@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/build/{agent-yby11zaq.js → agent-68t2wzmc.js}

@@ -1,14 +1,14 @@
 import {
   TargetedPentestAgent2,
   buildPentestSystemPrompt2
-} from "./cli-xtc2t6me.js";
-import"./cli-1ve18npr.js";
+} from "./cli-vdd1s3x9.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-dpsw2fe6.js";
-import"./cli-c05y640n.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-a6x4jm5a.js";
+import"./cli-9jscnhtg.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-fy6vh2a7.js";
+import"./cli-98wmmphf.js";
 export {
   TargetedPentestAgent2 as TargetedPentestAgent,
   buildPentestSystemPrompt2 as buildPentestSystemPrompt

package/build/agent-jhekpern.js

@@ -0,0 +1,13 @@
+import {
+  runAuthenticationAgent2
+} from "./cli-9kk9tm58.js";
+import"./cli-72y76bpg.js";
+import"./cli-qba2x69h.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-a6x4jm5a.js";
+import"./cli-9jscnhtg.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-98wmmphf.js";
+export {
+  runAuthenticationAgent2 as runAuthenticationAgent
+};

package/build/{agent-ayreaj6z.js → agent-qvreg8a4.js}

@@ -1,15 +1,15 @@
-import"./cli-qgz1q9g5.js";
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 import {
   init_zod

package/build/{agent-runs-g37vkrjr.js → agent-runs-30dvbvmm.js}

@@ -1,8 +1,11 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+} from "./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
+import {
+  AgentEventBus
+} from "./cli-t4q4t4dx.js";
 import {
   inspectSessionEvidence2,
   RecordedRunSpecSchema,
@@ -13,28 +16,25 @@ import {
   runRecordedAgent2,
   RunRecoveryBlockedError2,
   resumeRecordedAgent2
-} from "./cli-7eea4e2y.js";
-import {
-  AgentEventBus
-} from "./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-5ab346kd.js";
+import"./cli-t09zj814.js";
+import"./cli-1pmfnz1a.js";
+import"./cli-fdrrbb9p.js";
+import"./cli-9pz9wjt2.js";
+import"./cli-9kk9tm58.js";
+import"./cli-vdd1s3x9.js";
+import"./cli-z7ysyrr4.js";
 import"./cli-xcy2vxj2.js";
 import {
   resolveWorkerExecutable,
   launchLocalWorker
-} from "./cli-gx71jcke.js";
-import"./cli-1ve18npr.js";
+} from "./cli-vn4cwac3.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
 import {
   buildAuthConfig,
   init_ai
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/agent-runs.ts
@@ -115,7 +115,7 @@ async function runAgentRunsCommand(args) {
     if (!isAbsolute(values.store)) {
       throw new Error("agent-runs worker requires --store <absolute database>");
     }
-    const { serveLocalRunWorker } = await import("./index-qv4cc65p.js");
+    const { serveLocalRunWorker } = await import("./index-bt4r13q7.js");
     await serveLocalRunWorker({
       runId: values.run,
       databasePath: resolve(values.store)
@@ -129,7 +129,7 @@ async function runAgentRunsCommand(args) {
 ${HELP}`);
   }
   if (command === "attach") {
-    const { openRecordedRunClient } = await import("./recordedRunClient-dp032c32.js");
+    const { openRecordedRunClient } = await import("./recordedRunClient-w34kcch1.js");
     const client = await openRecordedRunClient(values.store);
     const controller = new AbortController;
     const detach = () => controller.abort();

package/build/agent-vybw255f.js

@@ -0,0 +1,13 @@
+import {
+  CodeAgent2
+} from "./cli-1pmfnz1a.js";
+import"./cli-72y76bpg.js";
+import"./cli-qba2x69h.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-a6x4jm5a.js";
+import"./cli-9jscnhtg.js";
+import"./cli-c2k4xxaw.js";
+import"./cli-98wmmphf.js";
+export {
+  CodeAgent2 as CodeAgent
+};

package/build/{apps-xn6km9yn.js → apps-na0y0992.js}

@@ -1,7 +1,4 @@
 #!/usr/bin/env bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
-import"./cli-7eea4e2y.js";
 import {
   ENDPOINT_TRANSPORTS2,
   listApps2,
@@ -18,21 +15,24 @@ import {
   searchEndpoints2,
   listDomains2,
   createDomain2
-} from "./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-t4q4t4dx.js";
+import"./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
+import"./cli-5ab346kd.js";
+import"./cli-t09zj814.js";
+import"./cli-1pmfnz1a.js";
+import"./cli-fdrrbb9p.js";
+import"./cli-9pz9wjt2.js";
+import"./cli-9kk9tm58.js";
+import"./cli-vdd1s3x9.js";
+import"./cli-z7ysyrr4.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/apps.ts

package/build/{auth-d105wc64.js → auth-dz2c5thx.js}

@@ -1,8 +1,9 @@
 #!/usr/bin/env bun
+import"./cli-t4q4t4dx.js";
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-98wmmphf.js";
 import {
   getPensarApiUrl2,
   getPensarConsoleUrl2,
@@ -18,23 +19,22 @@ import {
   createWorkspaceSelection2,
   pollWorkspaceSelection2,
   init_auth
-} from "./cli-c05y640n.js";
-import"./cli-7eea4e2y.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-9jscnhtg.js";
+import"./cli-5ab346kd.js";
+import"./cli-t09zj814.js";
+import"./cli-1pmfnz1a.js";
+import"./cli-fdrrbb9p.js";
+import"./cli-9pz9wjt2.js";
+import"./cli-9kk9tm58.js";
+import"./cli-vdd1s3x9.js";
+import"./cli-z7ysyrr4.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 import {
   __require

package/build/{blackboxAgent-s56sgx9b.js → blackboxAgent-2mwvaajb.js}

@@ -1,13 +1,13 @@
 import {
   BlackboxAttackSurfaceAgent2
-} from "./cli-k2nwxta0.js";
-import"./cli-1ve18npr.js";
+} from "./cli-t09zj814.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-dpsw2fe6.js";
-import"./cli-c05y640n.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-a6x4jm5a.js";
+import"./cli-9jscnhtg.js";
 import"./cli-c2k4xxaw.js";
-import"./cli-fy6vh2a7.js";
+import"./cli-98wmmphf.js";
 export {
   BlackboxAttackSurfaceAgent2 as BlackboxAttackSurfaceAgent
 };

package/build/{blackboxPentest-ps78v3w7.js → blackboxPentest-s2mfze9p.js}

@@ -1,26 +1,26 @@
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+import"./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-t09zj814.js";
+import"./cli-vdd1s3x9.js";
+import"./cli-z7ysyrr4.js";
 import {
   readExecutionMetrics,
   writeExecutionMetrics,
   runPentestWorkflow2
-} from "./cli-d37a42dc.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
+} from "./cli-9pz9wjt2.js";
+import"./cli-1pmfnz1a.js";
+import"./cli-fdrrbb9p.js";
 import {
   EMPTY_SESSION_TOKEN_USAGE,
   accumulateSessionTokens
 } from "./cli-ag6jtndp.js";
-import"./cli-1ve18npr.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
 import {
   init_ai,
   normalizeStepUsage
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 
 // src/core/api/blackboxPentest.ts
@@ -45,7 +45,12 @@ async function runPentestAgent(input) {
       tokenUsage
     });
   }
-  const { findings, findingsPath, pocsPath, reportPath } = result;
+  const { findings, findingsPath, pocsPath, reportPath, reportedFindings } = result;
+  if ((input.hooks?.findingPolicy ?? input.findingPolicy) === "external") {
+    console.log(`
+Reported ${reportedFindings?.length ?? 0} finding(s) for external evaluation`);
+    return result;
+  }
   console.log(`
 Found ${findings.length} vulnerabilities`);
   console.log(`Findings: ${findingsPath}`);

package/build/{cli-kb21qhvm.js → cli-1pmfnz1a.js}

@@ -1,11 +1,11 @@
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-72y76bpg.js";
 import {
   stepCountIs2,
   init_dist
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 
 // src/core/agents/specialized/codeAgent/agent.ts
 init_dist();
@@ -59,6 +59,7 @@ Prefer catalog + code_query for sink-first work; use candidates to separate unve
 4. **Stay focused** — stick to your objective. Don't wander into unrelated areas of the codebase.
 5. **Be thorough** — don't stop at the first match. Make sure you've covered everything relevant to the objective.
 `;
+var CODE_AGENT_EXTERNAL_SYSTEM_PROMPT = CODE_AGENT_SYSTEM_PROMPT.replace("use candidates to separate unverified ideas from `document_vulnerability`", "use candidates to separate unverified ideas from evidence-backed findings returned to the caller");
 
 // src/core/agents/specialized/codeAgent/agent.ts
 var CODE_AGENT_TOOLS = [
@@ -87,7 +88,7 @@ function codeAgentDefinition() {
   return defineAgent({
     name: "code-agent",
     role: "worker",
-    system: (opts) => opts.system ?? CODE_AGENT_SYSTEM_PROMPT,
+    system: (opts) => opts.system ?? (opts.findingPolicy === "external" ? CODE_AGENT_EXTERNAL_SYSTEM_PROMPT : CODE_AGENT_SYSTEM_PROMPT),
     activeTools: (opts) => {
       let activeTools = [...CODE_AGENT_TOOLS];
       if (opts.excludeTools?.length) {

package/build/{cli-ae8jqxqr.js → cli-563yntrb.js}

@@ -4,10 +4,10 @@ import {
   openSqliteRunStore,
   resolveWorkerEndpoint,
   workerRequest
-} from "./cli-7eea4e2y.js";
+} from "./cli-5ab346kd.js";
 import {
   launchLocalWorker
-} from "./cli-gx71jcke.js";
+} from "./cli-vn4cwac3.js";
 
 // src/core/runtime/recordedRunClient.ts
 import { setTimeout as delay } from "node:timers/promises";

package/build/{cli-7eea4e2y.js → cli-5ab346kd.js}

@@ -6,20 +6,20 @@ import {
   ALL_TOOL_NAMES2,
   SKILL_TOOL_NAMES2,
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-t4q4t4dx.js";
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-98wmmphf.js";
 import {
   init_constants
-} from "./cli-c05y640n.js";
+} from "./cli-9jscnhtg.js";
 import {
   startAgentExecution
 } from "./cli-g06s7edq.js";
 import {
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-72y76bpg.js";
 import {
   toolModelMessageSchema,
   modelMessageSchema,
@@ -42,7 +42,7 @@ import {
   init_runControlStore,
   RunLimitError,
   init_runModelStore
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 import {
   newSessionId,
   isSessionId,
@@ -71,7 +71,7 @@ import {
 import {
   getCurrentVersion,
   init_installation
-} from "./cli-65g6rcat.js";
+} from "./cli-w9nw2a4z.js";
 import {
   __commonJS,
   __require

package/build/{cli-1ve18npr.js → cli-72y76bpg.js}

@@ -1,10 +1,11 @@
 import {
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
+} from "./cli-t4q4t4dx.js";
 
 // src/core/agents/agentRuntime.ts
 function assembleAgentHooks(opts) {
   return {
+    findingPolicy: opts.findingPolicy,
     backends: opts.backends,
     subagentSpawner: opts.subagentSpawner,
     languageModelMiddleware: opts.languageModelMiddleware,
@@ -39,7 +40,7 @@ class AgentRuntime extends OffensiveSecurityAgent {
       responseSchema: definition.responseSchema?.(opts, state),
       stopWhen: definition.stopWhen?.(opts, state) ?? opts.stopWhen,
       extraTools: mergeExtraTools(opts.extraTools, definition.extraTools?.(opts, state)),
-      resolveResult: resolveResult ? (streamResult) => resolveResult(opts, state, streamResult) : undefined,
+      resolveResult: resolveResult ? (streamResult, validatedResponse) => resolveResult(opts, state, streamResult, validatedResponse) : undefined,
       target: definition.target?.(opts, state) ?? opts.target,
       grpc: definition.grpc?.(opts, state) ?? opts.grpc,
       browserEngine: definition.browserEngine?.(opts, state) ?? opts.browserEngine,

package/build/{cli-fy6vh2a7.js → cli-98wmmphf.js}

@@ -3,7 +3,7 @@ import {
   get2,
   update2,
   init_config2
-} from "./cli-709rvekb.js";
+} from "./cli-zbbtr4sb.js";
 import {
   __esm
 } from "./cli-h6y3bt60.js";

package/build/{cli-c05y640n.js → cli-9jscnhtg.js}

@@ -1,7 +1,7 @@
 import {
   config2,
   init_config
-} from "./cli-fy6vh2a7.js";
+} from "./cli-98wmmphf.js";
 import {
   __esm
 } from "./cli-h6y3bt60.js";

package/build/{cli-3sp6nd8d.js → cli-9kk9tm58.js}

@@ -8,7 +8,7 @@ import {
 import {
   AgentRuntime,
   defineAgent
-} from "./cli-1ve18npr.js";
+} from "./cli-72y76bpg.js";
 import {
   hasToolCall,
   init_dist,
@@ -16,7 +16,7 @@ import {
   init_lazyLogger,
   createLogger,
   init_structured
-} from "./cli-dpsw2fe6.js";
+} from "./cli-a6x4jm5a.js";
 
 // src/core/agents/specialized/authenticationAgent/agent.ts
 init_dist();