@pensar/apex 2.5.0-canary.2bbb0f6f → 2.5.0-canary.4945243d

package/build/{agent-xnrz4bhp.js → agent-68775258.js}

@@ -5,19 +5,19 @@ import {
   buildPentestPrompt,
   buildPentestSystemPrompt,
   resolvePentestAgentRole
-} from "./cli-3ew5fs3f.js";
+} from "./cli-hbaf9qh5.js";
 import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
-import"./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
 import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
 import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
 import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 export {

package/build/{agent-71sn1cjn.js → agent-b1146p0e.js}

@@ -1,23 +1,23 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-gbch9xmy.js";
+} from "./cli-q7fvqgpj.js";
 import"./cli-c8131c4q.js";
 import {
   init_dist,
   stepCountIs
-} from "./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
+} from "./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
 import {
   exports_external,
   init_zod
 } from "./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
 import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 

package/build/agent-pzvc179w.js

@@ -0,0 +1,20 @@
+import {
+  CodeAgent
+} from "./cli-sjjvw6zb.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
+import"./cli-c8131c4q.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  CodeAgent
+};

package/build/{apps-ghf7kp1s.js → apps-1yqzph3a.js}

@@ -2,17 +2,17 @@
 import {
   markCommandFailed
 } from "./cli-7q3ae3ft.js";
-import"./cli-a8n64cef.js";
-import"./cli-9pbk8m32.js";
-import"./cli-7sqb16dd.js";
-import"./cli-fw7sp0fp.js";
-import"./cli-14j00zfh.js";
-import"./cli-3ew5fs3f.js";
-import"./cli-yge44bmk.js";
-import"./cli-4mgj070h.js";
-import"./cli-g3cb8pj5.js";
+import"./cli-71sxzrzm.js";
+import"./cli-w329bvm0.js";
+import"./cli-c1s54gqq.js";
+import"./cli-a7byd64n.js";
+import"./cli-7nerwz84.js";
+import"./cli-hbaf9qh5.js";
+import"./cli-ap1hrzh5.js";
+import"./cli-dtvmhkgj.js";
+import"./cli-sjjvw6zb.js";
 import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
+import"./cli-ssxghzzy.js";
 import {
   ENDPOINT_TRANSPORTS,
   createApp,
@@ -29,17 +29,17 @@ import {
   searchEndpoints,
   updateApp,
   updateEndpoint
-} from "./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
+} from "./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
 import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
 import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 

package/build/{auth-p1nrv7re.js → auth-7f4zw8bb.js}

@@ -2,22 +2,22 @@
 import {
   markCommandFailed
 } from "./cli-7q3ae3ft.js";
-import"./cli-a8n64cef.js";
-import"./cli-9pbk8m32.js";
-import"./cli-7sqb16dd.js";
-import"./cli-fw7sp0fp.js";
-import"./cli-14j00zfh.js";
-import"./cli-3ew5fs3f.js";
-import"./cli-yge44bmk.js";
-import"./cli-4mgj070h.js";
-import"./cli-g3cb8pj5.js";
+import"./cli-71sxzrzm.js";
+import"./cli-w329bvm0.js";
+import"./cli-c1s54gqq.js";
+import"./cli-a7byd64n.js";
+import"./cli-7nerwz84.js";
+import"./cli-hbaf9qh5.js";
+import"./cli-ap1hrzh5.js";
+import"./cli-dtvmhkgj.js";
+import"./cli-sjjvw6zb.js";
 import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
-import"./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
+import"./cli-1tbyezda.js";
 import {
   createWorkspaceSelection,
   disconnect,
@@ -33,15 +33,15 @@ import {
   pollWorkspaceSelection,
   selectWorkspace,
   startDeviceFlow
-} from "./cli-08fcc6d8.js";
+} from "./cli-d61ezw8h.js";
 import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
 import {
   config,
   init_config
-} from "./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
+} from "./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
 import"./cli-knd276ed.js";
 import {
   __require

package/build/authentication-07y2h8b1.js

@@ -0,0 +1,20 @@
+import {
+  runAuthenticationAgent
+} from "./cli-dtvmhkgj.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
+import"./cli-c8131c4q.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  runAuthenticationAgent
+};

package/build/blackboxAgent-06sdbm18.js

@@ -0,0 +1,20 @@
+import {
+  BlackboxAttackSurfaceAgent
+} from "./cli-7nerwz84.js";
+import"./cli-9fsre5pt.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
+import"./cli-c8131c4q.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
+import"./cli-avmhkjtv.js";
+import"./cli-j54qa6tm.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
+import"./cli-knd276ed.js";
+import"./cli-bc05qbss.js";
+export {
+  BlackboxAttackSurfaceAgent
+};

package/build/{blackboxPentest-9snp9gvp.js → blackboxPentest-npd5t8tv.js}

@@ -1,30 +1,30 @@
 import {
   EMPTY_SESSION_TOKEN_USAGE,
   accumulateSessionTokens
-} from "./cli-9pbk8m32.js";
+} from "./cli-w329bvm0.js";
 import {
   readExecutionMetrics,
   runPentestWorkflow,
   writeExecutionMetrics
-} from "./cli-7sqb16dd.js";
-import"./cli-fw7sp0fp.js";
-import"./cli-14j00zfh.js";
-import"./cli-3ew5fs3f.js";
-import"./cli-yge44bmk.js";
-import"./cli-g3cb8pj5.js";
+} from "./cli-c1s54gqq.js";
+import"./cli-a7byd64n.js";
+import"./cli-7nerwz84.js";
+import"./cli-hbaf9qh5.js";
+import"./cli-ap1hrzh5.js";
+import"./cli-sjjvw6zb.js";
 import"./cli-9fsre5pt.js";
-import"./cli-a9vq54sx.js";
-import"./cli-4vwnsyep.js";
-import"./cli-gbch9xmy.js";
+import"./cli-ssxghzzy.js";
+import"./cli-k420bwxm.js";
+import"./cli-q7fvqgpj.js";
 import"./cli-fw5r7pfj.js";
 import"./cli-c8131c4q.js";
-import"./cli-f47dgye3.js";
-import"./cli-08fcc6d8.js";
+import"./cli-1tbyezda.js";
+import"./cli-d61ezw8h.js";
 import"./cli-avmhkjtv.js";
 import"./cli-j54qa6tm.js";
-import"./cli-9ya3yktn.js";
-import"./cli-8pk8znhw.js";
-import"./cli-3bmqdcfh.js";
+import"./cli-5et4dmnr.js";
+import"./cli-4ftbxtgv.js";
+import"./cli-j87d7k33.js";
 import"./cli-knd276ed.js";
 import"./cli-bc05qbss.js";
 

package/build/{cli-f47dgye3.js → cli-1tbyezda.js}

@@ -4,7 +4,7 @@ import {
   init_auth,
   init_constants,
   signGatewayRequest
-} from "./cli-08fcc6d8.js";
+} from "./cli-d61ezw8h.js";
 import {
   AISDKError,
   APICallError,
@@ -86,11 +86,11 @@ import {
 import {
   config,
   init_config
-} from "./cli-9ya3yktn.js";
+} from "./cli-5et4dmnr.js";
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-3bmqdcfh.js";
+} from "./cli-j87d7k33.js";
 import {
   require_src
 } from "./cli-knd276ed.js";
@@ -47460,7 +47460,7 @@ async function create2(input) {
   if (normalizedConfig?.headers !== undefined) {
     snapshotHeaders = { ...normalizedConfig.headers };
   } else {
-    const { config: appConfig } = await import("./index-23jj0234.js");
+    const { config: appConfig } = await import("./index-11xmmw64.js");
     const cfg = await appConfig.get();
     snapshotHeaders = cfg.defaultHeaders ? { ...cfg.defaultHeaders } : { ...DEFAULT_HEADER_RECORD };
   }

package/build/{cli-8pk8znhw.js → cli-4ftbxtgv.js}

@@ -1,7 +1,7 @@
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-3bmqdcfh.js";
+} from "./cli-j87d7k33.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-9ya3yktn.js → cli-5et4dmnr.js}

@@ -3,7 +3,7 @@ import {
   init,
   init_config,
   update
-} from "./cli-8pk8znhw.js";
+} from "./cli-4ftbxtgv.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-a8n64cef.js → cli-71sxzrzm.js}

@@ -5,16 +5,16 @@ import {
   SKILL_TOOL_NAMES,
   apiRequest,
   buildBaseSystemPrompt
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   init_dist,
   init_session,
   sessions,
   stepCountIs
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 import {
   init_constants
-} from "./cli-08fcc6d8.js";
+} from "./cli-d61ezw8h.js";
 import {
   exports_external,
   init_zod

package/build/{cli-14j00zfh.js → cli-7nerwz84.js}

@@ -1,14 +1,14 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-gbch9xmy.js";
+} from "./cli-q7fvqgpj.js";
 import {
   hasToolCall,
   init_dist,
   stepCountIs
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 
 // src/core/agents/specialized/attackSurface/blackboxAgent.ts
 init_dist();
@@ -484,7 +484,7 @@ ${authenticationInstructions}
 Your FIRST tool call must be: browser_navigate to ${loginTarget}
 Then use browser tools to authenticate. Pass the credentialId to delegate_to_auth_subagent — secrets are resolved automatically.
 For browser_fill on password/secret fields, use credentialId + credentialField instead of raw values.
-When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
+When a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login identifier — not MFA-after-password. Immediately before filling it, call sms_list_messages with reserve=true; never pass that tool a phone number. If it returns 429, retry the reservation later as a separate attempt without waiting in the tool. Then fill credentialField="phoneNumber", click send-code, sleep with execute_command, and call sms_list_messages with sinceMs from that click and claim=true. If the list is empty, make one delayed list retry; if it stays empty, stop and report. Do not report phone_verification as a barrier. TOTP-via-env for authenticator MFA is unchanged.
 
 Do NOT run curl, nmap, dig, or any other command before completing login.
 Include authentication information with EVERY target that requires it in your final report.

package/build/{cli-fw7sp0fp.js → cli-a7byd64n.js}

@@ -2,11 +2,11 @@ import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema,
   OffensiveSecurityAgent
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   hasToolCall,
   init_dist
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 import {
   exports_external,
   init_zod,

package/build/{cli-yge44bmk.js → cli-ap1hrzh5.js}

@@ -1,12 +1,12 @@
 import {
   EvidenceFileEntrySchema
-} from "./cli-a9vq54sx.js";
+} from "./cli-ssxghzzy.js";
 import {
   AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
   hasCanonicalName
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   exports_external,
   init_zod

package/build/{cli-7sqb16dd.js → cli-c1s54gqq.js}

@@ -5,24 +5,24 @@ import {
   WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_DISCOVERY_SYSTEM_PROMPT,
   WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT
-} from "./cli-fw7sp0fp.js";
+} from "./cli-a7byd64n.js";
 import {
   BlackboxAttackSurfaceAgent
-} from "./cli-14j00zfh.js";
+} from "./cli-7nerwz84.js";
 import {
   TargetedPentestAgent,
   buildPentestSystemPrompt
-} from "./cli-3ew5fs3f.js";
+} from "./cli-hbaf9qh5.js";
 import {
   REPORT_FILENAME_JSON,
   REPORT_FILENAME_MD,
   buildPentestReport,
   renderJson,
   renderMarkdown
-} from "./cli-yge44bmk.js";
+} from "./cli-ap1hrzh5.js";
 import {
   CodeAgent
-} from "./cli-g3cb8pj5.js";
+} from "./cli-sjjvw6zb.js";
 import {
   FindingsRegistry,
   OffensiveSecurityAgent,
@@ -31,7 +31,7 @@ import {
   pLimit,
   runWithBoundedConcurrency,
   toGrpcPentestContext
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   createThreatModelPrompt
 } from "./cli-fw5r7pfj.js";
@@ -45,7 +45,7 @@ import {
   init_structured,
   newSessionId,
   scopedLogger
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 import {
   __require
 } from "./cli-bc05qbss.js";
@@ -7815,7 +7815,7 @@ async function runPentestSwarm(input) {
 }
 async function runPentestWorkflow(input) {
   if (input.fastStrike) {
-    const { runFastStrike } = await import("./fastStrike-f441e9nr.js");
+    const { runFastStrike } = await import("./fastStrike-fjqcncfy.js");
     return runFastStrike(input);
   }
   const {

package/build/{cli-08fcc6d8.js → cli-d61ezw8h.js}

@@ -1,7 +1,7 @@
 import {
   config,
   init_config
-} from "./cli-9ya3yktn.js";
+} from "./cli-5et4dmnr.js";
 import {
   __esm
 } from "./cli-bc05qbss.js";

package/build/{cli-4mgj070h.js → cli-dtvmhkgj.js}

@@ -1,9 +1,9 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   detectOSAndEnhancePrompt
-} from "./cli-gbch9xmy.js";
+} from "./cli-q7fvqgpj.js";
 import {
   createLogger,
   hasToolCall,
@@ -11,7 +11,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -146,14 +146,16 @@ or two fresh codes are both rejected.
 If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
 after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
 
-1. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
-2. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
-3. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with that \`credentialId\` and \`sinceMs\`.
-   If the list is empty, sleep and list again a few times. If it stays empty or returns an error, stop
-   and report what you observed — do not hang in a wait loop. Set \`claim=true\` once a message is present
-   so other runs cannot reuse the OTP.
-4. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
-5. Continue the login and call \`complete_authentication\`.
+1. Call \`sms_list_messages\` with \`reserve=true\` immediately before filling the phone field. Never pass
+   a phone number to this tool. If it returns 429, retry this reservation later as a separate attempt; do
+   not wait or poll inside the tool.
+2. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
+3. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
+4. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with \`sinceMs\` and \`claim=true\`.
+   If the list is empty, make one delayed list retry; if it stays empty or returns an error, stop and report
+   what you observed — do not hang in a wait loop.
+5. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
+6. Continue the login and call \`complete_authentication\`.
 
 TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
 app code.
@@ -349,11 +351,13 @@ function buildAuthPrompt(target, authHints, credentialManager, context, envVarNa
     const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
     const smsInstructions = hasSmsPasswordless ? `
 If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
-identifier — not MFA-after-password. browser_fill credentialField="phoneNumber", click send-code, then
-execute_command \`sleep 5\` and call sms_list_messages with sinceMs = Date.now() at that click (claim=true
-once a message is present). If the list is empty, sleep and list again; if it stays empty, fail with what
-you observed — do not hang waiting. Then browser_fill the OTP. Do NOT report phone_verification as a
-barrier for this flow. TOTP-via-env for authenticator MFA is unchanged.` : "";
+identifier — not MFA-after-password. Immediately before filling the phone field, call sms_list_messages
+with reserve=true; never pass that tool a phone number. If it returns 429, retry the reservation later as
+a separate attempt without waiting in the tool. Then browser_fill credentialField="phoneNumber", click
+send-code, and call sms_list_messages with sinceMs = Date.now() at that click and claim=true after a brief
+execute_command sleep. If the list is empty, make one delayed list retry; if it stays empty, fail with what
+you observed. Then browser_fill the OTP. Do NOT report phone_verification as a barrier for this flow.
+TOTP-via-env for authenticator MFA is unchanged.` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response

package/build/{cli-3ew5fs3f.js → cli-hbaf9qh5.js}

@@ -5,7 +5,7 @@ import {
   createReportErrorTool,
   isMemoryEnabled,
   readPlan
-} from "./cli-4vwnsyep.js";
+} from "./cli-k420bwxm.js";
 import {
   createLogger,
   hasToolCall,
@@ -13,7 +13,7 @@ import {
   init_lazyLogger,
   init_structured,
   scopedLogger
-} from "./cli-f47dgye3.js";
+} from "./cli-1tbyezda.js";
 import {
   exports_external,
   init_zod
@@ -748,7 +748,7 @@ Do NOT discover or enumerate other endpoints or services. Focus exclusively on t
   const credentialSection = credentialContext ? `
 ## Available Credentials
 The operator provided the following credentials and authentication instructions for this engagement. Authenticate by following the instructions in each credential's Context exactly — use the method it describes (for example, a token/API exchange via execute_command or http_request) rather than defaulting to a browser login. Treat the Context as the source of truth for how to authenticate, and how to re-authenticate if a provided session expires. When a tool needs a secret value and supports it (e.g. browser_fill), reference it by credentialId + credentialField so the secret resolves securely at execution time instead of hardcoding it. If required authentication cannot be established and blocks the assigned objective or all further testing, call report_error with reason "authentication_failed" and a specific message; otherwise continue reachable testing and report the limitation in your final response.
-When a credential has additional field phoneNumber, phone is the login identifier (not MFA-after-password). Fill credentialField="phoneNumber", click send-code, sleep with execute_command, then sms_list_messages with sinceMs from that click (claim=true once a message is present). If the list stays empty, stop and report — do not hang. Do not report phone_verification as a barrier. TOTP-via-environment-variable for authenticator MFA is unchanged.
+When a credential has additional field phoneNumber, phone is the login identifier (not MFA-after-password). Immediately before filling it, call sms_list_messages with reserve=true; never pass that tool a phone number. If it returns 429, retry the reservation later as a separate attempt without waiting in the tool. Then fill credentialField="phoneNumber", click send-code, sleep with execute_command, and call sms_list_messages with sinceMs from that click and claim=true. If the list is empty, make one delayed list retry; if it stays empty, stop and report. Do not report phone_verification as a barrier. TOTP-via-environment-variable for authenticator MFA is unchanged.
 
 ${credentialContext}
 ` : "";

package/build/{cli-3bmqdcfh.js → cli-j87d7k33.js}

@@ -3,7 +3,7 @@ import {
 } from "./cli-bc05qbss.js";
 
 // package.json
-var version = "2.5.0-canary.2bbb0f6f", package_default;
+var version = "2.5.0-canary.4945243d", package_default;
 var init_package = __esm(() => {
   package_default = {
     author: "Pensar",