@pensar/apex 2.6.1 → 2.7.0-canary.1572d9a4

package/build/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 // @bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-8sw5zpqz.js";
+import"./cli-1j28cbhy.js";
 import {
   require_src,
   require_src2,
@@ -18,16 +18,22 @@ import {
 import {
   endAllActiveRootSpans,
   init_active_root_spans,
-  init_model_history,
-  init_models,
-  buildAuthConfig,
-  init_utils,
   init_session,
   createLogger,
   logger,
   init_structured,
+  init_models,
+  resolveReasoningSetting,
+  getReasoningCapabilities,
+  getReasoningChoices,
+  validateReasoningSetting,
+  init_reasoning,
+  buildAuthConfig,
+  init_utils,
+  init_ai,
+  init_model_history,
   init_ai2
-} from "./cli-dpsw2fe6.js";
+} from "./cli-e9v6zg6h.js";
 import {
   init_inference_attempt,
   init_native_rollout_evidence
@@ -40,13 +46,13 @@ import {
   init_customProviders,
   resolveHoonifyModel,
   init_hoonify
-} from "./cli-709rvekb.js";
+} from "./cli-cg3ypx5n.js";
 import {
   init_package,
   version,
   package_default,
   init_installation
-} from "./cli-65g6rcat.js";
+} from "./cli-khnf5xrf.js";
 import {
   require_src6
 } from "./cli-bb02pjt0.js";
@@ -375,6 +381,45 @@ var require_main = __commonJS(function(exports, module) {
   module.exports = DotenvModule;
 });
 
+// src/core/cli/reasoning.ts
+init_ai2();
+function getSavedReasoning(model, config) {
+  const cap = getReasoningCapabilities(model, config.customProviders);
+  const saved = config.modelReasoning?.[model];
+  if (saved !== undefined)
+    return getReasoningChoices(cap).includes(saved) ? saved : "default";
+  if (cap.control === "none")
+    return;
+  return resolveReasoningSetting(model, {
+    enableThinking: config.reasoningEnabled,
+    openAIReasoningEffort: config.openAIReasoningEffort,
+    customProviders: config.customProviders
+  }, "model") ?? "default";
+}
+function resolveCliReasoning(args, model, config) {
+  const index = args.findIndex((arg) => arg === "--effort" || arg.startsWith("--effort="));
+  const enable = args.includes("--extended-thinking");
+  const disable = args.includes("--no-extended-thinking");
+  if (Number(index >= 0) + Number(enable) + Number(disable) > 1)
+    throw new Error("Use only one of --effort, --extended-thinking, or --no-extended-thinking.");
+  if (index >= 0) {
+    const value = args[index].startsWith("--effort=") ? args[index].slice("--effort=".length) : args[index + 1];
+    if (!value || value.startsWith("--"))
+      throw new Error("--effort requires a level or default.");
+    const cap = getReasoningCapabilities(model, config.customProviders);
+    if (value !== "default" && (cap.control !== "effort" || !cap.efforts.includes(value)))
+      throw new Error(`--effort is not supported at "${value}" for ${model}. Available levels: ${["default", ...cap.efforts].join(", ")}.`);
+    return validateReasoningSetting(model, value, config.customProviders);
+  }
+  if (enable || disable) {
+    const cap = getReasoningCapabilities(model, config.customProviders);
+    if (cap.control === "none")
+      throw new Error(`Thinking controls are not known for ${model}; use the model default.`);
+    return validateReasoningSetting(model, enable ? cap.control === "effort" ? cap.defaultEffort ?? "default" : "enabled" : cap.efforts.includes("none") ? "none" : "disabled", config.customProviders);
+  }
+  return getSavedReasoning(model, config);
+}
+
 // src/cli.ts
 var import_dotenv = __toESM(require_main(), 1);
 import { resolve as resolve2 } from "path";
@@ -710,6 +755,7 @@ var package_default2 = {
     "format:check": 'biome check && prettier --check "**/*.{md,yml,yaml}"',
     "generate:ascii": "bun run scripts/generate-ascii-art.ts",
     "generate:models": "bun run scripts/generate-models.ts",
+    "generate:reasoning": "bun run scripts/sync-reasoning-capabilities.ts",
     knip: "knip",
     lint: "biome lint src/",
     "lint:fix": "biome lint --write src/",
@@ -725,15 +771,16 @@ var package_default2 = {
     tsc: "tsc --noEmit"
   },
   type: "module",
-  version: "2.6.1"
+  version: "2.7.0-canary.1572d9a4"
 };
 
 // src/core/ai/index.ts
-init_ai2();
+init_ai();
 init_inference_attempt();
 init_model_history();
 init_models();
 init_native_rollout_evidence();
+init_reasoning();
 init_utils();
 
 // src/core/api/clientIdentity.ts
@@ -986,6 +1033,8 @@ class AgentEventBus {
         break;
       }
       case "tool-result": {
+        if (chunk.preliminary)
+          break;
         const tr = chunk;
         this.emit("tool-result", {
           toolCallId: tr.toolCallId,
@@ -1584,7 +1633,7 @@ async function createInstrumentedBus(session, model) {
   reportHerdrState("working");
   const bus = new AgentEventBus;
   attachCliAgentStreamListeners(bus);
-  const { attachWandbToEventBus } = await import("./upload-4gvhwmvr.js");
+  const { attachWandbToEventBus } = await import("./upload-34ewrjp5.js");
   const wandbCleanup = await attachWandbToEventBus(session, bus).catch((e) => {
     console.warn("[wandb] Tracing disabled:", e.message);
     return null;
@@ -1604,7 +1653,7 @@ async function resolveCliHeaders() {
   const { parseHeaderLine, parseHeadersFromFile, formatParseError } = await import("./parse-cqecqrc5.js");
   const merged = {};
   if (!noGlobal) {
-    const { config: appConfig } = await import("./index-je6hcsqr.js");
+    const { config: appConfig } = await import("./index-bv6dtwse.js");
     const cfg = await appConfig.get();
     if (cfg.defaultHeaders) {
       Object.assign(merged, cfg.defaultHeaders);
@@ -1635,8 +1684,8 @@ ${formatParseError(parsed.error)}`);
   return merged;
 }
 async function resolveCliModel() {
-  const { config: appConfig } = await import("./index-je6hcsqr.js");
-  const { getDefaultModelForConfig } = await import("./utils-cjrz64pc.js");
+  const { config: appConfig } = await import("./index-bv6dtwse.js");
+  const { getDefaultModelForConfig } = await import("./utils-fzm66efw.js");
   const pensarConfig = await appConfig.get();
   const explicit = resolveExplicitCliModel({
     model: getArg("--model"),
@@ -1717,10 +1766,13 @@ pentest options:
   --cwd <path>             Source code path \u2014 enables whitebox attack surface
   --mode <mode>            Pentest mode: exfil (pivoting & flag extraction)
   --model <model>          AI model (default: auto-selected from configured provider)
-  --extended-thinking       Enable extended thinking for supported models
   --task-driven             Enable task-driven architecture (experimental)
+  --lance                 Minimal offensive-capability mode (requires --prompt)
+  --timeout-ms <ms>        Lance budget (default: 900000)
+  --deadline-at <epoch-ms> Lance absolute harness deadline
   --fast-strike            Single-operator fast strike: skip attack-surface/swarm
                            phases, one tight recon\u2192exploit loop against the target
+  --external-findings      Return findings without Apex's in-run finding judge
   --prompt <text|@file>    Guidance for the pentest agent (inline text or @filepath)
   --threat-model <text|@file>  Threat model to guide the pentest (inline or @filepath)
   --header "Name: Value"   Custom HTTP header (repeatable)
@@ -1748,6 +1800,9 @@ export-trajectory options:
   --output <path>  Fresh output directory; existing paths are never overwritten
 
 Global options:
+  --effort <level>       Reasoning effort or default (headless commands)
+  --extended-thinking   Enable thinking (headless commands)
+  --no-extended-thinking Disable thinking where supported (headless commands)
   --model-provider <id>  Hoonify or custom provider for --model (headless commands)
   -h, --help         Show this help message
   -v, --version      Show version number
@@ -1769,9 +1824,8 @@ Custom inference:
 `);
 }
 async function runPentest() {
-  const { runPentestAgent } = await import("./blackboxPentest-ps78v3w7.js");
-  const { sessions } = await import("./index-wqetp6gq.js");
-  const { config: appConfig } = await import("./index-je6hcsqr.js");
+  const { sessions } = await import("./index-tpyzq2wq.js");
+  const { config: appConfig } = await import("./index-bv6dtwse.js");
   const target = getArgRequired("--target");
   const cwd = getArg("--cwd");
   const mode = getArg("--mode");
@@ -1780,12 +1834,20 @@ async function runPentest() {
   const enableThinking = hasFlag("--extended-thinking");
   const taskDriven = hasFlag("--task-driven");
   const fastStrike = hasFlag("--fast-strike");
+  const lance = hasFlag("--lance");
+  if (lance && (fastStrike || taskDriven || threatModelRaw)) {
+    throw new Error("Lance cannot be combined with Strike, task-driven, or threat-model workflows");
+  }
+  if (lance && !promptRaw)
+    throw new Error("Lance requires a specific objective via --prompt");
+  const externalFindings = hasFlag("--external-findings");
   const evidenceOutput = nativeRolloutEvidenceOutput();
   const resolvedTm = threatModelRaw ? resolveThreatModelPrompt(threatModelRaw) : undefined;
   const resolvedPrompt = promptRaw ? resolveFlagValue(promptRaw) : undefined;
   const prompt = combinePromptParts(resolvedTm, resolvedPrompt);
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
+  const reasoning = resolveCliReasoning(args, model, pensarConfig);
   const headers = await resolveCliHeaders();
   const { exfilMode, warning: modeWarning } = resolvePentestMode(mode);
   if (modeWarning) {
@@ -1796,21 +1858,23 @@ async function runPentest() {
   }
   const sep = "=".repeat(60);
   console.log(`${sep}
-PENTEST ORCHESTRATION
+${lance ? "LANCE" : "PENTEST ORCHESTRATION"}
 ${sep}
 Target:  ${target}${cwd ? `
 Cwd:     ${cwd} (whitebox)` : ""}${exfilMode ? `
 Mode:    exfil` : ""}
-Model:   ${model}${enableThinking ? `
-Thinking: enabled` : ""}${taskDriven ? `
+Model:   ${model}${reasoning ? `
+Reasoning: ${reasoning}` : ""}${taskDriven ? `
 Task-driven: enabled` : ""}${fastStrike ? `
-Fast strike: enabled` : ""}${headers ? `
+Fast strike: enabled` : ""}${externalFindings ? `
+Findings: external evaluation` : ""}${headers ? `
 Headers: ${Object.keys(headers).length} configured` : ""}
 `);
   const session = await sessions.create({
-    name: cwd ? "Whitebox Pentest" : "Blackbox Pentest",
+    name: lance ? "Lance" : cwd ? "Whitebox Pentest" : "Blackbox Pentest",
     targets: [target],
     config: {
+      ...reasoning !== undefined ? { modelReasoning: { model, setting: reasoning } } : {},
       ...cwd ? { codebasePath: cwd } : {},
       ...exfilMode ? { exfilMode: true } : {},
       ...prompt ? { prompt } : {},
@@ -1820,25 +1884,71 @@ Headers: ${Object.keys(headers).length} configured` : ""}
     }
   });
   console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
-  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-c9yhfqcs.js");
+  if (lance) {
+    const { runCliLance } = await import("./lance-sacfgs1z.js");
+    await runCliLance({
+      prompt: resolvedPrompt,
+      model,
+      reasoning,
+      target,
+      session,
+      enableThinking,
+      authConfig: buildAuthConfig(pensarConfig),
+      findingPolicy: externalFindings ? "external" : pensarConfig.findingPolicy,
+      lance: {
+        ...getArg("--timeout-ms") ? { timeoutMs: Number(getArg("--timeout-ms")) } : {},
+        ...getArg("--deadline-at") ? { deadlineAt: Number(getArg("--deadline-at")) } : {}
+      }
+    });
+    return;
+  }
+  const { runPentestAgent } = await import("./blackboxPentest-w2nr4md3.js");
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-rph1774m.js");
   const evidence = await runWithCliNativeRolloutEvidence({
     session,
     outputDirectory: evidenceOutput,
     run: async () => {
       const { bus: pentestBus, cleanup: wandbCleanup } = await createInstrumentedBus(session, model);
       try {
-        const { findings, findingsPath, pocsPath, reportPath } = await runPentestAgent({
+        const {
+          findings,
+          findingsPath,
+          pocsPath,
+          reportPath,
+          reportedFindings,
+          objectiveResults,
+          submissionJson,
+          solved,
+          summary
+        } = await runPentestAgent({
           target,
           ...cwd ? { cwd } : {},
           session,
           model,
+          reasoning,
           enableThinking,
+          ...externalFindings ? { findingPolicy: "external" } : {},
           ...fastStrike ? { fastStrike: true } : {},
           surfaceIntegrationEnabled: pensarConfig.surfaceIntegrationEnabled,
           authConfig: buildAuthConfig(pensarConfig),
           eventBus: pentestBus
         });
-        console.log(`
+        if (externalFindings) {
+          console.log(`
+${sep}
+RESULTS
+${sep}
+Findings:  ${reportedFindings?.length ?? 0}
+Evaluation: external`);
+          console.log(JSON.stringify({
+            reportedFindings: reportedFindings ?? [],
+            ...objectiveResults ? { objectiveResults } : {},
+            ...submissionJson ? { submissionJson } : {},
+            ...solved === undefined ? {} : { solved },
+            ...summary === undefined ? {} : { summary }
+          }, null, 2));
+        } else {
+          console.log(`
 ${sep}
 RESULTS
 ${sep}
@@ -1846,6 +1956,7 @@ Findings:  ${findings.length}
 Path:      ${findingsPath}
 POCs:      ${pocsPath}${reportPath ? `
 Report:    ${reportPath}` : ""}`);
+        }
       } finally {
         await wandbCleanup();
       }
@@ -1856,14 +1967,15 @@ Report:    ${reportPath}` : ""}`);
   }
 }
 async function runTargetedPentest() {
-  const { runTargetedPentestAgent } = await import("./targetedPentest-rcbs4nvp.js");
-  const { sessions } = await import("./index-wqetp6gq.js");
-  const { config: appConfig } = await import("./index-je6hcsqr.js");
+  const { runTargetedPentestAgent } = await import("./targetedPentest-6yxznt7s.js");
+  const { sessions } = await import("./index-tpyzq2wq.js");
+  const { config: appConfig } = await import("./index-bv6dtwse.js");
   const target = getArgRequired("--target");
   const objectives = getAllArgs("--objective");
   const evidenceOutput = nativeRolloutEvidenceOutput();
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
+  const reasoning = resolveCliReasoning(args, model, pensarConfig);
   if (objectives.length === 0) {
     console.error("Error: at least one --objective is required");
     process.exit(1);
@@ -1883,15 +1995,16 @@ ${objectivesList}
   const session = await sessions.create({
     name: "Targeted Pentest",
     targets: [target],
-    ...headers !== undefined || evidenceOutput ? {
+    ...headers !== undefined || evidenceOutput || reasoning !== undefined ? {
       config: {
+        ...reasoning !== undefined ? { modelReasoning: { model, setting: reasoning } } : {},
         ...headers !== undefined ? { headers } : {},
         ...evidenceOutput ? { nativeRolloutEvidence: { outputDirectory: evidenceOutput } } : {}
       }
     } : {}
   });
   console.log(`PENSAR_SESSION_PATH:${session.rootPath}`);
-  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-c9yhfqcs.js");
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-rph1774m.js");
   const evidence = await runWithCliNativeRolloutEvidence({
     session,
     outputDirectory: evidenceOutput,
@@ -1903,6 +2016,7 @@ ${objectivesList}
           objectives,
           session,
           model,
+          reasoning,
           authConfig: buildAuthConfig(pensarConfig),
           eventBus: targetedBus
         });
@@ -1923,11 +2037,12 @@ POCs:      ${pocsPath}`);
   }
 }
 async function runThreatModel() {
-  const { runThreatModelWorkflow } = await import("./threatModel-jkxfa40s.js");
-  const { config: appConfig } = await import("./index-je6hcsqr.js");
+  const { runThreatModelWorkflow } = await import("./threatModel-739kpexm.js");
+  const { config: appConfig } = await import("./index-bv6dtwse.js");
   const path = await import("path");
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
+  const reasoning = resolveCliReasoning(args, model, pensarConfig);
   const outputArg = getArg("--output") ?? getArg("-o") ?? "threat-model.md";
   const resolvedPath = path.isAbsolute(outputArg) ? outputArg : path.resolve(process.cwd(), outputArg);
   const sep = "=".repeat(60);
@@ -1949,6 +2064,7 @@ Model:    ${model}
     codebasePath: process.cwd(),
     outputPath: resolvedPath,
     model,
+    reasoning,
     authConfig: buildAuthConfig(pensarConfig),
     eventBus: threatBus
   });
@@ -1959,10 +2075,10 @@ ${sep}
 Threat model written to: ${resolvedPath}`);
 }
 async function runOperator() {
-  const { runOffensiveSecurityAgent } = await import("./offesecAgent-5whnpeta.js");
-  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-wqetp6gq.js");
-  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-r9yjkfrv.js");
-  const { config: appConfig } = await import("./index-je6hcsqr.js");
+  const { runOffensiveSecurityAgent } = await import("./offesecAgent-81h1p6ee.js");
+  const { sessions, normalizeMessages, getResumeMessages } = await import("./index-tpyzq2wq.js");
+  const { ALL_TOOL_NAMES, SKILL_TOOL_NAMES } = await import("./index-qys178kp.js");
+  const { config: appConfig } = await import("./index-bv6dtwse.js");
   const { createInterface } = await import("readline");
   const { readFileSync, existsSync } = await import("fs");
   const path = await import("path");
@@ -1979,6 +2095,7 @@ async function runOperator() {
   const evidenceOutput = nativeRolloutEvidenceOutput();
   const pensarConfig = await appConfig.get();
   const model = await resolveCliModel();
+  const reasoning = resolveCliReasoning(args, model, pensarConfig);
   const sep = "\u2500".repeat(60);
   console.log(`${sep}
 OPERATOR SESSION
@@ -1992,6 +2109,7 @@ ${sep}
     name: "Operator Session",
     targets: target ? [target] : [],
     config: {
+      ...reasoning !== undefined ? { modelReasoning: { model, setting: reasoning } } : {},
       mode: "operator",
       agentCwd: process.cwd(),
       operatorSettings: {
@@ -2003,7 +2121,7 @@ ${sep}
       ...evidenceOutput ? { nativeRolloutEvidence: { outputDirectory: evidenceOutput } } : {}
     }
   });
-  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-c9yhfqcs.js");
+  const { runWithCliNativeRolloutEvidence } = await import("./native-rollout-evidence-rph1774m.js");
   const evidence = await runWithCliNativeRolloutEvidence({
     session,
     outputDirectory: evidenceOutput,
@@ -2032,6 +2150,7 @@ ${sep}
             prompt: currentPrompt,
             ...systemPrompt ? { system: systemPrompt } : {},
             model,
+            reasoning,
             target,
             activeTools: [...ALL_TOOL_NAMES, ...SKILL_TOOL_NAMES],
             stopWhen: stepCountIs(1e4),
@@ -2105,7 +2224,7 @@ try {
       await standaloneRuntime?.shutdown();
       process.exitCode = 1;
     } else {
-      const { startTui } = await import("./index-4vqdgb42.js");
+      const { startTui } = await import("./index-jt52ffgn.js");
       await startTui(options);
     }
   } else if (hasFlag("-p") || command === "--prompt") {
@@ -2125,37 +2244,37 @@ try {
     await runTargetedPentest();
   } else if (command === "login" || command === "auth") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./auth-d105wc64.js");
+    await import("./auth-7md9kwda.js");
   } else if (command === "uninstall") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./uninstall-7s784q4a.js");
+    await import("./uninstall-yxrn9edt.js");
   } else if (command === "apps") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./apps-xn6km9yn.js");
+    await import("./apps-3stwnmen.js");
   } else if (command === "pentests") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./pentests-e0f32aqx.js");
+    await import("./pentests-jgw031mc.js");
   } else if (command === "agent-runs") {
-    const { runAgentRunsCommand } = await import("./agent-runs-g37vkrjr.js");
+    const { runAgentRunsCommand } = await import("./agent-runs-f86emmgg.js");
     await runAgentRunsCommand(args.slice(1));
   } else if (command === "targets") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./targets-xj9g3q0z.js");
+    await import("./targets-bjah19dp.js");
   } else if (command === "issues") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./issues-eb3q9d3a.js");
+    await import("./issues-sncyqh14.js");
   } else if (command === "knowledge") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./knowledge-fqsvtx0f.js");
+    await import("./knowledge-esgvy5ws.js");
   } else if (command === "fixes") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./fixes-kytx5dmj.js");
+    await import("./fixes-926cw1ej.js");
   } else if (command === "logs") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./logs-x62b7hk1.js");
+    await import("./logs-bcbjpjp6.js");
   } else if (command === "config") {
     process.argv = [process.argv[0], process.argv[1], ...args.slice(1)];
-    await import("./config-zpqkd5cz.js");
+    await import("./config-e5v1bkh1.js");
   } else if (command === "threat-model") {
     await runThreatModel();
   } else if (command === "doctor") {

package/build/{config-zpqkd5cz.js → config-e5v1bkh1.js}

@@ -2,7 +2,7 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-8sw5zpqz.js";
 import {
   isSensitiveHeaderName,
   renderHeaderValue