@pensar/apex 2.5.0 → 2.6.1-canary.4c944004

package/build/{cli-knd276ed.js → cli-bb02pjt0.js}

@@ -1,6 +1,6 @@
 import {
   __commonJS
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // node_modules/@opentelemetry/api/build/src/version.js
 var require_version = __commonJS(function(exports) {
@@ -169,14 +169,14 @@ var require_types = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.DiagLogLevel = undefined;
   var DiagLogLevel;
-  (function(DiagLogLevel2) {
-    DiagLogLevel2[DiagLogLevel2["NONE"] = 0] = "NONE";
-    DiagLogLevel2[DiagLogLevel2["ERROR"] = 30] = "ERROR";
-    DiagLogLevel2[DiagLogLevel2["WARN"] = 50] = "WARN";
-    DiagLogLevel2[DiagLogLevel2["INFO"] = 60] = "INFO";
-    DiagLogLevel2[DiagLogLevel2["DEBUG"] = 70] = "DEBUG";
-    DiagLogLevel2[DiagLogLevel2["VERBOSE"] = 80] = "VERBOSE";
-    DiagLogLevel2[DiagLogLevel2["ALL"] = 9999] = "ALL";
+  (function(DiagLogLevel) {
+    DiagLogLevel[DiagLogLevel["NONE"] = 0] = "NONE";
+    DiagLogLevel[DiagLogLevel["ERROR"] = 30] = "ERROR";
+    DiagLogLevel[DiagLogLevel["WARN"] = 50] = "WARN";
+    DiagLogLevel[DiagLogLevel["INFO"] = 60] = "INFO";
+    DiagLogLevel[DiagLogLevel["DEBUG"] = 70] = "DEBUG";
+    DiagLogLevel[DiagLogLevel["VERBOSE"] = 80] = "VERBOSE";
+    DiagLogLevel[DiagLogLevel["ALL"] = 9999] = "ALL";
   })(DiagLogLevel = exports.DiagLogLevel || (exports.DiagLogLevel = {}));
 });
 
@@ -529,9 +529,9 @@ var require_Metric = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ValueType = undefined;
   var ValueType;
-  (function(ValueType2) {
-    ValueType2[ValueType2["INT"] = 0] = "INT";
-    ValueType2[ValueType2["DOUBLE"] = 1] = "DOUBLE";
+  (function(ValueType) {
+    ValueType[ValueType["INT"] = 0] = "INT";
+    ValueType[ValueType["DOUBLE"] = 1] = "DOUBLE";
   })(ValueType = exports.ValueType || (exports.ValueType = {}));
 });
 
@@ -635,9 +635,9 @@ var require_trace_flags = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.TraceFlags = undefined;
   var TraceFlags;
-  (function(TraceFlags2) {
-    TraceFlags2[TraceFlags2["NONE"] = 0] = "NONE";
-    TraceFlags2[TraceFlags2["SAMPLED"] = 1] = "SAMPLED";
+  (function(TraceFlags) {
+    TraceFlags[TraceFlags["NONE"] = 0] = "NONE";
+    TraceFlags[TraceFlags["SAMPLED"] = 1] = "SAMPLED";
   })(TraceFlags = exports.TraceFlags || (exports.TraceFlags = {}));
 });
 
@@ -1005,10 +1005,10 @@ var require_SamplingResult = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.SamplingDecision = undefined;
   var SamplingDecision;
-  (function(SamplingDecision2) {
-    SamplingDecision2[SamplingDecision2["NOT_RECORD"] = 0] = "NOT_RECORD";
-    SamplingDecision2[SamplingDecision2["RECORD"] = 1] = "RECORD";
-    SamplingDecision2[SamplingDecision2["RECORD_AND_SAMPLED"] = 2] = "RECORD_AND_SAMPLED";
+  (function(SamplingDecision) {
+    SamplingDecision[SamplingDecision["NOT_RECORD"] = 0] = "NOT_RECORD";
+    SamplingDecision[SamplingDecision["RECORD"] = 1] = "RECORD";
+    SamplingDecision[SamplingDecision["RECORD_AND_SAMPLED"] = 2] = "RECORD_AND_SAMPLED";
   })(SamplingDecision = exports.SamplingDecision || (exports.SamplingDecision = {}));
 });
 
@@ -1017,12 +1017,12 @@ var require_span_kind = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.SpanKind = undefined;
   var SpanKind;
-  (function(SpanKind2) {
-    SpanKind2[SpanKind2["INTERNAL"] = 0] = "INTERNAL";
-    SpanKind2[SpanKind2["SERVER"] = 1] = "SERVER";
-    SpanKind2[SpanKind2["CLIENT"] = 2] = "CLIENT";
-    SpanKind2[SpanKind2["PRODUCER"] = 3] = "PRODUCER";
-    SpanKind2[SpanKind2["CONSUMER"] = 4] = "CONSUMER";
+  (function(SpanKind) {
+    SpanKind[SpanKind["INTERNAL"] = 0] = "INTERNAL";
+    SpanKind[SpanKind["SERVER"] = 1] = "SERVER";
+    SpanKind[SpanKind["CLIENT"] = 2] = "CLIENT";
+    SpanKind[SpanKind["PRODUCER"] = 3] = "PRODUCER";
+    SpanKind[SpanKind["CONSUMER"] = 4] = "CONSUMER";
   })(SpanKind = exports.SpanKind || (exports.SpanKind = {}));
 });
 
@@ -1031,10 +1031,10 @@ var require_status = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.SpanStatusCode = undefined;
   var SpanStatusCode;
-  (function(SpanStatusCode2) {
-    SpanStatusCode2[SpanStatusCode2["UNSET"] = 0] = "UNSET";
-    SpanStatusCode2[SpanStatusCode2["OK"] = 1] = "OK";
-    SpanStatusCode2[SpanStatusCode2["ERROR"] = 2] = "ERROR";
+  (function(SpanStatusCode) {
+    SpanStatusCode[SpanStatusCode["UNSET"] = 0] = "UNSET";
+    SpanStatusCode[SpanStatusCode["OK"] = 1] = "OK";
+    SpanStatusCode[SpanStatusCode["ERROR"] = 2] = "ERROR";
   })(SpanStatusCode = exports.SpanStatusCode || (exports.SpanStatusCode = {}));
 });
 
@@ -1368,7 +1368,7 @@ var require_trace_api = __commonJS(function(exports) {
 });
 
 // node_modules/@opentelemetry/api/build/src/index.js
-var require_src = __commonJS(function(exports) {
+var require_src6 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.trace = exports.propagation = exports.metrics = exports.diag = exports.context = exports.INVALID_SPAN_CONTEXT = exports.INVALID_TRACEID = exports.INVALID_SPANID = exports.isValidSpanId = exports.isValidTraceId = exports.isSpanContextValid = exports.createTraceState = exports.TraceFlags = exports.SpanStatusCode = exports.SpanKind = exports.SamplingDecision = exports.ProxyTracerProvider = exports.ProxyTracer = exports.defaultTextMapSetter = exports.defaultTextMapGetter = exports.ValueType = exports.createNoopMeter = exports.DiagLogLevel = exports.DiagConsoleLogger = exports.ROOT_CONTEXT = exports.createContextKey = exports.baggageEntryMetadataFromString = undefined;
   var utils_1 = require_utils();
@@ -1482,4 +1482,4 @@ var require_src = __commonJS(function(exports) {
   };
 });
 
-export { require_src };
+export { require_src6 };

package/build/{cli-j54qa6tm.js → cli-c2k4xxaw.js}

@@ -1,7 +1,7 @@
 import {
   __commonJS,
   __require
-} from "./cli-bc05qbss.js";
+} from "./cli-h6y3bt60.js";
 
 // node_modules/@vercel/oidc/dist/token-error.js
 var require_token_error = __commonJS(function(exports, module) {
@@ -43,6 +43,47 @@ var require_token_error = __commonJS(function(exports, module) {
   }
 });
 
+// node_modules/@vercel/oidc/dist/auth-errors.js
+var require_auth_errors = __commonJS(function(exports, module) {
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+  var auth_errors_exports = {};
+  __export(auth_errors_exports, {
+    AccessTokenMissingError: () => AccessTokenMissingError,
+    RefreshAccessTokenFailedError: () => RefreshAccessTokenFailedError
+  });
+  module.exports = __toCommonJS(auth_errors_exports);
+
+  class AccessTokenMissingError extends Error {
+    constructor() {
+      super("No authentication found. Please log in with the Vercel CLI (vercel login).");
+      this.name = "AccessTokenMissingError";
+    }
+  }
+
+  class RefreshAccessTokenFailedError extends Error {
+    constructor(cause) {
+      super("Failed to refresh authentication token.", { cause });
+      this.name = "RefreshAccessTokenFailedError";
+    }
+  }
+});
+
 // node_modules/@vercel/oidc/dist/token-io.js
 var require_token_io = __commonJS(function(exports, module) {
   var __create = Object.create;
@@ -269,47 +310,6 @@ var require_oauth = __commonJS(function(exports, module) {
   }
 });
 
-// node_modules/@vercel/oidc/dist/auth-errors.js
-var require_auth_errors = __commonJS(function(exports, module) {
-  var __defProp = Object.defineProperty;
-  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-  var __getOwnPropNames = Object.getOwnPropertyNames;
-  var __hasOwnProp = Object.prototype.hasOwnProperty;
-  var __export = (target, all) => {
-    for (var name in all)
-      __defProp(target, name, { get: all[name], enumerable: true });
-  };
-  var __copyProps = (to, from, except, desc) => {
-    if (from && typeof from === "object" || typeof from === "function") {
-      for (let key of __getOwnPropNames(from))
-        if (!__hasOwnProp.call(to, key) && key !== except)
-          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-    }
-    return to;
-  };
-  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-  var auth_errors_exports = {};
-  __export(auth_errors_exports, {
-    AccessTokenMissingError: () => AccessTokenMissingError,
-    RefreshAccessTokenFailedError: () => RefreshAccessTokenFailedError
-  });
-  module.exports = __toCommonJS(auth_errors_exports);
-
-  class AccessTokenMissingError extends Error {
-    constructor() {
-      super("No authentication found. Please log in with the Vercel CLI (vercel login).");
-      this.name = "AccessTokenMissingError";
-    }
-  }
-
-  class RefreshAccessTokenFailedError extends Error {
-    constructor(cause) {
-      super("Failed to refresh authentication token.", { cause });
-      this.name = "RefreshAccessTokenFailedError";
-    }
-  }
-});
-
 // node_modules/@vercel/oidc/dist/token-util.js
 var require_token_util = __commonJS(function(exports, module) {
   var __create = Object.create;

package/build/{cli-x92fkt2f.js → cli-d8x165mf.js}

@@ -1,17 +1,22 @@
 import {
-  OffensiveSecurityAgent
-} from "./cli-sx3jkv7p.js";
+  GOOGLE_SIGNIN_PROMPT_GUIDANCE,
+  browserEngineForGoogleSignIn
+} from "./cli-jdrx44ge.js";
 import {
-  detectOSAndEnhancePrompt
-} from "./cli-5wemv37a.js";
+  MOBILE_OTP_PROMPT_GUIDANCE
+} from "./cli-retw3rw5.js";
+import {
+  AgentRuntime,
+  defineAgent
+} from "./cli-s82mq645.js";
 import {
-  createLogger,
   hasToolCall,
   init_dist,
+  scopedLogger,
   init_lazyLogger,
-  init_structured,
-  scopedLogger
-} from "./cli-p4r7q012.js";
+  createLogger,
+  init_structured
+} from "./cli-a9j339n2.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();
@@ -141,19 +146,9 @@ every 30 seconds, so run this immediately before filling the field. If the code
 retry once (you may have crossed a period boundary). Only report an MFA barrier if no seed is available
 or two fresh codes are both rejected.
 
-# SMS passwordless (phone as login)
+${MOBILE_OTP_PROMPT_GUIDANCE}
 
-If a credential has a \`phoneNumber\` additional field, the phone number IS the login identifier — not MFA
-after a password. Do **not** report \`phone_verification\` as a barrier for this flow.
-
-1. \`browser_fill\` with \`credentialId\` and \`credentialField="phoneNumber"\` (never type the number).
-2. Click the target's send-code / text-me control. Note \`Date.now()\` at that click as \`sinceMs\`.
-3. \`execute_command\` \`sleep 5\`, then call \`sms_list_messages\` with that \`credentialId\` and \`sinceMs\`.
-   If the list is empty, sleep and list again a few times. If it stays empty or returns an error, stop
-   and report what you observed — do not hang in a wait loop. Set \`claim=true\` once a message is present
-   so other runs cannot reuse the OTP.
-4. \`browser_fill\` the OTP from the claimed/listed result (\`code\`, or parse \`body\` if \`code\` is null).
-5. Continue the login and call \`complete_authentication\`.
+${GOOGLE_SIGNIN_PROMPT_GUIDANCE}
 
 TOTP-via-environment-variable above is unchanged and still applies when the login asks for an authenticator
 app code.
@@ -205,71 +200,41 @@ If you encounter rate-limiting errors (e.g. "Rate limit exceeded", HTTP 429, "to
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 var log = scopedLogger(() => createLogger("authentication-agent"));
-
-class AuthenticationAgent extends OffensiveSecurityAgent {
+var AUTH_ACTIVE_TOOLS = [
+  "execute_command",
+  "complete_authentication",
+  "browser_navigate",
+  "browser_snapshot",
+  "browser_screenshot",
+  "browser_click",
+  "browser_fill",
+  "browser_evaluate",
+  "browser_console",
+  "browser_get_cookies",
+  "email_list_inboxes",
+  "email_list_messages",
+  "email_search_messages",
+  "email_get_message",
+  "send_email",
+  "sms_list_messages",
+  "web_search",
+  "get_page"
+];
+var authenticationAgentDefinition = defineAgent({
+  name: "authentication-agent",
+  role: "worker",
+  system: () => AUTH_SUBAGENT_SYSTEM_PROMPT,
+  activeTools: () => [...AUTH_ACTIVE_TOOLS],
+  stopWhen: () => hasToolCall("complete_authentication"),
+  target: (opts) => opts.target,
+  browserEngine: (opts) => browserEngineForGoogleSignIn(opts.session.credentialManager?.hasGoogleSignIn() === true),
+  prompt: (opts) => buildAuthPrompt(opts.target, opts.authHints, opts.session.credentialManager, opts.context, opts.environmentVariables ? Object.keys(opts.environmentVariables) : undefined),
+  resolveResult: (opts) => loadAuthResult(join(opts.session.rootPath, "auth", "auth-data.json"))
+});
+
+class AuthenticationAgent extends AgentRuntime {
   constructor(opts) {
-    const {
-      model,
-      target,
-      session,
-      authHints,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      context,
-      environmentVariables,
-      secretValues,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort
-    } = opts;
-    const cm = session.credentialManager;
-    super({
-      system: detectOSAndEnhancePrompt(AUTH_SUBAGENT_SYSTEM_PROMPT),
-      prompt: buildAuthPrompt(target, authHints, cm, context, environmentVariables ? Object.keys(environmentVariables) : undefined),
-      model,
-      session,
-      target,
-      authConfig,
-      onStepFinish,
-      abortSignal,
-      eventBus,
-      subagentId,
-      subagentName: opts.subagentName,
-      environmentVariables,
-      secretValues,
-      enableThinking,
-      thinkingEffort,
-      openAIReasoningEffort,
-      toolChoice: "auto",
-      activeTools: [
-        "execute_command",
-        "complete_authentication",
-        "browser_navigate",
-        "browser_snapshot",
-        "browser_screenshot",
-        "browser_click",
-        "browser_fill",
-        "browser_evaluate",
-        "browser_console",
-        "browser_get_cookies",
-        "email_list_inboxes",
-        "email_list_messages",
-        "email_search_messages",
-        "email_get_message",
-        "send_email",
-        "sms_list_messages",
-        "web_search",
-        "get_page"
-      ],
-      stopWhen: hasToolCall("complete_authentication"),
-      resolveResult: () => {
-        const authDataPath = join(session.rootPath, "auth", "auth-data.json");
-        return loadAuthResult(authDataPath);
-      }
-    });
+    super(authenticationAgentDefinition, opts);
   }
 }
 function loadAuthResult(authDataPath) {
@@ -346,14 +311,10 @@ function buildAuthPrompt(target, authHints, credentialManager, context, envVarNa
     parts.push("");
   }
   if (credBlock) {
-    const hasSmsPasswordless = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
-    const smsInstructions = hasSmsPasswordless ? `
-If a credential has a phoneNumber additional field (Mobile OTP / sms-passwordless), phone is the login
-identifier — not MFA-after-password. browser_fill credentialField="phoneNumber", click send-code, then
-execute_command \`sleep 5\` and call sms_list_messages with sinceMs = Date.now() at that click (claim=true
-once a message is present). If the list is empty, sleep and list again; if it stays empty, fail with what
-you observed — do not hang waiting. Then browser_fill the OTP. Do NOT report phone_verification as a
-barrier for this flow. TOTP-via-env for authenticator MFA is unchanged.` : "";
+    const hasMobileOtp = credentialManager?.listReferences().some((ref) => ref.additionalFieldKeys?.includes("phoneNumber"));
+    const smsInstructions = hasMobileOtp ? `
+${MOBILE_OTP_PROMPT_GUIDANCE}
+` : "";
     parts.push(`INSTRUCTIONS:
 You have credentials available via credential IDs — authenticate immediately.
 1. For API/form logins, use execute_command (curl) to submit credentials and capture the Set-Cookie / token response
@@ -380,14 +341,11 @@ and only pollutes results — fail fast with success=false instead.`);
   return parts.join(`
 `);
 }
-async function runAuthenticationAgent(input) {
+async function runAuthenticationAgent2(input) {
   const agent = new AuthenticationAgent(input);
   const result = await agent.consume();
   log.info(`Authentication ${result.success ? "succeeded" : "failed"}: ${result.summary}`);
   return result;
 }
 
-// src/core/api/authentication.ts
-var runAuthenticationAgent2 = runAuthenticationAgent;
-
-export { runAuthenticationAgent2 as runAuthenticationAgent };
+export { runAuthenticationAgent2 };

package/build/{cli-vkbzcnw1.js → cli-da57pbjb.js}

@@ -1,55 +1,60 @@
-import {
-  EvidenceFileEntrySchema
-} from "./cli-9qbxkhye.js";
 import {
   AttackPathSchema,
   CweEntrySchema,
   ValidatedCweEntrySchema,
-  hasCanonicalName
-} from "./cli-sx3jkv7p.js";
+  hasCanonicalName,
+  EvidenceFileEntrySchema
+} from "./cli-v0d1n2j3.js";
 import {
-  exports_external,
   init_zod
-} from "./cli-avmhkjtv.js";
+} from "./cli-3qznjsnr.js";
+import {
+  string,
+  number,
+  boolean,
+  array,
+  object,
+  _enum
+} from "./cli-mz5pk30x.js";
 
 // src/core/report/schemas.ts
 init_zod();
-var PentestReportFindingSchema = exports_external.object({
-  title: exports_external.string(),
-  severity: exports_external.enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
-  description: exports_external.string(),
-  impact: exports_external.string(),
-  evidence: exports_external.string(),
-  endpoint: exports_external.string(),
-  pocPath: exports_external.string(),
-  remediation: exports_external.string(),
-  references: exports_external.string().optional(),
-  cwes: exports_external.array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
-  rootCauseGroup: exports_external.string().optional(),
-  relatedFindings: exports_external.array(exports_external.string()).optional(),
-  rootCauseLead: exports_external.boolean().optional(),
-  evidenceFiles: exports_external.array(EvidenceFileEntrySchema).optional(),
+var PentestReportFindingSchema = object({
+  title: string(),
+  severity: _enum(["CRITICAL", "HIGH", "MEDIUM", "LOW"]),
+  description: string(),
+  impact: string(),
+  evidence: string(),
+  endpoint: string(),
+  pocPath: string(),
+  remediation: string(),
+  references: string().optional(),
+  cwes: array(ValidatedCweEntrySchema.or(CweEntrySchema)).optional(),
+  rootCauseGroup: string().optional(),
+  relatedFindings: array(string()).optional(),
+  rootCauseLead: boolean().optional(),
+  evidenceFiles: array(EvidenceFileEntrySchema).optional(),
   attackPath: AttackPathSchema.optional()
 });
-var PentestReportSchema = exports_external.object({
-  version: exports_external.string().regex(/^1\.\d+$/),
-  metadata: exports_external.object({
-    target: exports_external.string(),
-    model: exports_external.string(),
-    timestamp: exports_external.string(),
-    sessionId: exports_external.string(),
-    mode: exports_external.enum(["blackbox", "whitebox", "targeted"])
+var PentestReportSchema = object({
+  version: string().regex(/^1\.\d+$/),
+  metadata: object({
+    target: string(),
+    model: string(),
+    timestamp: string(),
+    sessionId: string(),
+    mode: _enum(["blackbox", "whitebox", "targeted"])
   }),
-  summary: exports_external.object({
-    totalFindings: exports_external.number(),
-    bySeverity: exports_external.object({
-      CRITICAL: exports_external.number(),
-      HIGH: exports_external.number(),
-      MEDIUM: exports_external.number(),
-      LOW: exports_external.number()
+  summary: object({
+    totalFindings: number(),
+    bySeverity: object({
+      CRITICAL: number(),
+      HIGH: number(),
+      MEDIUM: number(),
+      LOW: number()
     })
   }),
-  findings: exports_external.array(PentestReportFindingSchema)
+  findings: array(PentestReportFindingSchema)
 });
 var REPORT_VERSION = "1.0";
 
@@ -93,12 +98,10 @@ function buildPentestReport(findings, context) {
     }))
   };
 }
-
 // src/core/report/renderers/json.ts
 function renderJson(report) {
   return JSON.stringify(report, null, 2);
 }
-
 // src/core/report/renderers/markdown.ts
 function renderMarkdown(report) {
   const { metadata, findings, summary } = report;