buildPentestSystemPrompt2 as buildPentestSystemPrompt
+};

package/build/agent-z3cwtnxe.js

@@ -0,0 +1,12 @@
+import {
+  runAuthenticationAgent2
+} from "./cli-wxc2m46g.js";
+import"./cli-qba2x69h.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-6a720rez.js";
+import"./cli-qktcyj48.js";
+import"./cli-6x8frsp1.js";
+export {
+  runAuthenticationAgent2 as runAuthenticationAgent
+};

package/build/{apps-ghf7kp1s.js → apps-jhxy4z5c.js}

@@ -1,47 +1,37 @@
 #!/usr/bin/env bun
-import {
-  markCommandFailed
-} from "./cli-7q3ae3ft.js";
-import"./cli-a8n64cef.js";
-import"./cli-9pbk8m32.js";
-import"./cli-7sqb16dd.js";
-import"./cli-fw7sp0fp.js";
-import"./cli-14j00zfh.js";
-import"./cli-3ew5fs3f.js";
-import"./cli-yge44bmk.js";
-import"./cli-4mgj070h.js";
-import"./cli-g3cb8pj5.js";
-import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
+import"./cli-6x8frsp1.js";
+import"./cli-6a720rez.js";
 import {
   ENDPOINT_TRANSPORTS,
+  listApps,
+  getApp,
   createApp,
-  createDomain,
-  createEndpoint,
+  updateApp,
   deleteApp,
-  deleteEndpoint,
-  getApp,
-  getEndpoint,
-  listApps,
-  listDomains,
   listEndpoints,
+  getEndpoint,
+  createEndpoint,
+  updateEndpoint,
+  deleteEndpoint,
   searchApps,
   searchEndpoints,
-  updateApp,
-  updateEndpoint
-} from "./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
-import"./cli-fw5r7pfj.js";
-import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
-import"./cli-avmhkjtv.js";
-import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
-import"./cli-knd276ed.js";
-import"./cli-bc05qbss.js";
+  listDomains,
+  createDomain
+} from "./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-gaxrjhm4.js";
+import"./cli-hhmamgyb.js";
+import"./cli-80vnzkcx.js";
+import"./cli-dcn88vnc.js";
+import"./cli-wxc2m46g.js";
+import"./cli-as3caggc.js";
+import"./cli-yft4vzhv.js";
+import"./cli-ft24awnp.js";
+import {
+  markCommandFailed
+} from "./cli-z82n3qk1.js";
+import"./cli-qba2x69h.js";
+import"./cli-qktcyj48.js";
 
 // src/cli/apps.ts
 var APPLICATION_TYPES = [

package/build/{auth-p1nrv7re.js → auth-hzh7ex0t.js}

@@ -1,51 +1,42 @@
 #!/usr/bin/env bun
 import {
-  markCommandFailed
-} from "./cli-7q3ae3ft.js";
-import"./cli-a8n64cef.js";
-import"./cli-9pbk8m32.js";
-import"./cli-7sqb16dd.js";
-import"./cli-fw7sp0fp.js";
-import"./cli-14j00zfh.js";
-import"./cli-3ew5fs3f.js";
-import"./cli-yge44bmk.js";
-import"./cli-4mgj070h.js";
-import"./cli-g3cb8pj5.js";
-import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
-import"./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
-import"./cli-fw5r7pfj.js";
-import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
+  config2,
+  init_config
+} from "./cli-6x8frsp1.js";
 import {
-  createWorkspaceSelection,
-  disconnect,
-  ensureValidToken,
-  fetchWorkspaces,
   getPensarApiUrl,
   getPensarConsoleUrl,
-  init_auth,
-  isConnected,
-  pollForWorkspaceCreation,
-  pollLegacyToken,
-  pollWorkOSToken,
-  pollWorkspaceSelection,
-  selectWorkspace,
-  startDeviceFlow
-} from "./cli-08fcc6d8.js";
-import"./cli-avmhkjtv.js";
-import"./cli-j54qa6tm.js";
+  isConnected2,
+  disconnect2,
+  startDeviceFlow2,
+  pollWorkOSToken2,
+  pollLegacyToken2,
+  ensureValidToken2,
+  fetchWorkspaces2,
+  pollForWorkspaceCreation2,
+  selectWorkspace2,
+  createWorkspaceSelection2,
+  pollWorkspaceSelection2,
+  init_auth
+} from "./cli-6a720rez.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-gaxrjhm4.js";
+import"./cli-hhmamgyb.js";
+import"./cli-80vnzkcx.js";
+import"./cli-dcn88vnc.js";
+import"./cli-wxc2m46g.js";
+import"./cli-as3caggc.js";
+import"./cli-yft4vzhv.js";
+import"./cli-ft24awnp.js";
 import {
-  config,
-  init_config
-} from "./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
-import"./cli-knd276ed.js";
+  markCommandFailed
+} from "./cli-z82n3qk1.js";
+import"./cli-qba2x69h.js";
+import"./cli-qktcyj48.js";
 import {
   __require
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // src/cli/auth.ts
 import * as readline from "node:readline";
@@ -79,7 +70,7 @@ function prompt(question) {
   });
 }
 async function selectWorkspaceInBrowser(apiUrl, accessToken) {
-  const selection = await createWorkspaceSelection(apiUrl, accessToken);
+  const selection = await createWorkspaceSelection2(apiUrl, accessToken);
   openUrl(selection.selectionUrl);
   console.log(`
 You have multiple workspaces. Choose one in your browser to continue.
@@ -87,12 +78,12 @@ If the browser didn't open, visit:
   ${selection.selectionUrl}
 
 Waiting for workspace selection...`);
-  return pollWorkspaceSelection(apiUrl, accessToken, selection.selectionId);
+  return pollWorkspaceSelection2(apiUrl, accessToken, selection.selectionId);
 }
 async function login() {
-  const appConfig = await config.get();
-  const hasStoredCredentials = isConnected(appConfig);
-  const validToken = hasStoredCredentials ? await ensureValidToken({
+  const appConfig = await config2.get();
+  const hasStoredCredentials = isConnected2(appConfig);
+  const validToken = hasStoredCredentials ? await ensureValidToken2({
     accessToken: appConfig.accessToken,
     refreshToken: appConfig.refreshToken,
     pensarAPIKey: appConfig.pensarAPIKey
@@ -115,7 +106,7 @@ Pensar Console — Managed Inference
 Connect for usage-based AI inference. No API keys needed.
 `);
   const apiUrl = getPensarApiUrl();
-  const flowInfo = await startDeviceFlow(apiUrl);
+  const flowInfo = await startDeviceFlow2(apiUrl);
   if (flowInfo.mode === "workos") {
     const { clientId, deviceInfo } = flowInfo;
     openUrl(deviceInfo.verification_uri_complete);
@@ -126,13 +117,13 @@ If not, open this URL:
 Your code: ${deviceInfo.user_code}
 
 Waiting for browser authorization...`);
-    const tokens = await pollWorkOSToken({
+    const tokens = await pollWorkOSToken2({
       clientId,
       deviceCode: deviceInfo.device_code,
       interval: deviceInfo.interval,
       expiresIn: deviceInfo.expires_in
     });
-    await config.update({
+    await config2.update({
       accessToken: tokens.accessToken,
       refreshToken: tokens.refreshToken
     });
@@ -149,7 +140,7 @@ If not, open this URL:
 Your code: ${deviceInfo.userCode}
 
 Waiting for browser authorization...`);
-    const data = await pollLegacyToken({
+    const data = await pollLegacyToken2({
       apiUrl,
       deviceCode: deviceInfo.deviceCode,
       interval: deviceInfo.interval,
@@ -160,12 +151,12 @@ Waiting for browser authorization...`);
     if (!apiKey) {
       throw new Error("Pensar Console did not return an API key");
     }
-    await config.update({
+    await config2.update({
       pensarAPIKey: apiKey,
       gatewaySigningKey: data.signingKey ?? null
     });
     if (data.workspace) {
-      await config.update({
+      await config2.update({
         workspaceId: data.workspace.id,
         workspaceSlug: data.workspace.slug
       });
@@ -181,7 +172,7 @@ Waiting for browser authorization...`);
   }
 }
 async function handleWorkspaces(apiUrl, accessToken) {
-  const wsResult = await fetchWorkspaces(apiUrl, accessToken);
+  const wsResult = await fetchWorkspaces2(apiUrl, accessToken);
   let workspaces = wsResult.workspaces;
   const consoleUrl = wsResult.consoleUrl ?? getPensarConsoleUrl();
   if (workspaces.length === 0) {
@@ -191,7 +182,7 @@ If the browser didn't open, visit: ${consoleUrl}/create-workspace?redirect=/cred
 `);
     openUrl(`${consoleUrl}/create-workspace?redirect=/credits`);
     console.log("Waiting for workspace creation...");
-    workspaces = await pollForWorkspaceCreation(apiUrl, accessToken);
+    workspaces = await pollForWorkspaceCreation2(apiUrl, accessToken);
   }
   let workspaceId;
   if (workspaces.length === 1) {
@@ -203,9 +194,9 @@ If the browser didn't open, visit: ${consoleUrl}/create-workspace?redirect=/cred
   } else {
     workspaceId = await selectWorkspaceInBrowser(apiUrl, accessToken);
   }
-  const result = await selectWorkspace(apiUrl, accessToken, workspaceId);
+  const result = await selectWorkspace2(apiUrl, accessToken, workspaceId);
   const workspace = result.workspace;
-  await config.update({
+  await config2.update({
     workspaceId: workspace.id,
     workspaceSlug: workspace.slug,
     gatewaySigningKey: result.signingKey ?? null
@@ -228,21 +219,21 @@ If the browser didn't open, visit: ${consoleUrl}/create-workspace?redirect=/cred
   console.log("\nPensar models are now available. Run `pensar` to get started.");
 }
 async function logout() {
-  const appConfig = await config.get();
-  if (!isConnected(appConfig)) {
+  const appConfig = await config2.get();
+  if (!isConnected2(appConfig)) {
     console.log("Not currently connected to Pensar Console.");
     return;
   }
-  await disconnect();
+  await disconnect2();
   console.log("✓ Disconnected from Pensar Console.");
 }
 async function status() {
-  const appConfig = await config.get();
-  if (!isConnected(appConfig)) {
+  const appConfig = await config2.get();
+  if (!isConnected2(appConfig)) {
     console.log("Not connected to Pensar Console.\n\nRun `pensar login` to connect.");
     return;
   }
-  const validToken = await ensureValidToken({
+  const validToken = await ensureValidToken2({
     accessToken: appConfig.accessToken,
     refreshToken: appConfig.refreshToken,
     pensarAPIKey: appConfig.pensarAPIKey
@@ -260,7 +251,7 @@ async function status() {
       if (res.ok) {
         const data = await res.json();
         if (data.workspace) {
-          await config.update({
+          await config2.update({
             workspaceId: data.workspace.id,
             workspaceSlug: data.workspace.slug
           });

package/build/blackboxAgent-jdd0y2v1.js

@@ -0,0 +1,12 @@
+import {
+  BlackboxAttackSurfaceAgent2
+} from "./cli-gaxrjhm4.js";
+import"./cli-qba2x69h.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-6a720rez.js";
+import"./cli-qktcyj48.js";
+import"./cli-6x8frsp1.js";
+export {
+  BlackboxAttackSurfaceAgent2 as BlackboxAttackSurfaceAgent
+};

package/build/blackboxPentest-zbhzbggr.js

@@ -0,0 +1,58 @@
+import"./cli-6x8frsp1.js";
+import {
+  init_ai,
+  normalizeStepUsage
+} from "./cli-6a720rez.js";
+import"./cli-hvj9qass.js";
+import"./cli-44aw4n3f.js";
+import"./cli-gaxrjhm4.js";
+import"./cli-as3caggc.js";
+import"./cli-yft4vzhv.js";
+import {
+  readExecutionMetrics,
+  writeExecutionMetrics,
+  runPentestWorkflow2
+} from "./cli-dcn88vnc.js";
+import"./cli-hhmamgyb.js";
+import"./cli-80vnzkcx.js";
+import {
+  EMPTY_SESSION_TOKEN_USAGE,
+  accumulateSessionTokens
+} from "./cli-ag6jtndp.js";
+import"./cli-qba2x69h.js";
+import"./cli-qktcyj48.js";
+
+// src/core/api/blackboxPentest.ts
+init_ai();
+async function runPentestAgent(input) {
+  const persisted = readExecutionMetrics(input.session.rootPath)?.tokenUsage;
+  let tokenUsage = persisted ?? EMPTY_SESSION_TOKEN_USAGE;
+  const onStepFinish = async (event) => {
+    tokenUsage = accumulateSessionTokens(tokenUsage, normalizeStepUsage(event));
+    await input.onStepFinish?.(event);
+  };
+  let result;
+  try {
+    result = await runPentestWorkflow2({
+      ...input,
+      onStepFinish,
+      onCacheMetrics: input.onCacheMetrics
+    });
+  } finally {
+    writeExecutionMetrics({
+      sessionRootPath: input.session.rootPath,
+      tokenUsage
+    });
+  }
+  const { findings, findingsPath, pocsPath, reportPath } = result;
+  console.log(`
+Found ${findings.length} vulnerabilities`);
+  console.log(`Findings: ${findingsPath}`);
+  console.log(`POCs: ${pocsPath}`);
+  if (reportPath)
+    console.log(`Report: ${reportPath}`);
+  return { findings, findingsPath, pocsPath, reportPath };
+}
+export {
+  runPentestAgent
+};

package/build/{cli-gbch9xmy.js → cli-44aw4n3f.js}

@@ -1,9 +1,9 @@
 import {
-  createLogger,
+  scopedLogger,
   init_lazyLogger,
-  init_structured,
-  scopedLogger
-} from "./cli-f47dgye3.js";
+  createLogger,
+  init_structured
+} from "./cli-6a720rez.js";
 
 // src/core/agents/specialized/utils.ts
 import { execSync } from "node:child_process";

package/build/{cli-t7rhyqx5.js → cli-586h170q.js}

@@ -1,9 +1,9 @@
 import {
-  createLogger,
+  scopedLogger,
   init_lazyLogger,
-  init_structured,
-  scopedLogger
-} from "./cli-f47dgye3.js";
+  createLogger,
+  init_structured
+} from "./cli-6a720rez.js";
 
 // src/core/integrations/wandb/client.ts
 init_structured();