@pensar/apex 2.6.1 → 2.7.0-canary.6d9d1e0d

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (144) hide show
  1. package/build/agent-davhjnxc.js +13 -0
  2. package/build/{agent-yby11zaq.js → agent-gk4vmr2h.js} +6 -6
  3. package/build/agent-mqqd38dq.js +13 -0
  4. package/build/{agent-runs-g37vkrjr.js → agent-runs-12pmj6vc.js} +16 -16
  5. package/build/{agent-ayreaj6z.js → agent-xtn1masf.js} +5 -5
  6. package/build/{apps-xn6km9yn.js → apps-yjyvn8vk.js} +13 -13
  7. package/build/{auth-d105wc64.js → auth-xzp4f1bh.js} +13 -13
  8. package/build/{blackboxAgent-s56sgx9b.js → blackboxAgent-ettjqj45.js} +6 -6
  9. package/build/{blackboxPentest-ps78v3w7.js → blackboxPentest-kf0pbhp5.js} +11 -11
  10. package/build/{cli-c05y640n.js → cli-0cwdrrq7.js} +1 -1
  11. package/build/{cli-fy6vh2a7.js → cli-0ry9v2cb.js} +1 -1
  12. package/build/{cli-7eea4e2y.js → cli-4mar7kvr.js} +6 -6
  13. package/build/{cli-k2nwxta0.js → cli-5gaxk6hd.js} +2 -2
  14. package/build/{cli-d37a42dc.js → cli-8hxrn15h.js} +8 -8
  15. package/build/{cli-az3xq70v.js → cli-arxx5hbs.js} +1 -1
  16. package/build/{cli-n2en7j5b.js → cli-ge8q6nxr.js} +1 -1
  17. package/build/{cli-1ve18npr.js → cli-gr4az5sf.js} +1 -1
  18. package/build/{cli-709rvekb.js → cli-h5wkaqwe.js} +1 -1
  19. package/build/{cli-65g6rcat.js → cli-hprqe9j2.js} +1 -1
  20. package/build/{cli-kb21qhvm.js → cli-m5ryqeav.js} +2 -2
  21. package/build/{cli-xtc2t6me.js → cli-metec8r8.js} +3 -3
  22. package/build/{cli-dpsw2fe6.js → cli-nj73990n.js} +353 -185
  23. package/build/{cli-ae8jqxqr.js → cli-pchzt5f7.js} +2 -2
  24. package/build/{cli-3sp6nd8d.js → cli-t3m0e9t2.js} +2 -2
  25. package/build/{cli-qgz1q9g5.js → cli-tfaqp0ty.js} +105 -36
  26. package/build/{cli-gx71jcke.js → cli-xpspbhqs.js} +1 -1
  27. package/build/{cli-ngq9dr8n.js → cli-zmeb85er.js} +3 -3
  28. package/build/cli.js +37 -37
  29. package/build/{config-zpqkd5cz.js → config-n03g5jad.js} +1 -1
  30. package/build/{fastStrike-mcjdvwez.js → fastStrike-9mys4r1b.js} +5 -5
  31. package/build/{fixes-kytx5dmj.js → fixes-tcd29w2t.js} +13 -13
  32. package/build/{index-je6hcsqr.js → index-3n19dh6s.js} +1 -1
  33. package/build/{index-wqetp6gq.js → index-42dnvkns.js} +5 -5
  34. package/build/{index-fv64eb32.js → index-6ptkm3fe.js} +2 -2
  35. package/build/{index-qv4cc65p.js → index-93br69mn.js} +13 -13
  36. package/build/{index-4vqdgb42.js → index-hh9bqe4y.js} +1236 -1195
  37. package/build/{index-dr3tg1w3.js → index-k1pvqjaq.js} +1 -1
  38. package/build/{index-r9yjkfrv.js → index-mmmx59w3.js} +4 -4
  39. package/build/{index-n65z6v7b.js → index-msb8ht2s.js} +6 -6
  40. package/build/{index-ns4m4s01.js → index-qtpprc5a.js} +4 -4
  41. package/build/{issues-eb3q9d3a.js → issues-d0e1tzda.js} +13 -13
  42. package/build/{knowledge-fqsvtx0f.js → knowledge-vgvrzey3.js} +13 -13
  43. package/build/lib/{chunk-1azdancq.js → chunk-0ec46jyd.js} +1 -1
  44. package/build/lib/{chunk-9yksqgzr.js → chunk-29bvrw6m.js} +11 -11
  45. package/build/lib/{chunk-z137x08b.js → chunk-3ac8kcj9.js} +5 -5
  46. package/build/lib/{chunk-bb0ekhkw.js → chunk-3g3ksmsv.js} +8 -8
  47. package/build/lib/{chunk-9tt2021m.js → chunk-45nvxhrc.js} +9 -9
  48. package/build/lib/{chunk-w66ce82a.js → chunk-66t5k77r.js} +1 -1
  49. package/build/lib/{chunk-r4j8ybn9.js → chunk-74ddy2e7.js} +37 -20
  50. package/build/lib/{chunk-4hwzqthr.js → chunk-851r7zp8.js} +1 -1
  51. package/build/lib/{chunk-1fy8azee.js → chunk-8m15nv6s.js} +1 -1
  52. package/build/lib/{chunk-7pwa92rn.js → chunk-9etzp9n2.js} +1 -1
  53. package/build/lib/{chunk-xhdpgpkm.js → chunk-acfewabw.js} +2 -2
  54. package/build/lib/{chunk-ba41jh41.js → chunk-bdbd8d8q.js} +297 -127
  55. package/build/lib/{chunk-z96pbjhd.js → chunk-c6gj39ew.js} +1 -1
  56. package/build/lib/{chunk-yrnrbjes.js → chunk-fytt5jz7.js} +1 -1
  57. package/build/lib/{chunk-3c00n0cy.js → chunk-gv1p302b.js} +3 -3
  58. package/build/lib/{chunk-1yct6cra.js → chunk-j1ftnbgr.js} +1 -1
  59. package/build/lib/{chunk-nhfax4gb.js → chunk-mepzy07f.js} +1 -1
  60. package/build/lib/{chunk-e8yy2k73.js → chunk-mqcwxrnh.js} +1 -1
  61. package/build/lib/{chunk-v3dk9j7k.js → chunk-n3kr09mb.js} +11 -11
  62. package/build/lib/{chunk-acgbyf5h.js → chunk-pd487tpr.js} +1 -1
  63. package/build/lib/{chunk-1jvwqnem.js → chunk-rchnq1ez.js} +3 -3
  64. package/build/lib/{chunk-2qsq76xq.js → chunk-wa0q3smh.js} +62 -10
  65. package/build/lib/{chunk-mg03jdmt.js → chunk-xw8d7pv7.js} +1 -1
  66. package/build/lib/{chunk-r2dkp4tb.js → chunk-y9m8yw7k.js} +1 -1
  67. package/build/lib/core/agents/offSecAgent/index.js +7 -7
  68. package/build/lib/core/agents/offSecAgent/subagentSpawner.js +5 -5
  69. package/build/lib/core/agents/offSecAgent/tools/index.js +4 -4
  70. package/build/lib/core/agents/offSecAgent/tools/listMemories.d.ts +11 -1
  71. package/build/lib/core/agents/specialized/attackSurface/blackboxAgent.js +9 -9
  72. package/build/lib/core/agents/specialized/attackSurface/schemas.js +9 -9
  73. package/build/lib/core/agents/specialized/authenticationAgent/index.js +10 -10
  74. package/build/lib/core/agents/specialized/codeAgent/agent.js +9 -9
  75. package/build/lib/core/agents/specialized/findingJudge/agent.js +8 -8
  76. package/build/lib/core/agents/specialized/findingJudge/index.js +3 -3
  77. package/build/lib/core/agents/specialized/patching/index.js +10 -10
  78. package/build/lib/core/agents/specialized/pentest/agent.js +9 -9
  79. package/build/lib/core/agents/specialized/whiteboxAttackSurface/index.js +9 -9
  80. package/build/lib/core/ai/ai.d.ts +23 -6
  81. package/build/lib/core/ai/ai.js +2 -2
  82. package/build/lib/core/ai/index.js +2 -2
  83. package/build/lib/core/ai/models/claude-capabilities.d.ts +3 -2
  84. package/build/lib/core/ai/models/index.d.ts +1 -1
  85. package/build/lib/core/ai/utils.d.ts +2 -0
  86. package/build/lib/core/ai/utils.js +4 -2
  87. package/build/lib/core/api/index.js +19 -19
  88. package/build/lib/core/api/targetedPentest.js +10 -10
  89. package/build/lib/core/config/index.js +1 -1
  90. package/build/lib/core/findings/registry.js +3 -3
  91. package/build/lib/core/session/index.js +2 -2
  92. package/build/lib/core/session/persistence.js +3 -3
  93. package/build/lib/core/workflows/pentest.js +15 -15
  94. package/build/lib/core/workflows/seams.js +4 -4
  95. package/build/lib/core/workflows/whiteboxAttackSurface.js +11 -11
  96. package/build/lib/index.js +22 -22
  97. package/build/{logs-x62b7hk1.js → logs-mvrvrkfa.js} +13 -13
  98. package/build/{native-rollout-evidence-c9yhfqcs.js → native-rollout-evidence-h2za8fyf.js} +3 -3
  99. package/build/{offesecAgent-5whnpeta.js → offesecAgent-r4hz607z.js} +4 -4
  100. package/build/pentest-52s2dn28.js +22 -0
  101. package/build/{pentests-e0f32aqx.js → pentests-yvt9wvxd.js} +13 -13
  102. package/build/recordedRunClient-6z78az3b.js +11 -0
  103. package/build/{targetedPentest-rcbs4nvp.js → targetedPentest-6aeg3nxd.js} +6 -6
  104. package/build/{targets-xj9g3q0z.js → targets-a38xnsgm.js} +13 -13
  105. package/build/threatModel-1gsb7ytk.js +21 -0
  106. package/build/{uninstall-7s784q4a.js → uninstall-kt485ay4.js} +1 -1
  107. package/build/{upload-4gvhwmvr.js → upload-ahw3are7.js} +4 -4
  108. package/build/{utils-cjrz64pc.js → utils-yqdepzr3.js} +3 -3
  109. package/package.json +1 -1
  110. package/src/core/agents/offSecAgent/offensiveSecurityAgent.test.ts +92 -5
  111. package/src/core/agents/offSecAgent/offensiveSecurityAgent.ts +49 -28
  112. package/src/core/agents/offSecAgent/tools/listMemories.test.ts +230 -0
  113. package/src/core/agents/offSecAgent/tools/listMemories.ts +73 -6
  114. package/src/core/ai/ai.operator-context.bench.test.ts +1408 -0
  115. package/src/core/ai/ai.recorded-context.test.ts +74 -0
  116. package/src/core/ai/ai.test.ts +54 -0
  117. package/src/core/ai/ai.ts +299 -80
  118. package/src/core/ai/compactionTelemetry.test.ts +2 -2
  119. package/src/core/ai/models/anthropic.ts +6 -0
  120. package/src/core/ai/models/bedrock.ts +18 -0
  121. package/src/core/ai/models/claude-capabilities.ts +29 -8
  122. package/src/core/ai/models/index.ts +4 -1
  123. package/src/core/ai/models/models.test.ts +23 -0
  124. package/src/core/ai/models/openrouter.ts +6 -0
  125. package/src/core/ai/providers/anthropic-models.test.ts +60 -1
  126. package/src/core/ai/providers/bedrock-models.test.ts +81 -0
  127. package/src/core/ai/providers/gateway-models.test.ts +16 -6
  128. package/src/core/ai/utils.native-rollout-evidence.test.ts +1 -0
  129. package/src/core/ai/utils.ts +189 -143
  130. package/src/core/observability/telemetry.test.ts +2 -3
  131. package/src/tui/components/chat/loading-indicator.tsx +20 -4
  132. package/src/tui/components/chat/message-list.tsx +1 -0
  133. package/src/tui/components/operator-dashboard/run-events.test.ts +3 -1
  134. package/src/tui/components/shared/__tests__/tool-renderer-lifecycle.tsx +18 -0
  135. package/src/tui/components/shared/action-label.test.ts +9 -0
  136. package/src/tui/components/shared/compacting-icon.tsx +18 -0
  137. package/src/tui/components/shared/index.ts +1 -0
  138. package/src/tui/components/shared/tool-registry.ts +1 -0
  139. package/src/tui/components/shared/tool-renderer.tsx +21 -7
  140. package/build/agent-6w7egcf1.js +0 -13
  141. package/build/agent-9zx75feh.js +0 -13
  142. package/build/pentest-e61hc38s.js +0 -22
  143. package/build/recordedRunClient-dp032c32.js +0 -11
  144. package/build/threatModel-jkxfa40s.js +0 -21
@@ -7,6 +7,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
7
7
  import { z } from "zod";
8
8
  import { RunPersistenceError } from "../runtime/persistenceError";
9
9
  import type { RunContextRecorder } from "../runtime/runContext";
10
+ import { estimateMessageTokens } from "./contextManagement";
10
11
 
11
12
  const state: { model?: MockLanguageModelV3 } = {};
12
13
  vi.mock("./utils", async () => ({
@@ -178,6 +179,76 @@ describe("pre-dispatch gate (real SDK)", () => {
178
179
  });
179
180
 
180
181
  describe("step commits (real SDK)", () => {
182
+ it("commits fitted in-stream context before dispatch without restoring old tool results", async () => {
183
+ const output = "e".repeat(8_000);
184
+ const seenAtDispatch: number[] = [];
185
+ const preparedOffsets: number[] = [];
186
+ const { recorder } = fakeRecorder();
187
+ let calls = 0;
188
+ state.model = new MockLanguageModelV3({
189
+ modelId: "small",
190
+ doStream: async () => {
191
+ const latest = recorder.latest();
192
+ if (latest) seenAtDispatch.push(estimateMessageTokens(latest));
193
+ const call = calls++;
194
+ return call < 8
195
+ ? streamOf([
196
+ {
197
+ type: "tool-call",
198
+ toolCallId: `c${call}`,
199
+ toolName: "probe",
200
+ input: '{"q":"x"}',
201
+ },
202
+ finishChunk(),
203
+ ])
204
+ : streamOf([...textStepChunks("done", "done"), finishChunk()]);
205
+ },
206
+ });
207
+
208
+ await drain(
209
+ streamResponse({
210
+ model: "custom:fixture:small",
211
+ prompt: "run probes",
212
+ silent: true,
213
+ tools: {
214
+ probe: {
215
+ description: "probe",
216
+ inputSchema: z.object({ q: z.string() }),
217
+ execute: async () => output,
218
+ },
219
+ },
220
+ stopWhen: stepCountIs(20),
221
+ contextRecorder: recorder,
222
+ onContextPrepared: ({ responseMessageOffset }) => {
223
+ preparedOffsets.push(responseMessageOffset);
224
+ },
225
+ authConfig: {
226
+ customProviders: {
227
+ fixture: {
228
+ baseUrl: "https://example.invalid/v1",
229
+ models: [
230
+ { id: "small", contextLength: 20_000, maxOutputTokens: 2_000 },
231
+ ],
232
+ },
233
+ },
234
+ },
235
+ }),
236
+ );
237
+
238
+ expect(calls).toBe(9);
239
+ expect(seenAtDispatch).toHaveLength(9);
240
+ expect(preparedOffsets).toEqual([0, 2, 4, 6, 8, 10, 12, 14, 16]);
241
+ expect(Math.max(...seenAtDispatch)).toBeLessThan(7_000);
242
+ const final = recorder.latest();
243
+ expect(final).toHaveLength(18);
244
+ const toolOutputLengths = final
245
+ ?.filter((message) => message.role === "tool")
246
+ .map((message) => JSON.stringify(message).length);
247
+ expect(
248
+ toolOutputLengths?.filter((length) => length < 1_000).length,
249
+ ).toBeGreaterThanOrEqual(4);
250
+ });
251
+
181
252
  it("commits base + cumulative response.messages per step, preserving accepted outputs in later turns", async () => {
182
253
  let call = 0;
183
254
  state.model = new MockLanguageModelV3({
@@ -440,6 +511,9 @@ describe("critical failure modes (real SDK)", () => {
440
511
  // Every commit is the base optionally extended, never base + base.
441
512
  const base = checkpoints[0]?.messages ?? [];
442
513
  expect(base.length).toBeGreaterThan(0);
514
+ expect(checkpoints.at(-1)?.messages.map((message) => message.role)).toEqual(
515
+ ["user", "assistant", "tool"],
516
+ );
443
517
  for (const c of checkpoints) {
444
518
  expect(c.messages.slice(0, base.length)).toEqual(base);
445
519
  expect(c.messages.slice(base.length, base.length * 2)).not.toEqual(base);
@@ -155,6 +155,60 @@ describe("isRepairFailClosedTool", () => {
155
155
  });
156
156
 
157
157
  describe("buildReasoningProviderOptions", () => {
158
+ it("sends Claude Haiku 5.5 max effort through Bedrock", () => {
159
+ expect(
160
+ buildReasoningProviderOptions("global.anthropic.claude-haiku-5-5", {
161
+ enableThinking: true,
162
+ thinkingEffort: "max",
163
+ }),
164
+ ).toEqual({
165
+ anthropic: {
166
+ thinking: { type: "adaptive", display: "summarized" },
167
+ effort: "max",
168
+ },
169
+ bedrock: {
170
+ reasoningConfig: {
171
+ type: "adaptive",
172
+ display: "summarized",
173
+ maxReasoningEffort: "max",
174
+ },
175
+ },
176
+ });
177
+ });
178
+
179
+ it("uses Claude Haiku 5.5 medium effort by default and can disable thinking", () => {
180
+ expect(
181
+ buildReasoningProviderOptions("global.anthropic.claude-haiku-5-5", {
182
+ enableThinking: true,
183
+ }),
184
+ ).toEqual({
185
+ anthropic: {
186
+ thinking: { type: "adaptive", display: "summarized" },
187
+ effort: "medium",
188
+ },
189
+ bedrock: {
190
+ reasoningConfig: {
191
+ type: "adaptive",
192
+ display: "summarized",
193
+ maxReasoningEffort: "medium",
194
+ },
195
+ },
196
+ });
197
+ expect(
198
+ buildReasoningProviderOptions("global.anthropic.claude-haiku-5-5", {
199
+ enableThinking: false,
200
+ }),
201
+ ).toEqual({
202
+ anthropic: { thinking: { type: "disabled" } },
203
+ bedrock: {
204
+ reasoningConfig: { type: "disabled" },
205
+ additionalModelRequestFields: {
206
+ thinking: { type: "disabled" },
207
+ },
208
+ },
209
+ });
210
+ });
211
+
158
212
  it("sets the bedrock reasoningConfig (and anthropic.thinking) for a Bedrock Claude model when thinking is enabled", () => {
159
213
  // Console sandbox agents run on Bedrock; this is the path the bug starved.
160
214
  const result = buildReasoningProviderOptions(