@pensar/apex 2.5.0 → 2.6.1-canary.025b1ecf

package/build/lib/core/agents/offSecAgent/tools/documentFinding.d.ts

@@ -0,0 +1,285 @@
+import { z } from "zod";
+import { type ScriptSyntaxResult } from "./scriptSyntaxCheck";
+import type { ToolContext } from "./types";
+export declare const documentVulnerabilityInputSchema: z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    impact: z.ZodString;
+    evidence: z.ZodString;
+    materiality: z.ZodObject<{
+        exploitPath: z.ZodString;
+        securityImpact: z.ZodString;
+        affectedAssetOrAbusePath: z.ZodString;
+        falsePositiveRationale: z.ZodString;
+    }, z.core.$strip>;
+    endpoint: z.ZodString;
+    remediation: z.ZodString;
+    references: z.ZodOptional<z.ZodString>;
+    vulnerabilityClass: z.ZodOptional<z.ZodString>;
+    toolCallDescription: z.ZodString;
+    pocName: z.ZodString;
+    pocType: z.ZodEnum<{
+        bash: "bash";
+        python: "python";
+        javascript: "javascript";
+    }>;
+    pocContent: z.ZodString;
+    pocDescription: z.ZodString;
+    generatedExecutableArtifacts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        language: z.ZodEnum<{
+            bash: "bash";
+            python: "python";
+            javascript: "javascript";
+        }>;
+    }, z.core.$strip>>>;
+    attackPath: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        applicationId: z.ZodOptional<z.ZodString>;
+        applicationName: z.ZodOptional<z.ZodString>;
+        host: z.ZodOptional<z.ZodString>;
+        relationshipType: z.ZodOptional<z.ZodString>;
+        notes: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    credentialIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type DocumentVulnerabilityInput = z.infer<typeof documentVulnerabilityInputSchema>;
+type PocType = "bash" | "python" | "javascript";
+export declare function documentVulnerability(ctx: ToolContext): import("ai").Tool<{
+    title: string;
+    description: string;
+    impact: string;
+    evidence: string;
+    materiality: {
+        exploitPath: string;
+        securityImpact: string;
+        affectedAssetOrAbusePath: string;
+        falsePositiveRationale: string;
+    };
+    endpoint: string;
+    remediation: string;
+    toolCallDescription: string;
+    pocName: string;
+    pocType: "bash" | "python" | "javascript";
+    pocContent: string;
+    pocDescription: string;
+    credentialIds: string[];
+    references?: string | undefined;
+    vulnerabilityClass?: string | undefined;
+    generatedExecutableArtifacts?: {
+        path: string;
+        language: "bash" | "python" | "javascript";
+    }[] | undefined;
+    attackPath?: {
+        applicationId?: string | undefined;
+        applicationName?: string | undefined;
+        host?: string | undefined;
+        relationshipType?: string | undefined;
+        notes?: string | undefined;
+    }[] | undefined;
+}, {
+    success: boolean;
+    error: string;
+    message: string;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    syntaxFailed?: undefined;
+    syntaxCheck?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    generatedArtifactChecks?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+} | {
+    success: boolean;
+    duplicate: boolean;
+    matchType: "exact" | "application-wide" | "semantic" | undefined;
+    matchedFinding: string;
+    message: string;
+    error?: undefined;
+    syntaxFailed?: undefined;
+    syntaxCheck?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    generatedArtifactChecks?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+} | {
+    success: boolean;
+    syntaxFailed: boolean;
+    syntaxCheck: ScriptSyntaxResult;
+    message: string;
+    error?: undefined;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    generatedArtifactChecks?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+} | {
+    success: boolean;
+    pocFailed: boolean;
+    stdout: string | undefined;
+    stderr: string | undefined;
+    exitCode: number | undefined;
+    syntaxCheck: ScriptSyntaxResult | undefined;
+    message: string;
+    error?: undefined;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    syntaxFailed?: undefined;
+    generatedArtifactChecks?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+} | {
+    success: boolean;
+    syntaxFailed: boolean;
+    syntaxCheck: ScriptSyntaxResult | undefined;
+    generatedArtifactChecks: GeneratedArtifactCheck[];
+    message: string;
+    error?: undefined;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+} | {
+    success: boolean;
+    judgeRejected: boolean;
+    judgeReasoning: string;
+    judgeConcerns: string[];
+    judgeConfidence: number;
+    message: string;
+    error?: undefined;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    syntaxFailed?: undefined;
+    syntaxCheck?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    generatedArtifactChecks?: undefined;
+} | {
+    generatedArtifactChecks?: GeneratedArtifactCheck[] | undefined;
+    success: boolean;
+    finding: {
+        timestamp: string;
+        sessionId: string;
+        target: string;
+        pocOutput: {
+            stdout: string;
+            stderr: string;
+            exitCode: number;
+            executedAt: string;
+        };
+        cwes: {
+            id: string;
+            reasoning: string;
+            name: string;
+        }[];
+        cvss: {
+            scored: boolean;
+            score: number;
+            severity: string;
+            vectorString: string;
+            metrics: import("../../../../lib/cvss").CVSS4Metrics;
+            scoreType: string;
+            reasoning: string;
+        };
+        judge: {
+            error?: {
+                message: string;
+                type: string;
+                model: string;
+                stack?: string;
+            } | undefined;
+            valid: true;
+            findingType: "informational" | "vulnerability" | "expected-behavior";
+            confidence: number;
+            reasoning: string;
+            concerns: string[];
+            verificationSteps: string[] | undefined;
+            toolEvidence: string[] | undefined;
+            reproducedPoc: boolean | undefined;
+            webResearchUsed: boolean | undefined;
+            limitations: string[] | undefined;
+        };
+        description: string;
+        title: string;
+        endpoint: string;
+        evidence: string;
+        toolCallDescription?: string | undefined;
+        impact: string;
+        remediation: string;
+        references?: string | undefined;
+        attackPath?: {
+            applicationId?: string | undefined;
+            applicationName?: string | undefined;
+            host?: string | undefined;
+            relationshipType?: string | undefined;
+            notes?: string | undefined;
+        }[] | undefined;
+        severity: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW";
+        pocPath: string;
+        rootCauseGroup?: string | undefined;
+        relatedFindings?: string[] | undefined;
+        rootCauseLead?: boolean | undefined;
+        evidenceFiles?: {
+            path: string;
+            type: "http-response" | "screenshot" | "poc-output" | "raw-evidence";
+            description: string;
+        }[] | undefined;
+        credentialIds?: string[];
+    };
+    filepath: string;
+    message: string;
+    syntaxCheck: ScriptSyntaxResult | undefined;
+    error?: undefined;
+    duplicate?: undefined;
+    matchType?: undefined;
+    matchedFinding?: undefined;
+    syntaxFailed?: undefined;
+    pocFailed?: undefined;
+    stdout?: undefined;
+    stderr?: undefined;
+    exitCode?: undefined;
+    judgeRejected?: undefined;
+    judgeReasoning?: undefined;
+    judgeConcerns?: undefined;
+    judgeConfidence?: undefined;
+}>;
+type GeneratedArtifactCheck = ScriptSyntaxResult & {
+    path: string;
+    language: PocType;
+};
+/**
+ * Validates PoC script for POSIX portability issues.
+ * Returns array of warning messages for non-portable patterns.
+ */
+export declare function validatePocPortability(content: string, pocType: PocType): string[];
+export {};

package/build/lib/core/agents/offSecAgent/tools/email/adapters.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Email provider adapters.
+ *
+ * Each adapter wraps a first-party SDK into the shared {@link EmailAdapter}
+ * interface so individual tool files stay provider-agnostic.
+ *
+ * - Gmail  → @googleapis/gmail
+ * - Outlook → @microsoft/microsoft-graph-client
+ * - IMAP   → imapflow
+ * - HTTP   → native fetch (any mailbox API implementing the wire contract)
+ */
+import type { EmailInboxConfig } from "../../../../session";
+import type { EmailAttachment, EmailListResult, EmailMessageFull, EmailSearchResult } from "./types";
+export interface EmailAdapter {
+    listMessages(opts: {
+        folder?: string;
+        maxResults?: number;
+        pageToken?: string;
+    }): Promise<EmailListResult>;
+    getMessage(messageId: string, folder?: string): Promise<EmailMessageFull>;
+    searchMessages(opts: {
+        query: string;
+        folder?: string;
+        maxResults?: number;
+        pageToken?: string;
+    }): Promise<EmailSearchResult>;
+    getAttachments(messageId: string, folder?: string): Promise<EmailAttachment[]>;
+    getAttachmentContent(messageId: string, attachmentId: string, folder?: string): Promise<{
+        filename: string;
+        mimeType: string;
+        base64Content: string;
+    }>;
+    markAsRead(messageId: string, folder?: string): Promise<void>;
+}
+/**
+ * Lets a host supply an adapter for an inbox that has no transport of its own.
+ * Returning null falls through to {@link createEmailAdapter}.
+ */
+export type EmailAdapterResolver = (inbox: EmailInboxConfig) => EmailAdapter | null;
+/**
+ * The single place an adapter is chosen. Prefers the host's resolver, falls
+ * back to the config-driven factory.
+ */
+export declare function resolveEmailAdapter(inbox: EmailInboxConfig, resolver?: EmailAdapterResolver): EmailAdapter;
+export declare function createEmailAdapter(inbox: EmailInboxConfig): EmailAdapter;

package/build/lib/core/agents/offSecAgent/tools/email/adapters.js

@@ -0,0 +1,8 @@
+import {
+  resolveEmailAdapter2,
+  createEmailAdapter2
+} from "../../../../../chunk-zrbqn62x.js";
+export {
+  createEmailAdapter2 as createEmailAdapter,
+  resolveEmailAdapter2 as resolveEmailAdapter
+};

package/build/lib/core/agents/offSecAgent/tools/email/getAttachments.d.ts

@@ -0,0 +1,33 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_get_attachments
+ *
+ * Lists attachments on a message, or downloads a specific attachment's
+ * content as base64.
+ */
+export declare function emailGetAttachments(ctx: ToolContext): import("ai").Tool<{
+    inboxId: string;
+    messageId: string;
+    toolCallDescription: string;
+    attachmentId?: string | undefined;
+    folder?: string | undefined;
+}, {
+    success: boolean;
+    error: string;
+    attachment?: undefined;
+    attachments?: undefined;
+} | {
+    success: boolean;
+    attachment: {
+        filename: string;
+        mimeType: string;
+        base64Content: string;
+    };
+    error?: undefined;
+    attachments?: undefined;
+} | {
+    success: boolean;
+    attachments: import("./types").EmailAttachment[];
+    error?: undefined;
+    attachment?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/getMessage.d.ts

@@ -0,0 +1,20 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_get_message
+ *
+ * Retrieves the full content of a single email message by its ID.
+ */
+export declare function emailGetMessage(ctx: ToolContext): import("ai").Tool<{
+    inboxId: string;
+    messageId: string;
+    toolCallDescription: string;
+    folder?: string | undefined;
+}, {
+    success: boolean;
+    error: string;
+    message?: undefined;
+} | {
+    success: boolean;
+    message: import("./types").EmailMessageFull;
+    error?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/index.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Email tool suite for agent inbox interaction and outbound email.
+ *
+ * Provides six read-only inbox tools (Gmail, Outlook, IMAP) plus a
+ * send_email tool that uses SMTP (works with any SMTP server including
+ * Resend's SMTP relay).
+ */
+export { emailGetAttachments } from "./getAttachments";
+export { emailGetMessage } from "./getMessage";
+export { emailListInboxes } from "./listInboxes";
+export { emailListMessages } from "./listMessages";
+export { emailMarkRead } from "./markRead";
+export { emailSearchMessages } from "./searchMessages";
+export { sendEmail } from "./sendEmail";
+import type { ToolContext } from "../types";
+/**
+ * Create the full email toolset. Inbox tools pull config from
+ * `ctx.session.config.emailIntegration`; send_email pulls from
+ * `ctx.session.config.smtpConfig`. Gating for each subset is
+ * handled by the base agent class at the activeTools level.
+ */
+export declare function createEmailToolset(ctx: ToolContext): {
+    readonly email_list_inboxes: import("ai").Tool<{
+        toolCallDescription: string;
+    }, {
+        success: boolean;
+        error: string;
+        inboxes: never[];
+    } | {
+        success: boolean;
+        inboxes: {
+            id: string;
+            provider: "gmail" | "outlook" | "imap" | "http" | "pensar-managed";
+            name: string;
+            emailAddress: string;
+        }[];
+        error?: undefined;
+    }>;
+    readonly email_list_messages: import("ai").Tool<{
+        inboxId: string;
+        toolCallDescription: string;
+        folder?: string | undefined;
+        maxResults?: number | undefined;
+        pageToken?: string | undefined;
+    }, {
+        success: boolean;
+        error: string;
+    } | {
+        messages: import("./types").EmailMessageSummary[];
+        nextPageToken?: string;
+        totalEstimate?: number;
+        success: boolean;
+        error?: undefined;
+    }>;
+    readonly email_get_message: import("ai").Tool<{
+        inboxId: string;
+        messageId: string;
+        toolCallDescription: string;
+        folder?: string | undefined;
+    }, {
+        success: boolean;
+        error: string;
+        message?: undefined;
+    } | {
+        success: boolean;
+        message: import("./types").EmailMessageFull;
+        error?: undefined;
+    }>;
+    readonly email_search_messages: import("ai").Tool<{
+        inboxId: string;
+        query: string;
+        toolCallDescription: string;
+        folder?: string | undefined;
+        maxResults?: number | undefined;
+        pageToken?: string | undefined;
+    }, {
+        success: boolean;
+        error: string;
+    } | {
+        messages: import("./types").EmailMessageSummary[];
+        nextPageToken?: string;
+        totalEstimate?: number;
+        success: boolean;
+        error?: undefined;
+    }>;
+    readonly email_get_attachments: import("ai").Tool<{
+        inboxId: string;
+        messageId: string;
+        toolCallDescription: string;
+        attachmentId?: string | undefined;
+        folder?: string | undefined;
+    }, {
+        success: boolean;
+        error: string;
+        attachment?: undefined;
+        attachments?: undefined;
+    } | {
+        success: boolean;
+        attachment: {
+            filename: string;
+            mimeType: string;
+            base64Content: string;
+        };
+        error?: undefined;
+        attachments?: undefined;
+    } | {
+        success: boolean;
+        attachments: import("./types").EmailAttachment[];
+        error?: undefined;
+        attachment?: undefined;
+    }>;
+    readonly email_mark_read: import("ai").Tool<{
+        inboxId: string;
+        messageId: string;
+        toolCallDescription: string;
+        folder?: string | undefined;
+    }, {
+        success: boolean;
+        error: string;
+        message?: undefined;
+    } | {
+        success: boolean;
+        message: string;
+        error?: undefined;
+    }>;
+    readonly send_email: import("ai").Tool<{
+        to: string | string[];
+        subject: string;
+        body: string;
+        toolCallDescription: string;
+        from?: string | undefined;
+        html?: string | undefined;
+        cc?: string | string[] | undefined;
+        bcc?: string | string[] | undefined;
+        replyTo?: string | undefined;
+        headers?: Record<string, string> | undefined;
+        attachments?: {
+            path: string;
+            filename?: string | undefined;
+        }[] | undefined;
+    }, import("./sendEmail").SendEmailResult>;
+};
+/** All email tool names. Inbox tools gated on emailIntegration.inboxes; send_email gated on smtpConfig. */
+export declare const EMAIL_TOOL_NAMES: readonly ["email_list_inboxes", "email_list_messages", "email_get_message", "email_search_messages", "email_get_attachments", "email_mark_read", "send_email"];
+export declare const SEND_EMAIL_TOOL_NAME: "send_email";

package/build/lib/core/agents/offSecAgent/tools/email/listInboxes.d.ts

@@ -0,0 +1,23 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_list_inboxes
+ *
+ * Lists all email inboxes configured for the current session so the agent
+ * knows which inboxes are available before querying them.
+ */
+export declare function emailListInboxes(ctx: ToolContext): import("ai").Tool<{
+    toolCallDescription: string;
+}, {
+    success: boolean;
+    error: string;
+    inboxes: never[];
+} | {
+    success: boolean;
+    inboxes: {
+        id: string;
+        provider: "gmail" | "outlook" | "imap" | "http" | "pensar-managed";
+        name: string;
+        emailAddress: string;
+    }[];
+    error?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/listMessages.d.ts

@@ -0,0 +1,22 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_list_messages
+ *
+ * Lists messages in an inbox with optional folder selection and pagination.
+ */
+export declare function emailListMessages(ctx: ToolContext): import("ai").Tool<{
+    inboxId: string;
+    toolCallDescription: string;
+    folder?: string | undefined;
+    maxResults?: number | undefined;
+    pageToken?: string | undefined;
+}, {
+    success: boolean;
+    error: string;
+} | {
+    messages: import("./types").EmailMessageSummary[];
+    nextPageToken?: string;
+    totalEstimate?: number;
+    success: boolean;
+    error?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/markRead.d.ts

@@ -0,0 +1,20 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_mark_read
+ *
+ * Marks a message as read in the connected inbox.
+ */
+export declare function emailMarkRead(ctx: ToolContext): import("ai").Tool<{
+    inboxId: string;
+    messageId: string;
+    toolCallDescription: string;
+    folder?: string | undefined;
+}, {
+    success: boolean;
+    error: string;
+    message?: undefined;
+} | {
+    success: boolean;
+    message: string;
+    error?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/searchMessages.d.ts

@@ -0,0 +1,24 @@
+import type { ToolContext } from "../types";
+/**
+ * Tool: email_search_messages
+ *
+ * Searches email messages by a query string. Supports provider-native
+ * search syntax (Gmail search operators, Microsoft KQL, IMAP TEXT search).
+ */
+export declare function emailSearchMessages(ctx: ToolContext): import("ai").Tool<{
+    inboxId: string;
+    query: string;
+    toolCallDescription: string;
+    folder?: string | undefined;
+    maxResults?: number | undefined;
+    pageToken?: string | undefined;
+}, {
+    success: boolean;
+    error: string;
+} | {
+    messages: import("./types").EmailMessageSummary[];
+    nextPageToken?: string;
+    totalEstimate?: number;
+    success: boolean;
+    error?: undefined;
+}>;

package/build/lib/core/agents/offSecAgent/tools/email/sendEmail.d.ts

@@ -0,0 +1,28 @@
+import type { ToolContext } from "../types";
+export interface SendEmailResult {
+    success: boolean;
+    messageId?: string;
+    error?: string;
+}
+/**
+ * Tool: send_email
+ *
+ * Sends an email via SMTP. Works with any SMTP server including Resend's
+ * SMTP relay (smtp.resend.com:465, user "resend", password = API key).
+ */
+export declare function sendEmail(ctx: ToolContext): import("ai").Tool<{
+    to: string | string[];
+    subject: string;
+    body: string;
+    toolCallDescription: string;
+    from?: string | undefined;
+    html?: string | undefined;
+    cc?: string | string[] | undefined;
+    bcc?: string | string[] | undefined;
+    replyTo?: string | undefined;
+    headers?: Record<string, string> | undefined;
+    attachments?: {
+        path: string;
+        filename?: string | undefined;
+    }[] | undefined;
+}, SendEmailResult>;