release: v4.3.1

Subscription/model and web-console fixes plus GLM and API-collection support
since 4.3.0:
- force subscription CLI login (strip stray ANTHROPIC/OPENAI keys); add
  claude-opus-4-6
- scope: don't treat an endpoint's HTTP method as its host (findings no longer
  wrongly quarantined; no bogus graph HOST nodes)
- web: resolve run-id to live job, collapse the pinned-leads header, parse live
  findings/agent progress from decorated REPL output
- GLM 5.1/5.2/5.3 via API and via the Claude Code CLI (Z.ai devpack)
- import a Postman/OpenAPI/HAR collection as test surface (CLI/REPL/web)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/public/index.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>NeuroSploit v4.3.0 — Console</title>
+<title>NeuroSploit v4.3.1 — Console</title>
 <link rel="icon" type="image/svg+xml" href="logo.svg">
 <link rel="stylesheet" href="/vendor/xterm.css" />
 <link rel="stylesheet" href="/style.css" />
@@ -46,7 +46,7 @@
     <div class="sb-groups" id="sbGroups"><!-- populated by app.js --></div>
 
     <div class="sb-bottom">
-      <span class="sb-version" id="sbVersion">v4.3.0</span>
+      <span class="sb-version" id="sbVersion">v4.3.1</span>
       <div class="sb-bottom-actions">
         <button class="icon-btn" id="btnOpenAuth" title="Auth &amp; API keys">🔑</button>
         <button class="icon-btn" id="btnOpenRepl" title="Open terminal (Ctrl+`)">❭_</button>

web/server.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 'use strict';
 /**
- * NeuroSploit v4.3.0 — web console backend.
+ * NeuroSploit v4.3.1 — web console backend.
  *
  * Zero-dependency Node HTTP server that:
  *  - serves the static SPA in ./public
@@ -1890,7 +1890,7 @@ const server = http.createServer(async (req, res) => {
     }
 
     if (req.method === 'GET' && p === '/api/meta') {
-      return sendJson(res, 200, { version: "4.3.0", binary: BIN, root: ROOT });
+      return sendJson(res, 200, { version: "4.3.1", binary: BIN, root: ROOT });
     }
 
     // ---- providers / API keys (in-memory only, never persisted) ----
@@ -1936,7 +1936,7 @@ const server = http.createServer(async (req, res) => {
 loadPersistedJobs();
 
 server.listen(PORT, () => {
-  console.log(`NeuroSploit v4.3.0 web console → http://localhost:${PORT}`);
+  console.log(`NeuroSploit v4.3.1 web console → http://localhost:${PORT}`);
   console.log(`  binary : ${BIN || '(not found — build neurosploit-rs first)'}`);
   console.log(`  agents : ${AGENTS_DIR}`);
   console.log(`  runs   : ${RUNS_DIR}`);