v3.4.x: intelligent agent selection, whitebox, recon/code agents, Gemini, artifacts, RL, XBOW GUI

Harness intelligence:
- After recon, the model SELECTS which specialist agents match the target
  (select_agents) — runs the relevant subset, not blindly top-N
- RL reward store (rl.rs): per-agent weights persist to data/rl_state_rs.json,
  reward validated findings (severity-weighted), decay idle, bias next run
- Run artifacts persisted as JSON + MD (recon, exploitation transcript,
  findings, html report) under runs/<target>-<ts>/ for reuse by other AIs

Whitebox mode:
- run_whitebox: walks a repo, builds bounded source context, runs code agents,
  validates by adversarial vote. CLI `whitebox <path>` + web "White-box" mode

Agents: +12 recon (subdomain/tech/js/api/secrets/dns/content/param/waf/cloud/
graphql/osint) and +24 code SAST reviewers (sqli/cmdi/path/ssrf/xss/deser/
secrets/crypto/authz/idor/xxe/redirect/ssti/race/eval/csrf/random/logging/
upload/mass-assign/jwt/cors). Loader gains recon/ + code/ categories → 249 total

Models: +Google Gemini provider (API + gemini CLI subscription); installed_cli_
backends now detects gemini; chat_cli handles gemini/codex/grok + optional
Playwright MCP (.mcp.json) on the subscription path with autonomy flags

GUI: full XBOW-style redesign — sidebar (Operate/Library), topbar status, mode
segment (black-box/white-box), model panel, live console, severity cards,
agent browser with category filters, models view; responsive + aligned

Verified: cargo build --release clean; CLI agents/whitebox; LIVE subscription
run shows model selecting 23→4 agents, RL update, artifacts written; GUI +
white-box toggle in Playwright.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neurosploit-rs/crates/harness/src/pool.rs

@@ -13,14 +13,21 @@ pub struct ModelPool {
     sem: Arc<Semaphore>,
     pub candidates: Vec<ModelRef>,
     pub subscription: bool,
+    /// Path to an `.mcp.json` (Playwright) used on the subscription/CLI path.
+    pub mcp_config: Option<String>,
 }
 
 impl ModelPool {
     pub fn new(models: Vec<ModelRef>, concurrency: usize) -> Self {
-        Self::with_auth(models, concurrency, false)
+        Self::with_auth(models, concurrency, false, None)
     }
 
-    pub fn with_auth(models: Vec<ModelRef>, concurrency: usize, subscription: bool) -> Self {
+    pub fn with_auth(
+        models: Vec<ModelRef>,
+        concurrency: usize,
+        subscription: bool,
+        mcp_config: Option<String>,
+    ) -> Self {
         let concurrency = concurrency.max(1);
         ModelPool {
             client: ChatClient::new(),
@@ -31,13 +38,17 @@ impl ModelPool {
                 models
             },
             subscription,
+            mcp_config,
         }
     }
 
-    /// One completion for a model, via subscription CLI or HTTP API.
+    /// One completion for a model, via subscription CLI (optionally with MCP) or HTTP API.
     async fn one(&self, m: &ModelRef, system: &str, user: &str) -> Result<String> {
         if self.subscription && cli_binary_for(&m.provider).is_some() {
-            return self.client.chat_cli(&m.provider, &m.model, system, user).await;
+            return self
+                .client
+                .chat_cli(&m.provider, &m.model, system, user, self.mcp_config.as_deref())
+                .await;
         }
         self.client.chat(m, system, user).await
     }