feat(models,pocs): Grok 4.7 support; save every exploit/Frida script to the run's pocs/

Models: xai:grok-4.7 added as the preferred xAI model (API via XAI_API_KEY at
api.x.ai/v1, and subscription via the local `grok` CLI) and to the OpenCode Zen
list. `--model xai:grok-4.7` or `--subscription --model xai:grok-4.7`.

PoC persistence hardened so exploitation artifacts are retrievable after a run:
the POCS doctrine now explicitly requires saving repro scripts, Frida hook
scripts (<slug>.frida.js), custom exploit code/source, compiled PoCs, request
collections and adapted public PoCs into the run's pocs/ folder with a run
command in the header — and the mobile mode now carries that directive too, so
Frida bypass/hook scripts written during APK/IPA analysis are kept and re-runnable.

383 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

neurosploit-rs/crates/harness/src/models.rs

@@ -27,7 +27,7 @@ pub fn providers() -> Vec<Provider> {
         Provider { key: "openai", label: "OpenAI (ChatGPT)", base_url: "https://api.openai.com/v1", env_key: "OPENAI_API_KEY", kind: "cli",
             models: vec!["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna", "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex", "gpt-5.2", "gpt-5.1", "gpt-5.1-codex", "o4"] },
         Provider { key: "xai", label: "xAI Grok", base_url: "https://api.x.ai/v1", env_key: "XAI_API_KEY", kind: "cli",
-            models: vec!["grok-4.5", "grok-4", "grok-4-fast"] },
+            models: vec!["grok-4.7", "grok-4.5", "grok-4", "grok-4-fast"] },
         Provider { key: "gemini", label: "Google Gemini", base_url: "https://generativelanguage.googleapis.com/v1beta/openai", env_key: "GEMINI_API_KEY", kind: "cli",
             models: vec!["gemini-3-pro", "gemini-2.5-pro", "gemini-2.5-flash"] },
         Provider { key: "nvidia_nim", label: "NVIDIA NIM", base_url: "https://integrate.api.nvidia.com/v1", env_key: "NVIDIA_NIM_API_KEY", kind: "api",
@@ -59,7 +59,7 @@ pub fn providers() -> Vec<Provider> {
         // `opencode` agentic CLI on the user's own Zen/plan login — no key
         // needed in that mode. `kind: "cli"` reflects the latter.
         Provider { key: "opencode", label: "OpenCode Zen", base_url: "https://opencode.ai/zen/v1", env_key: "OPENCODE_API_KEY", kind: "cli",
-            models: vec!["claude-opus-5", "claude-sonnet-5", "gpt-5.6-sol", "gpt-5.5", "gemini-3-pro", "grok-4.5", "deepseek-v4-pro", "qwen3.7-max", "kimi-k3"] },
+            models: vec!["claude-opus-5", "claude-sonnet-5", "gpt-5.6-sol", "gpt-5.5", "gemini-3-pro", "grok-4.7", "grok-4.5", "deepseek-v4-pro", "qwen3.7-max", "kimi-k3"] },
         // Nous Research — Hermes models via the Nous Portal. As an API-key
         // provider here (OpenAI-compatible `inference-api.nousresearch.com`),
         // or (with --subscription) driven through the `hermes` CLI

neurosploit-rs/crates/harness/src/pipeline.rs

@@ -400,7 +400,7 @@ fn pocs_line() -> String {
              and the observable proof (response snippet, status code, timing, etc.). Header comment: what it \
              proves, how to run it. Actually RUN it once to confirm it works before citing it. Put the exact file \
              name (e.g. `pocs/idor_order_id.py`) in the finding's `evidence` field so the report and UI can link \
-             it — a finding without a cited PoC path looks unproven.\n         "),
+             it — a finding without a cited PoC path looks unproven. SAVE EVERY exploitation artifact you write              into {d}/ so it can be retrieved after the run: repro scripts, Frida hook scripts (`{d}/<slug>.frida.js`),              custom exploit code (any language), the compiled binary or its source, request collections, and any              downloaded-and-adapted public PoC. Keep the exact command to run each in its header comment.\n         "),
         None => String::new(),
     }
 }
@@ -3244,7 +3244,8 @@ fn collect_repo_context(root: &Path, max_files: usize, max_bytes: usize) -> Stri
 
 const MOBILE_RECON_SYS: &str = "You are a mobile/binary reverse-engineering recon specialist on an AUTHORIZED assessment of a LOCAL artifact (a binary, APK or IPA on disk). Identify format/arch, package metadata, entry points, protection layers (RASP/anti-tamper, root/JB and anti-debug detection, TLS pinning, obfuscation/packing), the attack surface (exported components, URL schemes, entitlements, linked frameworks) and hardcoded secrets/endpoints. Run everything HEADLESS (MobSF REST/Docker, Ghidra analyzeHeadless, apktool, jadx, otool/nm, r2). Do not ask permission; proceed. Reply with a compact JSON object (format, arch, package, protections, surface, secrets). No prose.";
 
-const MOBILE_TOOLING: &str = "TOOLING (all HEADLESS; provision on demand, time-box installs): APK/IPA static -> MobSF via its REST API (Docker image), `apktool`, `jadx`, `apkleaks`; binaries -> Ghidra `analyzeHeadless`, `radare2`/`rizin`, `binwalk`, `checksec`, `nm`/`otool`/`objdump`, `class-dump`; dynamic -> `frida`/`objection` for detection/pinning/anti-debug bypass; secrets -> `trufflehog`/`gitleaks`. Never require a GUI or an X display. Analyse and instrument non-destructively; never exfiltrate real user data.\n\n";
+const MOBILE_TOOLING: &str = "TOOLING (all HEADLESS; provision on demand, time-box installs): APK/IPA static -> MobSF via its REST API (Docker image), `apktool`, `jadx`, `apkleaks`; binaries -> Ghidra `analyzeHeadless`, `radare2`/`rizin`, `binwalk`, `checksec`, `nm`/`otool`/`objdump`, `class-dump`; dynamic -> `frida`/`objection` for detection/pinning/anti-debug bypass; secrets -> `trufflehog`/`gitleaks`. Never require a GUI or an X display. Analyse and instrument non-destructively; never exfiltrate real user data.\n\
+         SAVE ARTIFACTS: write every Frida hook script, bypass script, patched-binary diff, decompiled-snippet PoC and          exploit you produce into $NEUROSPLOIT_POCS (e.g. `<slug>.frida.js`, `<slug>_bypass.js`, `<slug>.py`) with a          header comment saying what it proves and how to run it, and cite the path in the finding's `evidence`, so the          scripts can be retrieved and re-run after the engagement.\n\n";
 
 /// Mobile / binary engagement: analyse a LOCAL artifact (binary, APK or IPA) and
 /// run the mobile RE agents. Mirrors the host pipeline but the target is a file