@pensar/apex 2.6.1 → 2.7.0-canary.1572d9a4

package/build/cli-px6ehzqx.js

@@ -0,0 +1,54 @@
+import {
+  OffensiveSecurityAgent
+} from "./cli-58781vcf.js";
+import {
+  startAgentExecution,
+  resolveRootReasoning,
+  persistRootReasoningOverride
+} from "./cli-fjxmphg1.js";
+
+// src/core/api/offesecAgent.ts
+async function runOffensiveSecurityAgent2(input) {
+  const resolved = resolveRootReasoning(input);
+  const persisted = persistRootReasoningOverride(input);
+  input = persisted ? { ...resolved, session: await persisted } : resolved;
+  const agent = input.session ? new OffensiveSecurityAgent(input) : await OffensiveSecurityAgent.create(input);
+  input.onSessionReady?.(agent.session);
+  await startAgentExecution(agent).result;
+  return {
+    streamResult: agent.streamResult,
+    session: agent.session,
+    ...agent.lanceRuntime ? { lance: agent.lanceRuntime.metrics(input.model) } : {}
+  };
+}
+function createOffensiveSecurityAgentClient2() {
+  const controller = new AbortController;
+  let started = false;
+  return {
+    run(input) {
+      if (started) {
+        throw new Error("Offensive security agent client already started a run — create a new client per run");
+      }
+      started = true;
+      return runOffensiveSecurityAgent2({
+        ...input,
+        abortSignal: controller.signal
+      });
+    },
+    abort() {
+      controller.abort();
+    }
+  };
+}
+
+// src/core/api/lance.ts
+async function runLance(input) {
+  const result = await runOffensiveSecurityAgent2({
+    ...input,
+    mode: "lance",
+    activeTools: []
+  });
+  return { session: result.session, result: result.lance };
+}
+
+export { runOffensiveSecurityAgent2, createOffensiveSecurityAgentClient2, runLance };

package/build/{cli-xtc2t6me.js → cli-qs4msn6x.js}

@@ -1,13 +1,13 @@
 import {
-  collectCommand,
-  windowsProgramInvocation,
-  SANDBOX_ARTIFACTS_ROOT,
   isMemoryEnabled,
   readPlan,
+  collectCommand,
+  windowsProgramInvocation,
+  sandboxArtifactsRoot,
   REPORT_ERROR_TOOL_NAME,
   createReportErrorTool,
   PentestReportedError
-} from "./cli-qgz1q9g5.js";
+} from "./cli-58781vcf.js";
 import {
   GOOGLE_SIGNIN_PROMPT_GUIDANCE,
   browserEngineForGoogleSignIn
@@ -18,15 +18,15 @@ import {
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-mdzt2e8j.js";
 import {
   hasToolCall,
   init_dist,
-  scopedLogger,
-  init_lazyLogger,
   createLogger,
-  init_structured
-} from "./cli-dpsw2fe6.js";
+  init_structured,
+  scopedLogger,
+  init_lazyLogger
+} from "./cli-e9v6zg6h.js";
 import {
   init_zod
 } from "./cli-3qznjsnr.js";
@@ -78,6 +78,13 @@ var PentestResponseSchema = object({
   newObjectives: array(string()).optional().describe("Objectives for the NEXT run of this endpoint. Populate this directly from everything you observed: worker outcomes, what was confirmed or conclusively ruled out, recon anomalies nobody investigated, and the technology you fingerprinted. Each entry must be a focused, self-contained objective the next run can act on directly — name a concrete attack class against a concrete parameter, header, or flow. Do NOT restate anything tested this run or already marked completed in your assignment context; find the coverage gaps. Emit a small, high-signal set (typically 2-6), preferring breadth across distinct untested attack classes over payload variants. Empty/omitted when the endpoint is genuinely exhausted."),
   noFindingsReason: string().optional().describe("If no findings were documented, explain why (e.g., target not vulnerable, endpoint unreachable)")
 });
+var PentestExternalResponseSchema = PentestResponseSchema.omit({
+  findingsDocumented: true
+}).extend({
+  objectiveResults: array(ObjectiveResultSchema).describe("Status of each assigned objective, including findings or limitations."),
+  reportedFindings: array(string()).describe("One concise evidence-backed finding per vulnerability, including the affected target and security impact. An empty array is valid."),
+  noFindingsReason: string().optional().describe("If no findings are reported, explain why.")
+});
 function resolvePentestBrowserEngine(hasGoogleSignIn) {
   return browserEngineForGoogleSignIn(hasGoogleSignIn);
 }
@@ -95,55 +102,67 @@ var targetedPentestWorker = defineAgent({
       helperWorkspaceRoot: effectiveRole === "worker" ? pentestHelperWorkspaceRoot(opts.session, opts.subagentId, opts.sandbox?.type) : undefined
     };
   },
-  system: (opts, state) => buildPentestSystemPrompt2(opts.session, state.effectiveRole, state.mode, opts.systemScope, state.helperWorkspaceRoot),
+  system: (opts, state) => buildPentestSystemPrompt2(opts.session, state.effectiveRole, state.mode, opts.systemScope, state.helperWorkspaceRoot, opts.findingPolicy),
   fileWorkspaceRoot: (_opts, state) => state.helperWorkspaceRoot,
   grpc: (opts) => opts.grpc,
   browserEngine: (opts) => resolvePentestBrowserEngine(opts.session.credentialManager?.hasGoogleSignIn() === true),
   target: (opts) => opts.target,
   systemScope: (opts) => opts.systemScope,
   mode: (_opts, state) => state.mode,
-  activeTools: (opts, state) => buildPentestActiveTools(state.effectiveRole, opts.session),
-  responseSchema: () => PentestResponseSchema,
-  prompt: (opts, state) => buildPentestPrompt(opts.target, opts.objectives, opts.session, opts.findingsRegistry, opts.context, opts.environmentVariables ? Object.keys(opts.environmentVariables) : undefined, opts.subagentId, state.effectiveRole, opts.session.credentialManager?.formatForPrompt(), opts.grpc, state.mode),
-  extraTools: (_opts, state) => ({
+  activeTools: (opts, state) => buildPentestActiveTools(state.effectiveRole, opts.session, opts.findingPolicy),
+  responseSchema: (opts) => opts.findingPolicy === "external" ? PentestExternalResponseSchema : PentestResponseSchema,
+  prompt: (opts, state) => buildPentestPrompt(opts.target, opts.objectives, opts.session, opts.findingsRegistry, opts.context, opts.environmentVariables ? Object.keys(opts.environmentVariables) : undefined, opts.subagentId, state.effectiveRole, opts.session.credentialManager?.formatForPrompt(), opts.grpc, state.mode, opts.findingPolicy),
+  extraTools: (opts, state) => ({
     [REPORT_ERROR_TOOL_NAME]: createReportErrorTool((err) => {
       state.reportedError = err;
-    })
+    }, opts.findingPolicy)
   }),
   stopWhen: () => hasToolCall(REPORT_ERROR_TOOL_NAME),
-  resolveResult: async (opts, state, streamResult) => {
+  resolveResult: async (opts, state, streamResult, validatedResponse) => {
     if (state.reportedError) {
       throw new PentestReportedError(state.reportedError);
     }
     let objectiveResults;
     let newObjectives;
-    try {
-      const response = await streamResult.response;
-      for (const msg of response.messages ?? []) {
-        if (msg.role !== "assistant" || !Array.isArray(msg.content))
-          continue;
-        for (const part of msg.content) {
-          if (part.type === "tool-call" && part.toolName === "response" && part.input) {
-            const input = part.input;
-            if (input.result?.objectiveResults) {
-              objectiveResults = input.result.objectiveResults;
-            }
-            if (input.result?.newObjectives) {
-              newObjectives = input.result.newObjectives;
+    let reportedFindings;
+    if (opts.findingPolicy === "external") {
+      const parsed = PentestExternalResponseSchema.safeParse(validatedResponse);
+      if (!parsed.success) {
+        throw new Error("Externally graded pentest ended without a structured findings response");
+      }
+      objectiveResults = parsed.data.objectiveResults;
+      newObjectives = parsed.data.newObjectives;
+      reportedFindings = parsed.data.reportedFindings;
+    } else {
+      try {
+        const response = await streamResult.response;
+        for (const msg of response.messages ?? []) {
+          if (msg.role !== "assistant" || !Array.isArray(msg.content))
+            continue;
+          for (const part of msg.content) {
+            if (part.type === "tool-call" && part.toolName === "response" && part.input) {
+              const input = part.input;
+              if (input.result?.objectiveResults) {
+                objectiveResults = input.result.objectiveResults;
+              }
+              if (input.result?.newObjectives) {
+                newObjectives = input.result.newObjectives;
+              }
             }
           }
         }
-      }
-    } catch {}
+      } catch {}
+    }
     const sandboxed = opts.backends?.sandboxed === true;
-    const findingsPath = sandboxed ? `${SANDBOX_ARTIFACTS_ROOT}/findings` : opts.session.findingsPath;
-    const findings = sandboxed && opts.backends ? await loadSandboxFindings(opts.backends, findingsPath, opts.abortSignal) : loadFindings(findingsPath);
+    const findingsPath = sandboxed ? `${sandboxArtifactsRoot(opts.session)}/findings` : opts.session.findingsPath;
+    const findings = opts.findingPolicy === "external" ? [] : sandboxed && opts.backends ? await loadSandboxFindings(opts.backends, findingsPath, opts.abortSignal) : loadFindings(findingsPath);
     return {
       findings,
       findingsPath,
-      pocsPath: sandboxed ? `${SANDBOX_ARTIFACTS_ROOT}/pocs` : opts.session.pocsPath,
+      pocsPath: sandboxed ? `${sandboxArtifactsRoot(opts.session)}/pocs` : opts.session.pocsPath,
       objectiveResults,
-      newObjectives
+      newObjectives,
+      reportedFindings
     };
   }
 });
@@ -511,14 +530,16 @@ ${SECTION_SECURITY_HEADERS_CORS}
 ${SECTION_FINDING_QUALITY}
 
 ${SECTION_STATE_CHECKPOINTING}`;
-function destructiveSection(allow) {
-  return allow ? SECTION_DESTRUCTIVE_ALLOWED : SECTION_DESTRUCTIVE_BLOCKED;
+function destructiveSection(allow, findingPolicy = "native") {
+  if (allow)
+    return SECTION_DESTRUCTIVE_ALLOWED;
+  return findingPolicy === "external" ? SECTION_DESTRUCTIVE_BLOCKED.replace(" and document_vulnerability", "") : SECTION_DESTRUCTIVE_BLOCKED;
 }
 function rateLimitTestingSection(allow) {
   return allow ? SECTION_RATE_LIMITING_TESTING_ALLOWED : SECTION_RATE_LIMITING_TESTING_BLOCKED;
 }
-function buildPentestSystemPrompt2(session, role = "orchestrator", mode = "default", systemScope, helperWorkspaceRoot) {
-  const destructive = destructiveSection(session.config?.allowDestructiveActions);
+function buildPentestSystemPrompt2(session, role = "orchestrator", mode = "default", systemScope, helperWorkspaceRoot, findingPolicy = "native") {
+  const destructive = destructiveSection(session.config?.allowDestructiveActions, findingPolicy);
   const rateLimitTesting = rateLimitTestingSection(session.config?.allowRateLimitTesting);
   const guardrails = `${destructive}
 
@@ -527,11 +548,42 @@ ${rateLimitTesting}
 ${SECTION_SIDE_EFFECT_SAFETY}`;
   const systemSection = systemScope && systemScope.memberHosts.length > 0 ? `
 
-${SECTION_SYSTEM_SCOPE(systemScope.memberHosts)}` : "";
+${SECTION_SYSTEM_SCOPE(systemScope.memberHosts, findingPolicy)}` : "";
   const sourceRoot = mode === "fast-strike" ? session.config?.codebasePath : undefined;
   const helperToolsSection = role === "orchestrator" && mode !== "fast-strike" ? "" : `
 
 ${SECTION_HELPER_FILE_WORKSPACE(helperWorkspaceRoot ?? session.scratchpadPath, Boolean(sourceRoot))}`;
+  if (findingPolicy === "external") {
+    const sourcePolicy = sourceRoot ? `Read-only Source Access:
+- The configured repository at ${sourceRoot} is in scope for read-only analysis. Use source-assessment tools or execute_command to inspect it. Keep generated helpers in the file workspace; do not modify target source.` : SECTION_SOURCE_CODE_PROHIBITION;
+    const roleMethod = mode === "fast-strike" ? `Run a focused Strike assessment against the supplied target. Work alone: observe, form the strongest hypothesis, test it with the available HTTP, browser, source, and command tools, then move to the next lead only when evidence rules the first out. Use editable scripts for stateful or multi-stage work. Do not spawn agents or create task lists.` : role === "orchestrator" ? `Lead a focused assessment. State a short plan, perform light reconnaissance and any needed authentication, then call spawn_pentest_agent for each assigned objective that needs testing. Investigate chains or untested leads with another worker when the objective calls for it. For detection-only work, stop when the requested evidence is sufficient. Combine the workers' findings and objective results in your response; workers do not write to a shared finding registry in this run.` : session.config?.taskDriven ? `Test each assigned objective. Decompose techniques with create_task, update each task as you test, adapt when a lead fails, and use list_tasks to check coverage before finishing.` : `Test each assigned objective with the strongest available techniques. Verify reachability and authentication, inspect source when explicitly in scope, probe plausible weaknesses, and distinguish genuine security impact from benign behavior.`;
+    const authentication = SECTION_AUTHENTICATION.replace("Build verifiable POCs, but bound the blast radius.", "When the assigned objective requires a live proof, bound the blast radius.");
+    const exfilGoal = session.config?.exfilMode ? `
+
+Exfiltration goal: Locate and extract a flag in the format FLAG{...} or the assigned sensitive data. Pivot through a confirmed vulnerability when needed to reach it. Do not stop at discovery; demonstrate extraction before calling response.` : "";
+    return `You are an expert offensive security agent. ${roleMethod}
+${exfilGoal}
+
+${sourcePolicy}
+
+Finding boundary: The caller evaluates findings after this run. Put every credible vulnerability in the response tool's reportedFindings array with its affected target, observed evidence, and likely impact. For detection-only objectives, do not build a separate proof-of-concept script, seek a second in-run review, or continue exploiting once the requested evidence is sufficient. If the objective requires exploitation or extraction, pursue that objective fully.
+
+Use the browser for interactive or authenticated flows, HTTP tools for direct probes, and the shell for scripts or source analysis. Stay within the supplied scope and report uncertainty honestly. Complete every assigned objective before calling response.
+
+${guardrails}${systemSection}${helperToolsSection}
+
+${authentication}
+
+${SECTION_MATERIALITY_GUIDANCE}
+
+${SECTION_CREDENTIAL_DISCOVERY}
+
+${SECTION_SECURITY_HEADERS_CORS}
+
+${SECTION_STATE_CHECKPOINTING}${session.config?.promptInjectionLibrarySource ? `
+
+${SECTION_PROMPT_INJECTION}` : ""}`;
+  }
   if (mode === "fast-strike") {
     const sourcePolicy = sourceRoot ? `Read-only Source Access:
 - The configured repository at ${sourceRoot} is in scope for read-only analysis. Use available source-assessment tools or execute_command to inspect it.
@@ -559,12 +611,12 @@ ${guardrails}${systemSection}${helperToolsSection}`;
 
 ${SECTION_PROMPT_INJECTION}` : withGuardrails;
 }
-var SECTION_SYSTEM_SCOPE = (memberHosts) => `System Scope (structured):
+var SECTION_SYSTEM_SCOPE = (memberHosts, findingPolicy = "native") => `System Scope (structured):
 - This engagement covers a multi-application System. Member hosts already present in session targets: ${memberHosts.join(", ")}.
 - Declared relationships in the application context prioritize investigation order; undeclared paths between members remain in scope when discovered.
 - For cross-service follow-ups, an orchestrator MAY set a worker \`target\` to a full URL on another member host listed above. Workers receive this same System Scope. Do not invent hosts outside that set.
 - Authentication state is origin-specific. Before dispatching an authenticated cross-service follow-up, the orchestrator must establish and verify a session on that member origin. The worker must verify access on its assigned origin and follow the Authentication rules below if access is denied.
-- When a confirmed finding spans multiple members, populate the \`attackPath\` argument of \`document_vulnerability\` with the ordered member-to-member hop chain. Do not leave the chain only in the narrative.`;
+${findingPolicy === "external" ? "- When a finding spans multiple members, describe the ordered member-to-member path in your reported finding." : "- When a confirmed finding spans multiple members, populate the `attackPath` argument of `document_vulnerability` with the ordered member-to-member hop chain. Do not leave the chain only in the narrative."}`;
 var SECTION_ORCHESTRATOR_DELEGATION = `Sub-Agent Delegation Rules:
 - You DO NOT call document_vulnerability directly. Findings are documented by the workers you spawn.
 - You DO NOT execute deep exploitation attempts yourself. Your tools (execute_command, http_request, browser_*) are for INITIAL RECON only — fingerprinting, sanity-checking the target, observing baseline behavior.
@@ -611,7 +663,7 @@ ${SECTION_MATERIALITY_GUIDANCE}
 ${SECTION_BROWSER_INTERACTION}
 
 ${SECTION_STATE_CHECKPOINTING}`;
-function buildPentestPrompt(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext, grpc, mode = "default") {
+function buildPentestPrompt(target, objectives, session, findingsRegistry, context, envVarNames, subagentId, role = "orchestrator", credentialContext, grpc, mode = "default", findingPolicy = "native") {
   const sessionRootPath = session.rootPath;
   const exfilMode = session.config?.exfilMode ?? false;
   const taskDriven = mode === "fast-strike" || role === "orchestrator" ? false : session.config?.taskDriven ?? false;
@@ -650,7 +702,7 @@ For \`http_request\`, pass these as the \`headers\` parameter.`, `For \`execute_
     } catch {}
   }
   let knownFindingsSection = "";
-  if (findingsRegistry && findingsRegistry.size > 0) {
+  if (findingPolicy !== "external" && findingsRegistry && findingsRegistry.size > 0) {
     const existing = findingsRegistry.getFindings().map((f) => `- [${f.severity}] ${f.title} (endpoint: ${f.endpoint})`).join(`
 `);
     knownFindingsSection = `
@@ -743,7 +795,19 @@ Do NOT discover or enumerate other endpoints or services. Focus exclusively on t
 If your assignment lists ZERO open objectives (everything is already completed), skip steps 4-5, do light recon only, then finish — still populating newObjectives so the run is productive rather than re-testing completed objectives.
 
 Do NOT call document_vulnerability — that is the workers' job. Do NOT discover or enumerate other endpoints or services beyond the assigned target except for cross-service follow-ups explicitly authorized by the structured System Scope.`;
-  const instructions = role === "orchestrator" ? orchestratorInstructions : taskDriven ? taskDrivenInstructions : exfilMode ? `## Goal
+  const externalInstructions = role === "orchestrator" ? `## Instructions
+1. State a short plan, perform light reconnaissance and authenticate if needed.
+2. Delegate each assigned objective with spawn_pentest_agent. Follow a concrete chain or anomaly only when the assignment calls for it or the detection objective remains unmet.
+3. Include every credible vulnerability from the workers in reportedFindings. Summarize objective coverage and any remaining leads in objectiveResults and newObjectives. The caller evaluates findings after this run.` : taskDriven ? `## Instructions
+1. Create tasks for the supplied objectives and test them with the available tools.
+2. Update task results as evidence develops; inspect list_tasks before finishing.
+3. Put each credible vulnerability in reportedFindings with the affected target, evidence, and likely impact. Follow the assigned objective's discovery or exploitation boundary. The caller evaluates findings after this run.` : `## Instructions
+1. Test the supplied objectives using the available tools and follow the strongest evidence first.
+2. Put each credible vulnerability in reportedFindings with the affected target, evidence, and likely impact. For detection-only objectives, stop when the requested evidence is sufficient; exploit or pivot only if the objective requires it.
+3. Finish with objectiveResults for each objective and any high-signal newObjectives. The caller evaluates findings after this run.`;
+  const instructions = findingPolicy === "external" ? `${externalInstructions}${exfilMode ? `
+
+This is an exfiltration run: locate and extract FLAG{...} or the assigned sensitive data before finishing. Pivot through a confirmed weakness when necessary; report the result in objectiveResults without invoking a finding judge.` : ""}` : role === "orchestrator" ? orchestratorInstructions : taskDriven ? taskDrivenInstructions : exfilMode ? `## Goal
 Your target is a flag with the format FLAG{...}. Locate and extract it.
 
 ## Instructions
@@ -870,10 +934,10 @@ var SHARED_PENTEST_TOOLS = [
   "checkpoint_state"
 ];
 var MEMORY_TOOL_NAMES = ["add_memory", "list_memories", "get_memory"];
-function buildPentestActiveTools(role, session) {
+function buildPentestActiveTools(role, session, findingPolicy = "native") {
   const tools = role === "orchestrator" ? [...WORKER_RECON_TOOLS, ...SHARED_PENTEST_TOOLS, "spawn_pentest_agent"] : [
     ...WORKER_RECON_TOOLS,
-    "document_vulnerability",
+    ...findingPolicy === "external" ? [] : ["document_vulnerability"],
     ...WORKER_HELPER_FILE_TOOLS,
     ...SHARED_PENTEST_TOOLS,
     ...session.config?.taskDriven ? ["create_task", "update_task", "list_tasks"] : [],

package/build/{cli-kb21qhvm.js → cli-rvybdhgn.js}

@@ -1,11 +1,11 @@
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-mdzt2e8j.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-dpsw2fe6.js";
+} from "./cli-e9v6zg6h.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();
@@ -59,6 +59,7 @@ Prefer catalog + code_query for sink-first work; use candidates to separate unve
 4. **Stay focused** — stick to your objective. Don't wander into unrelated areas of the codebase.
 5. **Be thorough** — don't stop at the first match. Make sure you've covered everything relevant to the objective.
 `;
+var CODE_AGENT_EXTERNAL_SYSTEM_PROMPT = CODE_AGENT_SYSTEM_PROMPT.replace("use candidates to separate unverified ideas from `document_vulnerability`", "use candidates to separate unverified ideas from evidence-backed findings returned to the caller");
 
 // src/core/agents/specialized/codeAgent/agent.ts
 var CODE_AGENT_TOOLS = [
@@ -87,7 +88,7 @@ function codeAgentDefinition() {
   return defineAgent({
     name: "code-agent",
     role: "worker",
-    system: (opts) => opts.system ?? CODE_AGENT_SYSTEM_PROMPT,
+    system: (opts) => opts.system ?? (opts.findingPolicy === "external" ? CODE_AGENT_EXTERNAL_SYSTEM_PROMPT : CODE_AGENT_SYSTEM_PROMPT),
     activeTools: (opts) => {
       let activeTools = [...CODE_AGENT_TOOLS];
       if (opts.excludeTools?.length) {

package/build/{cli-ae8jqxqr.js → cli-v739h7hb.js}

@@ -4,10 +4,10 @@ import {
   openSqliteRunStore,
   resolveWorkerEndpoint,
   workerRequest
-} from "./cli-7eea4e2y.js";
+} from "./cli-gzb6qrzh.js";
 import {
   launchLocalWorker
-} from "./cli-gx71jcke.js";
+} from "./cli-7067zzeb.js";
 
 // src/core/runtime/recordedRunClient.ts
 import { setTimeout as delay } from "node:timers/promises";

package/build/{cli-ngq9dr8n.js → cli-wm8ech0x.js}

@@ -1,15 +1,15 @@
 import {
   EndpointTransportEnum,
   GrpcEndpointMetadataSchema
-} from "./cli-qgz1q9g5.js";
+} from "./cli-58781vcf.js";
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-mdzt2e8j.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-dpsw2fe6.js";
+} from "./cli-e9v6zg6h.js";
 import {
   tool
 } from "./cli-pwm29ks7.js";