diff --git a/README.md b/README.md
index 4bdf6c5..8f4614e 100755
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-π§ NeuroSploit v3.6.9
+π§ NeuroSploit v4.0.0
@@ -12,7 +12,7 @@
- 
+ 
@@ -214,6 +214,21 @@ No login? Use an **API key** instead β see [Authentication](#authentication--r
---
+## π₯οΈ Web console (NEW in v4.0.0)
+
+A browser UI for the same harness: a categorized lead board (toggle agents by category, add
+custom leads, `Start Exploitation`), a live structured findings view, run history, and a real
+REPL β all driven by spawning the compiled CLI, never a reimplementation of it.
+
+```bash
+cd neurosploit-rs && cargo build --release # once
+node web/server.js # β http://localhost:4173
+```
+
+Zero npm dependencies. Full API reference: **[web/API.md](web/API.md)**.
+
+---
+
## π Integrations (GitHub Β· GitLab Β· Jira)
Wire NeuroSploit into your SDLC. Toggle from the REPL (`/integrations`) or the CLI
diff --git a/TUTORIAL.md b/TUTORIAL.md
index 37dad79..7a33356 100644
--- a/TUTORIAL.md
+++ b/TUTORIAL.md
@@ -1,4 +1,4 @@
-# NeuroSploit β Tutorial & User Guide (v3.6.9)
+# NeuroSploit β Tutorial & User Guide (v4.0.0)
A complete, hands-on guide to installing, configuring and running NeuroSploit β
the autonomous, multi-model penetration-testing harness.
@@ -98,7 +98,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
### Verify
```bash
-neurosploit --version # neurosploit 3.6.9
+neurosploit --version # neurosploit 4.0.0
neurosploit agents # {"vulns":241,...,"ai":30,...,"total":430}
neurosploit models # all providers & models
```
diff --git a/neurosploit-rs/Cargo.lock b/neurosploit-rs/Cargo.lock
index 0a25272..cd42bf8 100644
--- a/neurosploit-rs/Cargo.lock
+++ b/neurosploit-rs/Cargo.lock
@@ -871,7 +871,7 @@ dependencies = [
[[package]]
name = "neurosploit"
-version = "3.6.9"
+version = "4.0.0"
dependencies = [
"anyhow",
"clap",
@@ -888,7 +888,7 @@ dependencies = [
[[package]]
name = "neurosploit-harness"
-version = "3.6.9"
+version = "4.0.0"
dependencies = [
"anyhow",
"futures",
diff --git a/neurosploit-rs/Cargo.toml b/neurosploit-rs/Cargo.toml
index 0005c05..103c30f 100644
--- a/neurosploit-rs/Cargo.toml
+++ b/neurosploit-rs/Cargo.toml
@@ -3,7 +3,7 @@ members = ["crates/harness", "app"]
resolver = "2"
[workspace.package]
-version = "3.6.9"
+version = "4.0.0"
edition = "2021"
license = "MIT"
repository = "https://github.com/JoasASantos/NeuroSploit"
diff --git a/neurosploit-rs/app/src/main.rs b/neurosploit-rs/app/src/main.rs
index fe3a493..5c236b6 100644
--- a/neurosploit-rs/app/src/main.rs
+++ b/neurosploit-rs/app/src/main.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
+//! NeuroSploit v4.0.0 β interactive harness + CLI (`run` / `whitebox` / `agents` / `models`).
mod repl;
mod tui;
@@ -11,8 +11,8 @@ use std::path::{Path, PathBuf};
#[command(
name = "neurosploit",
version,
- about = "NeuroSploit v3.6.9 β multi-model autonomous pentest harness",
- long_about = "NeuroSploit v3.6.9 β a Rust multi-model harness that drives a pool of LLMs \
+ about = "NeuroSploit v4.0.0 β multi-model autonomous pentest harness",
+ long_about = "NeuroSploit v4.0.0 β a Rust multi-model harness that drives a pool of LLMs \
(API key or local subscription: Claude/Codex/Gemini/Grok/OpenCode/Hermes) to autonomously test a target. \
After recon it INTELLIGENTLY selects only the agents matching the discovered surface, runs \
them in parallel, then validates every finding by cross-model voting before reporting.\n\n\
@@ -765,7 +765,7 @@ pub(crate) fn spawn_engagement(base: &Path, mut cfg: RunConfig, mcp: bool, mode:
println!(" β ua : {ua}");
write_status(&workdir, "running", &format!("\"target\":{:?}", cfg.target));
- println!(" ββ NeuroSploit v3.6.9 Β· by Joas A Santos & Red Team Leaders");
+ println!(" ββ NeuroSploit v4.0.0 Β· by Joas A Santos & Red Team Leaders");
println!(" β run id : {run_id}");
println!(" β target : {}", cfg.target);
println!(" β models : {}", cfg.models.join(", "));
diff --git a/neurosploit-rs/app/src/repl.rs b/neurosploit-rs/app/src/repl.rs
index 1b1272e..7826b6f 100644
--- a/neurosploit-rs/app/src/repl.rs
+++ b/neurosploit-rs/app/src/repl.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β interactive session (Claude-Code / Codex / Cursor-CLI style).
+//! NeuroSploit v4.0.0 β interactive session (Claude-Code / Codex / Cursor-CLI style).
//!
//! Launched when `neurosploit` runs with no subcommand. A persistent REPL with
//! real line editing (arrow-key history recall, Ctrl-A/E/K, paste), model
@@ -371,7 +371,7 @@ pub async fn repl(base: &Path) -> anyhow::Result<()> {
let backends = harness::installed_cli_backends();
println!("\x1b[1m");
println!(" ββββ ββββββββββββββ ββββββββββ βββββββ");
- println!(" βββββ ββββββββββββββ ββββββββββββββββββββ NeuroSploit v3.6.9");
+ println!(" βββββ ββββββββββββββ ββββββββββββββββββββ NeuroSploit v4.0.0");
println!(" ββββββ βββββββββ βββ ββββββββββββββ βββ interactive harness");
println!(" ββββββββββββββββ βββ ββββββββββββββ βββ by Joas A Santos");
println!(" βββ ββββββββββββββββββββββββββ ββββββββββββ & Red Team Leaders");
diff --git a/neurosploit-rs/app/src/tui.rs b/neurosploit-rs/app/src/tui.rs
index 68fe71d..167e28c 100644
--- a/neurosploit-rs/app/src/tui.rs
+++ b/neurosploit-rs/app/src/tui.rs
@@ -1,4 +1,4 @@
-//! NeuroSploit v3.6.9 β TUI "Mission Control" mode.
+//! NeuroSploit v4.0.0 β TUI "Mission Control" mode.
//!
//! Concurrent panels that update live while the engagement runs in the
//! background, with a composer input that stays active during execution:
diff --git a/web/API.md b/web/API.md
new file mode 100644
index 0000000..d008bf9
--- /dev/null
+++ b/web/API.md
@@ -0,0 +1,231 @@
+# NeuroSploit Web Console β API reference
+
+Backend: `web/server.js` (Node, zero external dependencies). It does three things:
+
+1. Serves the SPA in `web/public/`.
+2. Reads `agents_md/` and `runs/` from the repo root to build the lead board and run history.
+3. Shells out to the compiled `neurosploit` CLI binary (`neurosploit-rs/target/release/neurosploit`)
+ for every exploitation run and for the REPL β the web UI never reimplements harness logic,
+ it only drives the real CLI and parses its stdout.
+
+Base URL: `http://localhost:4173` (override with `PORT` or `NEUROSPLOIT_WEB_PORT`).
+
+All responses are JSON unless noted. All endpoints are same-origin; there is no auth layer β
+run this only on a trusted machine/network, same trust model as the CLI itself.
+
+---
+
+## Meta
+
+### `GET /api/meta`
+
+Server/version info.
+
+```json
+{ "version": "4.0.0", "binary": "/opt/neurosploit-rs/neurosploit-rs/target/release/neurosploit", "root": "/opt/neurosploit-rs" }
+```
+
+---
+
+## Agents / lead board
+
+### `GET /api/agents`
+
+Reads every `agents_md/{vulns,ai,infra,code,chains,recon,meta}/*.md`, extracts `name` (filename
+stem), `title` (first `# heading`), `cwe` (first `CWE-\d+` match), `kind` (source directory), and
+classifies each into a UI category (`category`) via a keyword taxonomy (Business Logic, Broken
+Access Control, Injection, Cross-Site Scripting, LLM Application, Auth & Session, SSRF & Network,
+API & GraphQL, Cloud & Infra, Client-Side, Cryptography, Rate Limiting & DoS, Cache & CDN,
+Recon & Fingerprint, Linux Host, Windows Host, Attack Chains, Code Review, Recon, Other).
+`meta/` (orchestration/doctrine agents) is loaded but excluded from `categories` β those aren't
+selectable "leads". Cached in-memory for 5s.
+
+```json
+{
+ "total": 435,
+ "agents": [ { "id": "sqli_error", "name": "sqli_error", "title": "SQL Injection (Error-Based) Specialist Agent", "cwe": "CWE-89", "kind": "vuln", "category": "Injection" } ],
+ "categories": [ { "category": "Business Logic", "agents": [ /* Agent[] */ ] } ]
+}
+```
+
+An agent's `id`/`name` is exactly what the CLI's `--only ` flag expects (see `neurosploit agents`).
+
+---
+
+## Runs (history)
+
+### `GET /api/runs`
+
+Lists `runs/ns-*` directories, newest first, with a summary read from each run's
+`meta.json` / `status.json` / `findings.json`.
+
+```json
+[ { "id": "ns-1787504238-testphp_vulnweb_com", "ts": 1787504238, "target": "http://testphp.vulnweb.com/", "state": "running", "findings": 3, "severities": { "High": 1, "Medium": 2 }, "hasReport": false } ]
+```
+
+`state` mirrors the CLI's `status.json`: `running` | `complete` | `stopped-raw` | `discarded` | `unknown`.
+
+### `GET /api/runs/:id`
+
+Full detail for one run: `{ id, meta, status, findings, assets }`. `findings` is the raw
+`findings.json` array (see [Finding shape](#finding-shape) below). `assets` lists which generated
+files exist (`report.html`, `report.pdf`, `report.md`, `recon.md`, `exploitation.md`).
+
+### `GET /api/runs/:id/asset/:path`
+
+Serves a file from that run's workdir (e.g. `report.html`, `report.pdf`, `evidence/foo.png`).
+Path-traversal-guarded (resolved path must stay under the run dir). Use this to embed/open the
+generated report from the browser.
+
+---
+
+## Exploitation jobs (live runs)
+
+Starting a job spawns `neurosploit [flags...] --verbose` as a child process and
+parses its stdout/stderr line-by-line into structured events β the same signal the interactive
+REPL's status line uses (phase, agent counts, findings, report path).
+
+### `POST /api/exploit`
+
+Body:
+
+```jsonc
+{
+ "mode": "run", // run | whitebox | greybox | host | aitest | skills
+ "target": "https://example.com", // required for run/host/aitest/greybox
+ "repo": "owner/repo", // required for whitebox; source repo for greybox
+ "models": ["anthropic:claude-opus-4-8"], // optional, repeatable in the CLI
+ "votes": 3, // --vote-n
+ "chainDepth": 2, // --chain-depth
+ "recon": 3, // --recon (1-4)
+ "maxAgents": 0, // --max-agents (0 = all)
+ "subscription": false, // --subscription
+ "offline": false, // --offline
+ "mcp": false, // --mcp
+ "creds": "creds.yaml", // --creds
+ "focus": "injection and business logic", // --focus
+ "objective": "pre-launch review of checkout", // --objective
+ "outOfScope": "staging.example.com", // --out-of-scope
+ "agents": ["sqli_error", "idor"] // --only , repeated β the lead-board selection
+}
+```
+
+Response: `{ "id": "" }`. This `id` is the **web job id**, not the run id β the CLI's own
+`ns--` run id is discovered from its own log line and exposed as `runId` in the
+job snapshot once the engagement starts writing to `runs/`.
+
+If `agents` is empty, no `--only` flag is passed and the harness falls back to its normal
+recon-driven agent selection (the intelligent default) β the lead board's "0 selected" state is a
+valid, meaningful choice, not an error.
+
+### `GET /api/exploit`
+
+List all jobs known to this server process (in-memory; lost on restart) as snapshots (see below).
+
+### `GET /api/exploit/:id`
+
+One job's current snapshot:
+
+```json
+{
+ "id": "d98f51ad-...", "target": "http://testphp.vulnweb.com/",
+ "runId": "ns-1787504238-testphp_vulnweb_com",
+ "phase": "exploiting", "findings": [ /* Finding[] */ ],
+ "agents": 245, "agentsDone": 12, "done": false, "exitCode": null,
+ "reportUrl": null, "startedAt": 1787504238594
+}
+```
+
+`phase` tracks the same lifecycle the REPL's `/status` shows: `starting β recon β planning β
+exploiting β validating β chaining β complete`, or `paused (quota)` / `paused (auth)` if the
+harness parks the run (token/quota exhaustion or auth failure β findings are preserved either way).
+
+### `POST /api/exploit/:id/stop`
+
+Sends `SIGINT` to the child process β identical to pressing Ctrl-C in the terminal. The harness's
+own graceful-stop logic decides whether to keep partial findings.
+
+### `GET /api/exploit/:id/events` (Server-Sent Events)
+
+Live stream. On connect, replays every buffered event so a reconnecting client doesn't miss
+history, then streams new ones. Named SSE events:
+
+| event | data | meaning |
+|------------|---------------------------------------|---------|
+| `log` | `{ "type": "log", "line": "..." }` | one stdout/stderr line (ANSI stripped) |
+| `finding` | `{ "type": "finding", "finding": {β¦} }` | a `finding_json:` line, parsed |
+| `snapshot` | job snapshot (see above) | phase/progress update |
+| `done` | job snapshot with `done: true` | process exited; stream closes |
+
+Client example:
+
+```js
+const es = new EventSource(`/api/exploit/${id}/events`);
+es.addEventListener('finding', (e) => console.log(JSON.parse(e.data).finding));
+es.addEventListener('done', () => es.close());
+```
+
+---
+
+## REPL sessions
+
+Spawns the CLI with **no subcommand** β the same interactive session `neurosploit` launches from
+a terminal β and pipes stdin/stdout. Because stdin isn't a TTY, the CLI's `Reader::Plain` path
+takes over: it prints each prompt to stdout then reads one line at a time from stdin, so it works
+perfectly over a plain pipe. This is a real harness process; every `/command` (`/run`, `/status`,
+`/stop`, `/model`, `/target`, natural-language input, etc.) behaves exactly as it would in a
+terminal.
+
+### `POST /api/repl`
+
+Starts a session. Response: `{ "id": "" }`.
+
+### `POST /api/repl/:id/input`
+
+Body: `{ "line": "/status" }`. Writes `line + "\n"` to the child's stdin.
+
+### `POST /api/repl/:id/stop`
+
+Sends `SIGTERM` to the session's child process.
+
+### `GET /api/repl/:id/events` (SSE)
+
+| event | data | meaning |
+|---------|-------------------------|---------|
+| `data` | `{ "chunk": "..." }` | raw stdout/stderr chunk (ANSI stripped), not line-buffered |
+| `close` | `{}` | child process exited |
+
+Replays the session's buffered output (capped at the last 5000 chunks) on connect, same as the
+exploit stream.
+
+---
+
+## Finding shape
+
+Findings are exactly the harness's `harness::types::Finding` struct (see
+`neurosploit-rs/crates/harness/src/types.rs`), serialized as JSON β the web UI does not transform
+or rename any field:
+
+```ts
+{
+ id: string, agent: string, title: string, severity: string, cwe: string, cvss: string,
+ endpoint: string, payload: string, evidence: string, impact: string, remediation: string,
+ confidence: number, validated: boolean, votes: string,
+ owasp: string, mitre: string, stage: string, exploitability: string, business_impact: string,
+ chains_from: string[], auth_context: string, account: string, secret: string,
+ review_status: string, review_reason: string, screenshots: string[],
+}
+```
+
+---
+
+## Running it
+
+```bash
+cd neurosploit-rs && cargo build --release # once, or after a harness change
+node web/server.js # http://localhost:4173
+```
+
+`PORT` (or `NEUROSPLOIT_WEB_PORT`) overrides the port. The server auto-locates the compiled binary
+under `neurosploit-rs/target/{release,debug}/neurosploit` relative to the repo root; if neither
+exists, `/api/exploit` and `/api/repl` return a 500 with a build hint.
diff --git a/web/README.md b/web/README.md
new file mode 100644
index 0000000..0c2df8d
--- /dev/null
+++ b/web/README.md
@@ -0,0 +1,27 @@
+# NeuroSploit v4.0.0 β web console
+
+A browser UI for the `neurosploit` CLI harness: a lead board (categorized agent picker + custom
+leads β `Start Exploitation`), a live structured findings view, run history, and a real REPL β
+all driven by spawning the actual CLI binary, never a reimplementation of harness logic.
+
+```bash
+cd neurosploit-rs && cargo build --release # build the CLI once
+node web/server.js # β http://localhost:4173
+```
+
+Zero npm dependencies (Node β₯18, built-ins only: `http`, `child_process`, `events`, `fs`).
+
+API reference: [`API.md`](./API.md).
+
+## Layout
+
+```
+web/
+βββ server.js backend: static server + agents_md/runs reader + CLI process manager
+βββ public/
+β βββ index.html SPA shell
+β βββ style.css lead-board / live-run / REPL drawer styling
+β βββ app.js client logic (fetch + EventSource, no framework)
+βββ API.md
+βββ package.json
+```
diff --git a/web/package.json b/web/package.json
new file mode 100644
index 0000000..c42dd73
--- /dev/null
+++ b/web/package.json
@@ -0,0 +1,13 @@
+{
+ "name": "neurosploit-web",
+ "version": "4.0.0",
+ "private": true,
+ "description": "NeuroSploit v4.0.0 web console β lead board + REPL, backed by the neurosploit CLI harness.",
+ "main": "server.js",
+ "scripts": {
+ "start": "node server.js"
+ },
+ "engines": {
+ "node": ">=18"
+ }
+}
diff --git a/web/public/app.js b/web/public/app.js
new file mode 100644
index 0000000..c2a44eb
--- /dev/null
+++ b/web/public/app.js
@@ -0,0 +1,441 @@
+'use strict';
+/* NeuroSploit v4.0.0 β web console frontend. Vanilla JS, no build step. */
+
+const $ = (sel) => document.querySelector(sel);
+const $$ = (sel) => Array.from(document.querySelectorAll(sel));
+
+const state = {
+ categories: [], // from /api/agents
+ selected: new Set(), // agent ids toggled on
+ customLeads: [], // free-text custom leads (folded into --focus)
+ filter: 'all', // all | selected | excluded
+ search: '',
+ runs: [], // from /api/runs
+ currentJob: null, // {id, es} for the live view
+ currentDetailId: null, // run id shown in detail view
+ detailPoll: null,
+ askFocus: '', askObjective: '', askOutOfScope: '',
+ replId: null, replEs: null,
+};
+
+// ---------------------------------------------------------------------------
+// helpers
+// ---------------------------------------------------------------------------
+
+function esc(s) {
+ return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&', '<': '<', '>': '>', '"': '"', "'": ''' }[c]));
+}
+async function api(path, opts) {
+ const res = await fetch(path, opts);
+ if (!res.ok) throw new Error(`${path} β ${res.status}`);
+ return res.headers.get('content-type')?.includes('json') ? res.json() : res.text();
+}
+function sevClass(sev) {
+ const s = (sev || '').toLowerCase();
+ if (s.includes('crit')) return 'sev-critical';
+ if (s.includes('high')) return 'sev-high';
+ if (s.includes('med')) return 'sev-medium';
+ if (s.includes('low')) return 'sev-low';
+ return 'sev-info';
+}
+function show(el, on) { el.hidden = !on; }
+
+// ---------------------------------------------------------------------------
+// agents / lead board
+// ---------------------------------------------------------------------------
+
+async function loadAgents() {
+ const data = await api('/api/agents');
+ state.categories = data.categories;
+ renderBoard();
+}
+
+function renderBoard() {
+ const root = $('#categories');
+ root.innerHTML = '';
+ for (const group of state.categories) {
+ const selCount = group.agents.filter((a) => state.selected.has(a.id)).length;
+ const card = document.createElement('div');
+ card.className = 'cat-card';
+ card.dataset.category = group.category;
+ card.innerHTML = `
+
+
+ ${esc(group.category)}
+ ${selCount} / ${group.agents.length}
+ βΎ
+
+
+ `;
+ const rows = card.querySelector('.agent-rows');
+ for (const a of group.agents) {
+ const row = document.createElement('div');
+ row.className = 'agent-row';
+ row.dataset.id = a.id;
+ row.dataset.title = (a.title + ' ' + a.name).toLowerCase();
+ row.innerHTML = `
+
+ ${esc(a.title)}
+ ${a.cwe ? `${esc(a.cwe)}` : ''}
+ `;
+ rows.appendChild(row);
+ }
+ card.querySelector('.cat-head').addEventListener('click', (e) => {
+ if (e.target.closest('.switch')) return;
+ card.classList.toggle('collapsed');
+ });
+ card.querySelector('.cat-toggle').addEventListener('change', (e) => {
+ const on = e.target.checked;
+ for (const a of group.agents) {
+ if (on) state.selected.add(a.id); else state.selected.delete(a.id);
+ }
+ renderBoard();
+ updateChips();
+ });
+ rows.querySelectorAll('.agent-toggle').forEach((input) => {
+ input.addEventListener('change', (e) => {
+ const id = e.target.dataset.id;
+ if (e.target.checked) state.selected.add(id); else state.selected.delete(id);
+ renderBoard();
+ updateChips();
+ applyFilters();
+ });
+ });
+ root.appendChild(card);
+ }
+ updateChips();
+ applyFilters();
+}
+
+function allAgents() {
+ return state.categories.flatMap((g) => g.agents);
+}
+
+function updateChips() {
+ const total = allAgents().length;
+ $('#chipAll').textContent = total;
+ $('#chipSelected').textContent = state.selected.size;
+ $('#chipExcluded').textContent = total - state.selected.size;
+}
+
+function applyFilters() {
+ const q = state.search.trim().toLowerCase();
+ $$('.agent-row').forEach((row) => {
+ const id = row.dataset.id;
+ const isSel = state.selected.has(id);
+ let visible = true;
+ if (state.filter === 'selected') visible = isSel;
+ if (state.filter === 'excluded') visible = !isSel;
+ if (visible && q) visible = row.dataset.title.includes(q);
+ row.classList.toggle('hidden-by-search', !visible);
+ });
+ $$('.cat-card').forEach((card) => {
+ const anyVisible = [...card.querySelectorAll('.agent-row')].some((r) => !r.classList.contains('hidden-by-search'));
+ card.style.display = anyVisible ? '' : 'none';
+ });
+}
+
+// ---------------------------------------------------------------------------
+// engagement bar / ask panel
+// ---------------------------------------------------------------------------
+
+function currentMode() { return $('#fieldMode').value; }
+
+$('#fieldMode').addEventListener('change', () => {
+ show($('.eb-repo'), currentMode() === 'greybox');
+ $('.eb-target label').textContent = currentMode() === 'whitebox' ? 'Repo / path' : 'Target';
+});
+
+$('#btnAskSend').addEventListener('click', () => {
+ const kind = $('#askKind').value;
+ const text = $('#askInput').value.trim();
+ if (!text) return;
+ if (kind === 'focus') state.askFocus = text;
+ if (kind === 'objective') state.askObjective = text;
+ if (kind === 'scope-out') state.askOutOfScope = text;
+ $('#askHint').textContent = `β ${kind} definido β aplicado no prΓ³ximo "Start Exploitation"`;
+ $('#askInput').value = '';
+});
+
+$('#btnCustomLead').addEventListener('click', () => {
+ const text = prompt('Descreva a lead customizada (linguagem livre β vira contexto de foco para os agentes):');
+ if (text && text.trim()) {
+ state.customLeads.push(text.trim());
+ $('#askHint').textContent = `β custom lead adicionada (${state.customLeads.length} total)`;
+ }
+});
+
+$$('.chip').forEach((chip) => {
+ chip.addEventListener('click', () => {
+ $$('.chip').forEach((c) => c.classList.remove('chip-active'));
+ chip.classList.add('chip-active');
+ state.filter = chip.dataset.filter;
+ applyFilters();
+ });
+});
+
+$('#leadSearch').addEventListener('input', (e) => { state.search = e.target.value; applyFilters(); });
+
+// ---------------------------------------------------------------------------
+// start exploitation β live run view
+// ---------------------------------------------------------------------------
+
+$('#btnStartExploitation').addEventListener('click', startExploitation);
+
+async function startExploitation() {
+ const mode = currentMode();
+ const target = $('#fieldTarget').value.trim();
+ const repo = $('#fieldRepo').value.trim();
+ if (mode !== 'whitebox' && !target) { alert('Defina o target.'); return; }
+ if (mode === 'whitebox' && !target && !repo) { alert('Defina o repo/path.'); return; }
+ if (mode === 'greybox' && !repo) { alert('Grey-box precisa de repo + target.'); return; }
+
+ const modelField = $('#fieldModel').value.trim();
+ const focusParts = [state.askFocus, ...state.customLeads].filter(Boolean);
+
+ const body = {
+ mode,
+ target: mode === 'whitebox' ? undefined : target,
+ repo: mode === 'whitebox' ? (target || repo) : (repo || undefined),
+ models: modelField ? [modelField] : [],
+ votes: Number($('#fieldVotes').value) || 3,
+ chainDepth: Number($('#fieldChain').value),
+ recon: Number($('#fieldRecon').value),
+ subscription: $('#fieldSubscription').checked,
+ mcp: $('#fieldMcp').checked,
+ agents: [...state.selected],
+ focus: focusParts.join('; ') || undefined,
+ objective: state.askObjective || undefined,
+ outOfScope: state.askOutOfScope || undefined,
+ };
+
+ $('#btnStartExploitation').disabled = true;
+ try {
+ const { id } = await api('/api/exploit', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+ attachLiveJob(id, body.target || body.repo);
+ } catch (e) {
+ alert('Falha ao iniciar: ' + e.message);
+ } finally {
+ $('#btnStartExploitation').disabled = false;
+ }
+}
+
+function attachLiveJob(id, target) {
+ if (state.currentJob) state.currentJob.es.close();
+ state.currentJob = { id, es: null, findings: [], target, phase: 'starting', agents: 0, agentsDone: 0, reportUrl: null };
+
+ show($('#boardView'), false);
+ show($('#detailView'), false);
+ show($('#liveView'), true);
+ $('#liveTarget').textContent = target || 'β';
+ $('#livePhase').textContent = 'starting';
+ $('#findingsList').innerHTML = '';
+ $('#logList').innerHTML = '';
+ $('#findingsCount').textContent = '0';
+ $('#progressFill').style.width = '0%';
+ $('#progressLabel').textContent = '0 / 0 agents';
+ show($('#btnOpenReport'), false);
+
+ const es = new EventSource(`/api/exploit/${id}/events`);
+ state.currentJob.es = es;
+ es.addEventListener('log', (e) => appendLog(JSON.parse(e.data).line));
+ es.addEventListener('finding', (e) => addFinding(JSON.parse(e.data).finding));
+ es.addEventListener('snapshot', (e) => applySnapshot(JSON.parse(e.data)));
+ es.addEventListener('done', (e) => { applySnapshot(JSON.parse(e.data)); refreshRuns(); });
+ es.onerror = () => { /* browser auto-retries; fine for a long-running engagement */ };
+}
+
+function appendLog(line) {
+ const div = document.createElement('div');
+ div.className = 'log-line';
+ div.textContent = line;
+ const list = $('#logList');
+ list.appendChild(div);
+ list.scrollTop = list.scrollHeight;
+}
+
+function addFinding(f) {
+ state.currentJob.findings.push(f);
+ const card = document.createElement('div');
+ card.className = 'finding-card';
+ card.innerHTML = `
+ ${esc(f.severity)}${esc(f.title)}
+ ${esc(f.cwe || '')} ${f.endpoint ? 'Β· ' + esc(f.endpoint) : ''} ${f.agent ? 'Β· ' + esc(f.agent) : ''}
+ `;
+ $('#findingsList').appendChild(card);
+ $('#findingsCount').textContent = state.currentJob.findings.length;
+}
+
+function applySnapshot(snap) {
+ $('#livePhase').textContent = snap.phase;
+ $('#progressLabel').textContent = `${snap.agentsDone} / ${snap.agents || '?'} agents`;
+ if (snap.agents) $('#progressFill').style.width = `${Math.min(100, (snap.agentsDone / snap.agents) * 100)}%`;
+ if (snap.reportUrl) {
+ const link = $('#btnOpenReport');
+ link.href = `/api/runs/${snap.runId}/asset/report.html`;
+ show(link, !!snap.runId);
+ }
+ if (snap.done) $('#phaseDot').style.background = 'var(--green)';
+}
+
+$('#btnStopRun').addEventListener('click', async () => {
+ if (!state.currentJob) return;
+ await api(`/api/exploit/${state.currentJob.id}/stop`, { method: 'POST' });
+});
+$('#btnBackToBoard').addEventListener('click', () => { show($('#liveView'), false); show($('#boardView'), true); });
+
+// ---------------------------------------------------------------------------
+// sidebar β runs history
+// ---------------------------------------------------------------------------
+
+async function refreshRuns() {
+ try {
+ state.runs = await api('/api/runs');
+ } catch { state.runs = []; }
+ renderSidebar();
+}
+
+function stepClassFor(phase, step) {
+ const order = ['recon', 'planning', 'exploiting', 'remediation'];
+ const idx = { recon: 0, starting: 0, planning: 1, exploiting: 2, validating: 2, chaining: 2, complete: 3 }[phase] ?? 0;
+ const stepIdx = order.indexOf(step);
+ if (step === 'remediation') return 'pending'; // not automated yet β shown for roadmap parity only
+ if (stepIdx < idx) return 'done';
+ if (stepIdx === idx) return 'active';
+ return 'pending';
+}
+
+function renderSidebar() {
+ const root = $('#sbGroups');
+ root.innerHTML = '';
+
+ const running = state.runs.filter((r) => r.state === 'running');
+ const completed = state.runs.filter((r) => r.state !== 'running');
+
+ const groups = [
+ { label: 'Running', items: running, open: true },
+ { label: 'Completed', items: completed, open: true },
+ ];
+
+ for (const g of groups) {
+ const wrap = document.createElement('div');
+ wrap.className = 'sb-group';
+ wrap.innerHTML = `βΎ${g.label}${g.items.length}
`;
+ wrap.querySelector('.sb-group-head').addEventListener('click', () => wrap.classList.toggle('collapsed'));
+ const items = wrap.querySelector('.sb-items');
+ for (const r of g.items) {
+ const btn = document.createElement('button');
+ btn.className = 'sb-run' + (state.currentDetailId === r.id ? ' active' : '');
+ btn.innerHTML = `${esc(r.target)}${esc(r.id)} Β· ${r.findings} finding(s)`;
+ btn.addEventListener('click', () => openRun(r));
+ items.appendChild(btn);
+ if (r.state === 'running' && state.currentJob) {
+ const phase = state.currentJob.target === r.target ? $('#livePhase').textContent : null;
+ const steps = document.createElement('div');
+ steps.className = 'sb-steps';
+ steps.innerHTML = ['recon', 'planning', 'exploiting', 'remediation'].map((s) =>
+ `${s[0].toUpperCase() + s.slice(1)}
`).join('');
+ items.appendChild(steps);
+ }
+ }
+ root.appendChild(wrap);
+ }
+}
+
+function openRun(run) {
+ state.currentDetailId = run.id;
+ if (run.state === 'running' && state.currentJob) {
+ show($('#boardView'), false); show($('#detailView'), false); show($('#liveView'), true);
+ return;
+ }
+ show($('#boardView'), false); show($('#liveView'), false); show($('#detailView'), true);
+ loadDetail(run.id);
+ renderSidebar();
+}
+
+async function loadDetail(id) {
+ clearInterval(state.detailPoll);
+ const detail = await api(`/api/runs/${encodeURIComponent(id)}`);
+ $('#detailTarget').textContent = detail.status?.target || detail.meta?.target || id;
+ $('#detailState').textContent = detail.status?.state || 'unknown';
+ const list = $('#detailFindings');
+ list.innerHTML = detail.findings.length
+ ? detail.findings.map((f) => `
+
+
${esc(f.severity)}${esc(f.title)}
+
${esc(f.cwe || '')} ${f.endpoint ? 'Β· ' + esc(f.endpoint) : ''} ${f.agent ? 'Β· ' + esc(f.agent) : ''}
+
nenhum finding validado.
';
+ const reportLink = $('#detailOpenReport');
+ if (detail.assets.includes('report.html')) {
+ reportLink.href = `/api/runs/${encodeURIComponent(id)}/asset/report.html`;
+ show(reportLink, true);
+ } else show(reportLink, false);
+
+ if (detail.status?.state === 'running') {
+ state.detailPoll = setInterval(() => loadDetail(id), 4000);
+ }
+}
+
+$('#btnDetailBack').addEventListener('click', () => { clearInterval(state.detailPoll); show($('#detailView'), false); show($('#boardView'), true); });
+$('#btnNewEngagement').addEventListener('click', () => { show($('#detailView'), false); show($('#liveView'), false); show($('#boardView'), true); });
+
+// ---------------------------------------------------------------------------
+// REPL drawer β real CLI harness session
+// ---------------------------------------------------------------------------
+
+function openReplDrawer() { show($('#replDrawer'), true); if (!state.replId) startRepl(); }
+
+async function startRepl() {
+ $('#replOutput').textContent = '';
+ const { id } = await api('/api/repl', { method: 'POST' });
+ state.replId = id;
+ const es = new EventSource(`/api/repl/${id}/events`);
+ state.replEs = es;
+ es.addEventListener('data', (e) => {
+ const { chunk } = JSON.parse(e.data);
+ const out = $('#replOutput');
+ out.textContent += chunk;
+ out.scrollTop = out.scrollHeight;
+ });
+ es.addEventListener('close', () => { es.close(); });
+}
+
+$('#fabRepl').addEventListener('click', openReplDrawer);
+$('#btnOpenRepl').addEventListener('click', openReplDrawer);
+$('#btnReplClose').addEventListener('click', () => show($('#replDrawer'), false));
+$('#btnReplRestart').addEventListener('click', async () => {
+ if (state.replId) await api(`/api/repl/${state.replId}/stop`, { method: 'POST' }).catch(() => {});
+ state.replEs?.close();
+ state.replId = null;
+ startRepl();
+});
+$('#replInput').addEventListener('keydown', async (e) => {
+ if (e.key !== 'Enter') return;
+ const line = e.target.value;
+ e.target.value = '';
+ const out = $('#replOutput');
+ out.textContent += `β ${line}\n`;
+ out.scrollTop = out.scrollHeight;
+ if (!state.replId) await startRepl();
+ await api(`/api/repl/${state.replId}/input`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ line }) });
+});
+
+// ---------------------------------------------------------------------------
+// boot
+// ---------------------------------------------------------------------------
+
+async function boot() {
+ const meta = await api('/api/meta').catch(() => ({}));
+ $('#sbMeta').textContent = `v${meta.version || '4.0.0'}`;
+ await loadAgents();
+ await refreshRuns();
+ setInterval(refreshRuns, 6000);
+}
+boot();
diff --git a/web/public/index.html b/web/public/index.html
new file mode 100644
index 0000000..1aef368
--- /dev/null
+++ b/web/public/index.html
@@ -0,0 +1,191 @@
+
+
+
+
+
+NeuroSploit v4.0.0 β Console
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
NeuroSploit CLI harness β REPL
+
+
+
+
+
+
+
+ β
+
+
+