diff --git a/README.md b/README.md
index 4bdf6c5..8f4614e 100755
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-π§ NeuroSploit v3.6.9
+π§ NeuroSploit v4.0.0
@@ -12,7 +12,7 @@
- 
+ 
@@ -214,6 +214,21 @@ No login? Use an **API key** instead β see [Authentication](#authentication--r
---
+## π₯οΈ Web console (NEW in v4.0.0)
+
+A browser UI for the same harness: a categorized lead board (toggle agents by category, add
+custom leads, `Start Exploitation`), a live structured findings view, run history, and a real
+REPL β all driven by spawning the compiled CLI, never a reimplementation of it.
+
+```bash
+cd neurosploit-rs && cargo build --release # once
+node web/server.js # β http://localhost:4173
+```
+
+Zero npm dependencies. Full API reference: **[web/API.md](web/API.md)**.
+
+---
+
## π Integrations (GitHub Β· GitLab Β· Jira)
Wire NeuroSploit into your SDLC. Toggle from the REPL (`/integrations`) or the CLI
diff --git a/TUTORIAL.md b/TUTORIAL.md
index 37dad79..7a33356 100644
--- a/TUTORIAL.md
+++ b/TUTORIAL.md
@@ -1,4 +1,4 @@
-# NeuroSploit β Tutorial & User Guide (v3.6.9)
+# NeuroSploit β Tutorial & User Guide (v4.0.0)
A complete, hands-on guide to installing, configuring and running NeuroSploit β
the autonomous, multi-model penetration-testing harness.
@@ -98,7 +98,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
### Verify
```bash
-neurosploit --version # neurosploit 3.6.9
+neurosploit --version # neurosploit 4.0.0
neurosploit agents # {"vulns":241,...,"ai":30,...,"total":430}
neurosploit models # all providers & models
```
diff --git a/neurosploit-rs/Cargo.lock b/neurosploit-rs/Cargo.lock
index 0a25272..cd42bf8 100644
--- a/neurosploit-rs/Cargo.lock
+++ b/neurosploit-rs/Cargo.lock
@@ -871,7 +871,7 @@ dependencies = [
[[package]]
name = "neurosploit"
-version = "3.6.9"
+version = "4.0.0"
dependencies = [
"anyhow",
"clap",
@@ -888,7 +888,7 @@ dependencies = [
[[package]]
name = "neurosploit-harness"
-version = "3.6.9"
+version = "4.0.0"
dependencies = [
"anyhow",
"futures",
diff --git a/neurosploit-rs/Cargo.toml b/neurosploit-rs/Cargo.toml
index 0005c05..103c30f 100644
--- a/neurosploit-rs/Cargo.toml
+++ b/neurosploit-rs/Cargo.toml
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
resolver = "2"
[workspace.package]
-version = "3.6.9"
+version = "4.0.0"
edition = "2021"
license = "MIT"
repository = "https://github.com/JoasASantos/NeuroSploit"
diff --git a/neurosploit-rs/app/src/main.rs b/neurosploit-rs/app/src/main.rs
index fe3a493..5c236b6 100644
--- a/neurosploit-rs/app/src/main.rs
+++ b/neurosploit-rs/app/src/main.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
+//! NeuroSploit v4.0.0 β interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
mod repl;
mod tui;
@@ -11,8 +11,8 @@ use std::path::{Path, PathBuf};
#[command(
name = "neurosploit",
version,
- about = "NeuroSploit v3.6.9 β multi-model autonomous pentest harness",
- long_about = "NeuroSploit v3.6.9 β a Rust multi-model harness that drives a pool of LLMs \
+ about = "NeuroSploit v4.0.0 β multi-model autonomous pentest harness",
+ long_about = "NeuroSploit v4.0.0 β a Rust multi-model harness that drives a pool of LLMs \
(API key or local subscription: Claude/Codex/Gemini/Grok/OpenCode/Hermes) to autonomously test a target. \
After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
@@ -765,7 +765,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
println!(" β ua : {ua}");
write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
- println!(" ββ NeuroSploit v3.6.9 Β· by Joas A Santos & Red Team Leaders");
+ println!(" ββ NeuroSploit v4.0.0 Β· by Joas A Santos & Red Team Leaders");
println!(" β run id : {run_id}");
println!(" β target : {}", cfg.target);
println!(" β models : {}", cfg.models.join(", "));
diff --git a/neurosploit-rs/app/src/repl.rs b/neurosploit-rs/app/src/repl.rs
index 1b1272e..7826b6f 100644
--- a/neurosploit-rs/app/src/repl.rs
+++ b/neurosploit-rs/app/src/repl.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β interactive session (Claude-Code / Codex / Cursor-CLI style).
+//! NeuroSploit v4.0.0 β interactive session (Claude-Code / Codex / Cursor-CLI style).
//!
//! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
//! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
@@ -371,7 +371,7 @@ pub async fn repl(base: &Path) -> anyhow::Result<()> {
let backends = harness::installed_cli_backends();
println!("\x1b[1m");
println!(" ββββ ββββββββββββββ ββββββββββ βββββββ");
- println!(" βββββ ββββββββββββββ ββββββββββββββββββββ NeuroSploit v3.6.9");
+ println!(" βββββ ββββββββββββββ ββββββββββββββββββββ NeuroSploit v4.0.0");
println!(" ββββββ βββββββββ βββ ββββββββββββββ βββ interactive harness");
println!(" ββββββββββββββββ βββ ββββββββββββββ βββ by Joas A Santos");
println!(" βββ ββββββββββββββββββββββββββ ββββββββββββ & Red Team Leaders");
diff --git a/neurosploit-rs/app/src/tui.rs b/neurosploit-rs/app/src/tui.rs
index 68fe71d..167e28c 100644
--- a/neurosploit-rs/app/src/tui.rs
+++ b/neurosploit-rs/app/src/tui.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β TUI "Mission Control" mode.
+//! NeuroSploit v4.0.0 β TUI "Mission Control" mode.
//!
//! Concurrent panels that update live while the engagement runs in the
//! background, with a composer input that stays active during execution:
diff --git a/web/API.md b/web/API.md
new file mode 100644
index 0000000..35acec1
--- /dev/null
+++ b/web/API.md
@@ -0,0 +1,282 @@
+# NeuroSploit Web Console β API reference
+
+Backend: `web/server.js` (Node, zero external dependencies). It does three things:
+
+1. Serves the SPA in `web/public/`.
+2. Reads `agents_md/` and `runs/` from the repo root to build the lead board and run history.
+3. Shells out to the compiled `neurosploit` CLI binary (`neurosploit-rs/target/release/neurosploit`)
+ for every exploitation run and for the REPL β the web UI never reimplements harness logic,
+ it only drives the real CLI and parses its stdout.
+
+Base URL: `http://localhost:4173` (override with `PORT` or `NEUROSPLOIT_WEB_PORT`).
+
+All responses are JSON unless noted. All endpoints are same-origin; there is no auth layer β
+run this only on a trusted machine/network, same trust model as the CLI itself.
+
+---
+
+## Meta
+
+### `GET /api/meta`
+
+Server/version info.
+
+```json
+{ "version": "4.0.0", "binary": "/opt/neurosploit-rs/neurosploit-rs/target/release/neurosploit", "root": "/opt/neurosploit-rs" }
+```
+
+---
+
+## Agents / lead board
+
+### `GET /api/agents`
+
+Reads every `agents_md/{vulns,ai,infra,code,chains,recon,meta}/*.md`, extracts `name` (filename
+stem), `title` (first `# heading`), `cwe` (first `CWE-\d+` match), `kind` (source directory), and
+classifies each into a UI category (`category`) via a keyword taxonomy (Business Logic, Broken
+Access Control, Injection, Cross-Site Scripting, LLM Application, Auth & Session, SSRF & Network,
+API & GraphQL, Cloud & Infra, Client-Side, Cryptography, Rate Limiting & DoS, Cache & CDN,
+Recon & Fingerprint, Linux Host, Windows Host, Attack Chains, Code Review, Recon, Other).
+`meta/` (orchestration/doctrine agents) is loaded but excluded from `categories` β those aren't
+selectable "leads". Cached in-memory for 5s.
+
+```json
+{
+ "total": 435,
+ "agents": [ { "id": "sqli_error", "name": "sqli_error", "title": "SQL Injection (Error-Based) Specialist Agent", "cwe": "CWE-89", "kind": "vuln", "category": "Injection" } ],
+ "categories": [ { "category": "Business Logic", "agents": [ /* Agent[] */ ] } ]
+}
+```
+
+An agent's `id`/`name` is exactly what the CLI's `--only ` flag expects (see `neurosploit agents`).
+
+---
+
+## Providers / models / API keys
+
+### `GET /api/providers`
+
+Static mirror of `crates/harness/src/models.rs` `providers()` β every provider the harness
+supports, its models, and whether it's usable via a local CLI subscription login (`kind: "cli"`)
+or API key only (`kind: "api"`).
+
+```json
+[ { "key": "anthropic", "label": "Anthropic Claude", "kind": "cli", "models": ["claude-opus-5", "..."] } ]
+```
+
+### `GET /api/keys`
+
+Which providers currently have an API key set **in this server process's memory** (booleans only
+β never the value):
+
+```json
+[ { "provider": "anthropic", "set": true }, { "provider": "openai", "set": false } ]
+```
+
+### `POST /api/keys`
+
+Body `{ "provider": "anthropic", "key": "sk-..." }`. Stores the key in an in-memory `Map` β
+**never written to disk**, lost on server restart. Every subsequent `/api/exploit` and `/api/repl`
+child process is spawned with `.envKey` set from this store (merged over `process.env`).
+Omitting `key` (or passing an empty string) clears it. 400 on an unknown provider.
+
+### `DELETE /api/keys/:provider`
+
+Clears one provider's key.
+
+---
+
+## Runs (history)
+
+### `GET /api/runs`
+
+Lists `runs/ns-*` directories, newest first, with a summary read from each run's
+`meta.json` / `status.json` / `findings.json`.
+
+```json
+[ { "id": "ns-1787504238-testphp_vulnweb_com", "ts": 1787504238, "name": "Keystone β Digital Banking", "target": "http://testphp.vulnweb.com/", "state": "running", "findings": 3, "severities": { "High": 1, "Medium": 2 }, "hasReport": false } ]
+```
+
+`state` mirrors the CLI's `status.json`: `running` | `complete` | `stopped-raw` | `discarded` | `unknown`.
+
+### `GET /api/runs/:id`
+
+Full detail for one run: `{ id, name, meta, status, findings, assets }` (`name` is the engagement
+name set in the wizard, `""` if this run predates that or was started outside the web console). `findings` is the raw
+`findings.json` array (see [Finding shape](#finding-shape) below). `assets` lists which generated
+files exist (`report.html`, `report.pdf`, `report.md`, `recon.md`, `exploitation.md`).
+
+### `GET /api/runs/:id/asset/:path`
+
+Serves a file from that run's workdir (e.g. `report.html`, `report.pdf`, `evidence/foo.png`).
+Path-traversal-guarded (resolved path must stay under the run dir). Use this to embed/open the
+generated report from the browser.
+
+---
+
+## Exploitation jobs (live runs)
+
+Starting a job spawns `neurosploit [flags...] --verbose` as a child process and
+parses its stdout/stderr line-by-line into structured events β the same signal the interactive
+REPL's status line uses (phase, agent counts, findings, report path).
+
+### `POST /api/exploit`
+
+Body:
+
+```jsonc
+{
+ "mode": "run", // run | whitebox | greybox | host | aitest | skills
+ "name": "Keystone β Digital Banking", // engagement name β required by the wizard UI
+ "target": "https://example.com", // required for run/host/aitest/greybox
+ "repo": "owner/repo", // required for whitebox; source repo for greybox
+ "models": ["anthropic:claude-opus-4-8"], // optional, repeatable in the CLI
+ "votes": 3, // --vote-n
+ "chainDepth": 2, // --chain-depth
+ "recon": 3, // --recon (1-4)
+ "maxAgents": 0, // --max-agents (0 = all)
+ "subscription": false, // --subscription
+ "offline": false, // --offline
+ "mcp": false, // --mcp
+ "creds": "creds.yaml", // --creds
+ "focus": "injection and business logic", // --focus
+ "objective": "pre-launch review of checkout", // --objective
+ "outOfScope": "staging.example.com", // --out-of-scope
+ "agents": ["sqli_error", "idor"], // --only , repeated β the lead-board selection
+ "auth": "Authorization: Bearer ", // target auth header β see Target auth below
+ "roles": [{ "name": "admin", "header": "Authorization: Bearer ..." }], // multi-identity access-control testing
+}
+```
+
+### Target auth (`auth` / `roles`)
+
+If `creds` is omitted and either `auth` or `roles` is set, the server writes a minimal
+`creds.yaml`-compatible file (matching `neurosploit-rs/creds.example.yaml`'s schema) to
+`os.tmpdir()/neurosploit-web/.creds.yaml` and passes it via `--creds`. An explicit `creds`
+path always wins over `auth`/`roles`. These ephemeral files are not cleaned up automatically β
+they live in the OS temp dir, never in the repo.
+
+`name` is not a harness/CLI concept β the server persists a `runId -> name` map to
+`.neurosploit/web-engagement-names.json` (keyed on the CLI's own run id, captured from its
+"run id : ns-β¦" log line) so `/api/runs` and `/api/runs/:id` can label a run by its engagement
+name, surviving a server restart.
+
+Response: `{ "id": "" }`. This `id` is the **web job id**, not the run id β the CLI's own
+`ns--` run id is discovered from its own log line and exposed as `runId` in the
+job snapshot once the engagement starts writing to `runs/`.
+
+If `agents` is empty, no `--only` flag is passed and the harness falls back to its normal
+recon-driven agent selection (the intelligent default) β the lead board's "0 selected" state is a
+valid, meaningful choice, not an error.
+
+### `GET /api/exploit`
+
+List all jobs known to this server process (in-memory; lost on restart) as snapshots (see below).
+
+### `GET /api/exploit/:id`
+
+One job's current snapshot:
+
+```json
+{
+ "id": "d98f51ad-...", "target": "http://testphp.vulnweb.com/",
+ "runId": "ns-1787504238-testphp_vulnweb_com",
+ "phase": "exploiting", "findings": [ /* Finding[] */ ],
+ "agents": 245, "agentsDone": 12, "done": false, "exitCode": null,
+ "reportUrl": null, "startedAt": 1787504238594
+}
+```
+
+`phase` tracks the same lifecycle the REPL's `/status` shows: `starting β recon β planning β
+exploiting β validating β chaining β complete`, or `paused (quota)` / `paused (auth)` if the
+harness parks the run (token/quota exhaustion or auth failure β findings are preserved either way).
+
+### `POST /api/exploit/:id/stop`
+
+Sends `SIGINT` to the child process β identical to pressing Ctrl-C in the terminal. The harness's
+own graceful-stop logic decides whether to keep partial findings.
+
+### `GET /api/exploit/:id/events` (Server-Sent Events)
+
+Live stream. On connect, replays every buffered event so a reconnecting client doesn't miss
+history, then streams new ones. Named SSE events:
+
+| event | data | meaning |
+|------------|---------------------------------------|---------|
+| `log` | `{ "type": "log", "line": "..." }` | one stdout/stderr line (ANSI stripped) |
+| `finding` | `{ "type": "finding", "finding": {β¦} }` | a `finding_json:` line, parsed |
+| `snapshot` | job snapshot (see above) | phase/progress update |
+| `done` | job snapshot with `done: true` | process exited; stream closes |
+
+Client example:
+
+```js
+const es = new EventSource(`/api/exploit/${id}/events`);
+es.addEventListener('finding', (e) => console.log(JSON.parse(e.data).finding));
+es.addEventListener('done', () => es.close());
+```
+
+---
+
+## REPL sessions
+
+Spawns the CLI with **no subcommand** β the same interactive session `neurosploit` launches from
+a terminal β and pipes stdin/stdout. Because stdin isn't a TTY, the CLI's `Reader::Plain` path
+takes over: it prints each prompt to stdout then reads one line at a time from stdin, so it works
+perfectly over a plain pipe. This is a real harness process; every `/command` (`/run`, `/status`,
+`/stop`, `/model`, `/target`, natural-language input, etc.) behaves exactly as it would in a
+terminal.
+
+### `POST /api/repl`
+
+Starts a session. Response: `{ "id": "" }`.
+
+### `POST /api/repl/:id/input`
+
+Body: `{ "line": "/status" }`. Writes `line + "\n"` to the child's stdin.
+
+### `POST /api/repl/:id/stop`
+
+Sends `SIGTERM` to the session's child process.
+
+### `GET /api/repl/:id/events` (SSE)
+
+| event | data | meaning |
+|---------|-------------------------|---------|
+| `data` | `{ "chunk": "..." }` | raw stdout/stderr chunk (ANSI stripped), not line-buffered |
+| `close` | `{}` | child process exited |
+
+Replays the session's buffered output (capped at the last 5000 chunks) on connect, same as the
+exploit stream.
+
+---
+
+## Finding shape
+
+Findings are exactly the harness's `harness::types::Finding` struct (see
+`neurosploit-rs/crates/harness/src/types.rs`), serialized as JSON β the web UI does not transform
+or rename any field:
+
+```ts
+{
+ id: string, agent: string, title: string, severity: string, cwe: string, cvss: string,
+ endpoint: string, payload: string, evidence: string, impact: string, remediation: string,
+ confidence: number, validated: boolean, votes: string,
+ owasp: string, mitre: string, stage: string, exploitability: string, business_impact: string,
+ chains_from: string[], auth_context: string, account: string, secret: string,
+ review_status: string, review_reason: string, screenshots: string[],
+}
+```
+
+---
+
+## Running it
+
+```bash
+cd neurosploit-rs && cargo build --release # once, or after a harness change
+node web/server.js # http://localhost:4173
+```
+
+`PORT` (or `NEUROSPLOIT_WEB_PORT`) overrides the port. The server auto-locates the compiled binary
+under `neurosploit-rs/target/{release,debug}/neurosploit` relative to the repo root; if neither
+exists, `/api/exploit` and `/api/repl` return a 500 with a build hint.
diff --git a/web/README.md b/web/README.md
new file mode 100644
index 0000000..69daa31
--- /dev/null
+++ b/web/README.md
@@ -0,0 +1,41 @@
+# NeuroSploit v4.0.0 β web console
+
+A browser UI for the `neurosploit` CLI harness: a 5-step engagement wizard (Asset β Scope & Auth
+β Leads β Model & Run β Review), a live structured findings view with a generative attack-path
+graph, run history, an Auth & Keys menu, and a real REPL β all driven by spawning the actual CLI
+binary, never a reimplementation of harness logic.
+
+- **Asset** β pick black/white/grey-box, host/infra, or AI/LLM, set the target or repo.
+- **Scope & Auth** β objective, focus, out-of-scope, and a link into the Auth & Keys menu.
+- **Leads** β the categorized agent picker (435 agents auto-classified) + custom leads.
+- **Model & Run** β pick a provider/model from the live catalog, API-key vs. subscription auth
+ mode, votes/chain-depth/recon intensity.
+- **Review** β confirm the plan, then `Start Exploitation` spawns the real CLI.
+- **Auth & Keys** (one menu, π in the sidebar) β target auth header + named roles for
+ IDOR/BOLA/BFLA testing, per-provider API keys (kept in server memory only, never on disk), and
+ an explicit `creds.yaml` path override.
+- **Generative Attack Path Chaining** β findings are grouped into kill-chain columns
+ (recon β initial-access β execution β privesc β lateral β exfil β impact) with chained findings
+ linked back to their parent, built live as findings stream in.
+
+```bash
+cd neurosploit-rs && cargo build --release # build the CLI once
+node web/server.js # β http://localhost:4173
+```
+
+Zero npm dependencies (Node β₯18, built-ins only: `http`, `child_process`, `events`, `fs`).
+
+API reference: [`API.md`](./API.md).
+
+## Layout
+
+```
+web/
+βββ server.js backend: static server + agents_md/runs reader + CLI process manager
+βββ public/
+β βββ index.html SPA shell
+β βββ style.css lead-board / live-run / REPL drawer styling
+β βββ app.js client logic (fetch + EventSource, no framework)
+βββ API.md
+βββ package.json
+```
diff --git a/web/package.json b/web/package.json
new file mode 100644
index 0000000..c42dd73
--- /dev/null
+++ b/web/package.json
@@ -0,0 +1,13 @@
+{
+ "name": "neurosploit-web",
+ "version": "4.0.0",
+ "private": true,
+ "description": "NeuroSploit v4.0.0 web console β lead board + REPL, backed by the neurosploit CLI harness.",
+ "main": "server.js",
+ "scripts": {
+ "start": "node server.js"
+ },
+ "engines": {
+ "node": ">=18"
+ }
+}
diff --git a/web/public/app.js b/web/public/app.js
new file mode 100644
index 0000000..5cb56ff
--- /dev/null
+++ b/web/public/app.js
@@ -0,0 +1,718 @@
+'use strict';
+/* NeuroSploit v4.0.0 β web console frontend. Vanilla JS, no build step. */
+
+const $ = (sel, root = document) => root.querySelector(sel);
+const $$ = (sel, root = document) => Array.from(root.querySelectorAll(sel));
+
+const MODE_LABELS = {
+ run: { target: 'Target URL', help: 'The application to test.', showRepo: false, placeholder: 'https://target.example.com' },
+ whitebox: { target: 'Source repo / path', help: "A GitHub URL, owner/repo shorthand, or a local path β cloned automatically if it's remote.", showRepo: false, placeholder: 'owner/repo' },
+ greybox: { target: 'Target URL', help: 'The running application to exploit, alongside the source repo below.', showRepo: true, placeholder: 'https://target.example.com' },
+ host: { target: 'Target host / IP', help: 'Runs Linux / Windows / Active Directory agents.', showRepo: false, placeholder: '10.0.0.10' },
+ aitest: { target: 'AI endpoint URL', help: 'A live AI agent, LLM chat, or MCP endpoint (OWASP LLM Top 10).', showRepo: false, placeholder: 'https://target.example.com/chat' },
+};
+
+const STEP_COUNT = 5;
+
+const state = {
+ theme: localStorage.getItem('ns-theme') || 'light',
+ step: 0,
+ mode: 'run',
+ categories: [],
+ selected: new Set(),
+ customLeads: [],
+ filter: 'all',
+ search: '',
+ providers: [],
+ auth: { header: '', roles: [] },
+ credsPath: '',
+ keys: [],
+ runs: [],
+ currentJob: null,
+ currentDetailId: null,
+ detailPoll: null,
+ replId: null, replEs: null,
+};
+
+// ---------------------------------------------------------------------------
+// helpers
+// ---------------------------------------------------------------------------
+
+function esc(s) {
+ return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c]));
+}
+async function api(path, opts) {
+ const res = await fetch(path, opts);
+ if (!res.ok) {
+ const body = await res.json().catch(() => ({}));
+ throw new Error(body.error || `${path} β ${res.status}`);
+ }
+ return res.headers.get('content-type')?.includes('json') ? res.json() : res.text();
+}
+function sevRank(sev) {
+ const s = (sev || '').toLowerCase();
+ if (s.includes('crit')) return 0;
+ if (s.includes('high')) return 1;
+ if (s.includes('med')) return 2;
+ if (s.includes('low')) return 3;
+ return 4;
+}
+function sevClass(sev) {
+ return ['sev-critical', 'sev-high', 'sev-medium', 'sev-low', 'sev-info'][sevRank(sev)];
+}
+function show(el, on) { if (el) el.hidden = !on; }
+function toast(msg) { console.log('[ns]', msg); }
+
+// ---------------------------------------------------------------------------
+// theme
+// ---------------------------------------------------------------------------
+
+function applyTheme() {
+ document.documentElement.setAttribute('data-theme', state.theme);
+ $('#btnThemeToggle').textContent = state.theme === 'dark' ? 'β' : 'βΎ';
+ $('#btnThemeToggle').title = state.theme === 'dark' ? 'Switch to light theme' : 'Switch to dark theme';
+}
+$('#btnThemeToggle').addEventListener('click', () => {
+ state.theme = state.theme === 'dark' ? 'light' : 'dark';
+ localStorage.setItem('ns-theme', state.theme);
+ applyTheme();
+});
+
+// ---------------------------------------------------------------------------
+// wizard β step navigation
+// ---------------------------------------------------------------------------
+
+function goToStep(n) {
+ state.step = Math.max(0, Math.min(STEP_COUNT - 1, n));
+ $$('.step-tab').forEach((tab, i) => {
+ tab.classList.toggle('active', i === state.step);
+ tab.classList.toggle('done', i < state.step);
+ });
+ $$('.wizard-panel').forEach((panel) => show(panel, Number(panel.dataset.panel) === state.step));
+ show($('#btnStepBack'), state.step > 0);
+ show($('#btnStepNext'), state.step < STEP_COUNT - 1);
+ show($('#btnLaunch'), state.step === STEP_COUNT - 1);
+ if (state.step === STEP_COUNT - 1) renderReview();
+ updateWizardSummary();
+}
+
+function validateStep(n) {
+ if (n === 0) {
+ if (!$('#fieldName').value.trim()) { alert('Name the engagement first β it identifies this run in the sidebar and history.'); $('#fieldName').focus(); return false; }
+ const target = $('#fieldTarget').value.trim();
+ if (!target) { alert(`${MODE_LABELS[state.mode].target} is required.`); return false; }
+ if (state.mode === 'greybox' && !$('#fieldRepo').value.trim()) { alert('Source repo is required for grey-box.'); return false; }
+ }
+ return true;
+}
+
+$('#btnStepNext').addEventListener('click', () => { if (validateStep(state.step)) goToStep(state.step + 1); });
+$('#btnStepBack').addEventListener('click', () => goToStep(state.step - 1));
+$$('.step-tab').forEach((tab) => tab.addEventListener('click', () => {
+ const n = Number(tab.dataset.step);
+ if (n <= state.step || validateStep(state.step)) goToStep(n);
+}));
+
+function updateWizardSummary() {
+ const name = $('#fieldName').value.trim() || '(unnamed)';
+ const target = $('#fieldTarget').value.trim() || '(not set)';
+ $('#wizardSummary').innerHTML = `Step ${state.step + 1} of ${STEP_COUNT} Β· ${esc(name)} Β· ${esc(state.mode)} Β· ${esc(target)}`;
+}
+$('#fieldName').addEventListener('input', updateWizardSummary);
+
+// mode tiles
+function selectMode(mode) {
+ state.mode = mode;
+ $$('.mode-tile').forEach((t) => t.classList.toggle('selected', t.dataset.mode === mode));
+ const cfg = MODE_LABELS[mode];
+ $('#targetLabel').textContent = cfg.target;
+ $('#targetHelp').textContent = cfg.help;
+ $('#fieldTarget').placeholder = cfg.placeholder;
+ show($('#fieldRepoGroup'), cfg.showRepo);
+ updateWizardSummary();
+}
+$$('.mode-tile').forEach((tile) => tile.addEventListener('click', () => selectMode(tile.dataset.mode)));
+$('#fieldTarget').addEventListener('input', updateWizardSummary);
+
+// ---------------------------------------------------------------------------
+// agents / lead board (step 3)
+// ---------------------------------------------------------------------------
+
+async function loadAgents() {
+ const data = await api('/api/agents');
+ state.categories = data.categories;
+ renderBoard();
+}
+
+function renderBoard() {
+ const root = $('#categories');
+ root.innerHTML = '';
+ for (const group of state.categories) {
+ const selCount = group.agents.filter((a) => state.selected.has(a.id)).length;
+ const card = document.createElement('div');
+ card.className = 'cat-card';
+ card.innerHTML = `
+
+
+ ${esc(group.category)}
+ ${selCount} / ${group.agents.length}
+ βΎ
+
+
+ `;
+ const rows = card.querySelector('.agent-rows');
+ for (const a of group.agents) {
+ const row = document.createElement('div');
+ row.className = 'agent-row';
+ row.dataset.id = a.id;
+ row.dataset.title = (a.title + ' ' + a.name).toLowerCase();
+ row.innerHTML = `
+
+ ${esc(a.title)}
+ ${a.cwe ? `${esc(a.cwe)}` : ''}
+ `;
+ rows.appendChild(row);
+ }
+ card.querySelector('.cat-head').addEventListener('click', (e) => {
+ if (e.target.closest('.switch')) return;
+ card.classList.toggle('collapsed');
+ });
+ const catToggle = card.querySelector('.cat-toggle');
+ // A partial selection (some but not all agents on) must look "partial",
+ // not "off" β an unchecked master switch reads as "category disabled"
+ // even when most of its agents are still on. Indeterminate = the middle
+ // state; clicking it from there selects everything (browser default).
+ catToggle.indeterminate = selCount > 0 && selCount < group.agents.length;
+ catToggle.addEventListener('change', (e) => {
+ const on = e.target.checked;
+ for (const a of group.agents) { if (on) state.selected.add(a.id); else state.selected.delete(a.id); }
+ renderBoard();
+ });
+ rows.querySelectorAll('.agent-toggle').forEach((input) => {
+ input.addEventListener('change', (e) => {
+ const id = e.target.dataset.id;
+ if (e.target.checked) state.selected.add(id); else state.selected.delete(id);
+ renderBoard();
+ });
+ });
+ root.appendChild(card);
+ }
+ updateChips();
+ applyFilters();
+}
+
+function allAgents() { return state.categories.flatMap((g) => g.agents); }
+
+function updateChips() {
+ const total = allAgents().length;
+ $('#chipAll').textContent = total;
+ $('#chipSelected').textContent = state.selected.size;
+ $('#chipExcluded').textContent = total - state.selected.size;
+}
+
+function applyFilters() {
+ const q = state.search.trim().toLowerCase();
+ $$('.agent-row').forEach((row) => {
+ const isSel = state.selected.has(row.dataset.id);
+ let visible = true;
+ if (state.filter === 'selected') visible = isSel;
+ if (state.filter === 'excluded') visible = !isSel;
+ if (visible && q) visible = row.dataset.title.includes(q);
+ row.classList.toggle('hidden-by-search', !visible);
+ });
+ $$('.cat-card').forEach((card) => {
+ const anyVisible = $$('.agent-row', card).some((r) => !r.classList.contains('hidden-by-search'));
+ card.style.display = anyVisible ? '' : 'none';
+ });
+}
+
+$$('.chip').forEach((chip) => chip.addEventListener('click', () => {
+ $$('.chip').forEach((c) => c.classList.remove('chip-active'));
+ chip.classList.add('chip-active');
+ state.filter = chip.dataset.filter;
+ applyFilters();
+}));
+$('#leadSearch').addEventListener('input', (e) => { state.search = e.target.value; applyFilters(); });
+
+function renderCustomLeads() {
+ const root = $('#customLeadsList');
+ root.innerHTML = state.customLeads.map((text, i) => `
+ ${esc(text)}β
+ `).join('');
+ $$('.custom-lead-chip .x', root).forEach((x) => x.addEventListener('click', () => {
+ state.customLeads.splice(Number(x.dataset.i), 1);
+ renderCustomLeads();
+ }));
+}
+$('#btnCustomLead').addEventListener('click', () => {
+ const text = prompt('Describe the custom lead (free text β becomes agent focus context):');
+ if (text && text.trim()) { state.customLeads.push(text.trim()); renderCustomLeads(); }
+});
+
+// ---------------------------------------------------------------------------
+// providers / model (step 4)
+// ---------------------------------------------------------------------------
+
+async function loadProviders() {
+ state.providers = await api('/api/providers');
+ const sel = $('#fieldProvider');
+ sel.innerHTML = state.providers.map((p) => ``).join('');
+ sel.addEventListener('change', onProviderChange);
+ onProviderChange();
+}
+function onProviderChange() {
+ const p = state.providers.find((x) => x.key === $('#fieldProvider').value) || state.providers[0];
+ const modelSel = $('#fieldModelSelect');
+ modelSel.innerHTML = (p?.models || []).map((m) => ``).join('');
+ const subBtn = $('#authModeToggle button[data-mode="subscription"]');
+ const supportsSub = p?.kind === 'cli';
+ subBtn.disabled = !supportsSub;
+ subBtn.title = supportsSub ? '' : `${p?.label} has no local CLI subscription mode β API key only.`;
+ if (!supportsSub) setAuthMode('api');
+ updateAuthModeHelp();
+}
+function setAuthMode(mode) {
+ $$('#authModeToggle button').forEach((b) => b.classList.toggle('selected', b.dataset.mode === mode));
+ state.authMode = mode;
+ updateAuthModeHelp();
+}
+function updateAuthModeHelp() {
+ const p = state.providers.find((x) => x.key === $('#fieldProvider').value);
+ $('#authModeHelp').textContent = state.authMode === 'subscription'
+ ? `Uses the locally logged-in ${p?.label || ''} CLI on this machine β no API key needed.`
+ : `Uses the API key set for ${p?.label || 'this provider'} in Auth & Keys.`;
+}
+$$('#authModeToggle button').forEach((b) => b.addEventListener('click', () => { if (!b.disabled) setAuthMode(b.dataset.mode); }));
+state.authMode = 'api';
+
+// ---------------------------------------------------------------------------
+// review (step 5)
+// ---------------------------------------------------------------------------
+
+function renderReview() {
+ const target = $('#fieldTarget').value.trim();
+ const repo = $('#fieldRepo').value.trim();
+ const provider = $('#fieldProvider').value;
+ const model = $('#fieldModelSelect').value;
+ const items = [
+ { k: 'Engagement name', v: $('#fieldName').value.trim() || '(not set)' },
+ { k: 'Mode', v: state.mode },
+ { k: MODE_LABELS[state.mode].target, v: target || '(not set)', mono: true },
+ ...(MODE_LABELS[state.mode].showRepo ? [{ k: 'Source repo', v: repo || '(not set)', mono: true }] : []),
+ { k: 'Model', v: `${provider}:${model}` },
+ { k: 'Auth mode', v: state.authMode === 'subscription' ? 'Subscription (local CLI)' : 'API key' },
+ { k: 'Leads selected', v: `${state.selected.size} of ${allAgents().length}${state.selected.size === 0 ? ' β auto (recon-driven)' : ''}` },
+ { k: 'Custom leads', v: String(state.customLeads.length) },
+ { k: 'Votes / chain / recon', v: `${$('#fieldVotes').value} / ${$('#fieldChain').value} / ${$('#fieldRecon').value}` },
+ { k: 'Target auth', v: state.auth.header ? 'header set' : (state.auth.roles.length ? `${state.auth.roles.length} role(s)` : 'none') },
+ ];
+ $('#reviewGrid').innerHTML = items.map((it) => `
+
+ `).join('');
+}
+
+// ---------------------------------------------------------------------------
+// launch
+// ---------------------------------------------------------------------------
+
+$('#btnLaunch').addEventListener('click', startExploitation);
+
+async function startExploitation() {
+ if (!validateStep(0)) { goToStep(0); return; }
+ const mode = state.mode;
+ const name = $('#fieldName').value.trim();
+ const target = $('#fieldTarget').value.trim();
+ const repo = $('#fieldRepo').value.trim();
+ const provider = $('#fieldProvider').value;
+ const model = $('#fieldModelSelect').value;
+ const focusParts = [$('#fieldFocus').value.trim(), ...state.customLeads].filter(Boolean);
+
+ const body = {
+ mode,
+ name,
+ target: mode === 'whitebox' ? undefined : target,
+ repo: mode === 'whitebox' ? target : (repo || undefined),
+ models: provider && model ? [`${provider}:${model}`] : [],
+ votes: Number($('#fieldVotes').value) || 3,
+ chainDepth: Number($('#fieldChain').value),
+ recon: Number($('#fieldRecon').value),
+ subscription: state.authMode === 'subscription',
+ mcp: $('#fieldMcp').checked,
+ agents: [...state.selected],
+ focus: focusParts.join('; ') || undefined,
+ objective: $('#fieldObjective').value.trim() || undefined,
+ outOfScope: $('#fieldOutOfScope').value.trim() || undefined,
+ auth: state.auth.header || undefined,
+ roles: state.auth.roles.length ? state.auth.roles : undefined,
+ creds: state.credsPath || undefined,
+ };
+
+ $('#btnLaunch').disabled = true;
+ $('#btnLaunch').textContent = 'Startingβ¦';
+ try {
+ const { id } = await api('/api/exploit', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+ attachLiveJob(id, body.target || body.repo, name);
+ } catch (e) {
+ alert('Failed to start: ' + e.message);
+ } finally {
+ $('#btnLaunch').disabled = false;
+ $('#btnLaunch').textContent = 'Start Exploitation β';
+ }
+}
+
+// ---------------------------------------------------------------------------
+// live run view
+// ---------------------------------------------------------------------------
+
+function bindRunTabs(scopeEl) {
+ $$('.run-tab', scopeEl).forEach((tab) => tab.addEventListener('click', () => {
+ $$('.run-tab', scopeEl).forEach((t) => t.classList.remove('active'));
+ tab.classList.add('active');
+ $$('.run-tab-panel', scopeEl).forEach((p) => show(p, p.dataset.tabpanel === tab.dataset.tab));
+ }));
+}
+bindRunTabs($('#liveView'));
+bindRunTabs($('#detailView'));
+
+function attachLiveJob(id, target, name) {
+ if (state.currentJob?.es) state.currentJob.es.close();
+ state.currentJob = { id, es: null, findings: [], target, name, phase: 'starting', agents: 0, agentsDone: 0, reportUrl: null, runId: null };
+
+ show($('#wizardView'), false);
+ show($('#detailView'), false);
+ show($('#liveView'), true);
+ $('#liveTarget').textContent = name || target || 'β';
+ $('#liveTargetSub').textContent = name ? target : '';
+ $('#livePhase').textContent = 'starting';
+ $('#phaseDot').style.background = '';
+ $('#liveFindingsTable tbody').innerHTML = '';
+ $('#liveAttackPath').innerHTML = '';
+ $('#logList').innerHTML = '';
+ $('#liveFindingsCount').textContent = '0';
+ show($('#liveFindingsEmpty'), true);
+ $('#progressFill').style.width = '0%';
+ $('#progressLabel').textContent = '0 / 0 agents';
+ show($('#btnOpenReport'), false);
+
+ const es = new EventSource(`/api/exploit/${id}/events`);
+ state.currentJob.es = es;
+ es.addEventListener('log', (e) => appendLog(JSON.parse(e.data).line));
+ es.addEventListener('finding', (e) => addFinding(JSON.parse(e.data).finding));
+ es.addEventListener('snapshot', (e) => applySnapshot(JSON.parse(e.data)));
+ es.addEventListener('done', (e) => { applySnapshot(JSON.parse(e.data)); es.close(); refreshRuns(); });
+ es.onerror = () => { /* EventSource auto-retries; the server replays its buffer on reconnect */ };
+}
+
+function appendLog(line) {
+ const div = document.createElement('div');
+ div.className = 'log-line';
+ div.textContent = line;
+ const list = $('#logList');
+ list.appendChild(div);
+ list.scrollTop = list.scrollHeight;
+}
+
+function findingRow(f) {
+ return `
+ | ${esc(f.severity)} |
+ ${esc(f.title)} |
+ ${esc(f.endpoint)} |
+ ${esc(f.cwe)} |
+ ${esc(f.agent)} |
+ ${f.confidence ? f.confidence.toFixed(2) : 'β'} |
+
`;
+}
+
+function addFinding(f) {
+ state.currentJob.findings.push(f);
+ $('#liveFindingsTable tbody').insertAdjacentHTML('beforeend', findingRow(f));
+ $('#liveFindingsCount').textContent = state.currentJob.findings.length;
+ show($('#liveFindingsEmpty'), false);
+ renderAttackPath($('#liveAttackPath'), state.currentJob.findings);
+}
+
+function applySnapshot(snap) {
+ $('#livePhase').textContent = snap.phase;
+ state.currentJob.runId = snap.runId;
+ $('#progressLabel').textContent = `${snap.agentsDone} / ${snap.agents || '?'} agents`;
+ if (snap.agents) $('#progressFill').style.width = `${Math.min(100, (snap.agentsDone / snap.agents) * 100)}%`;
+ if (snap.reportUrl && snap.runId) {
+ $('#btnOpenReport').href = `/api/runs/${snap.runId}/asset/report.html`;
+ show($('#btnOpenReport'), true);
+ }
+ if (snap.done) $('#phaseDot').classList.add('static');
+}
+
+$('#btnStopRun').addEventListener('click', async () => {
+ if (!state.currentJob) return;
+ await api(`/api/exploit/${state.currentJob.id}/stop`, { method: 'POST' });
+});
+$('#btnBackToBoard').addEventListener('click', () => { show($('#liveView'), false); show($('#wizardView'), true); });
+$('#btnDetailBack').addEventListener('click', () => { clearInterval(state.detailPoll); show($('#detailView'), false); show($('#wizardView'), true); });
+$('#btnNewEngagement').addEventListener('click', () => { clearInterval(state.detailPoll); show($('#detailView'), false); show($('#liveView'), false); show($('#wizardView'), true); });
+
+// ---------------------------------------------------------------------------
+// Generative Attack Path Chaining
+// ---------------------------------------------------------------------------
+
+const KILL_CHAIN_STAGES = ['recon', 'initial-access', 'execution', 'privesc', 'lateral', 'exfil', 'impact'];
+
+function renderAttackPath(container, findings) {
+ if (!findings.length) {
+ container.innerHTML = 'The attack path builds automatically as findings chain together β nothing confirmed yet.
';
+ return;
+ }
+ const byId = new Map(findings.map((f) => [f.id, f]));
+ const hasStages = findings.some((f) => f.stage);
+ let groups;
+ if (hasStages) {
+ groups = KILL_CHAIN_STAGES
+ .map((stage) => ({ label: stage.replace('-', ' '), items: findings.filter((f) => (f.stage || '') === stage) }))
+ .filter((g) => g.items.length);
+ const other = findings.filter((f) => !f.stage);
+ if (other.length) groups.push({ label: 'unstaged', items: other });
+ } else {
+ const order = ['critical', 'high', 'medium', 'low', 'info'];
+ groups = order
+ .map((sev) => ({ label: sev, items: findings.filter((f) => (f.severity || '').toLowerCase().includes(sev)) }))
+ .filter((g) => g.items.length);
+ }
+ container.innerHTML = `
+ ${!hasStages ? 'No kill-chain stage data yet β grouped by severity.
' : ''}
+
+ ${groups.map((g, i) => `
+ ${i > 0 ? '
β
' : ''}
+
+
${esc(g.label)} (${g.items.length})
+ ${g.items.map((f) => `
+
+
${esc(f.title)}
+
${esc(f.mitre || f.owasp || f.cwe || '')}
+ ${(f.chains_from || []).length ? `
β€· chains from ${(f.chains_from).map((cid) => esc(byId.get(cid)?.title || cid)).join(', ')}
` : ''}
+
+ `).join('')}
+
+ `).join('')}
+
βΎ${g.label}${g.items.length}
`;
+ wrap.querySelector('.sb-group-head').addEventListener('click', () => wrap.classList.toggle('collapsed'));
+ const items = wrap.querySelector('.sb-items');
+ for (const r of g.items) {
+ const btn = document.createElement('button');
+ btn.className = 'sb-run' + (state.currentDetailId === r.id ? ' active' : '');
+ btn.innerHTML = `${esc(r.name || r.target)}${r.name ? esc(r.target) + ' Β· ' : ''}${r.findings} finding(s)`;
+ btn.addEventListener('click', () => openRun(r));
+ items.appendChild(btn);
+ const isThisJob = r.state === 'running' && state.currentJob && r.id === state.currentJob.runId;
+ if (isThisJob) {
+ const steps = document.createElement('div');
+ steps.className = 'sb-steps';
+ steps.innerHTML = ['recon', 'planning', 'exploiting', 'remediation'].map((s) =>
+ `${s[0].toUpperCase() + s.slice(1)}
`).join('');
+ items.appendChild(steps);
+ }
+ }
+ root.appendChild(wrap);
+ }
+}
+
+function openRun(run) {
+ state.currentDetailId = run.id;
+ if (run.state === 'running' && state.currentJob && run.id === state.currentJob.runId) {
+ show($('#wizardView'), false); show($('#detailView'), false); show($('#liveView'), true);
+ renderSidebar();
+ return;
+ }
+ show($('#wizardView'), false); show($('#liveView'), false); show($('#detailView'), true);
+ loadDetail(run.id);
+ renderSidebar();
+}
+
+async function loadDetail(id) {
+ clearInterval(state.detailPoll);
+ const detail = await api(`/api/runs/${encodeURIComponent(id)}`);
+ const target = detail.status?.target || detail.meta?.target || id;
+ $('#detailTarget').textContent = detail.name || target;
+ $('#detailTargetSub').textContent = detail.name ? target : '';
+ $('#detailState').textContent = detail.status?.state || 'unknown';
+ $('#detailFindingsCount').textContent = detail.findings.length;
+ const tbody = $('#detailFindingsTable tbody');
+ tbody.innerHTML = detail.findings.map(findingRow).join('');
+ show($('#detailFindingsEmpty'), detail.findings.length === 0);
+ renderAttackPath($('#detailAttackPath'), detail.findings);
+ const reportLink = $('#detailOpenReport');
+ if (detail.assets.includes('report.html')) {
+ reportLink.href = `/api/runs/${encodeURIComponent(id)}/asset/report.html`;
+ show(reportLink, true);
+ } else show(reportLink, false);
+ if (detail.status?.state === 'running') state.detailPoll = setInterval(() => loadDetail(id), 4000);
+}
+
+// ---------------------------------------------------------------------------
+// Auth & Keys modal
+// ---------------------------------------------------------------------------
+
+function openAuthModal() {
+ show($('#authModal'), true);
+ renderRoleList();
+ $('#credsPath').value = state.credsPath;
+ refreshKeyStatus();
+}
+['#btnOpenAuth', '#btnOpenAuth2', '#btnOpenAuth3'].forEach((sel) => $(sel)?.addEventListener('click', openAuthModal));
+$('#btnCloseAuth').addEventListener('click', () => show($('#authModal'), false));
+$('#authModal').addEventListener('click', (e) => { if (e.target.id === 'authModal') show($('#authModal'), false); });
+
+$$('.modal-tab').forEach((tab) => tab.addEventListener('click', () => {
+ $$('.modal-tab').forEach((t) => t.classList.remove('active'));
+ tab.classList.add('active');
+ $$('.modal-panel').forEach((p) => show(p, p.dataset.mpanel === tab.dataset.mtab));
+}));
+
+$('#authHeader').addEventListener('input', (e) => { state.auth.header = e.target.value.trim(); });
+$('#authHeader').value = state.auth.header;
+$('#credsPath').addEventListener('input', (e) => { state.credsPath = e.target.value.trim(); });
+
+function renderRoleList() {
+ const root = $('#roleList');
+ root.innerHTML = state.auth.roles.map((r, i) => `
+
+
+
+
+
+ `).join('');
+ $$('input[data-f]', root).forEach((inp) => inp.addEventListener('input', (e) => {
+ state.auth.roles[Number(e.target.dataset.i)][e.target.dataset.f] = e.target.value;
+ }));
+ $$('[data-remove]', root).forEach((btn) => btn.addEventListener('click', () => {
+ state.auth.roles.splice(Number(btn.dataset.i), 1);
+ renderRoleList();
+ }));
+}
+$('#btnAddRole').addEventListener('click', () => { state.auth.roles.push({ name: '', header: '' }); renderRoleList(); });
+
+async function refreshKeyStatus() {
+ try { state.keys = await api('/api/keys'); } catch { state.keys = []; }
+ const root = $('#providerKeyList');
+ root.innerHTML = state.providers.map((p) => {
+ const set = state.keys.find((k) => k.provider === p.key)?.set;
+ return `
+
+
+ ${esc(p.label)}
+ ${p.kind === 'cli' ? 'cli+api' : 'api only'}
+
+
+
+ `;
+ }).join('');
+ $$('[data-save]', root).forEach((btn) => btn.addEventListener('click', async () => {
+ const provider = btn.dataset.save;
+ const input = root.querySelector(`input[data-provider="${provider}"]`);
+ const key = input.value.trim();
+ if (!key) return;
+ await api('/api/keys', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ provider, key }) });
+ input.value = '';
+ refreshKeyStatus();
+ }));
+}
+
+// ---------------------------------------------------------------------------
+// REPL drawer β real CLI harness session
+// ---------------------------------------------------------------------------
+
+function openReplDrawer() { show($('#replDrawer'), true); if (!state.replId) startRepl(); }
+
+async function startRepl() {
+ $('#replOutput').textContent = '';
+ const { id } = await api('/api/repl', { method: 'POST' });
+ state.replId = id;
+ const es = new EventSource(`/api/repl/${id}/events`);
+ state.replEs = es;
+ es.addEventListener('data', (e) => {
+ const { chunk } = JSON.parse(e.data);
+ const out = $('#replOutput');
+ out.appendChild(document.createTextNode(chunk));
+ out.scrollTop = out.scrollHeight;
+ });
+ es.addEventListener('close', () => es.close());
+}
+
+$('#fabRepl').addEventListener('click', openReplDrawer);
+$('#btnOpenRepl').addEventListener('click', openReplDrawer);
+$('#btnReplClose').addEventListener('click', () => show($('#replDrawer'), false));
+$('#btnReplRestart').addEventListener('click', async () => {
+ if (state.replId) await api(`/api/repl/${state.replId}/stop`, { method: 'POST' }).catch(() => {});
+ state.replEs?.close();
+ state.replId = null;
+ startRepl();
+});
+$('#replInput').addEventListener('keydown', async (e) => {
+ if (e.key !== 'Enter') return;
+ const line = e.target.value;
+ e.target.value = '';
+ const out = $('#replOutput');
+ const echo = document.createElement('span');
+ echo.className = 'repl-echo';
+ echo.textContent = `β ${line}\n`;
+ out.appendChild(echo);
+ out.scrollTop = out.scrollHeight;
+ if (!state.replId) await startRepl();
+ await api(`/api/repl/${state.replId}/input`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ line }) });
+});
+
+// ---------------------------------------------------------------------------
+// boot
+// ---------------------------------------------------------------------------
+
+async function boot() {
+ applyTheme();
+ selectMode('run');
+ goToStep(0);
+ renderCustomLeads();
+ const meta = await api('/api/meta').catch(() => ({}));
+ $('#sbVersion').textContent = `v${meta.version || '4.0.0'}`;
+ await Promise.all([loadAgents(), loadProviders()]);
+ await refreshRuns();
+ setInterval(refreshRuns, 6000);
+}
+boot();
diff --git a/web/public/index.html b/web/public/index.html
new file mode 100644
index 0000000..de78500
--- /dev/null
+++ b/web/public/index.html
@@ -0,0 +1,317 @@
+
+
+
+
+
+NeuroSploit v4.0.0 β Console
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Identifies this engagement in the sidebar and run history β required.
+
+
+
What are you testing?
+
Pick the engagement type β this decides which CLI subcommand runs underneath.
+
+
+
+
+
+
+
+
+
+
+
+
+
The application, host, or endpoint to test.
+
+
+
+
+
Cloned automatically if it's a GitHub URL or owner/repo shorthand.
+
+
+
+
+
+
+
Objective & focus
+
Steers what the agents prioritise and what counts as impact.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Authentication
+
Test as a logged-in user. Configured in the menu.
+
+
+
+
+
+
+
Set the action plan
+
Toggle specific leads to test, or leave everything off to let recon-driven auto-selection choose.
+
+
+
+
+
+
+
+
+
+
Model
+
Pick a provider and model from the harness's live catalog.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Uses the API key set in Auth & Keys for this provider.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Review
+
Confirm before launching β this spawns the real CLI harness.
+
+
+
+
+
+
| Severity | Title | Endpoint | CWE | Agent | Conf. |
|---|
No validated findings yet.
+
+
+
+
| Severity | Title | Endpoint | CWE | Agent | Conf. |
|---|
No validated findings.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Used so agents test as a logged-in user. Kept only for this session, sent to the CLI as an ephemeral creds file.
+
+
+
+
+
+
Two or more roles enable IDOR/BOLA/BFLA cross-role testing.
+
+
+
+
Keys are kept in this server process's memory only β never written to disk. Cleared on restart.
+
+
+
+
+
+
+
An explicit file on disk β see neurosploit-rs/creds.example.yaml for the schema (jwt/header/cookie/login/roles/ssh/windows/cloud).
+
+
+
+
+
+
+
NeuroSploit CLI harness β REPL
+
+
+
+
+
+
+
+ β
+
+
+