@pensar/apex 2.6.1 → 2.7.0-canary.21cb83dc

package/build/{fastStrike-mcjdvwez.js → fastStrike-16jw1s61.js}

@@ -5,21 +5,21 @@ import {
   assertDepth,
   inProcessSeams,
   OffensiveSecurityAgent
-} from "./cli-qgz1q9g5.js";
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+} from "./cli-t4q4t4dx.js";
+import"./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
 import {
   buildPentestReport,
   renderJson,
   renderMarkdown,
   REPORT_FILENAME_MD,
   REPORT_FILENAME_JSON
-} from "./cli-n2en7j5b.js";
+} from "./cli-z7ysyrr4.js";
 import"./cli-qba2x69h.js";
 import {
   createThreatModelPrompt
 } from "./cli-q126f6ef.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 import {
   init_zod
@@ -27,6 +27,7 @@ import {
 import {
   string,
   boolean,
+  array,
   object
 } from "./cli-mz5pk30x.js";
 
@@ -38,7 +39,18 @@ var FastStrikeResult = object({
   solved: boolean().describe("True if the objective was achieved — a vulnerability was confirmed and, where applicable, the flag or sensitive data was extracted."),
   summary: string().describe("Concise account of the vulnerability exploited, the exact steps that worked, and any flag or sensitive data recovered.")
 });
-var FAST_STRIKE_SYSTEM_PROMPT = `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
+var FastStrikeExternalResult = object({
+  solved: boolean().describe("True if the supplied objective was met."),
+  summary: string().describe("Concise account of security findings and the evidence observed, including any flag or sensitive data extracted for an exfiltration objective."),
+  reportedFindings: array(string()).describe("One concise evidence-backed description per discovered vulnerability."),
+  submissionJson: string().describe("The exact task-defined JSON submission as a string, or an empty string when no JSON submission was requested. Do not invent fields.")
+});
+function buildFastStrikeSystemPrompt(findingPolicy = "native") {
+  const external = findingPolicy === "external";
+  const objectiveStep = external ? "5. FOLLOW THE OBJECTIVE — Determine whether the observed behavior establishes a security weakness. For a detection-only objective, stop once the requested evidence is sufficient; develop an exploit or pivot only when the objective requires it." : "5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.";
+  const finishStep = external ? "6. REPORT & FINISH — Include each credible finding and its supporting observations in the caller's requested output. If the caller requested a JSON submission, include the exact JSON text in the response tool's submissionJson field as well; otherwise use an empty string. The caller evaluates findings after the run. Once the objective is met or credible leads are exhausted, call the response tool with the correct solved value and a concise summary." : "6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.";
+  const evidenceRule = external ? "- Bias toward the shortest path that satisfies the assigned objective. Distinguish observed evidence from hypotheses, and avoid separate in-run finding review." : "- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.";
+  return `You are an elite offensive security operator running a fast strike against a single target. You work ALONE and finish the job yourself — there is no team to hand off to, no swarm to spawn, no plan to file. Your edge is discipline and observation, not volume.
 
 Run this loop, tightly:
 
@@ -46,15 +58,17 @@ Run this loop, tightly:
 2. HYPOTHESIZE — From that signal and your deep knowledge of web/app vulnerability classes, name the single most likely vulnerability and why the evidence points to it. Rank leads by signal strength and go for the strongest first. A disabled form field, an ID in a URL or JWT, advertised demo creds, an exposed schema — these are tells; read them.
 3. ACT — Test that one hypothesis with the strongest available technique. Use direct tools for quick probes, but treat the shell as a working environment rather than merely a way to issue one-off commands. When the work becomes stateful, repetitive, concurrent, protocol-heavy, or multi-stage, externalize it into an editable script in the session scratchpad directory identified in the workspace instructions. Never create a scratchpad/ directory inside the target repository. Run the script, inspect the results, modify it, and rerun it as the attack develops. For blind/out-of-band testing (SSRF, blind RCE, XSS callbacks), start_callback_listener gives you a nonce-correlated listener that survives intervening commands: embed the returned callback URL (only an address you know the target can reach — never a guessed one) in the payload, then poll_callback_listener for hits. Listener readiness and the tool's own self-test never count as target evidence; stop_callback_listener when done.
 4. PRUNE — If the evidence disproves a lead, drop it and move to the next-strongest. Do NOT re-run a disproven approach or grind a dead end. Do NOT enumerate, brute-force, or run wordlists unless a specific signal demands it — choose techniques from evidence, not from a checklist.
-5. EXPLOIT — When a vulnerability is confirmed, exploit it: capture the flag, extract the sensitive data, and pivot through it if the objective requires more. Preserve viable primitives and build on them. Prefer extending a working script into an end-to-end exploit over rebuilding the chain with repeated one-off tool calls or stopping at the next network or protocol boundary.
-6. DOCUMENT & FINISH — Record each confirmed vulnerability with the document_vulnerability tool as you go. Before concluding that every credible lead is exhausted, account for each viable primitive and pursue any concrete path that could still close the objective. After this check, whether the objective was met or every credible lead was genuinely exhausted, call the response tool with the correct solved value and a concise summary.
+${objectiveStep}
+${finishStep}
 
 Rules:
 - You are one operator. Plan in your head and in short text notes — never via planning tools, task lists, or sub-agents.
 - Recon and exploitation are the same loop. Do just enough recon to form the first hypothesis, then start testing. Do not map the entire surface before acting.
 - Spend your reasoning on choosing techniques and interpreting evidence; use scripts for deterministic mechanics, iteration, and chain execution.
-- Bias toward the shortest path that proves impact. Speed comes from picking the right lead, not from skipping verification — always confirm a finding before you claim it.
+${evidenceRule}
 - Stay in scope. Only touch the target you were given and hosts it legitimately depends on.`;
+}
+var FAST_STRIKE_SYSTEM_PROMPT = buildFastStrikeSystemPrompt();
 async function runFastStrike(input) {
   const {
     target,
@@ -67,6 +81,7 @@ async function runFastStrike(input) {
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort,
     prompt,
     threatModel,
@@ -107,6 +122,7 @@ async function runFastStrike(input) {
 ${combined}` : combined;
   }
   const operatorGuidance = session.config?.prompt;
+  const findingPolicy = input.hooks?.findingPolicy ?? input.findingPolicy;
   const mode = cwd ? "whitebox" : "blackbox";
   eventBus?.emit("workflow-phase-start", {
     phase: "pentesting",
@@ -117,14 +133,17 @@ ${combined}` : combined;
   const promptParts = [`Target: ${target}`];
   if (operatorGuidance)
     promptParts.push(operatorGuidance);
-  promptParts.push("Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.");
+  promptParts.push(findingPolicy === "external" ? "Run the fast strike: investigate the target, identify security weaknesses, and submit the findings in the requested output. Stop when the supplied objective is met." : "Run the fast strike: find and exploit the vulnerability, complete the objective, and report what worked.");
+  if (findingPolicy === "external" && session.config?.exfilMode) {
+    promptParts.push("Exfiltration goal: locate and extract FLAG{...} or the assigned sensitive data through a confirmed weakness. Do not stop at discovery; include the extraction result in the final summary.");
+  }
   const agent = new OffensiveSecurityAgent({
     subagentSpawner: input.subagentSpawner,
     languageModelMiddleware: input.languageModelMiddleware,
     usageRecorder: input.usageRecorder,
     streamIdFactory: input.streamIdFactory,
     ...input.hooks,
-    system: FAST_STRIKE_SYSTEM_PROMPT,
+    system: buildFastStrikeSystemPrompt(findingPolicy),
     prompt: promptParts.join(`
 
 `),
@@ -132,8 +151,9 @@ ${combined}` : combined;
     session,
     target,
     mode: "fast-strike",
+    findingPolicy,
     activeTools: [],
-    responseSchema: FastStrikeResult,
+    responseSchema: findingPolicy === "external" ? FastStrikeExternalResult : FastStrikeResult,
     findingsRegistry,
     subagentId: "fast-strike",
     authConfig,
@@ -142,6 +162,7 @@ ${combined}` : combined;
     onStepFinish,
     onCacheMetrics,
     enableThinking,
+    thinkingEffort,
     openAIReasoningEffort
   });
   eventBus?.emit("subagent-spawn", {
@@ -154,14 +175,23 @@ ${combined}` : combined;
     subagentName: "Fast Strike",
     target
   });
-  let strikeResult;
+  let completed;
   try {
-    strikeResult = await agent.consume();
+    const strikeResult = await agent.consume();
+    if (findingPolicy === "external") {
+      const parsed = FastStrikeExternalResult.safeParse(strikeResult);
+      if (!parsed.success) {
+        throw new Error("Externally graded Fast Strike ended without a structured findings response");
+      }
+      completed = { policy: "external", outcome: parsed.data };
+    } else {
+      completed = { policy: "native", outcome: strikeResult };
+    }
     eventBus?.emit("subagent-complete", {
       subagentId: "fast-strike",
       status: "completed"
     });
-    await seams.hooks.onEndpointDone?.({ subagentId: "fast-strike", subagentName: "Fast Strike", target }, strikeResult);
+    await seams.hooks.onEndpointDone?.({ subagentId: "fast-strike", subagentName: "Fast Strike", target }, completed.outcome);
   } catch (e) {
     eventBus?.emit("subagent-complete", {
       subagentId: "fast-strike",
@@ -173,8 +203,30 @@ ${combined}` : combined;
   if (abortSignal?.aborted) {
     throw new DOMException("Pentest aborted by user", "AbortError");
   }
+  if (completed.policy === "external") {
+    const strikeResult = completed.outcome;
+    eventBus?.emit("workflow-phase-complete", {
+      phase: "pentesting",
+      summary: {
+        findingsCount: strikeResult.reportedFindings.length,
+        solved: strikeResult.solved,
+        operatorSummary: strikeResult.summary
+      }
+    });
+    return {
+      findings: [],
+      findingsPath: session.findingsPath,
+      pocsPath: session.pocsPath,
+      reportPath: null,
+      reportedFindings: strikeResult.reportedFindings,
+      submissionJson: strikeResult.submissionJson,
+      solved: strikeResult.solved,
+      summary: strikeResult.summary
+    };
+  }
   await findingsRegistry.groupByRootCause();
   const findings = [...findingsRegistry.getFindings()];
+  const strikeResult = completed.outcome;
   const report = buildPentestReport(findings, {
     target,
     model,

package/build/{fixes-kytx5dmj.js → fixes-6wxk22v5.js}

@@ -1,25 +1,25 @@
 #!/usr/bin/env bun
-import"./cli-fy6vh2a7.js";
-import"./cli-c05y640n.js";
+import"./cli-t4q4t4dx.js";
+import"./cli-98wmmphf.js";
+import"./cli-9jscnhtg.js";
 import {
   listFixes2,
   getFix2
-} from "./cli-7eea4e2y.js";
-import"./cli-qgz1q9g5.js";
-import"./cli-k2nwxta0.js";
-import"./cli-kb21qhvm.js";
-import"./cli-ngq9dr8n.js";
-import"./cli-d37a42dc.js";
-import"./cli-3sp6nd8d.js";
-import"./cli-xtc2t6me.js";
-import"./cli-n2en7j5b.js";
+} from "./cli-5ab346kd.js";
+import"./cli-t09zj814.js";
+import"./cli-1pmfnz1a.js";
+import"./cli-fdrrbb9p.js";
+import"./cli-9pz9wjt2.js";
+import"./cli-9kk9tm58.js";
+import"./cli-vdd1s3x9.js";
+import"./cli-z7ysyrr4.js";
 import"./cli-xcy2vxj2.js";
 import {
   markCommandFailed
 } from "./cli-z82n3qk1.js";
-import"./cli-1ve18npr.js";
+import"./cli-72y76bpg.js";
 import"./cli-qba2x69h.js";
-import"./cli-dpsw2fe6.js";
+import"./cli-a6x4jm5a.js";
 import"./cli-c2k4xxaw.js";
 
 // src/cli/fixes.ts