@pensar/apex 2.6.1-canary.e936ec17 → 2.6.1

package/build/pentest-e61hc38s.js

@@ -0,0 +1,22 @@
+import {
+  DEFAULT_CONCURRENCY2,
+  runPentestSwarm2,
+  runPentestWorkflow2
+} from "./cli-d37a42dc.js";
+import"./cli-n2en7j5b.js";
+import"./cli-ngq9dr8n.js";
+import"./cli-k2nwxta0.js";
+import"./cli-xtc2t6me.js";
+import"./cli-kb21qhvm.js";
+import"./cli-1ve18npr.js";
+import"./cli-qba2x69h.js";
+import"./cli-qgz1q9g5.js";
+import"./cli-dpsw2fe6.js";
+import"./cli-c05y640n.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-fy6vh2a7.js";
+export {
+  DEFAULT_CONCURRENCY2 as DEFAULT_CONCURRENCY,
+  runPentestSwarm2 as runPentestSwarm,
+  runPentestWorkflow2 as runPentestWorkflow
+};

package/build/{pentests-pk66smvx.js → pentests-e0f32aqx.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env bun
-import"./cli-9a7b3x56.js";
-import"./cli-c2nb79ce.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
 import {
   listScans2,
   getScan2,
   dispatchPentest2
-} from "./cli-rwnm0p5r.js";
-import"./cli-8q41y2ss.js";
-import"./cli-84qrqxjc.js";
-import"./cli-ay461rtr.js";
-import"./cli-zahhskff.js";
-import"./cli-9d8m1qw2.js";
-import"./cli-en2trtdx.js";
-import"./cli-h68jfmth.js";
-import"./cli-sf6x1vjx.js";
+} from "./cli-7eea4e2y.js";
+import"./cli-qgz1q9g5.js";
+import"./cli-k2nwxta0.js";
+import"./cli-kb21qhvm.js";
+import"./cli-ngq9dr8n.js";
+import"./cli-d37a42dc.js";
+import"./cli-3sp6nd8d.js";
+import"./cli-xtc2t6me.js";
+import"./cli-n2en7j5b.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-tt7d70n9.js";
+import"./cli-1ve18npr.js";
 import"./cli-qba2x69h.js";
-import"./cli-jpa3w5b4.js";
+import"./cli-dpsw2fe6.js";
 import"./cli-c2k4xxaw.js";
 import {
   init_zod
@@ -51,6 +51,8 @@ dispatch options:
   --endpoint-id <UUIDs>       Select endpoints; repeat or separate IDs with commas (full only)
   --endpoint-ids-file <file|-> Read endpoint UUIDs, one per line; - reads stdin
                              May combine with --endpoint-id; blank lines ignored
+  --knowledge-id <UUIDs>     Attach active knowledge base entries as run context;
+                             repeat or separate IDs with commas (maximum 20)
 
 Endpoint selection requires 1–1000 unique UUIDs and full depth.
 
@@ -85,6 +87,7 @@ async function main() {
           level: { type: "string" },
           "endpoint-ids-file": { type: "string" },
           "endpoint-id": { type: "string", multiple: true },
+          "knowledge-id": { type: "string", multiple: true },
           help: { type: "boolean", short: "h" }
         },
         strict: true,
@@ -117,7 +120,11 @@ async function main() {
         endpointIds: array(uuid()).min(1).max(1000).parse([...new Set(ids.map((id) => id.trim().toLowerCase()))]),
         scanLevel: scanLevel ?? "full"
       } : { branch: values.branch, scanLevel };
-      const result = await dispatchPentest2(input);
+      const knowledgeIds = (values["knowledge-id"] ?? []).flatMap((value) => value.split(","));
+      const knowledgeEntryIds = knowledgeIds.length ? array(uuid()).max(20).parse([
+        ...new Set(knowledgeIds.map((id) => id.trim().toLowerCase()))
+      ]) : undefined;
+      const result = await dispatchPentest2({ ...input, knowledgeEntryIds });
       console.log(JSON.stringify(result, null, 2));
     } else if (!sub || sub === "list") {
       const scans = await listScans2();

package/build/recordedRunClient-dp032c32.js

@@ -0,0 +1,11 @@
+import {
+  openRecordedRunClient2
+} from "./cli-ae8jqxqr.js";
+import"./cli-gx71jcke.js";
+import"./cli-dpsw2fe6.js";
+import"./cli-c05y640n.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-fy6vh2a7.js";
+export {
+  openRecordedRunClient2 as openRecordedRunClient
+};

package/build/{targetedPentest-t7f2vdpk.js → targetedPentest-rcbs4nvp.js}

@@ -1,15 +1,15 @@
-import"./cli-9a7b3x56.js";
-import"./cli-c2nb79ce.js";
-import"./cli-8q41y2ss.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
+import"./cli-qgz1q9g5.js";
 import {
   TargetedPentestAgent2
-} from "./cli-h68jfmth.js";
+} from "./cli-xtc2t6me.js";
 import {
   startAgentExecution
 } from "./cli-g06s7edq.js";
-import"./cli-tt7d70n9.js";
+import"./cli-1ve18npr.js";
 import"./cli-qba2x69h.js";
-import"./cli-jpa3w5b4.js";
+import"./cli-dpsw2fe6.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/api/targetedPentest.ts

package/build/{targets-5dp972y7.js → targets-xj9g3q0z.js}

@@ -1,26 +1,26 @@
 #!/usr/bin/env bun
-import"./cli-9a7b3x56.js";
-import"./cli-c2nb79ce.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
 import {
   listPentestTargets2,
   listTargetLogs2,
   searchTargetLogs2
-} from "./cli-rwnm0p5r.js";
-import"./cli-8q41y2ss.js";
-import"./cli-84qrqxjc.js";
-import"./cli-ay461rtr.js";
-import"./cli-zahhskff.js";
-import"./cli-9d8m1qw2.js";
-import"./cli-en2trtdx.js";
-import"./cli-h68jfmth.js";
-import"./cli-sf6x1vjx.js";
+} from "./cli-7eea4e2y.js";
+import"./cli-qgz1q9g5.js";
+import"./cli-k2nwxta0.js";
+import"./cli-kb21qhvm.js";
+import"./cli-ngq9dr8n.js";
+import"./cli-d37a42dc.js";
+import"./cli-3sp6nd8d.js";
+import"./cli-xtc2t6me.js";
+import"./cli-n2en7j5b.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-tt7d70n9.js";
+import"./cli-1ve18npr.js";
 import"./cli-qba2x69h.js";
-import"./cli-jpa3w5b4.js";
+import"./cli-dpsw2fe6.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/targets.ts

package/build/threatModel-jkxfa40s.js

@@ -0,0 +1,21 @@
+import"./cli-qgz1q9g5.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
+import {
+  runThreatModelWorkflow2
+} from "./cli-7eea4e2y.js";
+import"./cli-k2nwxta0.js";
+import"./cli-kb21qhvm.js";
+import"./cli-ngq9dr8n.js";
+import"./cli-d37a42dc.js";
+import"./cli-3sp6nd8d.js";
+import"./cli-xtc2t6me.js";
+import"./cli-n2en7j5b.js";
+import"./cli-xcy2vxj2.js";
+import"./cli-1ve18npr.js";
+import"./cli-qba2x69h.js";
+import"./cli-dpsw2fe6.js";
+import"./cli-c2k4xxaw.js";
+export {
+  runThreatModelWorkflow2 as runThreatModelWorkflow
+};

package/build/{uninstall-qshcasbp.js → uninstall-7s784q4a.js}

@@ -5,7 +5,7 @@ import {
 import {
   detectInstallMethod,
   init_installation
-} from "./cli-k594kwq8.js";
+} from "./cli-65g6rcat.js";
 import {
   __require
 } from "./cli-h6y3bt60.js";

package/build/{upload-jy6hp68b.js → upload-4gvhwmvr.js}

@@ -1,10 +1,10 @@
-import"./cli-9a7b3x56.js";
-import"./cli-c2nb79ce.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
 import {
   resolveConfig,
   createWeaveTracer
-} from "./cli-raavtvwt.js";
-import"./cli-jpa3w5b4.js";
+} from "./cli-az3xq70v.js";
+import"./cli-dpsw2fe6.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/integrations/wandb/upload.ts

package/build/{utils-6z5t7vq1.js → utils-cjrz64pc.js}

@@ -1,12 +1,12 @@
-import"./cli-9a7b3x56.js";
-import"./cli-c2nb79ce.js";
+import"./cli-fy6vh2a7.js";
+import"./cli-c05y640n.js";
 import {
   init_types
 } from "./cli-3gt761d2.js";
 import {
   AVAILABLE_MODELS,
   init_ai
-} from "./cli-jpa3w5b4.js";
+} from "./cli-dpsw2fe6.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/providers/utils.ts

package/package.json

@@ -344,5 +344,5 @@
     "tsc": "tsc --noEmit"
   },
   "type": "module",
-  "version": "2.6.1-canary.e936ec17"
+  "version": "2.6.1"
 }

package/src/cli/knowledge.test.ts

@@ -0,0 +1,140 @@
+import { spawn, spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const CLI = join(import.meta.dirname, "knowledge.ts");
+const ID = "33333333-3333-4333-8333-333333333333";
+
+function run(args: string[]) {
+  const result = spawnSync("bun", [CLI, ...args], { encoding: "utf8" });
+  return {
+    status: result.status,
+    stdout: result.stdout,
+    stderr: result.stderr,
+  };
+}
+
+async function captureRequest(args: string[]) {
+  let request: { method?: string; url?: string; body: unknown } | undefined;
+  const server = createServer((req, res) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (c: Buffer) => chunks.push(c));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf-8");
+      request = {
+        method: req.method,
+        url: req.url,
+        body: raw ? JSON.parse(raw) : undefined,
+      };
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ id: ID }));
+    });
+  });
+  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  if (address === null || typeof address === "string")
+    throw new Error("no port");
+  const home = mkdtempSync(join(tmpdir(), "pensar-knowledge-"));
+  try {
+    const status = await new Promise<number | null>((resolve) => {
+      const child = spawn("bun", [CLI, ...args], {
+        env: {
+          ...process.env,
+          HOME: home,
+          PENSAR_API_KEY: "test-key",
+          PENSAR_API_URL: `http://127.0.0.1:${address.port}`,
+        },
+        stdio: "ignore",
+      });
+      child.on("exit", resolve);
+    });
+    expect(status).toBe(0);
+  } finally {
+    server.close();
+    rmSync(home, { recursive: true, force: true });
+  }
+  if (!request) throw new Error("CLI sent no request");
+  return request;
+}
+
+describe("pensar knowledge CLI", () => {
+  it("documents that writes need a user login", () => {
+    const { status, stdout } = run(["--help"]);
+    expect(status).toBe(0);
+    expect(stdout).toContain("require a user login");
+  });
+
+  it("lists with filters", async () => {
+    const req = await captureRequest([
+      "--category",
+      "user_note",
+      "--status",
+      "active",
+      "--tag",
+      "auth,api",
+    ]);
+    expect(req.method).toBe("GET");
+    expect(req.url).toBe(
+      "/knowledge?category=user_note&status=active&tags=auth%2Capi",
+    );
+  });
+
+  it("adds an entry", async () => {
+    const req = await captureRequest([
+      "add",
+      "--title",
+      "Stack",
+      "--content",
+      "Next.js on Lambda",
+      "--category",
+      "technology_context",
+      "--tag",
+      "infra",
+    ]);
+    expect(req).toMatchObject({
+      method: "POST",
+      url: "/knowledge",
+      body: {
+        title: "Stack",
+        content: "Next.js on Lambda",
+        category: "technology_context",
+        tags: ["infra"],
+      },
+    });
+  });
+
+  it("updates an entry", async () => {
+    const req = await captureRequest(["update", ID, "--status", "stale"]);
+    expect(req).toMatchObject({
+      method: "PATCH",
+      url: `/knowledge/${ID}`,
+      body: { status: "stale" },
+    });
+  });
+
+  it("archives an entry", async () => {
+    const req = await captureRequest(["archive", ID]);
+    expect(req).toMatchObject({ method: "DELETE", url: `/knowledge/${ID}` });
+  });
+
+  it("requires title, content and category to add", () => {
+    const { status, stderr } = run(["add", "--title", "x"]);
+    expect(status).toBe(1);
+    expect(stderr).toContain("--title, --content and --category are required");
+  });
+
+  it("rejects an unknown category before calling the API", () => {
+    const { status, stderr } = run(["add", "--category", "nope"]);
+    expect(status).toBe(1);
+    expect(stderr).toContain('invalid --category "nope"');
+  });
+
+  it("requires an id for get", () => {
+    const { status, stderr } = run(["get"]);
+    expect(status).toBe(1);
+    expect(stderr).toContain("entry ID is required");
+  });
+});

package/src/cli/knowledge.ts

@@ -0,0 +1,146 @@
+#!/usr/bin/env bun
+
+/**
+ * pensar knowledge — Read and edit the workspace knowledge base
+ *
+ * Usage:
+ *   pensar knowledge [filters]              List entries
+ *   pensar knowledge get <id>               Get one entry
+ *   pensar knowledge add [options]          Add an entry
+ *   pensar knowledge update <id> [options]  Edit an entry
+ *   pensar knowledge archive <id>           Archive an entry
+ */
+
+import { parseArgs } from "node:util";
+import {
+  archiveKnowledge,
+  createKnowledge,
+  getKnowledge,
+  KNOWLEDGE_CATEGORIES,
+  KNOWLEDGE_STATUSES,
+  type KnowledgeCategory,
+  type KnowledgeInput,
+  type KnowledgeStatus,
+  listKnowledge,
+  updateKnowledge,
+} from "../core/api";
+import { markCommandFailed } from "./command-exit";
+
+function showHelp(): void {
+  console.log(`pensar knowledge — Read and edit the workspace knowledge base
+
+Entries are context that agents use during pentests. A false_positive_pattern
+entry suppresses matching findings.
+
+Usage:
+  pensar knowledge [filters]              List entries
+  pensar knowledge get <id>               Get one entry
+  pensar knowledge add [options]          Add an entry
+  pensar knowledge update <id> [options]  Edit an entry
+  pensar knowledge archive <id>           Archive an entry
+
+Filters and options:
+  --title <text>         Entry title (required for add)
+  --content <text>       Entry body (required for add)
+  --category <category>  ${KNOWLEDGE_CATEGORIES.join(", ")}
+                         (required for add)
+  --status <status>      ${KNOWLEDGE_STATUSES.join(", ")}
+  --tag <tags>           Repeat or separate with commas; a list filter
+                         matches entries carrying every tag
+
+Adding, editing and archiving require a user login; a workspace API key can
+only read.
+
+Options:
+  -h, --help             Show this help message`);
+}
+
+function parseCategory(value: string | undefined) {
+  if (value === undefined) return undefined;
+  if (!(KNOWLEDGE_CATEGORIES as readonly string[]).includes(value)) {
+    throw new Error(
+      `invalid --category "${value}". Accepted: ${KNOWLEDGE_CATEGORIES.join(", ")}`,
+    );
+  }
+  return value as KnowledgeCategory;
+}
+
+function parseStatus(value: string | undefined) {
+  if (value === undefined) return undefined;
+  if (!(KNOWLEDGE_STATUSES as readonly string[]).includes(value)) {
+    throw new Error(
+      `invalid --status "${value}". Accepted: ${KNOWLEDGE_STATUSES.join(", ")}`,
+    );
+  }
+  return value as KnowledgeStatus;
+}
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+  const sub = args[0] && !args[0].startsWith("-") ? args[0] : "list";
+
+  if (sub === "help" || args.includes("--help") || args.includes("-h")) {
+    showHelp();
+    return;
+  }
+
+  try {
+    const takesId = sub === "get" || sub === "update" || sub === "archive";
+    const id = takesId ? args[1] : undefined;
+    if (takesId && (!id || id.startsWith("-"))) {
+      throw new Error(`entry ID is required: pensar knowledge ${sub} <id>`);
+    }
+    const { values } = parseArgs({
+      args: args.slice(args[0] === sub ? (takesId ? 2 : 1) : 0),
+      options: {
+        title: { type: "string" },
+        content: { type: "string" },
+        category: { type: "string" },
+        status: { type: "string" },
+        tag: { type: "string", multiple: true },
+      },
+      strict: true,
+      allowPositionals: false,
+    });
+    const tags = values.tag?.flatMap((t) => t.split(",")).filter(Boolean);
+    const input: KnowledgeInput = {
+      title: values.title,
+      content: values.content,
+      category: parseCategory(values.category),
+      status: parseStatus(values.status),
+      tags,
+    };
+
+    let result: unknown;
+    if (sub === "list") {
+      result = await listKnowledge({
+        category: input.category,
+        status: input.status,
+        tags,
+      });
+    } else if (sub === "get") {
+      result = await getKnowledge(id!);
+    } else if (sub === "add") {
+      if (!input.title || !input.content || !input.category) {
+        throw new Error("--title, --content and --category are required");
+      }
+      result = await createKnowledge(input);
+    } else if (sub === "update") {
+      result = await updateKnowledge(id!, input);
+    } else if (sub === "archive") {
+      result = await archiveKnowledge(id!);
+    } else {
+      console.error(`Error: Unknown subcommand "${sub}"`);
+      showHelp();
+      return markCommandFailed();
+    }
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(
+      `\nError: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return markCommandFailed();
+  }
+}
+
+await main();

package/src/cli/pentests.test.ts

@@ -70,6 +70,21 @@ describe("hosted pentest dispatch", () => {
     });
   });
 
+  it("attaches knowledge entries to a launch", async () => {
+    await run([
+      "dispatch",
+      "--knowledge-id",
+      `${endpointA.toUpperCase()},${endpointB}`,
+      "--knowledge-id",
+      endpointA,
+    ]);
+    expect(api.dispatchPentest).toHaveBeenCalledWith({
+      branch: undefined,
+      scanLevel: undefined,
+      knowledgeEntryIds: [endpointA, endpointB],
+    });
+  });
+
   it("combines repeated, comma-separated, and file IDs without duplicates", async () => {
     const file = join(directory, "endpoints.txt");
     await writeFile(file, `${endpointB.toUpperCase()}\n${endpointA}\n`);

package/src/cli/pentests.ts

@@ -33,6 +33,8 @@ dispatch options:
   --endpoint-id <UUIDs>       Select endpoints; repeat or separate IDs with commas (full only)
   --endpoint-ids-file <file|-> Read endpoint UUIDs, one per line; - reads stdin
                              May combine with --endpoint-id; blank lines ignored
+  --knowledge-id <UUIDs>     Attach active knowledge base entries as run context;
+                             repeat or separate IDs with commas (maximum 20)
 
 Endpoint selection requires 1–1000 unique UUIDs and full depth.
 
@@ -70,6 +72,7 @@ async function main(): Promise<void> {
           level: { type: "string" },
           "endpoint-ids-file": { type: "string" },
           "endpoint-id": { type: "string", multiple: true },
+          "knowledge-id": { type: "string", multiple: true },
           help: { type: "boolean", short: "h" },
         },
         strict: true,
@@ -124,7 +127,18 @@ async function main(): Promise<void> {
             scanLevel: scanLevel ?? "full",
           }
         : { branch: values.branch, scanLevel };
-      const result = await dispatchPentest(input);
+      const knowledgeIds = (values["knowledge-id"] ?? []).flatMap((value) =>
+        value.split(","),
+      );
+      const knowledgeEntryIds = knowledgeIds.length
+        ? z
+            .array(z.uuid())
+            .max(20)
+            .parse([
+              ...new Set(knowledgeIds.map((id) => id.trim().toLowerCase())),
+            ])
+        : undefined;
+      const result = await dispatchPentest({ ...input, knowledgeEntryIds });
       console.log(JSON.stringify(result, null, 2));
     } else if (!sub || sub === "list") {
       const scans = await listScans();

package/src/cli.ts

@@ -269,6 +269,7 @@ Usage:
   pensar targets                      List pentest targets and view their agent logs
   pensar issues                       List and manage security issues
   pensar fixes                        View security fixes
+  pensar knowledge                    Read and edit the workspace knowledge base
   pensar logs                         View agent execution logs
   pensar config headers               Manage global default HTTP headers
   pensar export-trajectory            Convert saved rollout evidence to ATIF
@@ -828,6 +829,9 @@ try {
   } else if (command === "issues") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
     await import("./cli/issues");
+  } else if (command === "knowledge") {
+    process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
+    await import("./cli/knowledge");
   } else if (command === "fixes") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
     await import("./cli/fixes");

package/src/core/api/index.ts

@@ -151,6 +151,21 @@ export {
   searchTargetLogs,
   updateIssue,
 } from "./issues";
+export type {
+  KnowledgeCategory,
+  KnowledgeEntry,
+  KnowledgeInput,
+  KnowledgeStatus,
+} from "./knowledge";
+export {
+  archiveKnowledge,
+  createKnowledge,
+  getKnowledge,
+  KNOWLEDGE_CATEGORIES,
+  KNOWLEDGE_STATUSES,
+  listKnowledge,
+  updateKnowledge,
+} from "./knowledge";
 export { serveLocalRunWorker } from "./localWorker";
 export type {
   OffensiveSecurityAgentClientInput,

package/src/core/api/issues.ts

@@ -257,6 +257,7 @@ export interface DispatchPentestInput {
   branch?: string;
   scanLevel?: "priority" | "full";
   endpointIds?: string[];
+  knowledgeEntryIds?: string[];
 }
 
 export async function dispatchPentest(