v3.4.0: subscription backend (Claude Code / Codex / Grok logins)

The Rust harness can now use models two ways:
- API: provider API key (OpenAI-compatible HTTP) — existing path
- Subscription: drive the locally-installed agentic CLI login directly, no API
  key (anthropic→claude, openai→codex, xai→grok)

- models.rs: ChatClient::chat_cli spawns the CLI (stdin prompt), cli_binary_for
  + installed_cli_backends + binary_in_path PATH detection
- pool.rs: ModelPool::with_auth(subscription); one() routes per model
- types/CLI: RunConfig.subscription + `run --subscription` flag
- web: /api/run honors "subscription"; /api/info reports detected cli_backends;
  SPA gets a "Use subscription" toggle

Verified live: `run --subscription --model anthropic:claude-haiku-4-5` drove the
Claude subscription end-to-end (recon + agent + vote) with no API key set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neurosploit-rs/app/src/main.rs

@@ -33,6 +33,10 @@ enum Cmd {
         /// Exercise the pipeline without calling any model API.
         #[arg(long)]
         offline: bool,
+        /// Use local agentic CLI subscriptions (Claude Code / Codex / Grok)
+        /// instead of HTTP API keys.
+        #[arg(long)]
+        subscription: bool,
     },
     /// Show agent library counts.
     Agents,
@@ -84,18 +88,19 @@ async fn main() -> anyhow::Result<()> {
                 }
             }
         }
-        Cmd::Run { url, models, max_agents, vote_n, offline } => {
+        Cmd::Run { url, models, max_agents, vote_n, offline, subscription } => {
             let url = if url.starts_with("http") { url } else { format!("https://{url}") };
             let mut cfg = RunConfig::new(&url);
             cfg.max_agents = max_agents;
             cfg.vote_n = vote_n;
             cfg.offline = offline;
+            cfg.subscription = subscription;
             if !models.is_empty() {
                 cfg.models = models;
             }
             let lib = agents::load(&base);
             let refs: Vec<ModelRef> = cfg.models.iter().map(|s| ModelRef::parse(s)).collect();
-            let pool = ModelPool::new(refs, cfg.concurrency);
+            let pool = ModelPool::with_auth(refs, cfg.concurrency, cfg.subscription);
 
             let (tx, mut rx) = tokio::sync::mpsc::channel::<String>(256);
             let printer = tokio::spawn(async move {

neurosploit-rs/app/src/web.rs

@@ -59,6 +59,7 @@ async fn info(State(st): State<Arc<AppState>>) -> Json<Value> {
         "version": "3.4.0",
         "agents": {"vulns": lib.vulns.len(), "meta": lib.meta.len(), "total": lib.total()},
         "providers": provs,
+        "cli_backends": harness::installed_cli_backends(),
     }))
 }
 
@@ -126,6 +127,7 @@ async fn run(State(st): State<Arc<AppState>>, Json(body): Json<Value>) -> Json<V
         let vote_n = body.get("vote_n").and_then(|v| v.as_u64()).unwrap_or(3) as usize;
         let max_agents = body.get("max_agents").and_then(|v| v.as_u64()).unwrap_or(0) as usize;
         let offline = body.get("offline").and_then(|v| v.as_bool()).unwrap_or(false);
+        let subscription = body.get("subscription").and_then(|v| v.as_bool()).unwrap_or(false);
 
         let lib = agents::load(&base);
         let refs: Vec<ModelRef> = if models.is_empty() {
@@ -133,7 +135,7 @@ async fn run(State(st): State<Arc<AppState>>, Json(body): Json<Value>) -> Json<V
         } else {
             models.iter().map(|s| ModelRef::parse(s)).collect()
         };
-        let pool = ModelPool::new(refs, 8);
+        let pool = ModelPool::with_auth(refs, 8, subscription);
 
         let (tx, mut rx) = tokio::sync::mpsc::channel::<String>(256);
         let stf = st2.clone();
@@ -160,6 +162,7 @@ async fn run(State(st): State<Arc<AppState>>, Json(body): Json<Value>) -> Json<V
             cfg.vote_n = vote_n;
             cfg.max_agents = max_agents;
             cfg.offline = offline;
+            cfg.subscription = subscription;
             let _ = tx.send(format!("=== target: {url} ===")).await;
             let out = harness::run(cfg, &lib, &pool, tx.clone()).await;
             all_findings.extend(out.findings);